feat(peer): answer RLY-009 so relay.dig.net/dht can show the content layer

Cargo.toml

@@ -1,63 +1,63 @@
-[workspace]
-resolver = "2"
-# The canonical dig-node repo is a small workspace of the node ENGINE + its two
-# DIG-Browser host shells:
-#   * dig-node-core     — the NODE engine library (crate `dig_node_core`): RPC dispatch,
-#                         serve/fetch/redirect, chain-watch, subscriptions, gap-fill,
-#                         cache, P2P. The single node implementation shared by BOTH host
-#                         shells below. (Renamed from `dig-node` so the engine library and
-#                         the produced `dig-node` binary no longer share a name, #216.)
-#   * dig-node-service  — the OS-service binary (`dig-node`): axum transport + control
-#                         plane + CLI + service install. Depends on the engine library.
-#   * dig-runtime       — the DIG Browser's in-process node: a cdylib (`dig_runtime.dll`)
-#                         exposing the `dig_rpc`/`dig_wallet_rpc` C-ABI the browser links.
-#   * dig-wallet        — the DIG Browser's built-in Chia wallet host (loopback UI + BLS
-#                         signing), brought up by dig-runtime beside the node.
-# For the `.dig` STORE FORMAT the node depends on digstore's store-format LIBRARY crates
-# (digstore-core/-crypto/-chain/-host/-remote/-stage) as GIT dependencies — dig-node-core
-# -> store-lib, never the reverse. digstore is only ever an RPC client of a node.
-members = [
-    "crates/dig-node-core",
-    "crates/dig-node-service",
-    "crates/dig-runtime",
-    "crates/dig-wallet",
-]
-
-[workspace.package]
-edition = "2021"
-# The RELEASE version of the repo's shipped artifact — the `dig-node` binary
-# (`dig-node-service`, which inherits this via `version.workspace = true`). This is
-# the version the nightly-release.yml stable channel + version-increment CI reads from
-# the ROOT manifest (`[workspace.package].version`), so it MUST be set here for a
-# release to fire (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet)
-# keep their own independent versions — only the released binary tracks the workspace version.
-version = "0.72.6"
-
-# Release hardening, matching digstore: keep integer-overflow checks ON in release.
-# The node parses untrusted serialized input and does offset/length arithmetic over
-# it, so silent wrapping in release would turn a length bug into a memory/logic hazard.
-[profile.release]
-overflow-checks = true
-
-# -- dig-gossip vendored-fork patches (L7 peer network) -----------------------------------------------
-#
-# The node's P2P stack (dig-nat/dig-gossip/dig-dht/dig-pex/dig-download/dig-peer-selector) builds against
-# ADDITIVE forks of `chia-protocol` + `chia-sdk-client` that dig-gossip vendors: the DIG introducer
-# opcodes `RegisterPeer=218`/`RegisterAck=219` on `ProtocolMessageTypes`, plus `Peer::send_protocol_message`
-# + `RateLimits.dig_wire`. Those forks are the SAME upstream versions (`chia-protocol` 0.26,
-# `chia-sdk-client` 0.28) with additive DIG extensions, so patching the whole workspace to them is safe
-# for the store-format crates too (they simply gain unused enum variants).
-#
-# dig-gossip's own `[patch.crates-io]` does NOT apply transitively when it is a git DEPENDENCY (cargo
-# applies patches only from the ROOT manifest being built), so this workspace re-declares them, resolving
-# the vendored packages from the SAME pinned dig-gossip git rev — CI-safe when the repo is checked out
-# standalone. `native-tls` is NOT patched: dig-gossip is pulled with
-# `default-features = false, features = ["rustls", "relay"]`, so the OpenSSL/native-tls path is off.
-[patch.crates-io]
-chia-protocol = { git = "https://github.com/DIG-Network/dig-gossip", rev = "6d458974522cdada1f9b09469d7709e08036a800" }
-chia-sdk-client = { git = "https://github.com/DIG-Network/dig-gossip", rev = "6d458974522cdada1f9b09469d7709e08036a800" }
-
-# The dig-nat unification patch is RETIRED (#1280 crates.io cascade): dig-nat 0.7 is on crates.io and
-# the ENTIRE peer stack (dig-gossip 0.7.1, dig-dht 0.2.2, dig-download 0.2.1, dig-peer-selector 0.2.1,
-# dig-node-core) now depends on dig-nat "0.7" from crates.io, so cargo already resolves ONE dig-nat 0.7
-# instance without any git redirect. dig-constants is likewise a plain crates.io dep everywhere now.
