Repository navigation
id: investigate: multi-hop relay and P2P media paths — bridging peers, optional privacy relay, large-message chunking #2035
Description
LIST 9b. Nothing in ID's design should prevent future P2P text, voice (Ventrilo/Discord-like), video calls, or screen sharing — and traffic should NOT all hairpin through a central server; a relay exists only as an optional privacy proxy. Investigate multi-hop fan-out: in a group of four plus a fifth reachable only through one member, each sender reaches the peers they can see (multicast-equivalent = send to each) and the bridging member relays onward in the same manner; proxies are noted in the chain, validity rests on signatures/trust, ordering is mostly safe because messages chain by previous messages, and proxy latency matters for time-sensitive games. Also: very large messages and chunking — is wire-level chunking even needed when QUIC/Iroh streams handle breakup? Deliverable: relay model + chunking verdict.
Program: Drew's 2026-10-28 directive (full text: hatch-personal memory/topics/id-program-2026-10-28.md).
Working pattern: parallel investigations, then the named synthesis issue merges them into a full design. Route guidance: Workhorse by default; Specialist/Summit for synthesis and ramification-heavy work. A result that says "done" is not the endpoint — the orchestrator reviews it and may commission another round. Deliverables: a markdown design/investigation doc (mermaid/SVG diagrams welcome) linked from this issue, plus follow-up issues for anything buildable. Build a proof of concept where the design calls for one, but do NOT build the permanent feature on top of an unreviewed PoC.
Activity
developing-today commentedon Oct 29, 2026
CODE-956
dezren39 commentedon Oct 29, 2026
Parent epic: #2056 — ID platform expansion (2026-10-28 directive).
dezren39 commentedon Oct 29, 2026
Top priority — ID program wave-1. Drew directed this be picked up in the next runs (2026-10-29): enqueued directly as triage task 3349 in repo-health-code-pilot at queue priority 20 (only breakage-class work at priority 10 outranks it). Wave-1 is the ungated investigations and designs; syntheses and PoCs stay gated on their named inputs. Investigation route: Workhorse.
dezren39 commentedon Oct 29, 2026
🤖 Agent note · picked up
dezren39 commentedon Oct 29, 2026
🤖 Agent note · parked
triagedand strip the queue/work/status labels.Investigation result — relay model + chunking verdict
Full doc: PR #2246 →
doc/2026-10-29T11-05-00Z_investigation_multi_hop_relay_and_p2p_media/(377 lines, grounded inpkgs/idsource on current main).Three "relays" separated. (a) Iroh infra relay (n0 default, relay kit) = per-connection NAT fallback — exists, not this issue. (b) Bridging peer = the actual gap: today a message reaches only peers its sender can connect to; nothing forwards to a member reachable only through another member. (c) Privacy relay = opt-in hairpin mode only, never the default path.
Relay model. Sender fans out to visible neighbours (multicast-equivalent = send to each); any member bridges onward in the same manner, excluding the arrival neighbour. Adopt iroh-gossip (already a dependency; HyParView + PlumTree epidemic broadcast trees) as the fan-out substrate, with ID's group membership, origin signing, and prev-hash chaining as the layer on top — gossip today is used only for peer discovery (
commands/peers.rs). Validity rests on the origin signature alone; relays append self-signed hop records used for audit, loop prevention, and a hop cap (4; media ≤1) — a relay can delay/withhold (availability; healed by duplicate paths + existing pairwise range sync) but cannot forge or alter. Ordering needs no new machinery: chained messages name predecessors, so multi-hop arrival order is safe, as the event graph already assumes. Bridges relay only group traffic that passes their own ingest, subject to the per-ID budgets from #2032/#2033.Media. Direct mesh over QUIC datagrams for small groups; when a participant is reachable only via a bridge, the bridge is a selective forwarder of group-key-encrypted packets (routes ciphertext + metadata, SFU trust position, on a member's machine instead of a central server). Central hairpin exists only in privacy-relay mode, at a stated latency/bandwidth cost.
