From 1c0397927d68e9d0700950812b5ba460580d7c59 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Wed, 30 Sep 2026 22:19:22 -0700 Subject: [PATCH 1/6] chore(quest): start edge and core routing questline Co-Authored-By: GPT-6 From 1492b92e4112e410bc7e6ef79e12ad1337a5f01a Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 2 Oct 2026 07:33:13 -0700 Subject: [PATCH 2/6] chore(quest): claim planning work From 2c35d55668eceed08a44b375399e99d0aee35b12 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 2 Oct 2026 07:42:53 -0700 Subject: [PATCH 3/6] docs(quest): configure explicit cluster boundary identities --- quest/m1/cluster-routing/inter-cluster.md | 42 +++++++++++++++++++++-- 1 file changed, 39 insertions(+), 3 deletions(-) diff --git a/quest/m1/cluster-routing/inter-cluster.md b/quest/m1/cluster-routing/inter-cluster.md index 7bc07c072f..2f07b8ea97 100644 --- a/quest/m1/cluster-routing/inter-cluster.md +++ b/quest/m1/cluster-routing/inter-cluster.md @@ -10,8 +10,29 @@ clusters. ## Plan -- A boundary is a configured link to a relay of another cluster; decide how - a relay knows its own cluster id and its peer's. +- Decided with the maintainer on 2026-10-02: a boundary is a configured link + with an expected remote cluster identity, distinct from the local cluster + identity. Preserve `cluster.id` as the existing relay-origin Hop; silently + making every relay share that ID would merge distinct origins. +- Add a stable, explicit local cluster identity and an expected cluster + identity on each configured boundary peer. Recommended config spelling: + `cluster.domain` for the local identity and `cluster` on the existing peer + object for the remote identity. Use nonzero identifiers below 2^62, in a + separate role from relay Hop IDs. Every member of a cluster shares the + configured domain; never mint one randomly per restart. +- Existing peers without a boundary identity remain intra-cluster. Refuse a + boundary configuration without a local identity, a peer in the same domain, + or a malformed identity before listening or dialing. Keep the existing + peer authentication requirement; a URL or an observed socket address alone + does not authorize a boundary peer. +- Validate the remote domain against the configured expected identity when + establishing the boundary link. A missing, mismatched, or unconfigured + boundary identity is fatal. Both link directions must be classified + explicitly; do not trust an arbitrary domain supplied in an announcement. + Carry the identity declaration in the current unpublished lite version's + boundary handshake, with no change to published versions. Refuse boundary + operation when that version is not negotiated. This is validation of the + configured identities, not automatic topology discovery. - What crosses a boundary is a cluster's announcement, plus its cluster-id list. An imported record keeps that list as provenance, so whichever boundary relay exports it appends its own cluster id to the full @@ -29,7 +50,22 @@ clusters. Wire: the boundary announcement in the current wip lite version, with the draft updated in the same PR. Tests: two clusters with two boundary links and an origin that is not a boundary relay, and three clusters in a cycle with different ingress and egress relays, where -an announcement neither loops nor re-enters its origin cluster. + an announcement neither loops nor re-enters its origin cluster. + +Also test malformed and missing configuration, mismatched peer identities, +unauthenticated boundary requests, version refusal, and an ordinary +intra-cluster peer that retains its existing behavior. Sweep the routing +benchmark over clusters and boundary links, including a path-vector cycle, +so forwarding cost is measured against the touched path rather than the +whole route table. + +Update `doc/bin/relay/cluster.md`'s configuration and CLI examples inline. +The parent quest already owns the new concept routing page, so no separate +documentation quest is needed. + +Public API: additive explicit cluster-domain and boundary-peer configuration. +Wire: identity declaration and boundary announcements in the unpublished +lite version only; published versions do not gain boundary operation. ## Related From d3e7f365a1fc23b37c70b095b11646171a4648f8 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 2 Oct 2026 08:22:06 -0700 Subject: [PATCH 4/6] docs(quest): bind boundary domains to authenticated links --- quest/m1/cluster-routing/inter-cluster.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/quest/m1/cluster-routing/inter-cluster.md b/quest/m1/cluster-routing/inter-cluster.md index 2f07b8ea97..ffd1d6d6d9 100644 --- a/quest/m1/cluster-routing/inter-cluster.md +++ b/quest/m1/cluster-routing/inter-cluster.md @@ -29,6 +29,8 @@ clusters. establishing the boundary link. A missing, mismatched, or unconfigured boundary identity is fatal. Both link directions must be classified explicitly; do not trust an arbitrary domain supplied in an announcement. + Bind the expected domain to the authenticated link on accepted and dialed + sessions: the existing `peer` grant alone does not identify a domain. Carry the identity declaration in the current unpublished lite version's boundary handshake, with no change to published versions. Refuse boundary operation when that version is not negotiated. This is validation of the @@ -54,7 +56,8 @@ and an origin that is not a boundary relay, and three clusters in a cycle with d Also test malformed and missing configuration, mismatched peer identities, unauthenticated boundary requests, version refusal, and an ordinary -intra-cluster peer that retains its existing behavior. Sweep the routing +intra-cluster peer that retains its existing behavior. Include an authenticated +peer claiming the wrong domain. Sweep the routing benchmark over clusters and boundary links, including a path-vector cycle, so forwarding cost is measured against the touched path rather than the whole route table. From 7ae7238ffbee670b57e74492f632d08f3b51f653 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 2 Oct 2026 08:38:12 -0700 Subject: [PATCH 5/6] docs(quest): distinguish