+[workspace]
+resolver = "2"
+# The canonical dig-node repo is a small workspace of the node ENGINE + its two
+# DIG-Browser host shells:
+#   * dig-node-core     — the NODE engine library (crate `dig_node_core`): RPC dispatch,
+#                         serve/fetch/redirect, chain-watch, subscriptions, gap-fill,
+#                         cache, P2P. The single node implementation shared by BOTH host
+#                         shells below. (Renamed from `dig-node` so the engine library and
+#                         the produced `dig-node` binary no longer share a name, #216.)
+#   * dig-node-service  — the OS-service binary (`dig-node`): axum transport + control
+#                         plane + CLI + service install. Depends on the engine library.
+#   * dig-runtime       — the DIG Browser's in-process node: a cdylib (`dig_runtime.dll`)
+#                         exposing the `dig_rpc`/`dig_wallet_rpc` C-ABI the browser links.
+#   * dig-wallet        — the DIG Browser's built-in Chia wallet host (loopback UI + BLS
+#                         signing), brought up by dig-runtime beside the node.
+# For the `.dig` STORE FORMAT the node depends on digstore's store-format LIBRARY crates
+# (digstore-core/-crypto/-chain/-host/-remote/-stage) as GIT dependencies — dig-node-core
+# -> store-lib, never the reverse. digstore is only ever an RPC client of a node.
+members = [
+    "crates/dig-node-core",
+    "crates/dig-node-service",
+    "crates/dig-runtime",
+    "crates/dig-wallet",
+]
+
+[workspace.package]
+edition = "2021"
+# The RELEASE version of the repo's shipped artifact — the `dig-node` binary
+# (`dig-node-service`, which inherits this via `version.workspace = true`). This is
+# the version the nightly-release.yml stable channel + version-increment CI reads from
+# the ROOT manifest (`[workspace.package].version`), so it MUST be set here for a
+# release to fire (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet)
+# keep their own independent versions — only the released binary tracks the workspace version.
+version = "0.73.0"
+
+# Release hardening, matching digstore: keep integer-overflow checks ON in release.
+# The node parses untrusted serialized input and does offset/length arithmetic over
+# it, so silent wrapping in release would turn a length bug into a memory/logic hazard.
+[profile.release]
+overflow-checks = true
+
+# -- dig-gossip vendored-fork patches (L7 peer network) -----------------------------------------------
+#
+# The node's P2P stack (dig-nat/dig-gossip/dig-dht/dig-pex/dig-download/dig-peer-selector) builds against
+# ADDITIVE forks of `chia-protocol` + `chia-sdk-client` that dig-gossip vendors: the DIG introducer
+# opcodes `RegisterPeer=218`/`RegisterAck=219` on `ProtocolMessageTypes`, plus `Peer::send_protocol_message`
+# + `RateLimits.dig_wire`. Those forks are the SAME upstream versions (`chia-protocol` 0.26,
+# `chia-sdk-client` 0.28) with additive DIG extensions, so patching the whole workspace to them is safe
+# for the store-format crates too (they simply gain unused enum variants).
+#
+# dig-gossip's own `[patch.crates-io]` does NOT apply transitively when it is a git DEPENDENCY (cargo
+# applies patches only from the ROOT manifest being built), so this workspace re-declares them, resolving
+# the vendored packages from the SAME pinned dig-gossip git rev — CI-safe when the repo is checked out
+# standalone. `native-tls` is NOT patched: dig-gossip is pulled with
+# `default-features = false, features = ["rustls", "relay"]`, so the OpenSSL/native-tls path is off.
+[patch.crates-io]
+chia-protocol = { git = "https://github.com/DIG-Network/dig-gossip", rev = "6d458974522cdada1f9b09469d7709e08036a800" }
+chia-sdk-client = { git = "https://github.com/DIG-Network/dig-gossip", rev = "6d458974522cdada1f9b09469d7709e08036a800" }
+
+# The dig-nat unification patch is RETIRED (#1280 crates.io cascade): dig-nat 0.7 is on crates.io and
+# the ENTIRE peer stack (dig-gossip 0.7.1, dig-dht 0.2.2, dig-download 0.2.1, dig-peer-selector 0.2.1,
+# dig-node-core) now depends on dig-nat "0.7" from crates.io, so cargo already resolves ONE dig-nat 0.7
+# instance without any git redirect. dig-constants is likewise a plain crates.io dep everywhere now.

