joule-moq-room and the public room (L5c-2): grants with proof of possession, the lifecycle by the room's clock, room authorities at the relay, and two relay fixes #334

Merged

dcharlot merged 10 commits from joule-moq/room-live into main 2026-10-19 11:05:07 -04:00

Conversation 0 Commits 10 Files changed 39 +6109 -120

2026-10-19

Transaction Science

joule-moq-relay README and the changelog: the fetch's wait for groups still arriving, and the mux fix ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

aa6e920fdc

• View at this point in history

2026-10-19 07:38:46 -04:00

Transaction Science

joule-moq-relay: a mux self-deadlock fixed; a FETCH waits for groups still arriving ...

- transport::mux: a stream that arrived after the session closed (its peer not
  yet told) found nobody accepting, and its receiving half was dropped after the
  state was locked again: its Drop takes that lock, so the worker deadlocked, and
  every other worker after it. Any session the relay closes while its peer still
  opens streams (the session and ingress limits, a refused proof) could hang the
  relay. The half is now dropped before the lock is taken again; the regression
  test hangs without the fix and passes with it.
- A FETCH the cache does not yet cover, of a track whose publisher is still
  sending, waits (within its fill budget, at most a second) for the groups still
  arriving before the relay asks upstream: a page's audio is a group per 20 ms,
  each on its own stream, and a late joiner's fetch from group 0 through an HTTP
  front met one in flight and was passed to the publisher, which takes no
  requests (seen on the deployed room).
- room_authority: the ingress limit read from the relay's record when the client
  loses the race to see the close.

joule-moq-web: a late joiner's refused FETCH is tried again (a refusal comes
before any object).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dfb24a1a2b

• View at this point in history

2026-10-19 07:32:44 -04:00

Transaction Science

joule-moq-web e2e: --between, a pause between runs, for a deployment's grant rate per address ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

9c78299d5e

• View at this point in history

2026-10-19 06:30:28 -04:00

Transaction Science

joule-moq-web e2e: the service scenario compares the layout once every tile shows video; killStrays's pattern without its dashes ...

Against the deployment, a late joiner's first frame reached the canvas after
its tile was laid out, and the comparison ran in between. pkill on macOS read
the pattern's leading -- as an option, so strays were never ended.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

779597de02

• View at this point in history

2026-10-19 06:28:06 -04:00

Transaction Science

joule-moq-room CI; READMEs, the example configuration and the changelog for L5c-2 ...

A workflow of its own runs joule-moq-room's tests (its own workspace), on a
change to it, the relay, joule-moq or wai-rs; joule-moq-web's browser suite
runs on a change to the room service too, and gains the service scenario.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

bbbb6b7829

• View at this point in history

2026-10-19 06:11:07 -04:00

Transaction Science

joule-moq-relay: unlimited grant rules; the room's clock exempt from session limits ...

A session whose SETUP presents a token whose rule says unlimited is exempt from
max_session_ms and max_ingress_kbps: the room service's clock is a long-lived
session of the deployment's own, and the session limit closed it every ten
minutes (seen in the service scenario). joule-moq-room's relay-lines mark its
clock's rule so.

joule-moq-web: grantProofBy and clientSetupWithProof, so a test presents a page's
grant with a proof by another key (the page's own path signs with the
principal's key alone); the service scenario's teardown is bounded and its
proxy ends upgraded sockets.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

7e15664de9

• View at this point in history

2026-10-19 06:05:05 -04:00

Transaction Science

Merge remote-tracking branch 'origin/main' into joule-moq/room-live

553266a132

• View at this point in history

2026-10-19 06:02:53 -04:00

Transaction Science

joule-moq-web: a room service mode, and its end-to-end scenario ...

The page makes its own Ed25519 key, asks the room service for a grant for it
(a publisher's or a viewer's) from its Join and Watch buttons, presents the
grant with a proof by that key over the WebSocket binding (WebTransport not
tried), and takes the lifecycle from the service's clock, reading the room's
grants again when someone joins under a grant it did not hold
(wai-live-web's Room.setGrants). Leave, a typed human caption, the session's
end, and a proof by another key (tryWrongKey) for the tests.

e2e: the service scenario runs the relay (WebSocket only, trusting the
service's authority, its door holding each publisher to its own key), the
room service and a same-origin proxy on loopback; with --base it runs against
a deployment.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

72d60453c5

• View at this point in history

2026-10-19 06:02:52 -04:00

Transaction Science

joule-moq-room: a room service that issues grants and authors the lifecycle ...

It holds a room's authority and clock keys (a 0600 file outside every
repository). POST /grant signs a short-lived WRG1 grant for a key a page made,
a publisher's or a viewer's, bounded per client and per room; the relay honours
it only beside the key's proof (live-rooms §10.5). The clock's session on the
relay watches each publisher's video track and signs join, publish and leave on
its events track (§7.2, live-events §8.1); GET /room serves the signed
descriptor, the composition descriptor and the grants. A new room starts when
the last publisher has left.

A workspace of its own: it builds on wai-rs, whose serde_json features would
otherwise reach every crate of the joule-code workspace.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

f801f58acb

• View at this point in history

2026-10-19 03:13:32 -04:00

Transaction Science

joule-moq-relay: room authorities, a door trust field, and session limits ...

- auth.authorities: a WRG1 grant signed by a listed authority is honoured as
  live-rooms §10.2 maps it (its own media, catalog and events namespaces to
  publish, the room to subscribe), only beside a proof of possession and within
  its window; joule-moq's GrantHead reads it under the authority's key.
- A field "*" in a grant rule's or a door rule's prefix matches any field; a
  door rule's trust_field names the namespace field whose key it trusts there.
- limits.max_session_ms, max_ingress_kbps (with ingress_burst_ms) and
  max_resident_mb; a session also ends when its authority grant expires.
- The binary stops on SIGTERM as on Ctrl-C.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

71fbfe5a85

• View at this point in history

2026-10-19 03:03:00 -04:00