Chunking verdict: no new wire-level chunking protocol. QUIC streams already segment, retransmit, and reassemble — Iroh/QUIC handles the breakup. Two real size problems remain, both with in-repo answers: objects over ID's 1 MiB frame cap (
frames.rs:20MAX_FRAME_BYTES) that must travel as messages reuse the existing MLS-welcome checked chunk split/join (encryption/welcome.rs); genuinely large payloads don't travel in messages at all — the message carries a BLAKE3blob_refand the payload moves via iroh-blobs (verified streaming in 16 KiB chunk groups, range requests, resume, pull-through-bridge). Datagram-sized packetisation (RFC 9221, ~1200 B) belongs to the media codec layer only.Routing (same pass). Synthesis #2036 noted — it stays gated until #2034 also lands. Follow-up PoC filed: #2249 (five-node bridge PoC), explicitly gated on #2036's review so the PoC doesn't make the protocol's decisions. No code changed; nothing here presents a PoC as the permanent feature.
30 remaining items
dezren39 commentedon Oct 29, 2026
parked · worker
repo-worker-code· laneA· queue task 3349PR #2246: head checks green on
465729f3, all 4 Codex P2 threads dispositioned as fixed in that commit. The PR sits at merge-queue position 1, state AWAITING_CHECKS (re-enqueued 2026-10-29T12:33Z); queue checks did not start during a full 5-minute poll — runner backlog, not a code problem. Re-parked 20 minutes per the park-don't-wait rule (§5).Resume condition: if #2246 is merged, complete task 3349 as triaged; if the merge queue rejects it, read the rejection reason and fix.
dezren39 commentedon Oct 29, 2026
🤖 Agent note · picked up
dezren39 commentedon Oct 29, 2026
🤖 Agent note · parked
gh pr view 2246— if MERGED, complete task 3349 as triaged (merge_sha from the PR) and strip all status/, queue/, work/* labels from id: investigate: multi-hop relay and P2P media paths — bridging peers, optional privacy relay, large-message chunking #2035. If ejected from the queue again, read the reason fresh; head state was CLEAN/MERGEABLE with green checks and clean Codex at re-enqueue.dezren39 commentedon Oct 29, 2026
Investigation result — multi-hop relay and P2P media paths
Doc:
doc/2026-10-29T11-05-00Z_investigation_multi_hop_relay_and_p2p_media/2026-10-29T11-05-00Z_investigation_multi_hop_relay_and_p2p_media.md(PR #2246, in themainmerge queue; docs-only, no code touched).1. Three "relays" separated. Iroh infrastructure relay (exists, NAT fallback only), bridging peer (the actual gap — not implemented), privacy relay (opt-in hairpin, never a default path).
2. Relay model. Sender fans out to the peers it can see; any member bridges onward the same way. Adopt iroh-gossip (already a dependency — HyParView/PlumTree broadcast trees) as the fan-out substrate, with ID's signing/membership/chaining as the layer above. Validity rests on the origin signature; the hop chain is audit + loop control (hop cap 4; media ≤ 1 bridge hop) and is never a trust input. Ordering comes from prev-hash chaining, which the event graph already assumes.
3. Media. Direct QUIC-datagram mesh for small groups; when a participant is reachable only through one member, that member is a selective forwarder of encrypted packets (it cannot read them). Central hairpin only in privacy-relay mode.
4. Chunking verdict — no new wire-level chunking protocol. QUIC streams already segment/reassemble. Over-cap framed objects reuse the existing MLS-welcome checked chunking (
encryption/welcome.rs); large payloads travel as blob references via iroh-blobs (verified streaming, range/resume, pull-through-bridge). Datagram packetisation stays in the media layer (RFC 9221).Routing. PoC follow-up: #2249 (five-node bridge relay over iroh-gossip). Gated synthesis: #2036 (ID messaging/relay protocol v1), which also consumes #2034. Nothing here is presented as the permanent feature — the PoC is explicitly a PoC and the synthesis owns the design decision.
Open questions handed to the synthesis are listed in §5 of the doc (path-quality signals, hop-cap tuning per message class, bridging-peer capacity accounting, and the privacy-relay threat model).
done · worker
repo-worker-code· laneopenchamber-scheduled-lane· queue task 3349Investigation recorded (doc in PR #2246), follow-ups routed (#2249 PoC, #2036 synthesis). PR #2246 head
465729f3: checks green, all 4 Codex P2 threads resolved,MERGEABLE/CLEAN, sitting at merge-queue position 4 — themainmerge queue has not drained since 2026-10-29T10:57Z (repo-wide runner backlog), which is why earlier shifts kept re-parking. No content work remains on this issue.