cmux link: Cloud receiver listens before its first policy read, waits 20 s for the hello, reads early on a newer token

Merged
TE
1d ago
+206-31

Three receiver changes from Cloud measurements.

1. Listen before the first policy read (create time)

leo-workspace research/freestyle-network-vs-overlay-2026-11-05.md measured the receiver's first policy read at 5.5 to 8.3 s of a 12 s Cloud create, and the receiver reported ready only after it.

  • Now initialize binds the UDP socket, starts the WireGuard listener from the bind-time bootstrap and reports ready at once.
  • first_policy reads in the background and installs the policy through the same update channel the renewals use.
  • Before that first read lands, no peer is in the mesh and the verifier admits no token (NoVerifier), the same as before.
  • A first read with no answer retries with backoff (1 to 30 s). A refusal still closes the receiver.

2. 20 s for the service hello

On a dev capture (91d3ea01), several streams ended "(no hello)" at 5 s. The Mac's serve_cloud_dial opens the stream first and only then mints the hello's link token, with up to 5 s (DIAL_TIMEOUT) for that mint. The receiver gave the hello the same 5 s.

  • The receiver now waits HELLO_TIMEOUT = 20 s.
  • The pre-authentication lease still ends a waiting stream as soon as authority does.

3. A token minted against newer peer authority reads policy early

In the same capture, "token Invalid" followed an "Authority" refusal. This is not stale-token reuse: the Mac mints a fresh token for every dial and never keeps one.

  • Cause. Tokens carry the control plane's current peer authority (acl_version, authority_version), and the VM's policy can lag it by up to one renewal lease.
  • When it hints. NativeTokenVerifier::on_policy_behind fires only for a token that meets all of these:
    • signed for this receiver, host, epoch and team;
    • its WireGuard key is the one the stream arrived on;
    • the policy holds that install at that key, and only the binding differs.
  • What it does. The renewal loop then reads early, at most once per 2 s. The token itself is still refused; the hint admits nothing.
  • Review fix. Codex F1 at 474fde19: a token for another peer, or sent over another peer's session, never hints.

The failed policy reads in that capture are covered by local admission (#36014, platform#827, #36098).

Tests (fleet)

  • native_token_receiver_reports_a_newer_peer_binding_as_policy_behind_and_still_refuses (includes the cross-session case)
  • a_hello_after_the_macs_token_mint_is_still_read
  • Results: cargo fmt --check and clippy -D warnings pass. cmux-link native_token_receiver: 23 passed. cmux-tui --lib link::: 260 passed, with start_chat_cli::a_retry_resumes_its_folder_only_when_no_live_copy_holds_it skipped. That test is a known flake in an untouched file (also in #36008); it failed once here and passed in the earlier run.

Changelog

none

Agent session: agent session

šŸ¤– Generated with Claude Code