From 880a4273a2ffa2aa86737a3cfb64fac07adc09c8 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 18 Sep 2026 14:59:06 +0200 Subject: docs: state what is built, and what the packaged install has answered MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The two documents disagreed with the code they describe. §15.2 still listed playlists and Chromecast subtitles as not built, both shipped and tested; the protocol document's header said wire version 3.2 beside its own §13 saying 3.3, which is §12's "a number restated away from its definition is a number that will drift" happening to the document that states the rule. The packaged install is no longer an open question: the artefacts have been taken to a running hub and node on Ubuntu 26.04 (.deb), Fedora 44 (.rpm) and Windows 11 (.exe). What is left of D11 is signing the binary, which is a different question from whether it installs. The migration row overstated its own risk. Nothing replays the revisions behind the first packaged release — they were development no installation ever ran — so the exposure is the next migration, not the chain. The disk-I/O row gains the consequence that was measured rather than reasoned: a root waking from standby stalls the loop long enough for a client's WebRTC connection to time out, on one node with one member. `refresh_availability` is named beside the two chunk paths, because a stat on a sleeping disk is what wakes it while reading nothing. A blank line had also split §15.3's table in two. Co-Authored-By: Claude Opus 5 --- docs/MESHBAY_DESIGN.md | 27 ++++++++++++++------------- docs/MESHBAY_NODE_PROTOCOL.md | 2 +- 2 files changed, 15 insertions(+), 14 deletions(-) (limited to 'docs') diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 8c3f67a..3f767d9 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -16,7 +16,7 @@ > them — it names the invariant that holds today, not the incident that produced > it. §13 is the register of those labels. > -> Wire versions at the time of writing: **MNP 3.0** (oldest peer accepted 3.0), +> Wire versions at the time of writing: **MNP 3.3** (oldest peer accepted 3.0), > **MHP 0.1**, packages **0.14.0**. The normative source for the wire format is > `MESHBAY_NODE_PROTOCOL.md`; this document states the design the protocol > serves, not its byte layout. @@ -2997,11 +2997,16 @@ pairing, device linking with member-visible evidence, per-node identity, named r with RO/RW and eject/plug, the indexer with partial hashing, uploads, the sealed index and sealed upload path, encrypted chat with epochs, video streaming with seeking, audio-language and subtitle selection, transfer leases with queueing, -pause and resume, the group-application -framework with Chat, Files, Videos, -Music and Photos, cross-group search with source merging, the operator CLI and -loopback control API, the desktop client through its identity and download stages, -account recovery, and the Windows port through packaging. +pause and resume, the group-application framework with Chat, Files, Videos, +Music and Photos, cross-group search with source merging, per-account playlists, +casting to a Chromecast with subtitles rebased onto the relay's clock, the +operator CLI and loopback control API, the desktop client through its identity +and download stages, account recovery, and the Windows port through packaging. + +The packages install: a machine has been taken from the built artefacts to a +running hub and node on **Ubuntu 26.04 (`.deb`), Fedora 44 (`.rpm`) and +Windows 11 (`.exe`)**. What is not done is signing them (Stage D11, D12), which +is a different question from whether they install. ### 15.2 Not built @@ -3010,14 +3015,12 @@ account recovery, and the Windows port through packaging. | **Stage D5** | Node management panel over the operator ops, root selection included | | **Stage D6** | First-run wizard — detect, enable the unit, link, group, initialise, pair | | **Stage D9** | Python sidecar — `group://` over QUIC | -| **Stage D11** | Windows clean-machine install verification and code signing | +| **Stage D11** | Windows code signing — the installer runs on Windows 11; the binary is unsigned | | **Stage D12** | Release key, signed repositories, updates through the OS | | — | DLNA/UPnP casting (§11.4) | -| — | **Subtitles on a Chromecast.