[0xcadams]

What

Integrate the control, relay, publisher, and connector owners for native peer connections above the packet-carrier and telemetry foundations. A prepared native pair carries one end-to-end QUIC connection over interchangeable relay carriers, so losing a carrier need not reopen the application or its target socket. Regional placement remains measured against the live server.

Native serving is still opt-in. Production tnl connect and public ingress have not been cut over, and this PR is not ready to merge or deploy.

Why

Control must authorize the exact service run, enrolled visitor, and two relay processes before packet delivery starts. A relay must attest to the source on its accepted socket; neither a cluster bearer nor a connector-supplied IP proves that source. The publisher must independently authorize every application opening, even when packet delivery is authenticated.

Changing UDP or TCP delivery should preserve the existing application connection, not silently repeat its admission or dial another target. Background preparation keeps control requests and pair setup off application arrival. A relay claim alone does not prove that the publisher has installed its separately authorized packet registrations and listener.

Concurrent browser and share preparation must also converge on current policy without replaying credential redemption or extending the last confirmed serving deadline.

Changes

• Measure bounded TLS nonce probes to live relay services and send region preferences when starting publisher runs; prefer ready private ingress near the publisher within its service pool.
• Prepare signed device/workload peer pairs bound to an exact run, subject, relay assignments, protected delivery key, replay fence, and fixed deadline. Keep idempotent recovery and explicit authorized renewal/replacement.
• Bind fresh relay-process signing keys to leases and authorize pair-leg claims from signed connector proofs plus exact-process source attestations. Convert observed authority to conservative request-start deadlines.
• Forward authenticated encrypted packets through exact locally claimed publisher connections over QUIC DATAGRAMs or TLS/yamux, with bounded registrations and joined teardown.
• Keep shared QUIC datagram submission cancelable under backpressure. The outer session owns its single blocking enqueue worker; retiring a registration does not close sibling carriers or the borrowed session.
• Let opted-in publisher runs reconcile paged candidate references, independently prepare bindings with their run token, and serve guarded streams through their claimed relay connections. Share replay history and run capacity across carriers; keep existing forwarding streams on the sole TLS/yamux dispatcher.
• Record publisher installation only after both packet registrations and the inner listener exist. Recheck the exact run token and current delivery; return no key and never renew authority.
• Add an opt-in connector owner that races relay transports on one UDP socket, checks matching source receipts, waits for publisher confirmation, and opens applications on one inner connection without control requests or pair signing on arrival. Join canceled and late attempts; never retry application openings or fall back to ingress.
• Renew live relay claims with fresh signed proofs and checked receipts on their existing control streams. Recheck source, assignment, and current authority without changing packet registrations or inner streams; old deadlines still fence denied and late renewals.
• Qualify both publisher transports and every connector carrier combination with real control, PostgreSQL, two relays, one target socket, UDP loss, and native TCP carrier closure, without ingress.
• Retry rolled-back publisher-policy transactions with fresh authority checks, and serialize publisher fetch/apply so concurrent credential preparation does not use a stale revision cursor. Waiting and fetching share one bounded request budget; ordinary application requests still verify locally.
• Retain fail-closed production gates. Carrier reconnection needs an explicit winner activation/handoff; assignment/source rebinding, ICE integration, deployed-listener source handling, and public ingress cutover remain unfinished.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T23:33:27.800057Z	61033ba	New commits
🔒 Security Review	✅ Completed 2026-10-27T23:34:57.751923Z	61033ba	New commits

Security findings

Advisory findings (1)

• 🟡 Prevent unauthenticated clients from exhausting relay setup slots · High

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e28f4b1211

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Here are some automated security review suggestions for this pull request.

Reviewed commit: 33640bda9e

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security: Prevent unauthenticated clients from exhausting relay setup slots

On deployments where publishers need TLS/TCP (for example, because UDP/QUIC is blocked), do not let unauthenticated clients fill this global semaphore. The relay takes one of only 128 setup slots before TLS or publisher authentication and holds it for up to 10 seconds; an Internet client can keep 128 handshakes or probes incomplete, after which this branch closes every legitimate publisher connection. Reference deployments expose relay TCP/443 publicly, so repeating this against each relay prevents new or replacement publisher sessions and route recovery. Apply per-source limits/fair admission or reserve capacity for authenticated setup instead of globally failing closed.

