xeiaso.net / ircd.rs
Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

docs(memory): record P11 slice 130 (msgid S2S), netburst-join fix, handshake diagnostics

- s2s-notify-propagation: slice 130 (msgid) DONE; 128/129 went elsewhere.
- live-join-njoin: burst NJOINs now announce JOIN+MODE to local members (fix).
- new: channel-merge-works (split-merge verified, couldn't repro the report on HEAD;
two-node port-lock is process-local), link-version-021-staleness (recurring prep).

author
Xe Iaso date (Jun 12, 2026, 8:42 PM -0400) commit 9ae723d2 parent 04dc97cc
+120 -13
+6 -1
docs/claude-memory/README.md
··· 48 48 - [hunt_server proptest hazard](leveva-hunt-server-proptest-hazard.md) — VERSION/TIME/ADMIN/INFO/USERS/MOTD/STATS/LINKS/TRACE 402 on an unknown hunt <target>; proptests feeding arbitrary args to them must model matches(target,SERVER)→local-else-402 or they fail stochastically (slice 113 fixed five stale ones) 49 49 - [leveva UTF-8-only parse boundary](leveva-utf8-only-parse-boundary.md) — UTF-8-only enforced at Message::parse_bytes (the single byte→Message gate), not the framing layer; never add a lossy client byte path (P11 slice 120) 50 50 - [leveva LINELEN=2048 graphemes](leveva-linelen-2048-graphemes.md) — non-tag lines up to 2048 graphemes (not 512 bytes); cap lives in to_wire, framer ceiling = tags+LINELEN*64, chunkers/S2S stay byte-conservative (P11 slice 121) 51 - - [leveva S2S notify propagation](leveva-s2s-notify-propagation.md) — the P11 area closing IRCv3 "single-server-local" divergences; AWAY (122) + INVITE (123) + MONITOR-live (124) + REDACT (125) + capability-foundation (126) done; 127=REDACT→ENCAP done; msgid-gated-tag renumbered to 129 (slice 128 went to outgoing auto-connect) 51 + - [leveva S2S notify propagation](leveva-s2s-notify-propagation.md) — the P11 area closing IRCv3 "single-server-local" divergences; AWAY (122)+INVITE (123)+MONITOR-live (124)+REDACT (125)+capability-foundation (126)+REDACT→ENCAP (127)+msgid (130) done; 128/129 went elsewhere; server-time/bot/oper/account remote-msg tags remain 52 52 - [leveva outgoing auto-connect](leveva-outgoing-autoconnect.md) — P11 slice 128: the try_connections counterpart; pure autoconnect::AutoConnect::due (master + autoconnect + connect-freq cooldown ladder) + main.rs ticker reusing the CONNECT outbound-link plane 53 53 - [leveva S2S peer caps](leveva-s2s-peer-caps.md) — S2S capability negotiation (slice 126): the CAPAB-via-ENCAP burst verb + egress tag-filter; how to gate any IRCv3 tag per-peer; bare-unknown-verb-SQUITs-the-oracle lesson (extension verbs MUST ride ENCAP) 54 54 - [leveva live-join NJOIN](leveva-live-join-njoin.md) — P11 slice 129: live joins propagate as `:<sid> NJOIN` (op in member token), NOT `:<uid> JOIN` (the oracle drops bare server JOIN); inbound handle_njoin is burst-vs-live aware; fixed UIDs-not-nicks + chanop-not-synced interop bug; msgid follow-on now slice 130 55 + - [leveva msgid S2S propagation](leveva-s2s-notify-propagation.md#slice-130) — P11 slice 130: the message-ids `@msgid` server tag is network-stable (introducing server mints, relay carries it through + never re-mints), gated on slice-126 CAPAB egress; see the s2s-notify-propagation memory 56 + - [leveva netburst joins broadcast to clients](leveva-live-join-njoin.md) — FIX 2026-06-13: handle_njoin now fans JOIN+MODE to local members during the BURST too (newly-added only), not just live — a healed split shows the netjoin flood instead of silent merge 57 + - [leveva channel-merge works](leveva-channel-merge-works.md) — split-then-merge of two independent same-name channels preserves both members + op on HEAD; couldn't repro "remote member missing" post-129; two-node port-lock is process-local (use unique ports per test binary) 58 + - [leveva LINK_VERSION 021- staleness](leveva-link-version-021-staleness.md) — recurring pre-existing red: PASS-greeting tests/snapshots go stale vs server::LINK_VERSION (021- prefix); fix as a separate prep commit, git-stash to confirm pre-existing 59 + - [leveva S2S handshake diagnostics](leveva-link-version-021-staleness.md) — read_link_handshake now surfaces a peer's ERROR refusal + EOF/port hints + a 30s idle timeout (was a blind "did not complete"); a connect{} to a client port like 6667 is the classic cause
+38
docs/claude-memory/leveva-channel-merge-works.md
