Repository navigation
P3.7 test access: browser/Wasm peer page for phone runs + laptop VM NAT emulation #1826
Description
Origin
Owner ruling on #795 (Drew, 2026-10-28). The issue was blocked on 'owner provides two networks', framed as two home-style networks with a host on each. Drew's answer, in substance:
- He does not have a second computer on a second home network, and no VPC / paid networking will be set up for this — any server we run would be a plain host (e.g. plain OVH), not a VPC.
- He WILL run a test himself if it is runnable from a website on his phone (Wasm is fine), or from a mobile app.
- VMs on the laptop with an emulated NAT configuration are acceptable for the cells a phone cannot cover.
- His phone on carrier NAT is not a second home network — but per the id phase-3: P3.7 real-network holepunch and n0 QAD tests on two networks are owner-blocked with no tracking issue #795 discussion it IS a legitimate test cell (see below).
Plan
- Browser/Wasm peer page (the real-network cell). A static page carrying a Wasm build of the id connectivity test peer (or the smallest harness that exercises the same holepunch + n0 QAD paths). Drew opens it on his phone: phone on the carrier network, the other peer on the laptop at home. Carrier CGNAT vs home NAT is a real, hard, and realistic cell — it is the pairing actual mobile users present — and it needs zero installs and zero new hardware.
- Laptop VM NAT emulation (the remaining cells). A VM test config on the laptop placing peers behind different emulated NAT types (full-cone / restricted / symmetric) to cover the home-NAT x home-NAT combinations no available hardware provides. Emulated results are recorded AS emulated — never presented as real-network measurements (the acceptance brief's 'not falsely passed' rule cuts both ways).
Acceptance criteria
- The peer page loads on Drew's phone browser and completes a holepunch + QAD check against the laptop peer, with results recorded on id phase-3: P3.7 real-network holepunch and n0 QAD tests on two networks are owner-blocked with no tracking issue #795 (NAT types observed on both ends included).
- The VM emulation config exists, is reproducible from the repo, and runs the C2 matrix cells the phone pairing cannot cover; results recorded on id phase-3: P3.7 real-network holepunch and n0 QAD tests on two networks are owner-blocked with no tracking issue #795 and labeled emulated.
- id phase-3: P3.7 real-network holepunch and n0 QAD tests on two networks are owner-blocked with no tracking issue #795's acceptance is updated to this plan (its 'two owner-provided networks' criterion is superseded by the owner's ruling above).
Metadata
Metadata
Assignees
Labels
Package/app: id (pkgs/ or apps/ in this repo)Medium: expected under 1 day of workTest coverage, test infrastructure, or test-only fixesIntake review done: acceptance criteria, links, and normalized labels addedOrdinary priority (the default)Filed directly by a humanTriaged and routed (see agent note)
Activity
developing-today commentedon Oct 28, 2026
CODE-755
dezren39 commentedon Oct 28, 2026
Intake review
Fleet monitor intake pass (protocol §5), 2026-10-28.
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
Triage verdict (queue task 7751, lane ec118cad) — still live, but AC1 as written is not implementable; split filed
Verified against
origin/mainatd3476bce7(2026-11-03). No PR or branch implements any part of this plan (gh search prs 1826→ nothing; no doc references the issue).1. Browser/Wasm peer page: a browser cannot be an iroh holepunch/QAD peer
This is a capability limit, not a missing implementation:
spawn_qad_probesand the QAD streams are#[cfg(not(wasm_browser))], with empty streams on wasm (iroh-1.3.0/src/net_report.rs:344-385).pkgs/id/crates/id-core/src/connectivity.rs:12-15is the only connectivity code and is native (iroh::Endpoint,tokio); there is nowasm32target, cfg or wasm-bindgen path anywhere underpkgs/id.pkgs/id/webis the server-backed editor UI over a WebSocket (pkgs/id/web/src/collab.ts:2,111), and every.wasmunderpkgs/idis a Roc app/world module, not a peer.doc/2026-10-28T23-34-14Z_investigation_cloudflare_workers_fit/…md:21-26,167-172) and the id: design: ID serverless edition v1 (Cloudflare Workers) #2046 design keeps browsers on HTTPS/WebSocket (doc/2026-11-01_design_id2046.md:60,62).So "the peer page loads on Drew's phone browser and completes a holepunch + QAD check" cannot be satisfied by a page. Drew's ruling asked for something he can run from his phone and offered "Wasm is fine, or a mobile app" — the mobile-app branch is the viable one, and it is already filed as #1831 (Android app, which the owner direction explicitly calls "a native phone peer for this issue's test line"). Re-scoping AC1 to #1831 stays inside the ruling; it is not a new owner decision.
What remains honestly achievable in a browser: a static page that displays a run performed by the native peers (phone app ↔ laptop peer), showing the observed NAT types, path (direct/relay) and QAD result. It is a result viewer, not a measured peer, and must be labelled that way.
2. Laptop VM NAT emulation: already built, but not reproducible from the repo
The C2 matrix already runs over emulated NAT types on Linux netfilter:
doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/lab/topo.sh:41-74— cone (masquerade+ static DNAT), restricted (masquerade), symmetric (masquerade fully-random), withprobe-nat.shverifying each independently.…/c2-holepunch/RESULTS.md:96-123— full and mixed matrix (cone×cone, restricted×restricted, symmetric→relay, cone×symmetric, cone×restricted, symmetric×restricted), all labelled as emulation, with "real NAT devices and real networks" recorded untested (RESULTS.md:170).The gap is reproducibility, not the config:
…/c2-holepunch/Cargo.toml:14depends on/home/user/work/spikes/c1-connect, andlab/run.sh:24-26+lab/probe-nat.sh:14hardcode nix-store binary paths. Nobody else can re-run the matrix from a clean checkout.Split filed: #4984 — de-hardcode the paths, add a Nix/flake entry point, run it once end-to-end, and post the results to #795 labelled emulated. This is the actionable half and is queued as a bounded fix.
3. Blockers and ordering
status/blockeduntil then — do not mark the matrix passed on emulation alone.Labels:
queue/queued+status/needs-triage→status/triaged, keepingkind/test,priority/normal,effort/m,app/id,meta/enriched.🤖 Agent note · triaged
ec118cad-0fd3-4652-91c4-27432f2f2efdd3476bce7; found AC1 infeasible as drafted (browser cannot be an iroh UDP/QAD peer) and re-scoped the phone leg to the already-filed Proof-of-concept Android app + input interface extension (touch, mouse, hover) for relaying into live apps #1831 Android peer; split AC2's actionable half into id: make the C2 NAT-emulation lab reproducible from the repo (de-hardcode paths, add a runnable entry point) #4984 (reproducible emulated NAT matrix).dezren39 commentedon Nov 4, 2026
The VM-emulation acceptance item is now checked based on PR #5665 and the results recorded on #795. The documented Nix entry point completed three NAT probes and all nine ordered C2 pairs, all with dial exit 0; the results are explicitly labeled Linux netfilter emulation, not real-network measurements. The separate phone/carrier-network leg remains open and #795 stays blocked pending that work.