aae40ff · P2P-Hiverelay

Changed files (3) +42 -16

docs/COMMUNITY-UPDATE-0.25.0-rc.1.md +1 -1

…	…	@@ -78,7 +78,7 @@ Journal and app-lifecycle fixes (including registry load vs reseed split) that k
78	78	- Track B — blind public-test images (`1.0.0-rc.1.public-test.1`) on pilot FDs (syd / dal)
79	79	- Track C — later monorepo merge / opt-in blind profile (`v0.26.x` story)
80	80
81		Marketing line when both are live: “Fleet v0.25 + Blind public-test on syd1 (+ dal)” — two components, not one tag.
	81	Marketing line when both are live: “Fleet v0.25 + Blind public-test on relay-syd (+ relay-dal)” — two components, not one tag.
82	82
83	83	#### Explicit non-claims (please don’t oversell)
84	84

docs/LADDER-SHIP-MAP.md +29 -7

…	…	@@ -31,7 +31,7 @@ v0.26.x / later = first tag where blind-daemon is IN the monorepo
31	31	+ optional fleet enable ← Track C
32	32	```
33	33
34		Marketing one-liner when both are live: “Fleet v0.25.0 + Blind public-test on syd1 (+ dal)” — two components, one sentence, not one tag.
	34	Marketing one-liner when both are live: “Fleet v0.25.0 + Blind public-test on relay-syd (+ relay-dal)” — two components, one sentence, not one tag.
35	35
36	36	---
37	37
…	…	@@ -42,7 +42,7 @@ Marketing one-liner when both are live: **“Fleet v0.25.0 + Blind public-test o
42	42	\| G0 \| Integrity (can't forge bytes/sigs) \| Core already \|
43	43	\| G1 \| Payload opacity \| Encrypted/outbox/signed envelopes; utility services HTTP \|
44	44	\| G2-S \| Storage-schema opacity \| Blind cells / no app semantics at rest \|
45		\| G2-W \| Wire opacity \| Split transport (OHTTP + Protomux) — spec’d, not built \|
	45	\| G2-W \| Wire opacity \| Split transport (OHTTP + Protomux) — wire layer built in vnext; runtime not built (see Ship 9) \|
46	46	\| G3 \| At-rest unlinkability \| BlindShard/cells + multi-relay cohort \|
47	47	\| G4-T \| Route separation \| Tor onion path (+ later split-web) \|
48	48	\| G4-I \| Read-interest privacy \| Bucket/PIR later — not in near map \|
…	…	@@ -157,14 +157,16 @@ Still not “blind public-test complete” or “WAL boot-restore GA.”
157	157
158	158	\| Step \| Action \|
159	159	\|------\|--------\|
160		\| 3a.1 \| A record `syd1.p2phiverelay.xyz` → syd-1 public IP (fleet sydney) \|
161		\| 3a.2 \| (Later) Dallas (or Bern) name, e.g. `dal1.p2phiverelay.xyz` \|
	160	\| 3a.1 \| Shipped — A record `relay-syd.p2phiverelay.xyz` → `104.194.135.205` (fleet sydney) \|
	161	\| 3a.2 \| Shipped — A record `relay-dal.p2phiverelay.xyz` → `172.86.90.115` (fleet dallas, phase-2 seat) \|
	162
	163	> Naming: the pilot names follow the existing fleet convention (`relay-us`, `relay-sg`, `relay-eu`) — `relay-syd` / `relay-dal`, not `syd1` / `dal1`. `syd1.p2phiverelay.xyz` and `dal1.p2phiverelay.xyz` were placeholder names in an earlier draft of this map and have never existed in DNS. The signed Peerit bind artifacts (`02-apps/peerit-release-bind/config/blind-public-test-*.json`) are authoritative for these hostnames.
162	164
163	165	#### 3b — syd-1 deploy + qualify
164	166
165	167	\| Step \| Action \| Ladder / product \|
166	168	\|------\|--------\|------------------\|
167		\| 3b.1 \| ACME cert for syd1; open 443; leave 9100 alone \| Edge TLS \|
	169	\| 3b.1 \| ACME cert for `relay-syd`; open 443; leave 9100 alone \| Edge TLS \|
168	170	\| 3b.2 \| Load digest-pinned edge+daemon OCI; compose `docker-compose.blind-public-test.yml` \| Blind runtime \|
169	171	\| 3b.3 \| Node ceremony: new Blind root; preserve `/opt/hiverelay` + `~/.hiverelay` \| Store genesis \|
170	172	\| 3b.4 \| Qualify: DESCRIBE / CELL / INBOX / CORE / FORWARD-one-hop + negatives \| G2-S + G3 path + partial G4-T if Tor in pilot \|
