Skip to content

docs(quest): boundary identity constraints and TLS qmux prior art #4752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kixelated merged 1 commit into from
Oct 3, 2026
+17 −2
Merged

docs(quest): boundary identity constraints and TLS qmux prior art #4752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion quest/m1/cluster-routing/transit.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,9 @@ customer/provider export rule, RFC 9234, reduced to one bit):
- Edge links run qmux over TLS on TCP, not WebSocket and not QUIC:
intra-region links are not congested. qmux over TCP exists today only in
plaintext (`tcp://`, moq-tokio's `tcp.rs`); add `tls://` beside it on
moq-tokio's `tls` helpers. (Scheme name decided 2026-09-30.)
moq-tokio's `tls` helpers. (Scheme name decided 2026-09-30.) The closed
[#4731](https://github.com/moq-dev/moq/pull/4731) is prior art for the
Comment thread
coderabbitai[bot] marked this conversation as resolved.
`tls://` qmux piece in moq-tokio; its edge/core roles are not wanted.

Test: a two-region cluster in `rs/moq-relay/tests`. One region has two edges
whose links to two cores are upstream; the other is one relay that also
Expand Down
15 changes: 14 additions & 1 deletion quest/m3/routing-cost-domains.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,18 @@ Costs reflect SKU, directional egress economics, provider affinity, and marginal
transfer savings. A hosting provider is not necessarily a policy domain:
moq.pro can coordinate one model across its OVH and Linode nodes. Domain
membership must come from an operator-controlled trust boundary, not a peer's
unverified assertion.
unverified assertion. Whatever identifies a boundary must hold to these
operator-safety constraints:

- A boundary is an explicitly configured link with an expected remote
identity. A URL, an observed address, or the `peer` grant alone does not
make a link a boundary.
- The identity is bound to the authenticated link, whichever side dialed,
never taken from a route or announcement.
- A missing, malformed, or mismatched boundary identity is fatal: refuse it
at startup or drop the link.
- `cluster.id` is never reused as a domain identity. It is one node's id, and
sharing it across nodes merges distinct origins.

Investigate a shared cost model within a coordinating domain and explicit
import/export policy at its boundaries. A remote number is not comparable to
Expand Down Expand Up @@ -63,3 +74,5 @@ quests. Open wire/API choices belong to this design exercise.

- [#3769](https://github.com/moq-dev/moq/pull/3769) - measurement-based pricing
prompted the separation of measurement, operator policy, and protocol
- [#4718](https://github.com/moq-dev/moq/pull/4718) - the dropped
cluster-domain hop plan the boundary constraints come from
Loading