* feat: enforce per-epoch budget in RateLimitManager.admit
Replaces the pass-through skeleton with a lazily rolled fixed window:
admit() charges one message against the current epoch, resets the
counter once epochPeriodSec has elapsed, and rejects with OverBudget
when messagesPerEpoch is exhausted. Disabled or non-positive
configurations admit everything, so the default-constructed
MessagingClientConf (enabled = false) keeps today's behaviour.
Parking of over-budget messages stays with the SendService scheduler
(NextRoundRetry); the manager only answers whether one more
transmission fits. The queue / dequeueReady stubs that anticipated
manager-side parking are removed accordingly.
Extends tests/messaging/test_rate_limit_manager.nim with budget
boundary, epoch rollover, resetEpoch, and degenerate-config cases,
replacing the enabled-pass-through placeholder test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: split rate limit manager into config, quota source, and enforcement modules
Decomposes logos_delivery/messaging/rate_limit_manager/ into three
modules with one responsibility each:
- rate_limit_config: the configuration vocabulary (RateLimitConfig,
RateLimitError, defaults, isEnforcing). The API conf layer now
imports this alone instead of the enforcement engine.
- quota_source: the RLN seam. A single QuotaProvider callback returns
EpochQuota (epoch index + user message limit) so the two are read
atomically and a read cannot straddle an epoch boundary. Returns
none when RLN is unavailable, selecting the wall-clock fallback. The
callback shape keeps the manager free of any dependency on the Waku
kernel; the RLN-backed provider is built one layer up.
- rate_limit_manager: enforcement only; re-exports the other two so
existing single-import call sites are unchanged.
Config field names now mirror RLN exactly, per the requirement that the
rate limit share RLN Relay's format: epochSizeSec (was epochPeriodSec)
and userMessageLimit (was messagesPerEpoch), both uint64 to match
RlnConf. Renaming is contained to this branch: the config type moved
into the new rate_limit_config module here.
admit() now works in epoch-index terms: the epoch comes from the
provider when set (RLN's calcEpoch value), else from an absolute
wall-clock window (unixTime div epochSizeSec — absolute rather than
anchored at first use, matching RLN's derivation). The effective limit
is min(config.userMessageLimit, RLN's) — RLN can only tighten the
configured limit, since exceeding it would fail at proof generation
once the epoch's message ids are exhausted.
With no provider wired (this commit), behaviour is the wall-clock
window as before; RLN-backed provider wiring follows separately.
Tests rewritten against injected fake providers: limit boundary, epoch
rollover without sleeps, RLN-clamps-config, config-tightens-below-RLN,
and the wall-clock fallback (7 tests).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: charge admission once per task and exempt budget-parked tasks from the reaper
Two defects the send-service seam had once admission actually enforces,
both fixed by a single DeliveryTask.firstAdmittedTime field:
- The retry loop gated admission on firstPropagatedTime.isNone(), so a
task that failed to propagate (e.g. no peers) was re-admitted on every
1s tick, re-charging the epoch budget and — with the shipped default of
one message per epoch — starving all other traffic. Admission is now
gated on firstAdmittedTime.isNone(): a task charges one slot / draws one
nonce for its lifetime, and retries reuse it.
- reportTaskResult reaped any never-propagated task older than
MaxTimeInCache (60s) measured from message creation, so an over-budget
task parked for a 600s epoch was hard-failed with a misleading "Unable
to send within retry time window" long before the epoch could roll
(issue #4049). The reaper now runs only for admitted tasks and measures
from admission, so a task waiting for epoch budget is exempt and gets a
full delivery window once it is finally admitted.
The RLN-rejection branch in both processors resets firstAdmittedTime
along with clearing the proof, so the regenerated proof's fresh nonce is
re-admitted rather than sent uncharged.
The reap decision is extracted to DeliveryTask.isDeliveryTimedOut and
unit-tested (tests/messaging/test_delivery_task_reaping.nim); a
scheduler-level integration test of park-and-release is a follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: source the rate limit manager's epoch and budget from RLN
Wires the quota seam to its producer, so enforcement tracks RLN rather
than only the wall clock.