…	…	@@ -278,7 +280,27 @@ Never: TA-resistant / mixnet-level anonymity.
278	280
279	281	### Ship 9 — Split transport (G2-W + stronger G4-T)
280	282
281		When: after Ship 6–8 stable; spec exists, code does not
	283	When: after Ship 6–8 stable
	284
	285	> State correction (2026-07-27, verified): this row previously read "spec exists, code does not." That is wrong. The wire layer is built — in `00-core/hiverelay-blind-vnext-integration/packages/blind-protocol/`, not in main. What is missing is the runtime, the transport descriptor, and the main-tree merge. See the gap table below before scoping this ship.
	286
	287	\| Component \| State \| Where \|
	288	\|-----------\|-------\|-------\|
	289	\| `BlindOhttpKeyConfigV1` (schema, signing domain `hiverelay.blind.ohttp-key-config.v1`, domainId 201, rotation validity ≤120 epochs = 30 days) \| ✅ built \| vnext `blind-protocol/schemas.js`, `registry.js` \|
	290	\| `BlindOhttpTransportErrorV1` + delivery-boundary / retry-action taxonomy (3 rows) \| ✅ built \| vnext `blind-protocol` \|
	291	\| Relay roles `OHTTP_INGRESS=3`, `OHTTP_GATEWAY=4`; `TRANSPORT_SUPPORT.OHTTP` bit \| ✅ built \| vnext `registry.js` \|
	292	\| FORWARD family (`Open` / `OpenResult` / `Data` / `Window` / `Close` + `HopOpen` / `HopAccept` / `RouteScope`), circuit classes, flow-control fields, route-scope hashing \| ✅ built \| vnext `blind-protocol` \|
	293	\| Codec conformance tests (`public-wire-family-codecs`, `frozen-control-codecs`, `wire-runtime-authority`) \| ✅ built \| vnext `blind-protocol/test/` \|
	294	\| Client path resolver: strict/balanced downgrade, evidence-bearing result, `hiverelay-forward` candidate \| ✅ built in main \| [`packages/client/privacy-policy.js`](../packages/client/privacy-policy.js) \|
	295	\| `BlindTransportDescriptorV1` (spec §5) \| ❌ nowhere \| — \|
	296	\| Oblivious ingress service (receive → strip headers → forward) \| ❌ not built \| — \|
	297	\| Gateway HPKE decapsulation adapter \| ❌ not built \| — \|
	298	\| Browser OHTTP client + opaque-origin iframe (`ST-10`) \| ❌ not built \| — \|
	299	\| Padding-bucket enforcement \| ⚠️ mismatch — spec §3.5 wants 1/4/16/64 KiB; `STREAM_WIRE_CLASS` ships 4 KiB / 16 KiB / 65535 \| vnext `registry.js` \|
	300	\| `forward-relay.js` runtime upgraded to BlindForward frames \| ❌ still the 329-line varint byte-bridge, no flow control \| [`packages/core/core/protocol/forward-relay.js`](../packages/core/core/protocol/forward-relay.js) \|
	301	\| Any of the above in main \| ❌ `blind-protocol` is not a main workspace \| — \|
	302
	303	The spec document is behind the code, not ahead of it. `SPLIT-TRANSPORT-SPEC-V1-2026-07-26.md` §4.2 specifies fixed-offset frames with a `targetPubkey`, explicit `requestedInitialWindow/IdleMillis/LifetimeMillis`, and a signature on `Open`. The built `blindForwardOpenV1` has none of those — it uses a `circuitClass` enum, adds `parentRouteScopeHash` / `innerHandshake` / `nextDescriptorSequence`, and carries no `Open` signature. Reconcile the spec text against the registry before quoting §4.2 as a build target.
282	304
283	305	\| Contents \| Ladder \|
284	306	\|----------\|--------\|
…	…	@@ -388,7 +410,7 @@ You can call the product ladder complete for honest marketing when:
388	410	## 9. Immediate next three moves (in order)
389	411
390	412	1. Branch + tag path for Track A: `feat/service-http-wiring` → `v0.25.0-rc.1` canary → `v0.25.0` stable.
391		2. Unblock Track B: DNS `syd1.p2phiverelay.xyz` → deploy/qualify syd-1 → Dallas as 2nd FD.
	413	2. Unblock Track B: DNS `relay-syd.p2phiverelay.xyz` (live) → deploy/qualify syd-1 → Dallas as 2nd FD.
392	414	3. Only then merge boot-restore + tag 0.26 for “blind-capable product.”
393	415
394	416	---

