chore: retarget upstream portal-tunnel v2.4.0

gofix commented

2026-09-11 10:07:06 +00:00

Owner

Summary

Retarget the Rust relay to upstream portal-tunnel v2.4.0 / protocol 9 and retain the preceding review-fix ancestry (29dfdd54, b46e8bc5).
Correct the independent-review IVNP blockers: gateway-position Axis B fixture, bounded helper work, assignment rollback, owned/reaped helper lifecycle, capacity status, loopback bootstrap trust, strict framing/deadlines, Unix gating, and platform/packaging truth.
Close the final release-evidence blocker: the isolated deterministic Axis B fixture now passes both the exact-upstream Go control and the Rust-gateway candidate, while the earlier b50e91a0 CI run already established a native ARM64 image build/start pass.

Review dispositions

P0-A — resolved. scripts/v240-axis-b-ivnp-smoke.sh now builds a five-router isolated signed-RouterInfo mesh with three ready floodfills, NTCP2 only, no reseed, fixed deterministic destination selection, and one genuine IVNP tunnel per direction. It proves official v2.4.0 client -> selected candidate /sdk/connect gateway -> IVNP -> fixed exact-upstream Go v2.4.0 ingress -> run-unique backend response. The control changes only the gateway to Go. Exact endpoint/capability, distinct gateway/ingress identities, the fresh fully correlated Rust post-bridge marker, no direct fallback, and per-arm cleanup are fail-closed prerequisites to the sole JSON pass marker.
P1-B — resolved. Helper dial/control work has per-request timeout/cancellation tied to Unix-client disconnect and a 128-operation cap. Rust helper permits cover the actual helper operation lifetime. Timeout, cancellation, queue-bound, and capacity-accounting regressions pass.
P1-C — resolved. Gateway endpoint issuance/assignment mutation occurs only after conflict, transport, and capacity validation. Conflict/capacity regressions assert zero assignment and failure-map residue.
P1-D — resolved within the documented trust model. The stdout watcher uses weak ownership; run/drop/error/helper-exit/EOF/SIGTERM paths close, abort, reap, and remove runtime state. A held stdin pipe supplies parent-liveness EOF. Child environment is cleared and allowlisted. The helper is documented as a trusted component, not a UID/filesystem privilege boundary; an absolute external-helper Unix socket mode supports separately supervised sidecars.
P1-E — resolved. Inbound saturation writes IVNP status byte 2; gateway handling maps it to retryable HTTP 429/rate-limited behavior.
P1-F — resolved. First-contact loopback TLS is confined to explicit constructor bootstrap URLs, learned/transitive/registry loopback is rejected, the first leaf pin is reused for the client lifetime, and nonlocal DNS is resolved/pinned with loopback responses rejected. SSRF/rebinding/certificate-substitution regressions pass.
P1-G — resolved. Control JSON remains bounded/deadline-protected, IVNP remains Unix-only with truthful platform documentation, and the native ARM64 Docker build/start job passed at b50e91a0. The Axis B run at final HEAD also rebuilt and ran the ARM64 candidate image on native aarch64 uvm.

Exact evidence

Final implementation under test: 05b2a1aa9fca840aeab9cd0c4f6d41ba2d8c360b (deterministic mesh 94829a8d, fixed tunnel selection 05b2a1aa). Exact upstream v2.4.0 commit: ba9866553db657c0a4c95ae5cc092f7389f3a6dc.

