Config Expiry Conditions

• Inactive handshake beyond defined threshold (typically 30–45 days)
• Referral tier downgrade or slot deallocation
• Jurisdiction breach or node retraction
• Sponsor-triggered expiration via dashboard override

Expiry Behaviour

• Tunnel stops responding - no handshake or ping replies
• WireGuard client displays persistent failure or timeout loop
• Dashboard marks configuration as expired or signal withdrawn
• Associated DNS resolver may be deactivated or rerouted

Regenerating a Tunnel

• Log into client dashboard and request reissue under Config Management
• Referral sponsor must validate trust zone before regeneration occurs
• New configuration file is issued with fresh endpoint and resolver metadata
• Previous config remains invalid unless archived by Tier 3 operator

Maintaining Tunnel Integrity

• Keep your tunnel handshake active at least once every 30 days
• Avoid routing through unintended jurisdictions - signal drift may flag trust decay
• Enable encrypted DNS to ensure resolver traffic remains scoped inside tunnel
• Audit tunnel uptime via the dashboard or `/status` endpoint

“Tunnels aren’t static. Their encrypted lifecycle reflects how trust and infrastructure interact.”