Each G-code segment is decrypted in the gateway's locked memory buffer, streamed line-by-line to the printer's controller via Klipper's RAM-only streaming endpoint, and overwritten the moment telemetry confirms physical execution.
POST /printer/gcode/script accepts one line
at a time. Memory-locked buffers (mlock /
VirtualLock) prevent swap-out; multi-pass overwrite
after each segment.
Before a print starts, the engine fingerprints the device — CPU serial, firmware version, board serial, plus a thermal/motion behavioural snapshot. The session key is HKDF-derived from that fingerprint plus a fresh nonce. Another printer cannot decrypt the segments even with the ciphertext in hand.
Every segment delivered must produce a measurable physical change — toolhead position, heater temperature, extruder count — within a configurable window. If the device receives bytes but doesn't move, the engine flags it as a proxy-extraction attempt and emergency-purges the buffer.
Safety halts issued by the engine are HMAC-signed with the session key. An attacker on the visitor's LAN cannot issue spoofed halts to brick prints in flight.
HALT_COMMAND carries an HMAC over
(session_id, timestamp, reason, nonce). Constant-time
verified before action.
8b1f…a04d · executes safe-restinvalid · ignored, print continuesVirtualLock on Windows). Buffers never hit the page file.
~/.ehls-gateway/ (printer IP, server URL, last machine_id — diagnostic only).
Before the visitor can queue a print, EHLS probes their printer's firmware via Moonraker. Wrong firmware, wrong state, or a profile that demands more than the printer's caps → refuse with a structured error. The visitor can never silently start a print that would damage their hardware.
NOT_KLIPPER,
NOZZLE_RANGE, BUILD_VOLUME,
MISSING_HEATER, NOT_READY.
NOZZLE_RANGEEHLS runs on machines exposing a Moonraker streaming endpoint — the open architecture EHLS was designed against. That covers a wide range of current FDM hardware in serious workshops today.
We're extending EHLS to additional commercial brands and to entirely new manufacturing classes — bringing the same hardware-locked, ephemeral streaming guarantees with us.
Every successful print produces a JSON certificate listing every
segment IV, every adaptive adjustment, every telemetry alert,
plus a final SHA-256-HMAC over the whole record. The signing
key is HKDF-derived from (session_key, MIP hash),
so the certificate is provably tied to this print on
this printer.
Every EHLS-certified part carries a 16-character identifier and a GS1 Digital Link printed on its label. Paste either into the public verification page and the certificate chain is replayed in real time: every signature re-verified, every custodian transfer hashed against the previous, every event checked against the latest Merkle anchor — in under a second.
A regulator inspecting an aircraft, a hospital receiving an implant, an MRO accepting a part return — none of them need credentials, an account, or a vendor relationship. The provenance is the product; the lookup is just how the provenance is read.
certificate_id). The certificate signs the full
segment IV chain and the entire telemetry trace, so you can take
any physical part, look up its certificate, and prove it came from
this specific print on this specific printer. Useful for defence
supply chain, medical device traceability, and any context where
provenance matters.
machine_id. Tested with up to 50 concurrent sessions
on a single engine instance.
Bring your own Klipper printer. We'll stream a live print to your machine, IP-locked end-to-end.