Repository navigation
design(id): #2036 messaging/relay protocol v1 - #3833
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 58 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4c3b9dbf9e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | **Chained / durable** | Identity, membership, documents, money, durable chat, match results, session checkpoints | Origin signs each fact; event sequence/backlink and causal frontier provide graph order. Receivers verify the signed envelope and group membership at send time. | Retained as ordinary event-graph entries; durable facts are never moved to checkpoint-only signing. | Any peer can catch up from another member by range sync. Arrival may be out of order; graph dependencies determine application. | | ||
| | **Ephemeral / live** | Keystrokes, cursors, presence, live input, live-session chat | One signed session header binds session ID, purpose, participants and key commitment; frames carry per-session sequence numbers and MACs; signed segment checkpoints bind ordered deltas to state roots. | Live frames stay out of the durable graph and are not queued for offline members. A checkpoint is a normal signed graph event. Initial default: checkpoint every 256 events or 2 seconds, whichever comes first, and at explicit commit/blur/end; make limits configurable in the `WorldLimits` style. | Rebuild from the latest checkpoint plus the live frames since it. A disconnected live stream may lose its uncheckpointed tail; this is acceptable only for non-dispute-grade state. | | ||
|
|
||
| The checkpoint commits to the session, monotonic segment number, immediate previous checkpoint, ordered segment root, event count and time bounds. Frames must bind their session ID, sequence and payload under the session MAC. The 256-event/2-second values are defaults from the latest issue triage, not magic protocol constants. The existing `WorldLimits` pattern supports bounded runtime-configurable limits (`pkgs/id/src/world/mod.rs:57-100`). The investigation's threat analysis makes the guarantee explicit: a checkpoint attests to a signer-committed segment; it does not prove the exact time of each frame or that every recipient saw the same intermediate stream (`doc/2026-10-29T10-45-00Z_investigation_ephemeral_live_data_retention/2026-10-29T10-45-00Z_investigation_ephemeral_live_data_retention.md:84-99, 110-118`). |
There was a problem hiding this comment.
For a late or reconnecting participant that missed already-checkpointed frames, these checkpoint fields provide only commitments and metadata, not the state needed to satisfy §3's promise to rebuild from the latest checkpoint plus subsequent frames. A segment hash cannot reconstruct discarded deltas, and §4.6 permits expired audit blobs to disappear. Require recovery checkpoints to bind to retrievable state snapshots and retain those snapshots for the recovery lifetime (as contemplated in investigation #2034, §6); otherwise an implementation following this contract can lose checkpointed document/game state, not just the explicitly expendable live tail.
Useful? React with 👍 / 👎.
Summary
Add
doc/2026-11-01_design_id2036.md, a decision-ready synthesis of the #2034/#2035 inputs and latest #2036 triage.The note defines options, trade-offs, trust/retention invariants, acceptance criteria, and four independently mergeable implementation phases. It also makes validation-before-forwarding a hard gate: stock iroh-gossip's eager propagation cannot be made safe by post-receive validation alone.
Evidence
git diff --cached --checkpassed; this is docs-only, so implementation tests were not run.Merge Danger
Door: two-way — documentation only; implementation behavior is unchanged.
Blast Radius: narrow
Need help on this PR? Tag
@codesmith-botwith what you need.