From aa733ac816eea740a89013da7899c94709f9ac1a Mon Sep 17 00:00:00 2001 From: "@permadeath.com" Date: Wed, 30 Sep 2026 11:32:33 -0400 Subject: [PATCH] fix(infra)!: run the relay with strict sync validation didbot's #commit frames carry the tree nodes MST inversion needs, and its subscribe_repos test checks each commit as a strict relay does. The relay no longer passes --lenient-sync-validation, so it drops an unverifiable commit from any host rather than logging it. Co-Authored-By: Claude Opus 5.5 Change-Id: I89a4b57b44891209a60c4a2854204aa9b5b8f0e1 --- infra/README.md | 5 ++--- infra/files/compose.yml | 4 ---- plan/relay.md | 11 +++++------ 3 files changed, 7 insertions(+), 13 deletions(-) diff --git a/infra/README.md b/infra/README.md index afada543..89ffb91e 100644 --- a/infra/README.md +++ b/infra/README.md @@ -250,9 +250,8 @@ one that binds. off the stream, which makes it the one thing two indexes could disagree about; see `plan/clustering.md`. -**The relay runs lenient.** MST inversion fails on commits didbot currently -produces, and strict validation would drop them rather than log them. Tracked -in `plan/relay.md`; turn `--lenient-sync-validation` off once that is fixed. +**The relay validates strictly.** A commit whose ops do not invert to the +previous tree is dropped rather than logged, from every host it crawls. ## Nothing is indexed until somebody asks diff --git a/infra/files/compose.yml b/infra/files/compose.yml index 299dec94..1a0b91a1 100644 --- a/infra/files/compose.yml +++ b/infra/files/compose.yml @@ -59,10 +59,6 @@ services: - --trusted-domains=${RELAY_TRUSTED_DOMAINS} - --default-account-limit=${RELAY_DEFAULT_ACCOUNT_LIMIT} - --new-hosts-per-day-limit=${RELAY_NEW_HOSTS_PER_DAY} - # Lenient while didbot's commit proofs are still short of what Sync 1.1 - # wants: strict mode drops those commits rather than logging them. - # See plan/relay.md. - - --lenient-sync-validation jetstream: image: ${REGISTRY}/vibescrobble/jetstream:${JETSTREAM_REF} diff --git a/plan/relay.md b/plan/relay.md index fc024b04..a18c010d 100644 --- a/plan/relay.md +++ b/plan/relay.md @@ -61,17 +61,16 @@ software has been tuned for, which is what the first two items are about. whole pipeline locally on a private CA and a made-up zone; none of it is reachable by anybody else, and the certificate story is the part that does not survive contact with a real deployment. -- [ ] **Strict validation is coming, and one check already fails.** MST - inversion failed on every non-first commit — the CAR slice in a - `#commit` frame does not carry the MST blocks its `data` root names. - Lenient mode logs it; strict mode drops the commit. Signatures verify - cleanly, so this is the one gap. didbot's to close, with a deadline set - by somebody else. - [ ] **Deploy it.** One relay, one Jetstream, and a story for what a consumer sees while either is restarting. ## Done +- [x] **Validate sync strictly.** The relay runs without + `--lenient-sync-validation`. didbot's `#commit` frames carry the tree + nodes MST inversion needs, and its `crates/didbot/tests/subscribe_repos.rs` + checks every commit off the socket as a strict relay does. + - [x] **Raise the account limit deliberately.** `relay_trusted_domains` in `infra/variables.tf` lists the hosts the relay takes every account from. Any other host is held to `relay_default_account_limit`, and -- knotmirror 0.0.1