About
Tana mesh service

Tags
No tags available

Languages
TypeScript 96%, Dockerfile 4%

tana-mesh

network discovery and coordination service for the Tana blockchain.

overview

tana-mesh manages the validator network topology. it handles node registration, service discovery, health monitoring, and sovereign approval workflows. validators use mesh to find each other and establish peer-to-peer connections.

how it works

when a new validator wants to join the network, it registers with mesh and waits for sovereign approval. once approved, the validator appears in the node directory and other validators can discover and connect to it.

registration flow

new validator
     |
     v
registers with mesh (pending)
     |
     v
sovereign approves
     |
     v
status: active
     |
     v
other validators discover via mesh
     |
     v
peer connections established

service discovery

validators register the services they offer (ledger, t4, identity) along with their network addresses. other nodes query mesh to find which validators offer which services and how to connect to them.

health monitoring

validators send heartbeats every two minutes. if a validator misses heartbeats for five minutes, mesh marks it as offline. this allows the network to detect and route around failed nodes.

architecture

built with TypeScript and Hono, using SQLite for persistence. the database tracks nodes, their services, heartbeat history, and sovereign keys.

mesh runs as a centralized coordinator but does not participate in consensus. it provides network-level coordination so the blockchain can focus on state.

why off-chain

keeping network topology off-chain prevents circular dependencies (the chain needs the network, but the network would need the chain to update). it also enables instant network changes without waiting for block finality.

security model

three layers of security protect the network:

  1. Tailscale - nodes must be on the Tailscale network to reach mesh
  2. signatures - all requests require Ed25519 signatures proving key ownership
  3. sovereign approval - only sovereign keys can approve new validators

integration

validators query mesh on startup to discover peers. they then establish direct WebSocket connections for consensus messages, bypassing mesh for latency-sensitive communication.