Useful? React with 👍 / 👎.

[0xcadams]

The approved scope is now the coordinated v1 relay-first/P2P rewrite, hosted usage removal, simplified shared telemetry, and 20-minute guest budget. This remains the final integration and main merge gate; current green checks do not qualify the unfinished rewrite. Review fixes are preserved through 33640bd. The first new layers are #471 (same-session packet switching proof) and #472 (shared UDP socket, relay STUN, ICE, carrier replacement). Both have passed focused local race checks, routine Go tests, lint, and generation/format checks; #471 also has fresh green remote checks. Authorization/capacity, role migration, usage/telemetry/guest changes, companion website PRs, restacking, and exact-final-tip qualification remain in progress.

[0xcadams]

The guest-authority layer is now #474, and this final gate has been restacked above it. The current tip is a72c800.

The approved rewrite has two paths: prepared publisher-initiated public connections directly to ingress, and native connector/publisher sessions through two relay services with end-to-end QUIC, concurrent P2P setup, and warm relay fallback. Public traffic must have no relay/STUN/ICE dependency.

This PR remains unfinished. Hosted usage removal, shared v1 telemetry, five-minute fixed authority/capacity, public reverse-ingress integration, native relay signaling/integration, and the corresponding website changes are still required. Foundation and guest checks do not qualify the final implementation; merge only after the exact final tip passes its own checks.

[0xcadams]

Restacked above guest authority #474 and native usage retirement #476. The current final-gate tip is 3845fe0; matching website layers are tnldotdev/tnl.dev#190 and #191, with #191 pinned to native 294167a.

Local usage-retirement proofs include routine Go/lint/generation, ingress races, PostgreSQL guest/source/storage/lock boundaries, steady/recovery/shutdown database smoke, and the real two-minute cadence/relay-recovery check. Website proofs include bounded 365-day receipt-time deletion, fresh-baseline checks, browser behavior, and actual Vercel/collector observability.

The rewrite remains unfinished: shared v1 telemetry, fixed offline authority/capacity, publisher-to-ingress public integration, native relay/P2P integration, and corrected placement still need implementation. The Linux cross-team publisher-groups fixture also reports a connector cleanup deadline failure, tracked for investigation. None of these partial checks qualifies this final merge gate.

[0xcadams]

pushed signed c9279873 (publisher-policy transaction retry) and 529d63d9 (targeted x/net security update).

root and disposable-harness modules now select x/net v0.62.0 and its required golang.org/x minimums. go:vulncheck reports zero reachable vulnerabilities; it still notes one advisory in required modules that this code does not call. no suppression or policy change was added. #459 remains separate.

on the dependency-updated tree: routine Go/public API consumer, peer-transport race tier, feedback sanitizer races, harness races, Go lint, formatting and diff checks passed. the first routine run lost the deadline classification in the existing 100ms SDK HTTPS timeout fixture; five focused race repetitions and a complete routine rerun passed without changing that fixture or product errors.

local runtime shard 2/4 did not pass: the nested-member-hostname visitor received EOF after readiness (the earlier standalone-startup issue did not recur). its isolated real integration rerun passed; retain this as unresolved qualification evidence, not a green shard receipt. the 41a01ee8 CI shard 2/4 did pass. logs remain private local artifacts; current-tip CI is not claimed green.

carrier reconnection still requires a checked handoff to a live retained owner, preserving packet replay history and application admission. merely accepting a fresh claim for a retired delivery generation remains deliberately rejected. source rebinding, assignment replacement, ICE signaling/direct upgrade, and the public-ingress cutover are still unfinished. production native admission remains off. no merge, deployment, live infrastructure change, or deployed benchmark was run.