Final local verification: cargo fmt --all -- --check, cargo check --workspace --locked, cargo test --workspace --locked (187 passed; 0 failed; 3 ignored), cargo clippy --workspace --all-targets --locked -- -D warnings, helper go test ./..., Axis-B static regression, bash -n, and git diff --check all passed.
Final Axis-B artifacts: uvm /home/inseo/tmp/axis-b-deterministic-05b2a1aa-20260912t; local copy /Users/inseo/.hermes/profiles/ada/state/portal-tunnel-release/artifacts/axis-b-05b2a1aa-20260912t.
cargo test --locked: running 189 tests; test result: ok. 186 passed; 0 failed; 3 ignored; ... finished in 6.24s.
cargo clippy --locked --all-targets -- -D warnings: Finished dev profile ... in 3.42s.
go test -count=1 ./...: ok portal-tunnel-rs/helpers/portal-ivnp-helper 0.725s.
go test -race -count=1 ./...: ok portal-tunnel-rs/helpers/portal-ivnp-helper 1.902s.
Static helper: Linux ARM64 ELF, statically linked (CGO_ENABLED=0 GOOS=linux GOARCH=arm64).
scripts/v240-ivnp-capability-compat.sh: upstream Go overlay package ok ... 0.535s; Rust 1 passed; 0 failed; 188 filtered; Go v2.4.0 IVNP capability verified by Rust.
scripts/test-compose-config.sh: bundled Compose relay settings render with configured values and safe defaults.
scripts/test-container-image-tag.sh: container image tag gate accepts only exact production/dev release tags.
cargo fmt --all -- --check, git diff --check, bash -n scripts/*.sh, and sh -n scripts/container-image-tag.sh: exit 0, no output.
Forgejo run 162, primary Format, lint, and test: Job succeeded; CI reported 193 passed; 0 failed; 5 ignored, helper tests passed, and the Windows GNU cross-check completed after installing MinGW.

Deterministic Axis B pass

Command: ARTIFACT_DIR=/home/inseo/tmp/axis-b-deterministic-05b2a1aa-20260912t WAIT_SECONDS=180 scripts/v240-axis-b-ivnp-smoke.sh

Sole success marker: {"arms":["control-go-gateway","candidate-rust-gateway"],"candidate_commit":"05b2a1aa9fca840aeab9cd0c4f6d41ba2d8c360b","cleanup_verified":true,"marker":"IVNP_AXIS_B_PASS","upstream_commit":"ba9866553db657c0a4c95ae5cc092f7389f3a6dc"}.
Official client checksum passed and reports v2.4.0. Fresh responses were protocol-9-axis-b-control-03c2532b4721 and protocol-9-axis-b-candidate-95e5586c1064.
Candidate endpoint was exactly https://localhost:45141/sdk/connect, overlay=true, and allowlisted as the sole selection. Gateway destination 7vo6zs2ex3dyb2oterkexmqi6fz7uptgklclwmrierb3mv4lnbvq.b32.i2p and ingress destination bhtkjsxjv2jv2k6mqm4jtyrd4ijwsbxk5hqefgizggu4kublls4q.b32.i2p were distinct and bound into capability SHA-256 9510d4d452d626432e9b91e4750c8e5e3b50032f9f97eb3bf9736584536f1a44.
Rust emitted axis_b_event="ivnp_gateway_bridge_ready" after authenticated IVNP dial, capability framing/acceptance, and bridge activation; the marker proof matches the exact lease, ingress, gateway, and capability hash above.
Each arm proved five unique signed RouterInfos, three floodfills, bootstrap counts [3,3,4,4,4], NTCP2 only, SSU2 disabled, public reseed disabled, and one-hop inbound/outbound destination tunnels. The recorded fixture diff uses authenticated direct I2NP netdb replies only; application streaming still uses LeaseSet/Garlic/tunnel routing.
Cleanup proofs report every tracked relay, helper, client, backend, and infrastructure PID absent and the candidate container absent. The pass was reproduced in two immediately preceding clean-state runs before the exact-final-HEAD run.

Files changed by this review lane

CI/packaging/platform: .forgejo/workflows/rust-ci.yml, Dockerfile, docker-compose.yml, README.md, scripts/test-compose-config.sh.
Rust relay: crates/portal-relay/src/config.rs, relay/{bridge,discovery,ivnp,ivnp_stub,leases,mod,server}.rs.
Helper: helpers/portal-ivnp-helper/main.go, main_test.go.
Proof/docs: scripts/v240-axis-b-ivnp-smoke.sh, docs/unsupported-features.md.

Release state / remaining gates

Branch: codex/release-v2.4.0-20260911T085905Z-v2.4.0; PR #90 is closed and unmerged.
No reset, amend, rebase, force-push, duplicate PR, merge, tag, image push, publish, or deploy was performed.
Review evidence gates are closed: native ARM64 build/start and genuine protocol-9 Axis B both pass. PR #90 remains closed and unmerged; no merge, tag, image push, publish, or deploy was performed.

