# Overlay Mode

WireGuard-based tunneling over networks Kedge doesn't control. Used for cloud anchors, remote sites, and MSP-managed customer environments.

## Components
- WireGuard mesh manager (`internal/mesh/`)
- Headscale peer discovery (`internal/headscale/`)
- Shellstream handshake termination (`internal/shellstream/`)
- SessionTransitArtifact notarization (`internal/quartermaster/`)