··· 1 + --- 2 + name: leveva-channel-merge-works 3 + description: "Investigation finding — leveva split-then-merge of two independently-created same-name channels preserves BOTH members and their op on current HEAD; the user's \"remote member doesn't show up\" report could not be reproduced post-slice-129" 4 + metadata: 5 + node_type: memory 6 + type: project 7 + originSessionId: dffd0a98-08f0-4e3b-af02-71f5ec03a7bf 8 + --- 9 + 10 + 2026-06-12: the user reported that when two servers each independently create `#foo` 11 + (Xe chop on server 1, Zoe chop on server 2) **while split**, then link, the remote member 12 + (Zoe) doesn't show up in NAMES on the other side. 13 + 14 + **Could NOT reproduce on current HEAD** (master, includes slice 129's live-join NJOIN fix). 15 + Booted two real `leveva` nodes on **isolated** ports and verified every variant works: 16 + split-then-link (with/without `+R *!*@*` on one or both sides) AND link-first-then-live-join 17 + all end with both nodes showing `@Xe @Zoe` — **both members visible, both ops preserved**. 18 + 19 + Mechanism confirmed correct: `s2s/burst.rs` emits `:<sid> NJOIN <chan> :<@uid,…>` for every 20 + channel (member op encoded via `MemberPrefix::from(status).encode(uid)`), and inbound 21 + `s2s/njoin.rs::handle_njoin` merges into an existing local channel by UID via 22 + `Channels::njoin_member` (insert-if-absent; existing members untouched). No deop, no drop. 23 + 24 + The user's `ServerMode/#xe [+o Xe] by <SID>` line is **normal auto-reop** (the `+R *!*@*` 25 + mask matched Xe → server re-ops her) — I saw the identical `:<sid> MODE #foo +o Xe` in my 26 + runs. Not a bug. 27 + 28 + **Most likely cause:** the user's build PREDATED slice 129 (the live-join NJOIN / 29 + chanop-not-synchronized fix landed today, 2026-06-12). User said "commit what you have" and 30 + to keep going. If it recurs on a confirmed-current build, the untested angles are: a real 31 + SQUIT→rejoin netsplit cycle, >2 servers / multi-hop, or differing channel-name case. 32 + 33 + **Test-harness gotcha that bit me first:** `acquire_port_lock()` in the two-node harness is a 34 + **process-local** static Mutex, so it does NOT serialize across separate test BINARIES. 35 + `integration_two_node` and any new test that reuse ports 16710/16720 can collide when cargo 36 + runs test binaries in parallel → stale/cross-wired daemons produce garbage NAMES. Use 37 + **dedicated unique ports + fixtures** for any new two-node boot test. Related: 38 + [[leveva-live-join-njoin]], [[leveva-native-oracle-harness]].
+13 -4
docs/claude-memory/leveva-live-join-njoin.md
··· 22 22 **How it's wired now:** 23 23 - Outbound: `s2s/relay.rs::local_join` emits the NJOIN form, prefix from 24 24 `channels.member_status`. `&` channels are server-local → never propagated. 25 - - Inbound: `s2s/njoin.rs::handle_njoin` is burst-vs-live aware (`link.bursting`): burst = 26 - silent merge; live = client-form JOIN + synthetic `+o`/`+v` MODE to local members + 27 - split-horizon onward-relay. `relay::inbound_join` (`:<uid> JOIN`) stays as a tolerant 28 - fallback but nothing emits that form anymore. 25 + - Inbound: `s2s/njoin.rs::handle_njoin` announces **every newly-added member** (gated on 26 + `njoin_member`'s newly-added bool — a re-burst of an existing member is silent) to local 27 + co-members as a client-form JOIN + synthetic `+o`/`+v` MODE, **during the burst AND live**. 28 + Only the **onward-relay** to other peers is live-only (`!link.bursting`). `relay::inbound_join` 29 + (`:<uid> JOIN`) stays as a tolerant fallback but nothing emits that form anymore. 30 + 31 + **UPDATE (2026-06-13, maintainer-reported):** burst joins used to be a **silent** merge 32 + (`if live { announce }`), so a local client already in `#foo` never saw the netjoined remote 33 + members JOIN when a split healed — they only showed up in a later `NAMES`. Fixed: the JOIN + 34 + MODE fan-out now runs during the burst too (the netjoin flood real IRC shows). `fanout_local` 35 + only reaches local members, so a channel the server has no clients in stays a silent no-op. 36 + See [[leveva-channel-merge-works]] for the (separately-confirmed-working) split-merge of two 37 + independently-created same-name channels. 29 38 30 39 **Why:** never re-introduce a bare `:<uid> JOIN` relay — a faithful IRCnet peer drops it. 31 40 Any new join-like S2S relay must ride NJOIN (or ENCAP for extensions, cf.
