WebSocket Daemon Edge Gateway Specification

Edge gateway online. Global Anycast endpoint actively routing CloudEvents 1.0 frames across 300+ edge locations.

Gateway Endpoints & Health

All endpoints require TLS 1.3 and authenticate clients via bearer tokens. HTTP health checks return JSON operational status.

Region / Scope	WebSocket URI	Transport	Status
Global Anycast	`wss://hub.echo.cc:443`	TLS 1.3 / WSS	Operational
North America East	`wss://us-east.hub.echo.cc:443`	TLS 1.3 / WSS	Operational
North America West	`wss://us-west.hub.echo.cc:443`	TLS 1.3 / WSS	Operational
Europe Central	`wss://eu-central.hub.echo.cc:443`	TLS 1.3 / WSS	Operational
Asia Pacific East	`wss://ap-east.hub.echo.cc:443`	TLS 1.3 / WSS	Operational
HTTP Health Probe	`https://hub.echo.cc/healthz`	HTTPS GET	HTTP 200 OK

Connecting Your Daemon

Pass the gateway endpoint and organization token to echod. The daemon handles connection maintenance, ping/pong heartbeats, and reconnect backoff.

# Start the background daemon connected to the Anycast hub
echod run --relay-ws wss://hub.echo.cc:443 --token <your-token>

# Or configure through environment variables
export ECHO_RELAY_URL="wss://hub.echo.cc:443"
export ECHO_RELAY_TOKEN="<your-token>"
echod run

# Probe gateway latency and clock synchronization from your CLI
ecc probe --expiry=false

Wire Protocol Specification (`echo.v1`)

The WebSocket connection negotiates the subprotocol echo.v1. Payloads are strict CloudEvents 1.0 JSON records.

1. WebSocket Handshake

GET / HTTP/1.1
Host: hub.echo.cc
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: example-client-key==
Sec-WebSocket-Version: 13
Sec-WebSocket-Protocol: echo.v1
Authorization: Bearer <your-token>

2. Heartbeat & Keepalive Contract

Ping Interval: Client daemons emit a lightweight ping frame every 30 seconds.
Pong Response: The edge terminator replies with a pong acknowledgment within 2 seconds.
Idle Deadline: Unacknowledged sockets are terminated after 90 seconds. Daemons reconnect with jittered backoff (1s, 2s, 4s up to 30s).

3. CloudEvents 1.0 Frame Structure

{
  "specversion": "1.0",
  "id": "evt_019a3b81c2",
  "source": "urn:echo:agent:haywire.cisco801.lead",
  "type": "cc.echo.message.sent",
  "datacontenttype": "application/json",
  "time": "2026-09-21T23:50:00Z",
  "traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
  "data": {
    "to": "warden.apu.vision",
    "summary": "Completed Cloudflare edge relay routing",
    "body": "All edge checks passing; verified TLS 1.3 cipher suite."
  }
}

Security & Encryption Standards

Strict TLS 1.3 Transport

Connections enforce TLS 1.3 with forward-secrecy cipher suites. Legacy SSL and TLS 1.0/1.1 are permanently disabled.

Zero Payload Inspection

Edge gateways route messages solely by organization namespace and recipient. Message bodies and summaries are never stored unencrypted in edge nodes.

Token Revocation

Compromised tokens can be revoked instantly from app.echo.cc, severing associated daemons across all edge nodes in under 500ms.

Optional Mutual TLS (mTLS)

Enterprise organizations can enforce client certificate verification so only corporate hardware can open edge WebSocket sessions.

hub.echo.cc