[0xcadams]

follow-up local qualification at 529d63d9: the complete Go race suite passed. runtime shard 2/4 also passed when run without competing builds (262.206s), including standalone private QUIC/TLS-TCP, standalone publication, and nested member hostname (27.31s). this does not erase the earlier concurrent-run EOF evidence.

current-tip CI still has a Go race job failure and other jobs in progress; that log is being inspected. no green-CI or complete-cutover claim.

[0xcadams]

pushed signed fixture-only fix 18358135 for the 529d63d9 CI race-job assertion.

the certificate-admission fixture copied a locally translated policy view, replaced its observation time for a newly signed certificate, but retained the previous ControlTime. if issuance crossed a JWT-second boundary, the old authority clock made the new token appear future-issued. reconstructing the fresh control observation clears that old translation; production token, certificate, permission, and policy validation are unchanged.

a deterministic one-second-later observation fails before the fix with the same visitor token is invalid assertion and passes afterward. ten focused race repetitions, the full Go race suite, Go lint, formatting, and diff checks passed. the original promotion-wait, exactly-once promotion, successful admission, and preserved infrastructure-cause assertions remain intact.

this is not a green-CI claim; the newly pushed tip must qualify. native production admission remains off, and reconnection/ICE/public-ingress work remains unfinished. no merge, deployment, or live infrastructure operation.

[0xcadams]

next carrier-recovery boundary (design, not implemented):

peerConnection and publisher PeerSession must outlive an outer connector carrier. today relay nativePairDelivery.Close retires the shared publisher registration, so wrapping only the connector path in CarrierSlot cannot reconnect it. loosening same-generation registration admission would discard the replay fence and is not an acceptable fix.

a recovery handoff should retain the logical pair/application binding and introduce a separately checked carrier binding for each exact leg:

• control authorizes fresh connector/relay proofs for the exact current run, assignment, process lease, and observed source; it issues a new carrier delivery ID/revision rather than reopening the old registration.
• publisher background preparation independently installs that new registration on the still-live endpoint. its confirmation must cover the current carrier bindings; an old installation snapshot cannot authorize the handoff.
• connector installs the confirmed carrier through the live endpoint slot, requiring fresh packet probes. the original inner QUIC connection, application visitor IDs, capacity/replay state, and target sockets remain unchanged.
• old carrier IDs remain retired. late setup, expired authority, a stopped endpoint owner, or changed source/assignment without its own checked handoff cannot revive the owner. endpoint-process replacement creates a new session.

this separates logical application lifetime from carrier registration lifetime without treating packet keys, ICE observations, or a fresh relay claim as application permission. the first implementation slice should prove exact-process/same-source carrier replacement through real control and both outer transports before expanding to assignment replacement and source rebinding. existing retired-generation rejection tests stay intact. no production native gate is enabled by this design note.

[0xcadams]

real-control/PostgreSQL/two-relay race qualification at 18358135 passed: ten publisher/connector carrier-loss cases in 126.28s and live relay-claim renewal in 62.56s (190.475s package time). one target socket survived the original pair deadline, both relay claims advanced by at least 30.031s, and carrier faults did not repeat application admission. this remains direct-socket/local evidence, not deployed proxy-source, reconnection, assignment-replacement, or ICE qualification.

[0xcadams]

pushed signed dff78efe, adding a real-session boundary proof before the carrier-handoff implementation. with both publisher transports and both QUIC/TLS-yamux winner directions, a second transport is held inside its control-claim callback while the installed winner exchanges packets. releasing the late successful claim must reject the duplicate registration, preserve both directions of the winner and its borrowed publisher session, and return to one native reservation.

the control callback is a fixture; outer transports and relay packet registration/cleanup are real. existing retired-generation rejection tests remain unchanged. eight focused race repetitions, the full peer-transport race tier, the full Go race suite, Go lint, formatting, and diff checks passed. an initial test draft incorrectly expected a framed TCP carrier to survive an injected replay; that malformed-stream fence is preserved, and the isolation check uses fresh packet sequences.

reconnect design refinement: distinct carrier IDs are necessary but not sufficient. a late successful QUIC/TCP loser must not publish a newer binding than the selected winner. carrier preparation therefore needs an explicit winner activation/fenced handoff before publisher confirmation, separate from candidate authentication and from live claim renewal. this is not implemented or production-enabled yet.