boundary domains from relay hops Co-Authored-By: GPT-6 --- quest/m1/cluster-routing/inter-cluster.md | 24 +++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/quest/m1/cluster-routing/inter-cluster.md b/quest/m1/cluster-routing/inter-cluster.md index ffd1d6d6d9..ea8ad8746f 100644 --- a/quest/m1/cluster-routing/inter-cluster.md +++ b/quest/m1/cluster-routing/inter-cluster.md @@ -2,8 +2,9 @@ ## Goal -Announcements crossing a cluster boundary stay path vector with cluster ids -as the hops, like BGP between autonomous systems. A customer's on-prem +Announcements crossing a cluster boundary stay path vector with configured +cluster domains (`cluster.domain` / peer `cluster`) as the hops, like BGP +between autonomous systems. A customer's on-prem cluster is one hop, and an announcement naming the receiving cluster is dropped. Inside a cluster, hop lists name relays; across a boundary they name clusters. @@ -21,8 +22,8 @@ clusters. separate role from relay Hop IDs. Every member of a cluster shares the configured domain; never mint one randomly per restart. - Existing peers without a boundary identity remain intra-cluster. Refuse a - boundary configuration without a local identity, a peer in the same domain, - or a malformed identity before listening or dialing. Keep the existing + boundary configuration before listening or dialing if its local domain is + missing, its peer domain equals its local domain, or either identity is malformed. Keep the existing peer authentication requirement; a URL or an observed socket address alone does not authorize a boundary peer. - Validate the remote domain against the configured expected identity when @@ -35,10 +36,12 @@ clusters. boundary handshake, with no change to published versions. Refuse boundary operation when that version is not negotiated. This is validation of the configured identities, not automatic topology discovery. -- What crosses a boundary is a cluster's announcement, plus its cluster-id - list. An imported record keeps that list as provenance, so - whichever boundary relay exports it appends its own cluster id to the full - list; stripping it on import would let A → B → C → A re-enter A. +- What crosses a boundary is a cluster's announcement, plus its cluster-domain + list. An imported record keeps that list as provenance, so whichever boundary + relay exports it appends its configured `cluster.domain` to the full list. + Boundary path-vector hops use these domains; intra-cluster hop lists keep + using relay Hop IDs (`cluster.id`). Stripping provenance on import would + let A → B → C → A re-enter A. - The remote origin is outside the receiving cluster, so the importing boundary relay announces the record inside its cluster as the origin, with the boundary link's cost added. The serving origin's identity @@ -51,8 +54,9 @@ clusters. Wire: the boundary announcement in the current wip lite version, with the draft updated in the same PR. Tests: two clusters with two boundary links -and an origin that is not a boundary relay, and three clusters in a cycle with different ingress and egress relays, where - an announcement neither loops nor re-enters its origin cluster. +and an origin that is not a boundary relay, and three clusters in a cycle +with different ingress and egress relays, where an announcement neither loops +nor re-enters its origin cluster. Also test malformed and missing configuration, mismatched peer identities, unauthenticated boundary requests, version refusal, and an ordinary From 3562a5820d847c9ab3f32da4a7ef67fbf654ff99 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 2 Oct 2026 21:47:42 -0700 Subject: [PATCH 6/6] quest: say cluster domains, not cluster ids, for boundary hops Co-Authored-By: Claude Opus 5.5 --- quest/m1/cluster-routing/README.md | 4 ++-- quest/m1/cluster-routing/inter-cluster.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/quest/m1/cluster-routing/README.md b/quest/m1/cluster-routing/README.md index 386f8655e9..e8d8cb1ad1 100644 --- a/quest/m1/cluster-routing/README.md +++ b/quest/m1/cluster-routing/README.md @@ -52,7 +52,7 @@ link-state and existence-split design planned earlier that day: origins that announce the same one are interchangeable, which is how a redundant pair is expressed. A path a claim produces keeps Wildcard's per-origin identity. See [Selection](/quest/m1/cluster-routing/selection.md). -- Between clusters, announcements stay path vector with cluster ids as hops, +- Between clusters, announcements stay path vector with cluster domains as hops, in the last child. - Anything specific to moq.pro's deployment (generating peer lists and roles from its inventory, its simulator) is planned in moq.pro, not here. @@ -118,7 +118,7 @@ Once every child has landed: - [Edge and core](/quest/m1/cluster-routing/roles.md) - relays take an explicit edge or core role; edges spread paths over their region's cores and are never transit - [Selection](/quest/m1/cluster-routing/selection.md) - a broadcast under overlapping prefixes routes to one origin deterministically, and same-epoch origins are one source -- [Between clusters](/quest/m1/cluster-routing/inter-cluster.md) - announcements crossing a cluster boundary stay path vector with cluster ids as hops +- [Between clusters](/quest/m1/cluster-routing/inter-cluster.md) - announcements crossing a cluster boundary stay path vector with cluster domains as hops ## Related diff --git a/quest/m1/cluster-routing/inter-cluster.md b/quest/m1/cluster-routing/inter-cluster.md index ea8ad8746f..2c5eac6361 100644 --- a/quest/m1/cluster-routing/inter-cluster.md +++ b/quest/m1/cluster-routing/inter-cluster.md @@ -46,7 +46,7 @@ clusters. importing boundary relay announces the record inside its cluster as the origin, with the boundary link's cost added. The serving origin's identity still rides the reply, so re-originating does not merge two sources. -- Cluster-id lists are short, so they need no `Hop Base`/`Hop Keep` +- Cluster-domain lists are short, so they need no `Hop Base`/`Hop Keep` compression. - Cost across the boundary is plain configured link cost; business policy and incomparable costs are