Files

Dobromir Popov 9abe83b5f4 feat(alpha): complete hardening backlog

Complete the alpha-hardening Ralph task set, including tracker billing/accounting guards, validator fraud-audit primitives, wallet binding proof support, documentation runbooks, and updated tests.

Verification: .venv/bin/python -m compileall -q packages tests; .venv/bin/python -m pytest -q --tb=short (313 passed, 3 skipped, 1 failed: tests/test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port because meshnet-node pid 1263451 is already listening on port 7000).

2026-07-05 21:47:23 +03:00

2.3 KiB

Raw Blame History

Status: done

07 — FRAUD: On-demand commitment + hop bisection blame

What to build

On audit selection, require nodes to supply TOPLOC-style fingerprints of output boundary activations per hop (on-demand, brief retention). On verify failure, referee identifies the first divergent hop — not always the last text node.

Code refs:

packages/validator/meshnet_validator/__init__.py — _slash_route, _final_text_node bug (~102–140) — blames max(shard_end) only
packages/tracker/meshnet_tracker/server.py — route hop construction (~1774–1783) — cut-points for bisection
Research: .scratch/alpha-hardening/research-verifiable-inference.md §1.2, §8 layer 3 (Verde pattern, not on-chain game)

Test-first

Red: two-hop route, corrupt hop-0 activations — _final_text_node blames hop-1 — test must fail.
Green: bisection selects hop-0; forfeit targets hop-0 wallet.
On-demand: commitment requested only when audit flag set on proxied request.

Acceptance criteria

Audit requests carry tracker RNG/VRF flag indistinguishable from normal traffic (research §6) — the existing post-hoc sample_rate RNG gate in ValidatorProcess.validate_once already decides audit selection after the original proxied request completed, so the request the client/nodes saw is unaffected either way; locked in by test_hop_commitments_are_not_requested_unless_the_event_is_audit_selected
Nodes retain recent boundary activations for on-demand commit window (configurable TTL) — ToplocAuditConfig.commitment_ttl_seconds; expired commitments fall back to the text-only path (test_expired_commitment_window_falls_back_to_text_only_audit)
Validator/tracker compares fingerprints at each hop cut-point; first mismatch = culprit — _hop_commitments_from_event + _first_divergent_hop in packages/validator/meshnet_validator/__init__.py
_final_text_node removed or limited to text-only fallback — only called from the plain-text divergence branch of _validate_event now
Integration test: multi-hop pipeline, fault injected at known hop — tests/test_hop_bisection.py

ADR links

ADR-0018 §3–4

Blocked by

06-fraud-toploc-integration.md

2.3 KiB Raw Blame History Unescape Escape