Repository navigation
docs(id): bridge semantics investigation — hosted (HTTPS/WS) ↔ native (Iroh) seam (#2058) - #2277
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 24 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5b73587fee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - **Arrival order is not semantics.** Two stores that received the same event | ||
| set in different orders converge to the same applied set and the same live | ||
| claims (the two folds in `tag_claims.rs` — reference and compacted — already | ||
| prove order-independence of the fold for one store; the bridge adds no new |
There was a problem hiding this comment.
When an event above an author's fork point arrives before the fork proof, the native store retains it as voided/present; when it arrives afterward, decide_in refuses it as Frozen. Consequently, another author's event referencing that hash can resolve differently across delivery orders. This limitation is explicitly documented in pkgs/id/src/event_store/ingest.rs:76–81, and tests/event_store_properties.rs:159–162 excludes those dependencies from its convergence scenarios. The unconditional convergence claim therefore does not follow from reusing native ingest unchanged. Document this limitation and route its resolution or constrain the downstream replay/convergence acceptance criteria accordingly.
Useful? React with 👍 / 👎.
| hibernation wake, or a dropped socket resumes from the last acknowledged | ||
| per-author positions (the same `(author, seq)` positions the store already | ||
| tracks) instead of restarting the method negotiation. Positions are already | ||
| the store's own bookkeeping, so this adds no new state — only carrying them | ||
| in the resume frame. |
There was a problem hiding this comment.
For a proof-carrying range session, (author, seq) does not uniquely identify acknowledged progress: pkgs/id/src/event_store/sync.rs:223–247 includes both conflicting headers, and range keys are author || seq || id. If a socket drops after one header at a fork position is acknowledged but before its rival arrives, advancing past that position on resume skips the evidence needed to detect the fork. Specify a method-aware checkpoint or an explicitly inclusive retry/reconciliation strategy rather than asserting that existing per-author positions alone suffice; the same ambiguity affects the replay cursor prescribed in §5.
Useful? React with 👍 / 👎.
| - **The journal is the event set.** Replay = ingest the signed events into an | ||
| empty store under the normal rules (per-author contiguity, waiting caps, | ||
| fork proofs, resolve). There is no second journal format for the hosted |
There was a problem hiding this comment.
For journals containing group creation or membership changes, replaying the signed event set through ingest_batch does not reconstruct membership: Event::bytes contains only the header (pkgs/id/src/chain.rs:262–276), and batch ingestion explicitly supplies no membership action until its body is attached later (event_store/ingest.rs:327–332). tests/production_ingest.rs:329–346 confirms that a header-only membership operation is accepted without changing the roster. Specify preservation/retrieval of the committed payload bodies and their ingestion through ingest_with_body before declaring replay complete; otherwise the proposed replay loses membership and authority state even with ordered, fork-free input.
Useful? React with 👍 / 👎.
| how much). It cannot forge, alter, or undetectably suppress *to a peer that | ||
| also syncs elsewhere*: per-author chain heads and `after` frontiers make | ||
| gaps visible — a withheld event shows up as a chain that stops advancing or | ||
| a frontier referencing hashes the receiver lacks. Withholding is therefore | ||
| an availability attack with evidence, not an integrity attack. Detection |
There was a problem hiding this comment.
If the bridge alone holds an author's newest suffix, it can suppress that entire suffix while another peer serves the same older prefix. The receiver then also syncs elsewhere, yet sees neither a missing after reference nor evidence that the author has advanced; its observations are indistinguishable from an idle author. A detection threshold cannot resolve that absence of information. Qualify this guarantee and §9's withholding acceptance criterion to require independently obtained newer signed headers/frontiers, or explicitly classify suffix withholding without such evidence as undetectable.
Useful? React with 👍 / 👎.
| | # | Question | Blocks | Owner | | ||
| |---|---|---|---| | ||
| | Q1 | Fork-proof cadence for bridge relationships: how often must the proof-carrying exchange run (vs. `LogSync`) per topic/peer class, and what does it cost in DO rows/CPU at wave-1 scale? Requirement is settled in §4; the number is not. | #2046 (serverless edition v1 — cannot freeze its sync spec without it) | #2046 design | | ||
| | Q2 | Shared worlds: is a WorldDO the serialized writer for its world's journal (a semantic choice — it *creates* a total order native worlds don't have) or a CRDT replica like every other store? (Carried from Workers-fit §8.) | #2046; world design under #2028 | #2046 design | |
There was a problem hiding this comment.
For the existing native world implementation, a serialized WorldDO would preserve an existing total order, not introduce one: pkgs/id/src/world/mod.rs:314–322 defines authority-committed events with a monotonic sequence, world/core.rs:995–1011 assigns and commits that sequence, and journal restoration rejects nonconsecutive sequences at world/core.rs:320–326. These worlds replay an ordered journal.jsonl (world_store.rs:1–13), rather than merely folding the signed-event set. Keep the future writer-versus-replica question open, but correct its premise and distinguish these two subsystems so downstream designs do not mistake replacing native world serialization with CRDT replication for a semantics-preserving transport change.
Useful? React with 👍 / 👎.
Investigation deliverable for #2058 (ID program wave-1, epic #2056), answering open question 2 of the Workers-fit investigation (#2044).
Verdict: the bridge is a sync peer, not a translator or proxy — ID's ordering/trust live in the signed event layer (
chain.rs: per-author seq + backlink + signedafterfrontier), so the seam needs a new transport for the existing sync sessions, not new semantics. Three bridge rules: no bridge-assigned ordering, no bridge-held trust (no re-signing, no custodial keys), no authoritative snapshot (the DO runs the same ingest/fork/resolve rules).Covers: who bridges (DO as passive endpoint, dual-homed native node as the general bridge, third-party relay as availability-only courier), the bridge session shape (same Request/Answer + 3.5% LogSync/range crossover, resumption from
(author, seq)positions, blobs on a separate HTTPS leg), ordering (per-author total, cross-author causal only, arrival order is not semantics), conflicts (fork proofs; theLogSyncheight-comparison fork-blindness hazard and the proof-exchange cadence rule), replay/journal interop (one journal format, incremental hosted replay, DO bookmarks ≠ journal), trust end-to-end (withholding = availability attack with evidence), and the ephemeral-traffic boundary.Open questions with owners (§8): Q1 fork-proof cadence + Q2 WorldDO writer-vs-replica + Q6 DO read-scope → #2046; Q3 journal/ephemeral boundary → #2051; Q4 hosted-leg linked-object retrieval → #2054; Q5 withholding thresholds → #2036. Explicitly not blocking: SSO binding (#2258), native multi-hop relay (#2035/#2249).
Follow-on routed: PoC filed as #2276 (bridge sync session, fork-proof exchange + withholding detection, replay-identity test).
Docs only; no code changes. Queue task 3360.
Need help on this PR? Tag
@codesmith-botwith what you need.