docs/PEERIT-BLIND-CELLS-HANDOVER-2026-07-27.md +12 -8

…	…	@@ -79,15 +79,19 @@ utah's signed capability doc carries a real advertised onion:
79	79
80	80	## 3. Prerequisites NOT done yet (blockers)
81	81
	82	> Correction (2026-07-27, re-verified): an earlier draft of this brief listed the pilot hostnames as `syd1` / `dal1` and reported DNS as a blocker. Those names were placeholders carried over from `docs/LADDER-SHIP-MAP.md` and have never existed in DNS. The real names follow the fleet convention (`relay-us`, `relay-sg`, `relay-eu`) and already resolve. Use `relay-syd` / `relay-dal`. The signed Peerit bind artifacts (`02-apps/peerit-release-bind/config/blind-public-test-*.json`) are authoritative.
	83
82	84	\| Prereq \| Status \| Action \|
83	85	\|--------\|--------\|--------\|
84		\| DNS `syd1.p2phiverelay.xyz` \| ❌ not resolving \| Create A record → `104.194.135.205` \|
85		\| DNS `dal1.p2phiverelay.xyz` \| ❌ not resolving \| Create A record → `172.86.90.115` (do this AFTER syd-1 accepts) \|
	86	\| DNS `relay-syd.p2phiverelay.xyz` \| ✅ resolves → `104.194.135.205` \| none — live \|
	87	\| DNS `relay-dal.p2phiverelay.xyz` \| ✅ resolves → `172.86.90.115` \| none — live \|
	88	\| `syd1.p2phiverelay.xyz` / `dal1.p2phiverelay.xyz` \| ⛔ NXDOMAIN \| placeholder names — do not create these \|
	89	\| :443 reachable on both hosts \| ✅ TCP open (syd + dal) \| — \|
	90	\| TLS on :443 \| ⚠️ handshake failed from workstation on 2026-07-27 \| Re-check edge liveness; the 2026-07-26 Peerit DESCRIBE probe passed against both, so this is a regression or a network-path artifact — confirm before re-issuing certs \|
86	91	\| Blind OCI images built/pushed \| ⚠️ in worktree, not published \| Build + push `1.0.0-rc.1.public-test.1` digests (see §4) \|
87		\| ACME cert for syd1 \| ❌ pending \| Issue after DNS lands; blind-edge terminates TLS \|
88	92	\| `docker-compose.blind-public-test.yml` \| ⚠️ exists as `docker-compose.blind.yml` \| Adapt for public-test (see §4) \|
89	93
90		Do NOT start deploy until DNS + cert are live on syd-1. The edge needs a valid public-CA cert; a self-signed cert violates the public-test lease.
	94	DNS is not a blocker. The open question is edge liveness on :443 — TCP accepts but TLS did not complete from this workstation, while `reports/blind-public-test-describe-probe-20260726.json` shows both DESCRIBE endpoints passing the day before. Establish which is true before touching certs; a re-issue against a healthy edge is wasted churn. The edge needs a valid public-CA cert — a self-signed cert violates the public-test lease.
91	95
92	96	---
93	97
…	…	@@ -125,8 +129,8 @@ Per `docs/LADDER-SHIP-MAP.md` Ship 3. **Strict order: syd-1 fully accepts BEFORE
125	129
126	130	### 3a — DNS + cert
127	131
128		1. `syd1.p2phiverelay.xyz` A record → `104.194.135.205`
129		2. ACME cert for `syd1.p2phiverelay.xyz` (blind-edge terminates :443)
	132	1. ~~`relay-syd.p2phiverelay.xyz` A record → `104.194.135.205`~~ — already live
	133	2. ACME cert for `relay-syd.p2phiverelay.xyz` (blind-edge terminates :443)
130	134
131	135	### 3b — syd-1 deploy + qualify
132	136
…	…	@@ -146,7 +150,7 @@ Per `docs/LADDER-SHIP-MAP.md` Ship 3. **Strict order: syd-1 fully accepts BEFORE
146	150	### 3c — Dallas (2nd failure domain) — ONLY after 3b accepts
147	151
148	152	1. Continuity-linked phase-2 manifest (new pin-history entry, same digests)
149		2. `dal1.p2phiverelay.xyz` A record → `172.86.90.115`
	153	2. ~~`relay-dal.p2phiverelay.xyz` A record → `172.86.90.115`~~ — already live
150	154	3. Baseline capture BEFORE mutate; full qualify (same as 3b.4)
151	155	4. Two-relay cell write/readback — write to syd-1, read from dal-1 (and vice versa)
152	156	5. One-relay-down behavior — kill dal-1 daemon, verify syd-1 still serves; restart, verify recovery
…	…	@@ -176,7 +180,7 @@ This is `LIVE_PUBLIC_TEST_ONLY`. Do NOT:
176	180	- Edge HTTPS on public-CA TLS
177	181	- G4-T only if a Tor path is piloted (optional, not required for blind-edge)
178	182
179		Marketing line when live: "Fleet v0.25.0 + Blind public-test on syd1 (+ dal)" — two components, one sentence, not one tag.
	183	Marketing line when live: "Fleet v0.25.0 + Blind public-test on relay-syd (+ relay-dal)" — two components, one sentence, not one tag.
180	184
181	185	---
182	186

P2P-Hiverelay commits / aae40ff

Changed files (3) +42 -16