bl
258fa072aa
The discovery module defines the seam: DiscoveryProvider (subscribe/ announce over 32-byte TopicKeys) and a signed Announcement carrying root hash, ed25519 author, metadata and provider addresses. Signatures cover a deterministic postcard encoding including the topic (no cross- channel replay) and the provider identities (addresses stay refreshable hints). LanDiscovery conforms to the trait — mdns sightings become locally-authored announcements, one per pinned root — and the daemon's auto-sync now runs entirely through it: verify, index unconditionally, fetch only for trusted authors from allowlisted providers on already- pinned incomplete roots. The milestone-4 real-mdns sync test passes unchanged through the new path. Verification unit tests cover round trip, tampered root, wrong topic, forged author, mismatched signing key, and serde survival. docs/redoal-integration.md sketches the gesture-topic gossip provider against this contract. Also: fix a flaky hang in the socket-activation test (dup2(3,3) leaves CLOEXEC set when the listener already sits on fd 3; parent's listener copy masked daemon death), and give the test client a read-timeout hang guard. Add a top-level README. Dependencies: ed25519-dalek (Signature type; same implementation iroh keys use), postcard (deterministic signed encoding, iroh's canonical compact codec). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
38 lines
2.0 KiB
Markdown
38 lines
2.0 KiB
Markdown
# Milestone 6 — Discovery provider seam
|
|
|
|
## What landed
|
|
|
|
- `varde_daemon::discovery` with the spec's `DiscoveryProvider` trait,
|
|
`TopicKey`, and the signed `Announcement` type. Signatures are ed25519
|
|
(the same key type as iroh NodeIds) over a deterministic postcard
|
|
encoding that includes the topic, so announcements can't be replayed
|
|
onto other channels. Verification tests cover round trip, tampered
|
|
root, wrong topic, forged author, mismatched signing key, and
|
|
serde-then-verify.
|
|
- `LanDiscovery` implements the trait: mDNS sightings become
|
|
locally-authored, signed announcements ("peer N may hold pinned root
|
|
R"), one per pinned root. `announce()` is a no-op on the LAN — mDNS
|
|
already advertises presence, and varde never broadcasts content lists.
|
|
- The daemon's auto-sync was refactored *onto* the seam: sightings feed
|
|
presence tracking and the LanDiscovery channel; a single
|
|
`on_announcement` path verifies, indexes, and applies the consent
|
|
tiers (trusted author → pinned + incomplete → trusted providers →
|
|
fetch). The milestone-4 mdns integration test passes unchanged through
|
|
the new path, which is the proof the seam carries real traffic.
|
|
- Announcements surface on the event stream (`announcement` events) and
|
|
are indexed in memory per root.
|
|
- `docs/redoal-integration.md` sketches the gesture-topic gossip
|
|
provider against this contract, including the one extension it will
|
|
need (topic-scoped trust) and why nothing else changes.
|
|
|
|
## Deviations from the spec sketch
|
|
|
|
- The trait deals in `SignedAnnouncement` rather than bare
|
|
`Announcement`: the spec says announcements are signed, so the wire
|
|
type carries its signature and the subscriber can't forget to check.
|
|
- `Announcement.author` is an iroh `PublicKey` (ed25519, as specified);
|
|
provider addresses are excluded from the signed payload (they're
|
|
refreshable hints) while provider identities are covered.
|
|
- Signature bytes travel as a length-checked `Vec<u8>` because serde
|
|
cannot derive for `[u8; 64]`.
|