+30 -8
docs/claude-memory/leveva-s2s-notify-propagation.md
··· 1 1 --- 2 2 name: leveva-s2s-notify-propagation 3 - description: "leveva P11 — the S2S-notify-propagation parity area (closing the IRCv3 \"single-server-local\" divergences); AWAY (122) + INVITE (123) + MONITOR live (124) + REDACT (125) + S2S-capability-foundation (126) + REDACT→ENCAP (127) done; slice 128 went to a DIFFERENT area (outgoing auto-connect, see [[leveva-outgoing-autoconnect]]); msgid-gated-tag is next, now slice 129" 3 + description: "leveva P11 — the S2S-notify-propagation parity area (closing the IRCv3 \"single-server-local\" divergences); AWAY (122) + INVITE (123) + MONITOR live (124) + REDACT (125) + S2S-capability-foundation (126) + REDACT→ENCAP (127) + msgid (130) done; slices 128/129 went elsewhere (auto-connect / live-join NJOIN); server-time/bot/oper/account remote-message tags are the remaining follow-ons" 4 4 metadata: 5 5 node_type: memory 6 6 type: project ··· 117 117 a bare REDACT server command on the wire). (AWAY 122 + INVITE 123 stay first-class — REAL 118 118 IRCnet verbs the oracle relays.) 119 119 120 - **NOTE:** slice 128 was claimed by **outgoing auto-connect** (a different area — see 121 - [[leveva-outgoing-autoconnect]]), so this backlog renumbers: msgid is now **slice 129**. 120 + **NOTE:** slice 128 went to **outgoing auto-connect** ([[leveva-outgoing-autoconnect]]) 121 + and slice 129 went to **live-join NJOIN propagation** ([[leveva-live-join-njoin]]), so 122 + msgid landed as **slice 130** (not 129). 122 123 123 - **Remaining (the area's backlog), now sequenced as slices:** 124 - - **129 = msgid S2S propagation** — carry the originating server's `@msgid` across S2S 125 - as a **capability-gated tag** (user chose network-wide-same-id over per-server mint), 126 - built on the slice-126 egress gate. Then `server-time`/`bot`/`oper`/`account` tags on 127 - remote messages are further follow-ons (each its own slice). 124 + **Slice 130 DONE — msgid S2S propagation.** The IRCv3 message-ids `@msgid` tag was 125 + single-server-local (slice 66 stamped it only for LOCAL recipients). Now it is 126 + network-stable: the **introducing** server mints one id per message event (the existing 127 + per-target `msgid_cell`) and carries the SAME id on the S2S wire; a **relaying** server 128 + carries the inbound `@msgid` through to its local `message-tags` clients and onward-relays 129 + verbatim, **NEVER re-minting** (the spec's introducing-server-assigns model — an absent or 130 + ill-formed (`!msgid::is_valid`) inbound id is delivered without one, avoiding two ids for 131 + one event). Mechanism: `relay_wire()` gained a `msgid: Option<&str>` that prepends a 132 + `msgid` SERVER tag ahead of the client-only (`+`) tags (wire order `@msgid;+client`); 133 + `local_channel_message`/`route_message_to_remote`/`local_tagmsg`/`route_tagmsg_to_remote` 134 + took a `msgid` arg, fed the shared cell by `command/message`+`command/tagmsg` **only when 135 + `!ctx.peers.is_empty()`**; `inbound_message`/`inbound_tagmsg` read+validate `@msgid` and 136 + deliver it to local cap recipients. **Gated on slice 126's CAPAB egress** — the msgid is a 137 + server tag, byte-stripped (with the `+` tags) for a tag-blind peer. leveva-native (no 138 + oracle differential). Gate = relay/message/tagmsg units incl. the **per-event network 139 + invariant** (local consumer's id == the id on the wire) + inverses (no inbound id ⇒ none 140 + minted; ill-formed dropped; non-cap member never sees one; egress strips for a tag-blind 141 + peer) + `golden_s2s_msgid` (both directions, exact id propagated inbound; `canonicalize` 142 + already masks `msgid=` → `<MSGID>`) + `msgid_s2s_proptest` (propagate-iff-valid / egress / 143 + panic-freedom). PREP commit first: fixed pre-existing v0.0.2-bump `LINK_VERSION` (`021-` 144 + prefix) staleness in one handshake unit + 3 S2S golden snapshots (`cargo test -p leveva` 145 + was red on HEAD) — see [[leveva-link-version-021-staleness]]. 146 + 147 + **Remaining (the area's backlog):** 148 + - `server-time`/`bot`/`oper`/`account` tags on remote messages — further follow-ons 149 + (each its own slice), now that the msgid+CAPAB egress plumbing exists. 128 150 - `certfp` live post-burst (78) — relay deferred. 129 151 130 152 **Pattern for the next one:** clone the `s2s/setname.rs`/`s2s/away.rs` shape —