Gud Boi
4aa7a890cb
Anticipating gh #502 — TIPC over a WireGuard mesh as our go-to multihost tpt deployment — plus a cold-start handoff for whoever (or whatever) picks this up next. The wg deats, both verified locally, - a wg iface is L3/`tun` (`POINTOPOINT,NOARP`, `link/none`, no L2 addr) so TIPC's `eth` media **cannot** bind it; the udp bearer is *mandatory* over wg, not merely an alternative. Also its ~1420 MTU sits under ethernet's 1500. - the composed deployment maddr is `/ip4/<pub>/udp/51820/wg/u<key>/tipc/<stype>/<inst>/<scope>`. XXX note the tipc segment has NO locative part unlike tcp's inner `/ip4/../tcp/..` — a service name is location-independent, so wg carries routing and tipc carries identity. That's the argument for one `/tipc` proto w/ a structured value in the #498 spec proposal. XXX ALSO correcting a premise: TIPC is **not** unencrypted. It ships AES-GCM crypto (`tipc node set key`, linux 5.9+) w/ cluster/master/per-node keys + rekeying. Those keys are symmetric+pre-shared tho, so wg is still preferred for public-key identity, NAT traversal, and one overlay every tpt can share. `01_tipc_HANDOFF.md` is deliberately provider-neutral: env setup, the hard-won kernel facts table, the two closed design decisions (+why), what landed, the pre-land TODOs and the repo's working conventions. (this patch was generated in some part by `claude-code` using `claude-opus-5` (`anthropic`)) |
||
|---|---|---|
| .. | ||
| 00_shared_backend_contract.md | ||
| 01_tipc_HANDOFF.md | ||
| 01_tipc_backend.md | ||
| 02_quic_iroh_backend.md | ||
| 03_wg_tunnel_bindspace.md | ||
| README.md | ||
README.md
next-gen tractor.ipc transport backend plans
Implementation specs for three prospective .ipc transport backends, written so each can be worked independently (by a different model/provider) without design or lib-selection drift.
Read 00_shared_backend_contract.md first — it is the normative description of what a tractor transport backend is as of main@83b34884 (the backend duck-type, the 10-item registration checklist, the test-harness plumbing, the code-style rules). The three plans assume it and document only their own deltas.
| plan | issue | dep | size | lands |
|---|---|---|---|---|
| 01 — TIPC | #378 | none (stdlib) | small | landed, PR #493 — see the handoff |
02 — QUIC/iroh |
#353 | iroh (uniffi FFI) |
large | needs a prep PR |
03 — wg bindspace |
#482, #443 | pyroute2 |
medium, 3 layers | layer A now |
Headline conclusions:
- TIPC is the cheap win. Verified:
trio.SocketStreamandtrio.SocketListenerare address-family agnostic (onlySOCK_STREAM+ a trio socket), and CPython shipsAF_TIPC+ 23TIPC_*constants. So the backend is ~one module of contract boilerplate, zero new deps, and it buys kernel-native service discovery:bind()publishes,connect()-by-name resolves — no registrar in the loop. (modprobe tipcis required; hard-gate everything.) - QUIC’s cost is entirely in two adapters, not in QUIC. The
irohpython bindings areuniffi-generated asyncio, but the asyncio dependency is confined to one future-poll callback — a ~40-linetriobridge (TrioToken.run_sync_soon) replaces it. The second cost is that an iroh listener isn’t a socket, which needs a small, independently-reviewable prep PR to_server.py/_types.py. - WireGuard is not a transport. It’s an iface-layer tunnel, so it belongs as a nested bindspace (
TunnelledAddress+open_bindspace()@acms) wrapping whatever L4 tpt is in use — which is also what finally implements the long-spec’dAddress.namespace, and what generalizes toveth/vxlan/gre.
Ordering rationale: plan 01 first as the cheap proof the table-registration story generalizes to a genuinely new proto; plan 03 layer A is already deployable-today doc/example work; plan 02 last (and gated on its prep PR). Plans 01 and 02 both want the same Address.rebind_from_sockname gate — whichever lands first ships it.