[0xcadams]

What

Let an opt-in native service connection start over its prepared relays and upgrade to direct UDP without replacing its inner QUIC connection, application streams, or target sockets.

Stacked on #486. This adds the first ICE negotiation to the retained native session. ICE restart, assignment/source recovery, and deployed proxy-source qualification remain prerequisites for enabling native delivery in production.

Why

The packet endpoint can already switch carriers, but the publisher and connector did not negotiate or install a real ICE path. Waiting for connectivity checks at application arrival would delay usable relay delivery. A separate UDP socket would also discover a mapping different from the socket used for relay QUIC.

Changes

• Share each publisher run's socket across its relay QUIC connections and peer agents. Each connector likewise uses its existing shared socket for ICE.
• Exchange bounded ICE credentials and IP-only UDP candidates on dedicated inner-QUIC unidirectional streams, bound to the exact prepared pair and delivery. Application permission and relay-attested source stay with their existing owners.
• Run gathering and consent in joined background work. Install direct delivery only after ICE succeeds, then require the endpoint's fresh MAC probes before selection. Consent loss removes the direct carrier and retains relay delivery.
• Interrupt partial signaling on cancellation, reject mismatched bindings and trailing data, and retain causes in typed connectivity errors.
• Exercise relay-first traffic, direct upgrade, fallback, and a persistent target counter with real ICE. Verify an existing relay QUIC connection on the same socket remains usable after peer cleanup.
• Qualify the default publisher dialer and TLS/TCP publisher delivery against real control. Keep the existing relay-loss matrix explicitly relay-only, and fix its UDP fault fixture to retain a separate bounded mapping for each sender.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T03:29:35.192611Z	3473c05	New commits
🔒 Security Review	✅ Completed 2026-10-28T03:34:15.114972Z	3473c05	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[0xcadams]

Local qualification on signed commit f6e2ec02: full routine Go race suite, public Go consumer, Go vet/staticcheck, formatting, and generation comparison passed. The focused connectivity/wire race cases cover invalid bindings, candidate restrictions, framing bounds/truncation, partial-signal cancellation, real ICE upgrade/fallback, and a persistent outer QUIC stream sharing the physical socket. The real-control TestIntegrationPeerPackets matrix passed under race in 224.233s: ten relay-loss combinations, renewal past the original authority deadline, both-carrier reconnect, and direct upgrade with default QUIC and TLS/TCP publishers. The default-dialer failure was traced to the test UDP proxy mixing senders; the corrected per-sender mapping passed both the direct cases and the existing relay-only matrix. Production native admission remains gated; ICE restart and assignment/source recovery are still being completed.

[0xcadams]

Follow-up 3473c05b keeps distinct SDK-options, migration, and migration-query stages and validated child exit metadata; raw subprocess output remains hidden because it can contain application credentials. JS type/lint/format checks passed. The instrumented boundary passed on macOS (51.768s) and in the digest-pinned Linux runner (57.291s, Go 1.27.3 / Node 22.23.2). Neither run reproduced or explains the original public-case failure in job 122604033975. The diagnostics are now committed so any recurrence has a precise stage and exit status.

[0xcadams]

CI on 3473c05b completed with every non-skipped check passing, including Binary (connections), Go race, all PostgreSQL shards, and runtime workloads. This establishes the current-head result; the earlier Drizzle failure still has no reproduced root cause.

[0xcadams]

superseded by the replacement cutover tracked in #499 (replacement stack #491). closing this original PR at the author's request so only the replacement review remains active. the original branch, commits, reviews and failure evidence are preserved; no branch is deleted. outstanding integration and validation remain tracked in the replacement, not waived by this closure.