Transport Composition Roadmap

Status: Roadmap

Last reviewed: 2026-05-30

Purpose

NexusNet transport configuration is modeled as three explicit dimensions:

• Payload protocol: tcp, udp, or ip
• Outer transport: tcp, udp, quic, or fake_tcp
• Security layer: raw, tls, reality, or noise

This replaces overloading legacy mode alone. The current backend implements this model in nexus-backend/src/transport_profile.rs and sends it to agents as TransportProfile protobuf fields.

Feature Status

Profile	State	Evidence
TCP over TCP RAW	Complete	TransportSupport::Supported; deployed as TcpProxyRule.
TCP over TCP TLS	Complete	tls_cert credentials and cert_domain on TcpProxyRule.
TCP over TCP REALITY	Complete	REALITY credentials and TCP gateway REALITY path.
UDP over UDP RAW	Complete	UdpRule RAW mode.
UDP over UDP Noise	Complete	UdpRule ENC/Noise mode with X25519 key material.
TCP over QUIC REALITY	Complete	Backend emits QuicRule/upstream QUIC REALITY; agent uses Quinn stream relay.
UDP over QUIC REALITY	Complete	Backend emits QUIC REALITY DATAGRAM paths; agent has DATAGRAM relay.
UDP over FAKE_TCP RAW	Complete	TransportSupport::Supported; backend emits UdpRule FAKE_TCP fields and agent carries UDP datagram payloads in TCP-looking raw IP packets.
IP over QUIC REALITY DATAGRAM	Complete	L3 tunnels use payload=ip, outer=quic, security=reality.
UDP over TCP RAW	Planned	Present as TransportSupport::Planned; no supported agent rule path.
TCP over UDP Noise	Planned	Present as TransportSupport::Planned; no supported agent rule path.
Legacy mode-only routing	Deprecated	Preserved only for compatibility; current UI writes transport profiles.

Current Control-Plane Shape

Each chain node can carry one profile:

{
  "transportProfile": {
    "payload": "tcp",
    "outer": "quic",
    "security": "reality",
    "credentialId": "..."
  }
}

For tcp+udp chains, nodes can carry per-payload profiles:

{
  "transportProfiles": [
    { "payload": "tcp", "outer": "quic", "security": "reality", "credentialId": "..." },
    { "payload": "udp", "outer": "udp", "security": "raw" }
  ]
}

The backend still writes legacy compatibility fields such as mode and enc_key_id where older rule paths expect them.

Next Work

Item	State
Remove remaining UI dependence on legacy mode labels where profile labels are available.	Planned
Keep UDP over FAKE_TCP documented separately from any future real UDP-over-TCP stream framing.	Complete
Decide whether TCP-over-UDP Noise is still worth carrying now that QUIC REALITY exists.	Planned
Keep L3 modeled as payload=ip, not as fake TCP/UDP routes.	Complete