## Summary - Retarget the Rust relay to upstream portal-tunnel v2.4.0 / protocol 9 and retain the preceding review-fix ancestry (`29dfdd54`, `b46e8bc5`). - Correct the independent-review IVNP blockers: gateway-position Axis B fixture, bounded helper work, assignment rollback, owned/reaped helper lifecycle, capacity status, loopback bootstrap trust, strict framing/deadlines, Unix gating, and platform/packaging truth. - Close the final release-evidence blocker: the isolated deterministic Axis B fixture now passes both the exact-upstream Go control and the Rust-gateway candidate, while the earlier b50e91a0 CI run already established a native ARM64 image build/start pass. ## Review dispositions - **P0-A — resolved.** `scripts/v240-axis-b-ivnp-smoke.sh` now builds a five-router isolated signed-RouterInfo mesh with three ready floodfills, NTCP2 only, no reseed, fixed deterministic destination selection, and one genuine IVNP tunnel per direction. It proves official v2.4.0 client -> selected candidate `/sdk/connect` gateway -> IVNP -> fixed exact-upstream Go v2.4.0 ingress -> run-unique backend response. The control changes only the gateway to Go. Exact endpoint/capability, distinct gateway/ingress identities, the fresh fully correlated Rust post-bridge marker, no direct fallback, and per-arm cleanup are fail-closed prerequisites to the sole JSON pass marker. - **P1-B — resolved.** Helper dial/control work has per-request timeout/cancellation tied to Unix-client disconnect and a 128-operation cap. Rust helper permits cover the actual helper operation lifetime. Timeout, cancellation, queue-bound, and capacity-accounting regressions pass. - **P1-C — resolved.** Gateway endpoint issuance/assignment mutation occurs only after conflict, transport, and capacity validation. Conflict/capacity regressions assert zero assignment and failure-map residue. - **P1-D — resolved within the documented trust model.** The stdout watcher uses weak ownership; run/drop/error/helper-exit/EOF/SIGTERM paths close, abort, reap, and remove runtime state. A held stdin pipe supplies parent-liveness EOF. Child environment is cleared and allowlisted. The helper is documented as a trusted component, not a UID/filesystem privilege boundary; an absolute external-helper Unix socket mode supports separately supervised sidecars. - **P1-E — resolved.** Inbound saturation writes IVNP status byte `2`; gateway handling maps it to retryable HTTP 429/rate-limited behavior. - **P1-F — resolved.** First-contact loopback TLS is confined to explicit constructor bootstrap URLs, learned/transitive/registry loopback is rejected, the first leaf pin is reused for the client lifetime, and nonlocal DNS is resolved/pinned with loopback responses rejected. SSRF/rebinding/certificate-substitution regressions pass. - **P1-G — resolved.** Control JSON remains bounded/deadline-protected, IVNP remains Unix-only with truthful platform documentation, and the native ARM64 Docker build/start job passed at b50e91a0. The Axis B run at final HEAD also rebuilt and ran the ARM64 candidate image on native aarch64 uvm. ## Exact evidence Final implementation under test: `05b2a1aa9fca840aeab9cd0c4f6d41ba2d8c360b` (deterministic mesh `94829a8d`, fixed tunnel selection `05b2a1aa`). Exact upstream v2.4.0 commit: `ba9866553db657c0a4c95ae5cc092f7389f3a6dc`. - Final local verification: `cargo fmt --all -- --check`, `cargo check --workspace --locked`, `cargo test --workspace --locked` (`187 passed; 0 failed; 3 ignored`), `cargo clippy --workspace --all-targets --locked -- -D warnings`, helper `go test ./...`, Axis-B static regression, `bash -n`, and `git diff --check` all passed. - Final Axis-B artifacts: uvm `/home/inseo/tmp/axis-b-deterministic-05b2a1aa-20260912t`; local copy `/Users/inseo/.hermes/profiles/ada/state/portal-tunnel-release/artifacts/axis-b-05b2a1aa-20260912t`. - `cargo test --locked`: `running 189 tests`; `test result: ok. 186 passed; 0 failed; 3 ignored; ... finished in 6.24s`. - `cargo clippy --locked --all-targets -- -D warnings`: `Finished dev profile ... in 3.42s`. - `go test -count=1 ./...