crates/dig-node-core/Cargo.toml

@@ -161,7 +161,7 @@ getrandom = "0.2"
 # above -- `SafeText` crosses dig-dht's AND dig-peer's public error surfaces, so two dig-nat versions is
 # an outright compile error on those seams rather than merely two mTLS stacks. See
 # `seams/dig_peer/dht.rs::stage_failed` for this crate's side of the adoption.
-dig-nat = "0.15"
+dig-nat = "0.18"
 # dig-gossip is the ONE peer-stack exception: not yet published to crates.io (its publish is guarded
 # pending dig-peer-protocol, #681), so it stays a git dependency PINNED to a release commit — here
 # v0.17.12 (rev 3e352d91).
@@ -186,7 +186,7 @@ dig-nat = "0.15"
 # graph still unifies to ONE of each. The vendored chia-protocol/chia-sdk-client forks it path-patches
 # are re-declared at this SAME rev in the workspace `[patch.crates-io]` (a git dep's own patches do not
 # apply transitively — the #1529 3-rev lockstep: this dep rev + the two patch revs move together).
-dig-gossip = { git = "https://github.com/DIG-Network/dig-gossip", rev = "6d458974522cdada1f9b09469d7709e08036a800", default-features = false, features = ["rustls", "relay"] }
+dig-gossip = { git = "https://github.com/DIG-Network/dig-gossip", rev = "06bd79fb359834b416c466eca770d4a3c3f71aa1", default-features = false, features = ["rustls", "relay"] }
 # The canonical DIG network id (genesis challenge) for the gossip handshake / introducer scope. From
 # crates.io: dig-nat 0.7 requires `>=0.4, <0.6` and dig-gossip 0.7.1 requires `>=0.2, <0.5`, so `0.4`
 # sits in both windows and the whole graph resolves to ONE crates.io dig-constants 0.4.x.
@@ -202,7 +202,7 @@ dig-constants = "0.4"
 # so cargo unifies to ONE dig-dht instance — dig-dht's `PeerId` / `Contact` / `DhtTransport` share the
 # exact types `dig_nat::connect` returns. dig-dht 0.5 deps dig-nat "^0.10" (crates.io), the SAME
 # dig-nat "0.10" this crate pins, so the whole graph shares ONE dig-nat 0.10 instance.
-dig-dht = "0.9"
+dig-dht = "0.11.1"
 # -- L7 Peer Exchange (PEX, #166) --------------------------------------------------------------------
 # The node<->node peer-sharing protocol: over each established mTLS peer connection, a dedicated PEX
 # logical stream exchanges delta-based first-hand known-peer sets (handshake -> snapshot -> deltas),
@@ -237,7 +237,7 @@ dig-pex = "0.1"
 # `seams/dig_peer/module_anchor.rs` (`ChainAnchoredModuleVerifier`). NOTE the `testkit` feature is
 # deliberately NOT enabled: it is what makes the fail-OPEN `AcceptAnyModuleAnchor` nameable, and this
 # crate's anchor gate is the reshare path's ONLY root of trust.
-dig-download = "0.13"
+dig-download = "0.15"
 # -- The shared peer client (#1283/#1576) -------------------------------------------------------------
 # `DigPeer` — the ONE DIG Network peer client: peer_id-pinned mTLS over the full NAT ladder plus typed
 # RPC. Depended on DIRECTLY (not only transitively through dig-download) because dig-node supplies the
@@ -249,7 +249,7 @@ dig-download = "0.13"
 # module pull's trust boundary — on the fields that drive the whole pull plan. dig-download 0.8.1 is on
 # dig-peer 0.5 too, so exactly ONE dig-rpc-protocol + ONE dig-peer resolve here (asserted by
 # `crates/dig-node-core/tests/dependency_tree.rs`).
-dig-peer = "0.8"
+dig-peer = "0.9"
 # -- Self-optimizing peer selection (#178) ------------------------------------------------------------
 # The decision + learning layer between dig-dht discovery and dig-download execution: it ranks the
 # providers `find_providers` returns (learning throughput/rtt/reliability + a per-class saturation
@@ -266,7 +266,7 @@ dig-peer = "0.8"
 # dig-nat/dig-dht types). The selector mirrors `dig_gossip::PoolEvent` LOCALLY (it does not depend on
 # dig-gossip, which lags as a git dep), so the node maps `dig_gossip::PoolEvent` → the selector's local
 # `PoolEvent` 1:1 (see `download.rs::pool_event_to_selector`).
-dig-peer-selector = "0.8"
+dig-peer-selector = "0.9"
 # The canonical DIG mTLS certificate crate (L00, crates.io). The node's PERSISTENT machine identity
 # is a CA-signed `dig_tls::NodeCert` minted from the node's own BLS identity key and persisted 0600 in
 # the data dir (#908 identity boundary: this is the MACHINE key, never a user key). Replaces the
@@ -316,7 +316,7 @@ rcgen = "0.13"
 #
 # Pinned by the `the_fail_open_anchor_verifier_is_not_reachable_from_a_production_build` test, which
 # fails if `testkit` ever appears on the production entry.
-dig-download = { version = "0.13", features = ["testkit"] }
+dig-download = { version = "0.15", features = ["testkit"] }
 # Captures the peer-facing serve's real emitted tracing records into an in-memory buffer, so the
 # serve-observability tests (#1595) assert what an operator would actually see in the node log —
 # and that no payload byte or proof ever reaches it.