mirror of
https://github.com/block/buzz.git
synced 2026-10-31 06:21:34 +00:00
ceaaced941
Follow-up to the open-mesh change (d99cba5bb), closing three gaps found in
review:
1. A stray membership snapshot on an open relay no longer gates routing.
Admission runs TrustPolicy::Off there, but discovery still intersected
status notes with any kind:13534 roster that happened to exist (added out
of band), and the query layer applied the same authors filter — a hybrid
where admission admits everyone while discovery hides non-roster peers.
Both branches now check the relay mode: open relays ignore membership
entirely and rely on freshness plus owner-signed endpoint binding.
2. Reconcile recovers a node isolated by the startup probe fallback. A
transient NIP-11 probe failure at start falls back to the enforcing path
and a self-only allowlist; treating Ok(None) as an unconditional Keep then
pinned that node at "1 NODE" until an app restart — the original bug,
reintroduced by one HTTP blip. A self-only roster admits nobody else, so
restarting into open mesh relaxes nothing that protected anyone. An
allowlist admitting other owners is still never relaxed mid-flight.
3. Successful NIP-11 probes are memoized per relay URL. The deployment mode
does not flap at runtime, and discovery re-probed on every reconcile poll.
Failures are not cached, so the fallback in (2) re-probes and recovers.
Co-authored-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Michael Neale <michael.neale@gmail.com>