`: `ok portal-tunnel-rs/helpers/portal-ivnp-helper 0.725s`. - `go test -race -count=1 ./...`: `ok portal-tunnel-rs/helpers/portal-ivnp-helper 1.902s`. - Static helper: Linux ARM64 ELF, statically linked (`CGO_ENABLED=0 GOOS=linux GOARCH=arm64`). - `scripts/v240-ivnp-capability-compat.sh`: upstream Go overlay package `ok ... 0.535s`; Rust `1 passed; 0 failed; 188 filtered`; `Go v2.4.0 IVNP capability verified by Rust`. - `scripts/test-compose-config.sh`: `bundled Compose relay settings render with configured values and safe defaults`. - `scripts/test-container-image-tag.sh`: `container image tag gate accepts only exact production/dev release tags`. - `cargo fmt --all -- --check`, `git diff --check`, `bash -n scripts/*.sh`, and `sh -n scripts/container-image-tag.sh`: exit 0, no output. - Forgejo run 162, primary `Format, lint, and test`: `Job succeeded`; CI reported `193 passed; 0 failed; 5 ignored`, helper tests passed, and the Windows GNU cross-check completed after installing MinGW. ### Deterministic Axis B pass Command: `ARTIFACT_DIR=/home/inseo/tmp/axis-b-deterministic-05b2a1aa-20260912t WAIT_SECONDS=180 scripts/v240-axis-b-ivnp-smoke.sh` - Sole success marker: `{"arms":["control-go-gateway","candidate-rust-gateway"],"candidate_commit":"05b2a1aa9fca840aeab9cd0c4f6d41ba2d8c360b","cleanup_verified":true,"marker":"IVNP_AXIS_B_PASS","upstream_commit":"ba9866553db657c0a4c95ae5cc092f7389f3a6dc"}`. - Official client checksum passed and reports v2.4.0. Fresh responses were `protocol-9-axis-b-control-03c2532b4721` and `protocol-9-axis-b-candidate-95e5586c1064`. - Candidate endpoint was exactly `https://localhost:45141/sdk/connect`, `overlay=true`, and allowlisted as the sole selection. Gateway destination `7vo6zs2ex3dyb2oterkexmqi6fz7uptgklclwmrierb3mv4lnbvq.b32.i2p` and ingress destination `bhtkjsxjv2jv2k6mqm4jtyrd4ijwsbxk5hqefgizggu4kublls4q.b32.i2p` were distinct and bound into capability SHA-256 `9510d4d452d626432e9b91e4750c8e5e3b50032f9f97eb3bf9736584536f1a44`. - Rust emitted `axis_b_event="ivnp_gateway_bridge_ready"` after authenticated IVNP dial, capability framing/acceptance, and bridge activation; the marker proof matches the exact lease, ingress, gateway, and capability hash above. - Each arm proved five unique signed RouterInfos, three floodfills, bootstrap counts `[3,3,4,4,4]`, NTCP2 only, SSU2 disabled, public reseed disabled, and one-hop inbound/outbound destination tunnels. The recorded fixture diff uses authenticated direct I2NP netdb replies only; application streaming still uses LeaseSet/Garlic/tunnel routing. - Cleanup proofs report every tracked relay, helper, client, backend, and infrastructure PID absent and the candidate container absent. The pass was reproduced in two immediately preceding clean-state runs before the exact-final-HEAD run. ## Files changed by this review lane - CI/packaging/platform: `.forgejo/workflows/rust-ci.yml`, `Dockerfile`, `docker-compose.yml`, `README.md`, `scripts/test-compose-config.sh`. - Rust relay: `crates/portal-relay/src/config.rs`, `relay/{bridge,discovery,ivnp,ivnp_stub,leases,mod,server}.rs`. - Helper: `helpers/portal-ivnp-helper/main.go`, `main_test.go`. - Proof/docs: `scripts/v240-axis-b-ivnp-smoke.sh`, `docs/unsupported-features.md`. ## Release state / remaining gates - Branch: `codex/release-v2.4.0-20260911T085905Z-v2.4.0`; PR #90 is closed and unmerged. - No reset, amend, rebase, force-push, duplicate PR, merge, tag, image push, publish, or deploy was performed. - Review evidence gates are closed: native ARM64 build/start and genuine protocol-9 Axis B both pass. PR #90 remains closed and unmerged; no merge, tag, image push, publish, or deploy was performed.

gofix added 1 commit

2026-09-11 10:07:06 +00:00