Member-vouched sign-up codes, wired in and switched off #88

2026-09-02T14:56:40Z

paulhitt commented

2026-09-02 14:56:40 +00:00

(Migrated from gitlab.com)

Closes #43. Wired in and disabled, as asked.

Off, and inert without an end date. FN_VOUCH_REQUIRED alone does nothing — the gate engages only with FN_VOUCH_UNTIL set, and turns itself off when that passes. Vouching is a reasonable trade for a phase and a bad one for a policy, and a phase whose end depends on somebody remembering to change a variable is a policy with extra steps. Failing open is the right direction.

The tests caught a real bug in the first cut. Spentness was read off usedBy, which is only filled in once the new account exists — so a redeemed code still looked unspent and could be spent without limit, defeating the mechanism entirely; a sign-up that failed after redeeming also left a code unspent for ever. usedAt is the spent flag now, and usedBy is provenance attached to the row redemption returned rather than one found by a query.

Only the hash is stored. The alphabet omits O/0 and I/l/1. The cap is on codes outstanding, not ever issued. The gate sits after the format checks, so a code is not spent on a sign-up that was going to fail anyway.

Touches RoutesAccount.swift and Config.swift, so it joins the sign-up chain (!11 !13 !14 !15) — merge after those.

13 new tests; full relay suite 483 green.

Closes #43. **Wired in and disabled**, as asked. **Off, and inert without an end date.** `FN_VOUCH_REQUIRED` alone does nothing — the gate engages only with `FN_VOUCH_UNTIL` set, and turns itself off when that passes. Vouching is a reasonable trade for a phase and a bad one for a policy, and a phase whose end depends on somebody remembering to change a variable is a policy with extra steps. Failing open is the right direction. **The tests caught a real bug in the first cut.** Spentness was read off `usedBy`, which is only filled in once the new account exists — so a redeemed code still looked unspent and **could be spent without limit**, defeating the mechanism entirely; a sign-up that failed after redeeming also left a code unspent for ever. `usedAt` is the spent flag now, and `usedBy` is provenance attached to the row redemption returned rather than one found by a query. Only the hash is stored. The alphabet omits O/0 and I/l/1. The cap is on codes **outstanding**, not ever issued. The gate sits after the format checks, so a code is not spent on a sign-up that was going to fail anyway. Touches `RoutesAccount.swift` and `Config.swift`, so it joins the sign-up chain (!11 !13 !14 !15) — merge after those. 13 new tests; full relay suite 483 green.

paulhitt commented

2026-09-03 00:03:29 +00:00

(Migrated from gitlab.com)

added 23 commits

802b2121...deb55da5 - 22 commits from branch main
cd790d0a - Member-vouched sign-up codes, wired in and switched off

Compare with previous version

added 23 commits <ul><li>802b2121...deb55da5 - 22 commits from branch <code>main</code></li><li>cd790d0a - Member-vouched sign-up codes, wired in and switched off</li></ul> [Compare with previous version](/paulhitt/flamenet-relay/-/merge_requests/25/diffs?diff_id=2001142085&start_sha=802b2121f38e362751df8b1adbff6703f3c3f773)

paulhitt commented

2026-09-03 00:03:51 +00:00

(Migrated from gitlab.com)

mentioned in commit 08894ef8ff

mentioned in commit 08894ef8ff2d82dc85fb212483354c0f74ed2deb

paulhitt (Migrated from gitlab.com) merged commit 08894ef8ff into main

2026-09-03 00:03:51 +00:00

paulhitt commented

2026-09-09 18:59:17 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#88