Files

Dobromir Popov 9abe83b5f4 feat(alpha): complete hardening backlog

Complete the alpha-hardening Ralph task set, including tracker billing/accounting guards, validator fraud-audit primitives, wallet binding proof support, documentation runbooks, and updated tests.

Verification: .venv/bin/python -m compileall -q packages tests; .venv/bin/python -m pytest -q --tb=short (313 passed, 3 skipped, 1 failed: tests/test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port because meshnet-node pid 1263451 is already listening on port 7000).

2026-07-05 21:47:23 +03:00

2.0 KiB

Raw Blame History

Status: done

04 — H2: Tracker-authoritative token and work-unit accounting

What to build

Stop trusting node-reported usage for billing. The tracker already proxies responses — use tracker-observed response data and request limits to cap billable tokens, and compute work units from the route it constructed, not node declarations.

Code refs:

packages/tracker/meshnet_tracker/server.py — node_work from route construction (~1776–1782, ~1781–1782)
packages/tracker/meshnet_tracker/server.py — streaming token/chunk billing (~1890–1921)
packages/tracker/meshnet_tracker/server.py — non-streaming _usage_total_tokens (~1938–1943)
packages/tracker/meshnet_tracker/billing.py — charge_request node_work split (~104–151)

Accounting fraud = inflating tokens or shard span. Per ADR-0018 §5.

Test-first

Red: mock upstream returns inflated usage.total_tokens in body but tracker bills that value — test expects the tracker to cap billable tokens from observed stream chunks or request bounds.
Red: node registers false shard_end; billing uses tracker route span, not registration field alone.
Green: authoritative counters; ignore node-reported work units on charge path.

Acceptance criteria

Streaming token count uses tracker-observed chunks/tokens; upstream usage.total_tokens can only lower or match that observed count, never inflate it
Non-streaming token count caps upstream usage.total_tokens by tracker-known request bounds (max_tokens, and prompt estimate if available); exact tokenizer-backed counts are deferred unless already available locally
Work units = tracker-computed layer span per hop at route build time (~1781–1782)
Nodes cannot increase payout by lying about shard range mid-request
Integration test: malicious node metadata does not inflate charge_request shares

ADR links

ADR-0018 §5

Blocked by

02-a2-unified-auth-boundary.md

2.0 KiB Raw Blame History Unescape Escape