38 lines
2.0 KiB
Markdown
38 lines
2.0 KiB
Markdown
|
# Milestone 6 — Discovery provider seam
|
||
|
|
|
||
|
|
## What landed
|
||
|
|
|
||
|
|
- `varde_daemon::discovery` with the spec's `DiscoveryProvider` trait,
|
||
|
|
`TopicKey`, and the signed `Announcement` type. Signatures are ed25519
|
||
|
|
(the same key type as iroh NodeIds) over a deterministic postcard
|
||
|
|
encoding that includes the topic, so announcements can't be replayed
|
||
|
|
onto other channels. Verification tests cover round trip, tampered
|
||
|
|
root, wrong topic, forged author, mismatched signing key, and
|
||
|
|
serde-then-verify.
|
||
|
|
- `LanDiscovery` implements the trait: mDNS sightings become
|
||
|
|
locally-authored, signed announcements ("peer N may hold pinned root
|
||
|
|
R"), one per pinned root. `announce()` is a no-op on the LAN — mDNS
|
||
|
|
already advertises presence, and varde never broadcasts content lists.
|
||
|
|
- The daemon's auto-sync was refactored *onto* the seam: sightings feed
|
||
|
|
presence tracking and the LanDiscovery channel; a single
|
||
|
|
`on_announcement` path verifies, indexes, and applies the consent
|
||
|
|
tiers (trusted author → pinned + incomplete → trusted providers →
|
||
|
|
fetch). The milestone-4 mdns integration test passes unchanged through
|
||
|
|
the new path, which is the proof the seam carries real traffic.
|
||
|
|
- Announcements surface on the event stream (`announcement` events) and
|
||
|
|
are indexed in memory per root.
|
||
|
|
- `docs/redoal-integration.md` sketches the gesture-topic gossip
|
||
|
|
provider against this contract, including the one extension it will
|
||
|
|
need (topic-scoped trust) and why nothing else changes.
|
||
|
|
|
||
|
|
## Deviations from the spec sketch
|
||
|
|
|
||
|
|
- The trait deals in `SignedAnnouncement` rather than bare
|
||
|
|
`Announcement`: the spec says announcements are signed, so the wire
|
||
|
|
type carries its signature and the subscriber can't forget to check.
|
||
|
|
- `Announcement.author` is an iroh `PublicKey` (ed25519, as specified);
|
||
|
|
provider addresses are excluded from the signed payload (they're
|
||
|
|
refreshable hints) while provider identities are covered.
|
||
|
|
- Signature bytes travel as a length-checked `Vec<u8>` because serde
|
||
|
|
cannot derive for `[u8; 64]`.
|