Skip to content

fix(net,swarm): relays without an external address refuse reservations; sticky Public; reviewer standing (v0.3.60) - #354

Merged
ralyodio merged 4 commits into
masterfrom
fix/relay-autonat-reputation
Nov 12, 2026
Merged

ralyodio merged 4 commits into
masterfrom
fix/relay-autonat-reputation

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator

Follow-ups to #348, from what the live rollout showed.

  • Relay server: a reservation rate limiter gated on a confirmed external address. Nodes behind NAT/Docker were granting empty reservations; clients then failed with NoAddressesInReservation (seen on vienna from dev2's docker nodes).
  • Relay client: 6 h backoff (was 10 min) for a relay that answered with no addresses.
  • AutoNAT: Public stays sticky for 30 min. On vienna one probe server that couldn't dial back flipped the node Public→Private and it reserved relays it didn't need. A node with C0MPUTE_P2P_EXTERNAL is always public.
  • Agent swarms: peer endorsements make a bounty payable only from reviewers with standing (someone else published task.paid for them). Owner accept is unchanged. DIP 0034 updated.

Real-NAT check (bonita, home router, 0.3.58): reservation accepted on a public relay, peers reached it relayed, DCUtR hole punch succeeded for 5+ peers.

Tests (vienna): c0mpute-net 20 passed (2 new + relay e2e), agent_swarm 15 passed (1 new), agent_swarm_e2e passed, CLI builds.

🤖 Generated with Claude Code

…s; sticky Public; reviewer standing (v0.3.59)

- relay server: a reservation rate limiter gated on a confirmed external
  address, so nodes behind NAT/Docker stop granting empty reservations
  (clients failed with NoAddressesInReservation)
- relay client: 6 h backoff for a relay that answered with no addresses
- AutoNAT: Public is sticky for 30 min (one probe server that cannot dial
  back flipped public nodes to Private); C0MPUTE_P2P_EXTERNAL = always public
- agent swarms: peer endorsements make a bounty payable only from reviewers
  with standing (someone else paid them before)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

16 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 11 | LOW: 4

Severity Rule Location
HIGH js-ssrf-outbound-request apps/web/public/sw.js:24
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:109
MEDIUM sql-template-interpolation apps/web/src/lib/chat/convo-store.ts:116
MEDIUM sql-template-interpolation apps/web/src/lib/chat/convo-store.ts:117
MEDIUM sql-template-interpolation apps/web/src/lib/chat/push.ts:476
MEDIUM sh-remote-script-execution scripts/dev-setup.sh:25
MEDIUM sh-eval-expansion scripts/dev-setup.sh:35
MEDIUM sh-remote-script-execution scripts/install.sh:185
MEDIUM sh-remote-script-execution scripts/install.sh:210
MEDIUM sh-remote-script-execution scripts/install.sh:408
MEDIUM sh-remote-script-execution scripts/install.sh:450
LOW py-ssrf-outbound-request examples/business-strategist-agent/chat.py:37
LOW py-ssrf-outbound-request examples/business-strategist-agent/train.py:54
LOW secret-generic-credential node/crates/c0mpute-core/src/webhook.rs:1171
LOW py-path-traversal node/crates/c0mpute-core/tests/fixtures/fake-infernet-text:29

Snippets are redacted; ThreatCrush never prints matched credential material.

ralyodio and others added 2 commits November 12, 2026 09:21
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio ralyodio changed the title fix(net,swarm): relays without an external address refuse reservations; sticky Public; reviewer standing (v0.3.59) fix(net,swarm): relays without an external address refuse reservations; sticky Public; reviewer standing (v0.3.60) Nov 12, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 3245198 into master Nov 12, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant