bl
258fa072aa
The discovery module defines the seam: DiscoveryProvider (subscribe/ announce over 32-byte TopicKeys) and a signed Announcement carrying root hash, ed25519 author, metadata and provider addresses. Signatures cover a deterministic postcard encoding including the topic (no cross- channel replay) and the provider identities (addresses stay refreshable hints). LanDiscovery conforms to the trait — mdns sightings become locally-authored announcements, one per pinned root — and the daemon's auto-sync now runs entirely through it: verify, index unconditionally, fetch only for trusted authors from allowlisted providers on already- pinned incomplete roots. The milestone-4 real-mdns sync test passes unchanged through the new path. Verification unit tests cover round trip, tampered root, wrong topic, forged author, mismatched signing key, and serde survival. docs/redoal-integration.md sketches the gesture-topic gossip provider against this contract. Also: fix a flaky hang in the socket-activation test (dup2(3,3) leaves CLOEXEC set when the listener already sits on fd 3; parent's listener copy masked daemon death), and give the test client a read-timeout hang guard. Add a top-level README. Dependencies: ed25519-dalek (Signature type; same implementation iroh keys use), postcard (deterministic signed encoding, iroh's canonical compact codec). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Milestone 6 — Discovery provider seam
What landed
varde_daemon::discoverywith the spec'sDiscoveryProvidertrait,TopicKey, and the signedAnnouncementtype. Signatures are ed25519 (the same key type as iroh NodeIds) over a deterministic postcard encoding that includes the topic, so announcements can't be replayed onto other channels. Verification tests cover round trip, tampered root, wrong topic, forged author, mismatched signing key, and serde-then-verify.LanDiscoveryimplements the trait: mDNS sightings become locally-authored, signed announcements ("peer N may hold pinned root R"), one per pinned root.announce()is a no-op on the LAN — mDNS already advertises presence, and varde never broadcasts content lists.- The daemon's auto-sync was refactored onto the seam: sightings feed
presence tracking and the LanDiscovery channel; a single
on_announcementpath verifies, indexes, and applies the consent tiers (trusted author → pinned + incomplete → trusted providers → fetch). The milestone-4 mdns integration test passes unchanged through the new path, which is the proof the seam carries real traffic. - Announcements surface on the event stream (
announcementevents) and are indexed in memory per root. docs/redoal-integration.mdsketches the gesture-topic gossip provider against this contract, including the one extension it will need (topic-scoped trust) and why nothing else changes.
Deviations from the spec sketch
- The trait deals in
SignedAnnouncementrather than bareAnnouncement: the spec says announcements are signed, so the wire type carries its signature and the subscriber can't forget to check. Announcement.authoris an irohPublicKey(ed25519, as specified); provider addresses are excluded from the signed payload (they're refreshable hints) while provider identities are covered.- Signature bytes travel as a length-checked
Vec<u8>because serde cannot derive for[u8; 64].