[0xcadams]

pushed signed b6b55338 for the second share-preparation 503 boundary.

at dff78efe, trace 6ae1279dafe3f9ebce26e43c2905dcc8 shows successful share redemption/signing and a successful publisher-policy transaction after its 40001 retry; the publisher still returned 503. policy fetches overlap in that trace. a deterministic owner test reproduces the local failure: two requests begin with the same installed revision, then one applied delta invalidates the other request cursor.

publisher visitorpolicy now serializes fetch through apply. a queued caller begins from its predecessor’s installed revision; waiting plus fetching uses the same two-second budget. canceled/expired waiters issue no control call and cannot extend the last confirmed lease. control permission rules, one-use credential redemption, application admission, and the lease’s stale/expiry checks are unchanged.

deterministic public-URL/service tests pass, including cancellation, fixed wait budget, and late responses. browser/share preparation is also exercised through browserAccess.prepareToken: one already issued permission is installed without another token-issuance call. routine Go/public API, full Go races, visitor-policy races, lint, formatting, diff checks, and generation verification passed. the separated race share workload passed (131.27s coordinator); browser workload qualification is still running.

the full unsharded integration invocation did not pass: API/state/generated database/certificate/DNS packages passed, but daemon exhausted its 20-minute aggregate budget as the next test began (0s into long-lived HTTP fixture setup). do not count that as a stream deadlock or a full integration pass. use existing runtime shards and separate real-clock targets; focused long-lived HTTP qualification is running now. CI at the new tip is not claimed green. no merge, deployment, live infrastructure change, or deployed benchmark; native production gates remain off.

[0xcadams]

pushed signed cde60284: the default PostgreSQL integration command now composes the existing API group, four state shards, four runtime shards, and the separate lease/workload proofs sequentially. every group retains its existing timeout, tier, selector, and disposable PostgreSQL ownership. explicit RUN values, including ^TestIntegration, retain the original focused multi-package command.

dry-run plans cover default, explicit default-regex, and native focused selectors. a real focused publisher-policy conflict execution, harness races, formatting, and diff checks passed. the newly composed complete default invocation is running now; this is not yet a full integration receipt.

follow-up at b6b55338: separated race browser workload passed (134.90s coordinator), alongside the earlier share pass (131.27s). focused long-lived HTTP passed on both publisher transports (57.32s test; 58.947s package). neither credential redemption nor application admission was retried. CI still has jobs pending; no green-CI claim. native production gates remain disabled. no merge, deployment, live infrastructure change, or deployed benchmark.

[0xcadams]

CI clarification: the b6b55338 Runtime workloads job was canceled by the later push, before public browser/share preparation ran; its aggregate Load tests failure is the cancellation result, not a reproduced preparation failure. the basic runtime and relay-fault coordinators had passed (113.71s and 142.77s) before cancellation. the unchanged cde60284 tip is now left to complete CI and the composed local integration run.

dependency reconciliation is being validated in the separate 0xcadams/coordinated-dependencies worktree, stacked on this branch. it preserves the x/net security floor and Node >=22.18: ten npm updates are under test, but Undici 8/ref-parser 16 are deliberately deferred because they require Node >=22.19. no native production gate or deployed infrastructure setting changed.

[0xcadams]

signed follow-up work is in stacked draft #481 (f8179ad7 absolute policy deadline fence, adea3af9 dependency reconciliation), leaving this branch/tree unchanged for its complete-run receipt.

cde60284 integration CI completed every job except DNS integration; its aggregate failure comes from that one job. TestDNSIntegrationSplitAutomaticRelayCertificates hit the split fixture’s ten-second /ready wait for relay-a-1. the role diagnostics show a live, renewed relay lease but not-ready state; the log does not retain enough certificate-order evidence to classify this as ACME delay versus another preparation failure. a local disposable-Linux DNS reproduction is running. no startup or serving timeout was changed.

