Prove live Iroh relay token rollover before release

.github/workflows/iroh-release-gate.yml

@@ -16,6 +16,7 @@ on:
           - all
           - automatic
           - relay-only
+          - relay-expiry
           - direct-only
           - private-path
 
@@ -58,7 +59,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        mode: ${{ fromJSON(inputs.mode == 'all' && '["automatic","relay-only","direct-only","private-path"]' || format('["{0}"]', inputs.mode)) }}
+        mode: ${{ fromJSON(inputs.mode == 'all' && '["automatic","relay-only","relay-expiry","direct-only","private-path"]' || format('["{0}"]', inputs.mode)) }}
     runs-on: ${{ vars.MACOS_RUNNER_STREAMED_VALIDATION || 'warp-macos-15-arm64-6x' }}
     timeout-minutes: 120
     steps:
@@ -78,13 +79,13 @@ jobs:
           xcrun simctl list runtimes available | grep -Eq '\biOS\b' || xcodebuild -downloadPlatform iOS
 
       - name: Install app build dependencies
-        if: ${{ matrix.mode == 'automatic' || matrix.mode == 'relay-only' }}
+        if: ${{ matrix.mode == 'automatic' || matrix.mode == 'relay-only' || matrix.mode == 'relay-expiry' }}
         run: |
           ./scripts/install-zig-ci.sh
           ./scripts/download-prebuilt-ghosttykit.sh || ./scripts/ensure-ghosttykit.sh
 
       - name: Materialize isolated staging account
-        if: ${{ matrix.mode == 'automatic' || matrix.mode == 'relay-only' }}
+        if: ${{ matrix.mode == 'automatic' || matrix.mode == 'relay-only' || matrix.mode == 'relay-expiry' }}
         env:
           CMUX_DOGFOOD_STACK_EMAIL: ${{ secrets.CMUX_DOGFOOD_STACK_EMAIL }}
           CMUX_DOGFOOD_STACK_PASSWORD: ${{ secrets.CMUX_DOGFOOD_STACK_PASSWORD }}
@@ -105,6 +106,7 @@ jobs:
           case "${{ matrix.mode }}" in
             automatic) TAG=irgaut ;;
             relay-only) TAG=irgrel ;;
+            relay-expiry) TAG=irgexp ;;
             direct-only) TAG=irgdir ;;
             private-path) TAG=irgprv ;;
           esac

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxTransport.swift

@@ -410,6 +410,41 @@ public protocol CmxByteTransport: Sendable {
     func close() async
 }
 
+/// Optional privacy-safe identity for the exact native connection underneath a
+/// byte transport.
+///
+/// Release gates use this to prove that credential refresh did not replace a
+/// live transport. The value is process-local and must never be persisted or
+/// sent to a server.
+public protocol CmxByteTransportContinuityIdentifying: CmxByteTransport {
+    /// Returns a process-local identifier for the currently connected native
+    /// transport, or `nil` before connection or after teardown.
+    func transportContinuityID() async -> UInt64?
+}
+
+/// A privacy-safe handle that waits for one exact native transport to close.
+///
+/// The handle captures the transport generation at creation time, so callers
+/// can retain it across owner teardown without accidentally observing a later
+/// replacement connection.
+public struct CmxTransportClosureObservation: Sendable {
+    private let waitUntilClosedOperation: @Sendable () async -> Void
+
+    public init(waitUntilClosed: @escaping @Sendable () async -> Void) {
+        self.waitUntilClosedOperation = waitUntilClosed
+    }
+
+    public func waitUntilClosed() async {
+        await waitUntilClosedOperation()
+    }
+}
+
+/// Optional close notification for the exact native transport currently
+/// installed underneath a byte transport.
+public protocol CmxByteTransportClosureObserving: CmxByteTransport {
+    func transportClosureObservation() async -> CmxTransportClosureObservation?
+}
+
 /// Independently framed server-event bytes delivered outside the RPC control stream.
 public typealias CmxIndependentEventByteStream = AsyncThrowingStream<Data, any Error>
 

Packages/Shared/CmuxIrohTransport/Package.swift

@@ -18,7 +18,7 @@ let package = Package(
         .package(path: "../CMUXMobileCore"),
         .package(
             url: "https://github.com/manaflow-ai/iroh-ffi.git",
-            exact: "1.0.2-cmux.3"
+            exact: "1.0.2-cmux.4"
         ),
     ],
     targets: [

