HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Build the deterministic three-party and NAT-topology integration harness #14

New Issue
Open
opened 2026-07-15 10:04:24 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:24 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #13, #25

Outcome

Prove the real service + host + client lifecycle, not merely isolated serializers or a reported NAT callback.

Scope

  • Launch the service and the thin TestClient in non-interactive host/join modes; use the same public executable and SDK path available to operators and consumers.
  • Exercise register → prove host socket → browse → authorize → prove client socket → introduce → connect → ticket accept → direct traffic → disconnect.
  • Add same-LAN/internal endpoint, separate observed endpoints, timeout, stale lease/presence, replay, wrong tenant/protocol, cancellation, and mediator restart cases.
  • Add Linux network-namespace/container NAT scenarios where CI permissions allow, with a deterministic loopback suite as the always-on gate.
  • Verify traffic after connection flows peer-to-peer rather than through Rendezvous.
  • Record topology/simulation limitations; local emulation is not claimed as universal Internet proof.

Acceptance criteria

  • The happy path runs unattended and green in CI through the TestClient's stable script mode and exit codes.
  • Tests prove an authenticated LiteNetLib peer connection and direct payload exchange.
  • Same-LAN and external-candidate selection behavior is verified.
  • Expected traversal failures terminate cleanly and select the typed fallback path.
  • Secrets and raw reusable tokens do not appear in captured logs.
  • Test processes, sockets, namespaces, and containers always clean up.
  • Flaky wall-clock sleeps are replaced with bounded state-driven waits.
Parent: #1 Depends on: #13, #25 ## Outcome Prove the real service + host + client lifecycle, not merely isolated serializers or a reported NAT callback. ## Scope - Launch the service and the thin TestClient in non-interactive host/join modes; use the same public executable and SDK path available to operators and consumers. - Exercise register → prove host socket → browse → authorize → prove client socket → introduce → connect → ticket accept → direct traffic → disconnect. - Add same-LAN/internal endpoint, separate observed endpoints, timeout, stale lease/presence, replay, wrong tenant/protocol, cancellation, and mediator restart cases. - Add Linux network-namespace/container NAT scenarios where CI permissions allow, with a deterministic loopback suite as the always-on gate. - Verify traffic after connection flows peer-to-peer rather than through Rendezvous. - Record topology/simulation limitations; local emulation is not claimed as universal Internet proof. ## Acceptance criteria - The happy path runs unattended and green in CI through the TestClient's stable script mode and exit codes. - Tests prove an authenticated LiteNetLib peer connection and direct payload exchange. - Same-LAN and external-candidate selection behavior is verified. - Expected traversal failures terminate cleanly and select the typed fallback path. - Secrets and raw reusable tokens do not appear in captured logs. - Test processes, sockets, namespaces, and containers always clean up. - Flaky wall-clock sleeps are replaced with bounded state-driven waits.
Kyuubi commented 2026-07-16 11:06:45 +02:00
Author
Owner
Copy Link
Copy Source

Starting implementation on a stacked branch from verified TestClient commit 7e3be2c.

Plan: inventory existing deterministic topology coverage, build the always-on three-party harness through TestClient script mode, add state-driven adverse lifecycle and candidate-selection scenarios, add an opt-in Linux namespace/container topology gate where permissions allow, document emulation limits, then run adversarial review and full Debug/Release/integration cleanup gates.

Starting implementation on a stacked branch from verified TestClient commit `7e3be2c`. Plan: inventory existing deterministic topology coverage, build the always-on three-party harness through TestClient script mode, add state-driven adverse lifecycle and candidate-selection scenarios, add an opt-in Linux namespace/container topology gate where permissions allow, document emulation limits, then run adversarial review and full Debug/Release/integration cleanup gates.
Kyuubi self-assigned this 2026-07-16 11:06:46 +02:00
Kyuubi commented 2026-07-16 11:51:22 +02:00
Author
Owner
Copy Link
Copy Source

Implemented and pushed on codex/issue-14-integration-harness at 2ff7cd6 (stacked on #25).

Delivered:

  • always-on real service + public TestClient process scenarios for the full host/browse/join/direct-traffic lifecycle
  • same-LAN candidate proof, missing/empty selection exits, wrong tenant/protocol rejection before punching, typed traversal timeout with an advertised-but-never-dialed fallback, POSIX cancellation cleanup, abrupt-host presence expiry before lease expiry, and secret-safe output assertions
  • native LiteNetLib mediator coverage that serves traffic, restarts on the same UDP port, then serves a second authorized introduction
  • deterministic evidence matrix for replay, stale state, same-NAT and separate-observed-endpoint selection
  • privilege-gated Linux topology with isolated service, two MASQUERADE NAT routers, separate host/client LAN namespaces, distinct observed WAN endpoints, direct public-candidate traffic, ownership-safe bounded cleanup, exact capability preflight, EXIT probe cleanup, and a TRX nonzero-test guard
  • topology limitations and run instructions documented without claiming universal Internet proof

Adversarial branch audit: all P0-P3 findings resolved across architecture/API, correctness/security/lifecycle, and tests/performance/CI lenses.

Verification:

  • Debug build: pass
  • Debug tests: 219/219
  • Release build: pass
  • Release tests: 219/219
  • always-on public-process suite: 6/6
  • mediator restart cases: 2/2
  • formatting/analyzers/diff hygiene: pass
  • privileged test discovery/TRX guard: pass
  • privileged NAT execution on this worker: capability-gated skip because CAP_NET_ADMIN is unavailable; CI executes it when its exact bridge/veth/sysctl/MASQUERADE/conntrack preflight succeeds

The issue remains open while the dependency stack is completed and landed.

Implemented and pushed on `codex/issue-14-integration-harness` at `2ff7cd6` (stacked on #25). Delivered: - always-on real service + public TestClient process scenarios for the full host/browse/join/direct-traffic lifecycle - same-LAN candidate proof, missing/empty selection exits, wrong tenant/protocol rejection before punching, typed traversal timeout with an advertised-but-never-dialed fallback, POSIX cancellation cleanup, abrupt-host presence expiry before lease expiry, and secret-safe output assertions - native LiteNetLib mediator coverage that serves traffic, restarts on the same UDP port, then serves a second authorized introduction - deterministic evidence matrix for replay, stale state, same-NAT and separate-observed-endpoint selection - privilege-gated Linux topology with isolated service, two MASQUERADE NAT routers, separate host/client LAN namespaces, distinct observed WAN endpoints, direct public-candidate traffic, ownership-safe bounded cleanup, exact capability preflight, EXIT probe cleanup, and a TRX nonzero-test guard - topology limitations and run instructions documented without claiming universal Internet proof Adversarial branch audit: all P0-P3 findings resolved across architecture/API, correctness/security/lifecycle, and tests/performance/CI lenses. Verification: - Debug build: pass - Debug tests: 219/219 - Release build: pass - Release tests: 219/219 - always-on public-process suite: 6/6 - mediator restart cases: 2/2 - formatting/analyzers/diff hygiene: pass - privileged test discovery/TRX guard: pass - privileged NAT execution on this worker: capability-gated skip because `CAP_NET_ADMIN` is unavailable; CI executes it when its exact bridge/veth/sysctl/MASQUERADE/conntrack preflight succeeds The issue remains open while the dependency stack is completed and landed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#14
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?