Runtime workloads CI and the complete local integration invocation remain pending. #481 passed routine JS/Go, full Go races, browser toolbar, harness races, lint, formatting, package and generation checks; its native packet/renewal integration is still running. production native admission stays disabled. no merge, deployment, DNS update, or deployed benchmark.

[0xcadams]

CI Runtime workloads and the aggregate Load tests now passed at cde60284 (run 40599534894). this confirms the publisher-policy serialization fix through the CI browser/share workload, not just the local fixtures. the only failing integration job remains DNS startup; other integration jobs passed.

the composed local command failed for a different reason: API passed, state shards 1–4 passed (102.116s, 91.230s, 104.948s, 95.953s), then runtime shard 1 completed in 409.017s with TestIntegrationControlRestartPreservesDataPlane failing on the fresh /without-control visitor. subsequent runtime shards/real-clock groups were not reached. focused control-restart runs passed; more bounded repetitions now retain process and stream-allocation deadlines independently. no visitor retry or lease extension was added. local disposable Linux DNS also passed without a budget change. no full-local-integration or all-CI-green claim.

[0xcadams]

pushed signed 61033ba5, diagnostics only. the control-restart test now records non-secret stream-allocation and process-lease deadlines before the outage and on failure; process lease freshness alone is not evidence that both ends still hold current capacity. split fixture startup failures also retain the existing ACME/relay-order and Pebble diagnostics. no serving/startup deadline, assertion, admission, or retry behavior changed.

four additional focused race integration repetitions passed (23.91s, 23.54s, 23.59s, 23.90s), with valid diagnostic queries. routine Go/public API, Go lint, formatting, diff checks, and the disposable Linux DNS target passed. the earlier aggregate-run EOF and CI DNS readiness failure remain unresolved evidence, not erased by these passes.

all four runtime shards plus the two real-clock lease/workload targets are now running sequentially on this unchanged tree. the qualification driver preserves a failure result while continuing to the later independent groups, so a shard failure will not silently leave the remaining coverage unattempted. the public default Task retains its normal fail-fast behavior. current-tip CI is not claimed green; production native gates remain off.

[0xcadams]

current 61033ba5 CI update: DNS integration passed, so the earlier certificate-readiness failure did not reproduce at this tip. Linux routine Go failed on the same exact-deadline publisher-policy assertion already fixed by the separate f8179ad7 commit in stacked #481; that fix is not yet on #470. other jobs remain pending. no all-green claim and no change to the tree running sequential runtime qualification.

[0xcadams]

website reconciliation follow-up: stacked draft tnldotdev/tnl.dev#195 above #194/#193 now publishes native-assembled OpenAPI graphs, aligns publisher browser feedback and telemetry URLs, and synchronizes shared models/vocabulary with an interim pin to native #481 adea3af9. 583 routine website tests, 31 DB tests, real-control boundary, full types/build/lint/generation, and read-only native metric/link/export checks passed locally. native source was not modified by assembly or overlays. this preserves only #179’s publication slice; service-access and final source/cutover reconciliation are still open. no deployment or infrastructure mutation.

[0xcadams]

the sequential race runtime qualification completed successfully on unchanged signed 61033ba5: runtime shards 1–4 passed in 403.190s, 268.292s, 312.452s, and 345.013s; the separate real-clock lease proof passed in 117.601s and workload lifecycle proof in 447.935s. all six independent groups ran once; no admission, credential redemption, timeout, or serving authority was retried or extended. the control-restart test passed inside runtime shard 1 (23.11s), with a valid non-secret allocation/process-deadline snapshot.

this completes the previously unattempted local runtime coverage, not a successful single invocation of the entire composed default at this tip. API and all four state groups passed earlier at cde60284; the earlier composed-run control-outage EOF and DNS readiness failure remain retained and unexplained, not erased by later passes.

current 61033ba5 CI has finished: every reported non-skipped check passed except Go (Linux), which reproduced the exact-deadline policy assertion already fixed separately by f8179ad7 in #481. DNS and Runtime workloads passed at this tip. #481 still has its separate binary manual-Compose failure; neither stack nor final transport matrix is qualified. production native gates remain disabled. no merge, deployment, live infrastructure mutation, release operation, or deployed benchmark.