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientRuntime+Policy.swift

@@ -157,7 +157,8 @@ extension CmxIrohClientRuntime {
                 localBindingExpectation: policy.expectation,
                 managedRelayURLs: managedRelayURLs,
                 allowedRouteRelayURLs: endpointRelayProfile.allowedRelayURLs,
-                offlinePolicy: offlinePolicy
+                offlinePolicy: offlinePolicy,
+                verifiedDiscovery: policy.discovery
             )
             provider = registryContextProvider
         } else {
@@ -171,6 +172,7 @@ extension CmxIrohClientRuntime {
                 offlinePolicy: offlinePolicy,
                 lanFallback: lanFallback,
                 customPrivateFallback: customPrivateFallback,
+                verifiedDiscovery: policy.discovery,
                 now: now
             )
             registryContextProvider = provider
@@ -194,6 +196,7 @@ extension CmxIrohClientRuntime {
                 broker: broker,
                 managedRelayURLs: managedRelayURLs,
                 selectedRelayURLs: endpointRelayProfile.allowedRelayURLs,
+                automaticRefreshEnabled: automaticRelayCredentialRefreshEnabled,
                 credentialDidInstall: { [handleRelayCredential] response in
                     await handleRelayCredential(response, policy.binding)
                 }
@@ -203,13 +206,17 @@ extension CmxIrohClientRuntime {
 
         let bootstrap = startRelays ? configuration.cachedRelayCredential : nil
         if startRelays || bootstrap != nil {
+            let requiresRelayReadiness = !protocolConfiguration
+                .allowsNATTraversalAfterAdmission
             do {
                 try await coordinator.activate(
                     bindingID: policy.binding.bindingID,
                     endpointIdentity: policy.binding.endpointID,
-                    bootstrap: bootstrap
+                    bootstrap: bootstrap,
+                    waitForInitialCredential: requiresRelayReadiness
                 )
             } catch {
+                if requiresRelayReadiness { throw error }
                 // Registration remains authoritative; direct paths remain usable.
             }
         }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientRuntime+RelayPolicy.swift

@@ -106,6 +106,7 @@ extension CmxIrohClientRuntime {
             broker: broker,
             managedRelayURLs: replacementManagedURLs,
             selectedRelayURLs: profile.allowedRelayURLs,
+            automaticRefreshEnabled: automaticRelayCredentialRefreshEnabled,
             credentialDidInstall: { [handleRelayCredential] response in
                 await handleRelayCredential(response, binding)
             }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientRuntime.swift

@@ -77,6 +77,7 @@ public actor CmxIrohClientRuntime {
     let lanFallback: LANFallbackProvider?
     let customPrivateFallback: CustomPrivateFallbackProvider?
     let now: @Sendable () -> Date
+    let automaticRelayCredentialRefreshEnabled: Bool
     let handleBinding: BindingHandler
     let handleCachedBindings: CachedBindingsHandler
     let handleRelayCredential: RelayCredentialHandler
@@ -136,6 +137,7 @@ public actor CmxIrohClientRuntime {
         lanFallback: LANFallbackProvider? = nil,
         customPrivateFallback: CustomPrivateFallbackProvider? = nil,
         now: @escaping @Sendable () -> Date = { Date() },
+        automaticRelayCredentialRefreshEnabled: Bool = true,
         handleBinding: @escaping BindingHandler = { _, _ in true },
         handleCachedBindings: @escaping CachedBindingsHandler = { _, _ in },
         handleRelayCredential: @escaping RelayCredentialHandler = { _, _ in },
@@ -175,6 +177,7 @@ public actor CmxIrohClientRuntime {
         self.lanFallback = lanFallback
         self.customPrivateFallback = customPrivateFallback
         self.now = now
+        self.automaticRelayCredentialRefreshEnabled = automaticRelayCredentialRefreshEnabled
         self.handleBinding = handleBinding
         self.handleCachedBindings = handleCachedBindings
         self.handleRelayCredential = handleRelayCredential
@@ -188,6 +191,12 @@ public actor CmxIrohClientRuntime {
         currentSnapshot
     }
 
+    /// Returns the non-secret hard expiry of the relay credential currently
+    /// installed on the live endpoint.
+    public func relayCredentialExpiresAt() async -> Date? {
+        await relayCoordinator?.credentialExpiresAt()
+    }
+
     /// Monotonic count of online broker snapshots verified by this runtime.
     public func liveDiscoverySnapshotGeneration() -> UInt64 {
         liveDiscoveryGeneration

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientSession.swift

@@ -199,6 +199,18 @@ public actor CmxIrohClientSession {
         return await connection.isClosed()
     }
 
