From 4f5499198b7fb5e43732108bf026b4d0fe4c3388 Mon Sep 17 00:00:00 2001 From: mrambossek Date: Fri, 31 Jul 2026 19:56:22 +0200 Subject: [PATCH] =?UTF-8?q?build-status:=20server=20v0.3.0=20live=20on=20f?= =?UTF-8?q?mr=20=E2=80=94=20STUN/TCP-echo/observations/actions=20verified?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deployed via self-update (first real run). External checks: stun-5780 advertised, STUN binding OK v4+v6 with OTHER-ADDRESS, TCP echo mss=1440 over IPv6. Co-Authored-By: Claude Opus 5 --- docs/build-status.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/build-status.md b/docs/build-status.md index 3d73007..9afd872 100644 --- a/docs/build-status.md +++ b/docs/build-status.md @@ -224,3 +224,21 @@ externally over v4+v6). UDP data plane on all four service addresses :8442 — t the stun-5780 substrate. Daily randomized self-update timer installed (checksum-verified against SHA256SUMS; signature verification still TODO before treating the source as untrusted). Host config in `/etc/echolot-server.env`. SSH access for sessions: `ssh claude-echolot`. + +## Server v0.3.0 — STUN + TCP echo + observations + actions (2026-07-31) +Shipped and deployed to fmr via the server's own `--self-update` (first real exercise: +checksum-verified download v0.2.0→v0.3.0, atomic replace, restart — worked). Added over v0.2.0: +- **STUN** (RFC 5389 + 5780): 4 service addrs × primary/alt-port grid. Externally verified on + v4 AND v6 — binding success with XOR-MAPPED, RESPONSE-ORIGIN, OTHER-ADDRESS present, so the + profile now advertises **`stun-5780`** (the second IP earns its keep). +- **TCP echo** (:8441): JSON greeting with observed src + real Linux TCP_INFO — verified + externally `mss:1440` (v6, 1500−60), options `[sack,wscale]`, then byte-echo. +- **Observations API** `GET /v1/sessions/{id}/observations` (per-packet UDP view, connect-back + results, TCP records correlated by source IP). +- **Actions** `POST /v1/sessions/{id}/actions`: `delayed_echo` (DELAYED_ECHO at the observed + data-plane source — NAT-lifetime primitive) and `connect_back` (dials the control-plane + source, records connected/refused/timeout+rtt). +- Capabilities computed from what's actually wired: `udp-probe, delayed-echo, connect-back, + tcp-echo, stun-5780`. +Still not implemented: TLS-echo/JA4, HTTP echo, tls-reference, canary DNS (§6.1 reference +records), and the train/big-send/frag/throughput actions. Admin UI still token-mint + health only.