** The client shows them; the relay re-serves the same fMP4 bytes the browser gets, and a `` in the renderer's DOM never leaves the machine. The route is an out-of-band `/subs.vtt` on the relay plus `tracks` on `player.load()`, and its one unknown — whether the receiver's CORS requirement can be met by the relay — cannot be settled by reading code | | — | **Bitmap subtitles** (PGS, VOBSUB — about a fifth of the embedded streams). No WebVTT without OCR; they are not listed rather than listed and blank. Burn-in covers them and costs `-c:v copy`, which is what the eight-slot sizing assumes never happens | | — | Delegation (§3.4) | | — | Tier 3 roster attestation (§3.3) | -| — | Playlists (§9.10) | | — | Android client | | — | **Federation between two hubs.** The protocol is written and switched off in the code (§7.6); what is not built is one run between two machines | @@ -3033,14 +3036,12 @@ account recovery, and the Windows port through packaging. | Forward secrecy in group chat | **Given up deliberately and on the record** (§4.5). If it becomes a requirement it belongs in 1:1 DM | | Metadata at the hub | Membership, and who posted in which group and when. A known leak, not a solved problem (§7.1) | | The exact-hash content check | Structural, not functional (§7.5) | -| **The packaged install** | Built and never installed. `build-packages.sh` produces four `.deb` that carry the migrations and a relocatable entry point, and no machine has been taken from those packages to a running hub and node. Every packaging defect found so far was found the first time somebody tried | | **QUIC** | Off by default, and **not at parity**: it serves the index and file chunks with no transfer lease, no leaseless ceiling and no root-availability check, does its file I/O on the event loop, and returns exception text to the peer (**L3**). No client speaks it. Either it comes to parity or it goes; until then §5.1's "chat is the only gap" is the one sentence here that overstates the code | | **The relay registry** | **Closed in the code**: `relay.RELAYS_ENABLED` is False and every `/v1/relays` route answers 503, as federation does. Nothing in the tree calls them, node or client, and §11.1 measured two ISPs with no TURN relay needed. Kept code that nothing calls is what **L7** says not to keep; it stays only as the proof-of-possession design (**AV6**) until a node needs a relay or it is deleted | | **Free-text third-party search** | `tmdb_search_req` takes a member's query and spends the operator's per-credential quota with no rate limit and no per-member bound, where link previews carry both. §6.5's standing rule — a bound and a named adversary in the same commit — was not applied here | -| **Disk I/O on the node's event loop** | A chunk read-and-encrypt and every upload chunk write run in the message handler. On a spun-down or network-mounted root that stalls every group, every stream and the hub socket, which is `AV9`'s lesson with the disk in place of the mail server | +| **Disk I/O on the node's event loop** | A chunk read-and-encrypt and every upload chunk write run in the message handler, and `RootSet.refresh_availability` stats every root from the loop as well. On a spun-down or network-mounted root that stalls every group, every stream and the hub socket, which is `AV9`'s lesson with the disk in place of the mail server. **A disk waking from standby stalls it long enough for a client's WebRTC connection to time out and have to be reopened** — measured on one node with one member, so it is not a contention effect | | **Node announcements are not bounded** | One account may announce unlimited distinct node keys, each a row plus an IP-log row under a one-year retention. Proof of possession is checked (**M8**); the count is not | - -| **Migrations run on SQLite only** | The chain reaches head and agrees with the models there (§12), which is not where it ships. A default or a constraint PostgreSQL refuses would still reach a deploy | +| **Migrations run on SQLite only** | The chain reaches head and agrees with the models there (§12), which is not where it ships. **The exposure is one revision deep, not the whole chain**: every revision behind the first packaged release was development that no installation ever ran, so nothing replays them on PostgreSQL. What is unguarded is the *next* migration — a default, an index type or a constraint PostgreSQL refuses reaches a deploy without the suite saying so | --- diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md index a53d494..51feacd 100644 --- a/docs/MESHBAY_NODE_PROTOCOL.md +++ b/docs/MESHBAY_NODE_PROTOCOL.md @@ -1,6 +1,6 @@ # MeshBay Node Protocol (MNP) -**Wire version:** `3.2` — `meshbay_common/__init__.py` (`MNP_VERSION`) +**Wire version:** `3.3` — `meshbay_common/__init__.py` (`MNP_VERSION`) **Oldest peer accepted:** `3.0` — `handshake.py` (`MNP_MIN_SUPPORTED`) **Normative implementation:** `meshbay-common` (`protocol.py`, `handshake.py`, `groupbox.py`, `chatbox.py`, `adminop.py`, `join.py`, `device.py`, `crypto.py`, -- cgit v1.2.3