[0xcadams]

signed/pushed startup-selection slice: #483 at 1fd92f90e8751e6f65b6b7eed3095d9bf307ea20, stacked on #482.

• passed routine Go/public consumer, full Go races, six owning-package race suites, lint, formatting, regeneration, and committed generation verification.
• final disposable-PostgreSQL real-control/two-relay race run passed all ten packet-loss continuity cases and checked claim renewal in 184.322s. one target socket survived the original pair deadline; both relay claims advanced by at least 30.030s.
• activation selects the nonce already authenticated in one signed hello, after joining losing attempts. no extra signature, control call, application admission, or authority extension; the original startup and confirmed claim deadlines both clip the exchange.
• relay hellos stay passive, loser cleanup leaves publisher registration alone, and duplicate activation cannot replace a live registration or reopen a retired delivery generation. protocol fixtures, invalid/bounded reads, fuzz seeds, cancellation/cause/classification checks, overlapping hello selection, and expiry-during-join cases retain these boundaries.

this is not reconnect handoff: active outer-session closure still retires that registration. ICE/direct upgrade, public-ingress cutover, source-proxy qualification, guest serving-tail/metrics, remaining website service-access reconciliation, and final source pins remain open. production native admission remains disabled. no merge, deployment, live infrastructure change, release, or deployed benchmark was run.

#482's binary CI group passed, but its workload proof failed the QUIC revoked-HTTP assertion (workload_transport_integration_test.go:156). that assertion currently conflates HTTP 200 with redirect and omits the service. its log is retained; evidence improvements and reproduction are separate from this activation change. previous control-outage EOF/manual-Compose failures also remain unexplained rather than being erased by later passes.

[0xcadams]

combined source reconciliation is signed/pushed in #485 at 9b7d4b8f7ce91a7ce1132663ffdeaf740b4ae82e, stacked on #483. it includes #470's later 61033ba5 authority/certificate evidence and #484's exact workload-denial evidence, without modifying product behavior or weakening assertions.

on that combined source:

• the disposable-PostgreSQL race invocation task go:test:integration RUN='^TestIntegration(ControlRestartPreservesDataPlane|PeerPackets.*|WorkloadTransportLifecycle)$' passed in 649.373s.
• all ten native packet-loss cases passed (120.76s total); checked relay-claim renewal passed (62.69s). one target socket survived the original pair deadline, and both claims advanced by at least 30.019s.
• control restart passed in 23.60s, with the exact allocation and process-lease snapshot retained before shutdown.
• workload lifecycle passed QUIC in 223.05s and TLS/TCP in 217.62s, including revocation, unrenewed expiry, renewed continuity, and fixed expiry.
• daemon races, routine Go/public API, harness races, lint, formatting, and generation verification passed. routine Go's first attempt had a separate five-second QUIC fixture connection timeout before full-duplex assertions; the unchanged focused contract and subsequent routine run passed. the initial failure remains retained, not diagnosed by those passes.

#484's isolated Linux QUIC workload reproduction also passed in 223.298s. neither it nor the combined proof explains #482's original revoked-HTTP response, the earlier manual-Compose startup failure, or the original control-outage EOF. their evidence and open qualification status remain intact.

latest CI snapshot: #483 has 48 passing checks, one expected skip, and Runtime workloads still running; #485 has 43 passing checks, one expected skip, and runtime shards/workload/load still running. this is not final-matrix completion.

remaining product work includes reconnect handoff (active outer closure still retires its registration), assignment/source/network-change recovery, ICE/direct upgrade, public-ingress cutover, proxy-source qualification, guest serving-tail/metrics, and remaining website service-access/source-pin reconciliation. production native admission remains disabled. nothing merged or deployed; no live infrastructure, release, or deployed benchmark operation occurred.