build: select iroh TLS backend explicitly (tls-aws-lc-rs) instead of defaults

[themiguelamador]

What

Declares the iroh dependency explicitly in the five crates that use it (mesh-llm-protocol, mesh-llm-routing, mesh-client, mesh-llm-commands, mesh-llm-host-runtime), replacing the bare iroh = "1.0.0" with default-features = false plus the same feature set iroh's defaults enable today — except tls-ring, which is swapped for tls-aws-lc-rs.

Why

Cargo features are additive: a bare iroh = "1.0.0" enables iroh's default feature, which includes tls-ring, and no downstream consumer can subtract it. When both TLS backends are compiled in, iroh prefers ring — so any embedder of the mesh-llm SDK ships ring in its binary no matter what it does in its own manifest.

For deployments that need FIPS 140-3 alignment this is a hard blocker: ring is not FIPS-validated, while aws-lc-rs has a validated mode and is what rustls' FIPS story is built on. Today the only workaround is [patch.crates-io]-ing iroh itself to redefine its defaults, which every embedder has to carry independently.

With this change the resolved graph (normal deps) becomes:

├── iroh feature "fast-apple-datapath"
├── iroh feature "metrics"
├── iroh feature "portmapper"
└── iroh feature "tls-aws-lc-rs"

— no default, no tls-ring.

Notes

• Behavior is unchanged — iroh supports both backends equivalently; this only pins which one is compiled in.
• Dev-dependencies are untouched (mesh-llm-host-runtime's iroh/iroh-relay test deps) — they don't propagate to consumers.
• Verified with cargo tree -e normal,features -i iroh (output above) and cargo check on all five crates.
• If you'd prefer to keep ring as the project default, the alternative is passthrough tls-ring/tls-aws-lc-rs features plumbed through every crate between the SDK surface and iroh. That's a much larger diff; happy to rework this PR that way if you want backend choice rather than a swap.

Summary by CodeRabbit

• Improvements
  • Improved connection performance on Apple devices.
  • Enabled port mapping and connection metrics.
  • Added AWS-LC-RS TLS support for secure connections.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6f49776-bdee-4e94-b7cd-b58f149c3603

📥 Commits

Reviewing files that changed from the base of the PR and between e4c839c and de24ffd.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• crates/mesh-client/Cargo.toml
• crates/mesh-llm-commands/Cargo.toml
• crates/mesh-llm-host-runtime/Cargo.toml
• crates/mesh-llm-protocol/Cargo.toml
• crates/mesh-llm-routing/Cargo.toml

🚧 Files skipped from review as they are similar to previous changes (5)

• crates/mesh-llm-protocol/Cargo.toml
• crates/mesh-llm-commands/Cargo.toml
• crates/mesh-client/Cargo.toml
• crates/mesh-llm-host-runtime/Cargo.toml
• crates/mesh-llm-routing/Cargo.toml

---

📝 Walkthrough

Walkthrough

The five mesh crates now configure iroh explicitly. They disable default features and enable metrics, fast Apple datapath, port mapping, and AWS-LC-RS TLS.

Changes

iroh feature configuration

Layer / File(s)	Summary
Configure explicit iroh features crates/mesh-client/Cargo.toml, crates/mesh-llm-commands/Cargo.toml, crates/mesh-llm-host-runtime/Cargo.toml, crates/mesh-llm-protocol/Cargo.toml, crates/mesh-llm-routing/Cargo.toml	The five iroh dependencies disable default features and explicitly enable metrics, fast-apple-datapath, portmapper, and tls-aws-lc-rs.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• Mesh-LLM/mesh-llm#1071: Both PRs modify iroh dependency configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: explicitly selecting the iroh AWS-LC-RS TLS backend instead of default TLS features.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[i386]

Thanks for your first contribution! I'll get this reviewed.

[i386]

Approved — the explicit features match iroh 1.0.0's defaults, with only tls-ring replaced by tls-aws-lc-rs. No issues found.

[i386]

@michaelneale Net effect: iroh will use AWS-LC-RS rather than ring for TLS. Normal mesh networking behavior should be unchanged; the benefit is that SDK embedders are no longer forced to include ring, making FIPS-oriented builds possible without patching iroh. This alone does not make the full mesh-llm distribution FIPS-certified—the full crypto stack and AWS-LC configuration still determine that.