+    /// Returns Iroh's process-local identity for this exact admitted QUIC
+    /// connection. Alternate endpoint implementations may not provide one.
+    func connectionContinuityID() async -> UInt64? {
+        guard !closed,
+              let connection,
+              let continuityConnection = connection as? any CmxIrohConnectionContinuityIdentifying else {
+            return nil
+        }
+        guard !(await connection.isClosed()) else { return nil }
+        return await continuityConnection.connectionContinuityID()
+    }
+
     /// Reads package-private path evidence from the exact admitted connection.
     func observedSelectedPath() async -> CmxIrohObservedConnectionPath {
         guard let connection = connection as? any CmxIrohConnectionPathInspecting else {

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohConnectionContinuityIdentifying.swift

@@ -0,0 +1,7 @@
+/// Package-private access to Iroh's process-local stable connection identity.
+///
+/// Keeping this separate from ``CmxIrohConnection`` means alternate endpoint
+/// implementations do not need to expose a native diagnostic handle.
+protocol CmxIrohConnectionContinuityIdentifying: Sendable {
+    func connectionContinuityID() async -> UInt64
+}

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohDeferredByteTransport.swift

@@ -2,7 +2,11 @@ import CMUXMobileCore
 import Foundation
 
 /// Defers transport construction until the signed-in runtime finishes activation.
-actor CmxIrohDeferredByteTransport: CmxByteTransport {
+actor CmxIrohDeferredByteTransport:
+    CmxByteTransport,
+    CmxByteTransportClosureObserving,
+    CmxByteTransportContinuityIdentifying
+{
     private let request: CmxByteTransportRequest
     private let provider: any CmxIrohDeferredTransportProviding
     private var connectTask: Task<any CmxByteTransport, any Error>?
@@ -79,4 +83,18 @@ actor CmxIrohDeferredByteTransport: CmxByteTransport {
         transport = nil
         await closing?.close()
     }
+
+    func transportContinuityID() async -> UInt64? {
+        guard let identifying = transport as? any CmxByteTransportContinuityIdentifying else {
+            return nil
+        }
+        return await identifying.transportContinuityID()
+    }
+
+    func transportClosureObservation() async -> CmxTransportClosureObservation? {
+        guard let observing = transport as? any CmxByteTransportClosureObserving else {
+            return nil
+        }
+        return await observing.transportClosureObservation()
+    }
 }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohHostRuntime.swift

@@ -269,7 +269,8 @@ public actor CmxIrohHostRuntime {
                     try await relayCoordinator.activate(
                         bindingID: policy.binding.bindingID,
                         endpointIdentity: endpointID,
-                        bootstrap: policy.relayBootstrap
+                        bootstrap: policy.relayBootstrap,
+                        waitForInitialCredential: true
                     )
                 }
                 try requireCurrent(revision)

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohLibConnection.swift

@@ -2,7 +2,11 @@ import CMUXMobileCore
 import Foundation
 import IrohLib
 
-struct CmxIrohLibConnection: CmxIrohConnection, CmxIrohConnectionPathInspecting {
+struct CmxIrohLibConnection:
+    CmxIrohConnection,
+    CmxIrohConnectionContinuityIdentifying,
+    CmxIrohConnectionPathInspecting
+{
     let driver: Connection
     let peerIdentity: CmxIrohPeerIdentity
 
@@ -15,6 +19,10 @@ struct CmxIrohLibConnection: CmxIrohConnection, CmxIrohConnectionPathInspecting
         peerIdentity
     }
 
+    func connectionContinuityID() async -> UInt64 {
+        driver.stableId()
+    }
+
     func observedSelectedPath() async -> CmxIrohObservedConnectionPath {
         CmxIrohObservedConnectionPath(
             snapshots: driver.paths().map(CmxIrohConnectionPathSnapshot.init)

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohPooledByteTransport.swift

@@ -2,7 +2,11 @@ import CMUXMobileCore
 import Foundation
 
 /// Projects a pooled admitted session's control lane through the legacy byte seam.
-actor CmxIrohPooledByteTransport: CmxByteTransport {
+actor CmxIrohPooledByteTransport:
+    CmxByteTransport,
+    CmxByteTransportClosureObserving,
+    CmxByteTransportContinuityIdentifying
+{
     private let request: CmxByteTransportRequest
     private let pool: CmxIrohClientSessionPool
     private let ownerID = UUID()
@@ -73,6 +77,17 @@ actor CmxIrohPooledByteTransport: CmxByteTransport {
         )
     }
 
+    func transportContinuityID() async -> UInt64? {
+        await session?.connectionContinuityID()
+    }
+
+    func transportClosureObservation() -> CmxTransportClosureObservation? {
+        guard let session else { return nil }
+        return CmxTransportClosureObservation {
+            await session.waitUntilClosed()
+        }
+    }
+
     private func releaseOwnedControlSession(
         reason: DiagnosticSessionLifecycleKind,
         failure: DiagnosticFailureKind