--- title: "Orbital Network" description: "The distributed verification network that powers XI Objects content lookup and provenance at scale." published: 2026-02-18T18:06:36.619263+00:00 updated: 2026-02-18T18:06:36.619263+00:00 tags: ["architecture", "network", "orbital"] url: https://xiobjects.com/docs/xio/concepts/orbital source: XI Objects --- # Orbital Network The Orbital Network is XI Objects' distributed infrastructure for content verification, fingerprint search, certificate management, and provenance lookup. Orbital nodes serve as the "DNS resolvers" of the `.xio` domain space, handling binary wire protocol queries and returning signed records with cryptographic proofs. ## Architecture Overview ```mermaid graph TB subgraph Clients C1[Xio.Client SDK] C2[xi CLI Tool] C3[Application] end subgraph Certified["Certified Orbitals"] direction TB O1["Orbital + Control Module"] O2["Orbital + Control Module"] end subgraph Mirrors["Mirror-Only Orbitals"] M1[Orbital Node] M2[Orbital Node] end C1 --> O1 C2 --> O1 C3 --> M1 O1 <-->|Peer Sync| O2 O1 -->|Replication| M1 O2 -->|Replication| M2 style Certified fill:#0a0e1a,stroke:#582c7e style Mirrors fill:#1a1a2e,stroke:#7a4a9e ``` ## Two Types of Orbitals ### Certified Orbitals **Certified Orbitals** hold intermediate certificates from the Institute of Provenance Root CA and run both the Orbital service and the **Control module** (which operates as a module *within* the Orbital process). They can: - **Issue leaf certificates**: Short-lived Ed25519 certificates for content creators and services - **Revoke certificates**: Record revocations in the Sparse Merkle Tree - **Create and modify records**: Authoritative record management (ISSUE, REVOKE, DELTA operations) - **Advance epochs**: Sign and publish new state roots (Signed Map Heads) - **Serve queries**: Handle `.xio` domain lookups via the wire protocol - **Peer sync**: Replicate state to other Orbitals in the network ### Mirror-Only Orbitals **Mirror-Only Orbitals** run the Orbital service without the Control module. They receive replicated state from certified Orbitals and provide read-only verification: - **Serve queries**: Handle lookups and return records with proofs - **Verify content**: Validate trust blocks and certificate chains - **Cache and deliver**: High-performance, globally distributed access - **Cannot issue certificates**: No intermediate certificate, no Control module - **Cannot modify records**: Read-only participants in the network ## How It Works ### The Wire Protocol Clients communicate with Orbital nodes using a **DNS-like binary wire protocol**. Queries are serialized into binary messages and sent as HTTP POST requests: ```mermaid sequenceDiagram participant App as Application participant Client as Xio.Client participant Orbital as Orbital Node App->>Client: ResolveAsync("example.xio", XSIGN) Client->>Client: Build XioMessage (binary) Client->>Orbital: POST /query (application/octet-stream) Orbital->>Orbital: Parse query, lookup records Orbital-->>Client: Binary response with answers + proofs Client->>Client: Verify Sparse Merkle proofs Client-->>App: ResolveResponse (records, proofs) ``` The protocol message format includes: - **Header**: Transaction ID, flags, opcode, response code, section counts - **Question section**: Domain name + record type being queried - **Answer section**: Matching records (XIO, XSIGN, XFPR, Proof, etc.) - **Authority section**: Authoritative records - **Additional section**: Sparse Merkle proofs for answer verification ### Content Registration When content is signed and registered, the Orbital node stores: - The **trust block** and signing metadata as an `XSIGN` record (type 65003) - The **content fingerprint** as an `XFPR` record (type 65004) - Cryptographic **proofs** in the Sparse Merkle Tree for verifiable state ### Fingerprint Search Orbital nodes expose a dedicated endpoint for fingerprint similarity search: ``` POST /search/fingerprint ``` This performs cosine similarity search against stored fingerprint vectors, returning ranked matches with similarity scores. ### Peer Synchronization Certified Orbitals synchronize state with each other through authenticated peer-to-peer replication. Mirror-Only Orbitals receive replicated state from certified Orbitals to keep their records current. ## Public Endpoints Orbital nodes expose query endpoints for client applications: | Endpoint | Method | Purpose | |---|---|---| | `/query` | POST | Binary wire protocol queries (`application/octet-stream`) | | `/query/json` | POST | JSON convenience wrapper for queries | | `/search/fingerprint` | POST | Fingerprint similarity search | | `/health` | GET | Health check | ## Deployment Orbital nodes are deployed as containerized services. The infrastructure supports: - **Horizontal scaling**: Multiple Orbital instances behind load balancers - **Global distribution**: Mirror-Only Orbitals deployed worldwide for low-latency access