- Waku.currentRlnEpochQuota (waku/api/publish) reads RLN's current epoch
index and the epoch's user message limit together, returning none when
RLN is not mounted (or its limit is unset).
- MessagingClient.new builds a QuotaProvider closure over that accessor
and hands it to the RateLimitManager. The closure is late-binding: it
queries the kernel on each admission, so a node whose RLN mounts after
construction upgrades from the wall-clock fallback to RLN's epoch and
limit automatically, with no reconstruction.
With this, admit() rolls its window on RLN's epoch and clamps the
configured cap to RLN's user message limit; without RLN it still falls
back to the absolute wall-clock window and the configured limit.
Also switches the quota seam from std/options to results `Opt`, matching
the kernel surface it now bridges (`groupManager.userMessageLimit` is
`Opt`) and the rest of the messaging layer post-Opt migration.
Tests: currentRlnEpochQuota is none unmounted and reports epoch + the
configured userMessageLimit when mounted (anvil-backed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: cover admit-once and park/release at the send service scheduler
The rate limit manager's budget logic and the delivery-timeout reaper are
unit-covered, but the send service's use of them across the service loop was
not. Drive the scheduler a tick at a time against a scripted fake processor
and a fixed-epoch quota provider — no network, no sleeps — asserting:
- a task is charged against the budget exactly once however many rounds
delivery takes (firstAdmittedTime guards re-admission);
- an over-budget task parks as NextRoundRetry without reaching the processor,
then is admitted and delivered on the first tick after the epoch rolls.
Two testability seams keep this deterministic without a live relay: an
optional sendProcessor override on SendService.new injects the fake, and
trySendMessages is exported to drive one loop tick. The task is built
directly (like test_delivery_task_reaping) since DeliveryTask.new resolves
its shard through a broker provider only registered once the node starts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs: note rateLimit config is settable only programmatically
MessagingClientConf.rateLimit cannot be set through the JSON config or a CLI
flag: it carries no name pragma, and RateLimitConfig is a nested object with
no parseCmdArg, so applyJsonFieldsToConf rejects it with "cannot be set via
JSON". Record the limitation and the fix path on the field.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* refactor: consolidate the admission gate into admitOnce
send() and the retry loop duplicated the admit-then-stamp-firstAdmittedTime
sequence; both now call SendService.admitOnce, keeping the charge-once
invariant in one place.
No behavior change; messaging tests pass (14/14).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* use explicit return statement
* Make comments mroe concise
* refactor: give each rate-limit config field a single responsibility
`isEnforcing` folded three fields into one "should I enforce" answer, so a
zeroed `messagesPerEpoch` or `epochPeriodSec` silently disabled an enabled
config. Split the responsibilities:
- `enabled` alone gates enforcement; `admit` reads it directly and
`isEnforcing` is removed.
- a zero `messagesPerEpoch` now means what it says — admit nothing — which
`admit` already yields (`0 >= 0` -> OverBudget), no special case.
- `RateLimitManager.new` returns a Result and rejects an enabled config with
`epochPeriodSec == 0`, the only value that could crash the wall-clock
fallback (`unixTime div epochPeriodSec`).
Callers thread the Result through; a zero-init `RateLimitConfig` stays valid
(disabled), so default construction is unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: drop rate-limit stage from reliable channel send pipeline
Collapses the outgoing pipeline to `segmentation -> sds -> encryption ->
dispatch` by folding the encrypt-and-dispatch tail of `onReadyToSend`
directly into `send()`. Removes the `RateLimitManager` field, its
constructor param, the `ReadyToSendEvent` listener, and the
`awaitingDispatch` accounting that only existed to bridge the event-bus
hop between `send()` and `onReadyToSend`.
The `rate_limit_manager.nim` module itself is untouched — it will be
relocated to the messaging layer (co-located with RLN) in a follow-up
commit, where per-epoch admission actually belongs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: relocate RateLimitManager to messaging layer
Moves rate_limit_manager.nim from `logos_delivery/channels/` to
`logos_delivery/messaging/rate_limit_manager/` — the correct owner
now that admission sits alongside RLN in the messaging layer instead
of being fanned out to per-channel event listeners.
The API surface changes:
- `enqueueToSend` + `ReadyToSendEvent` (broker-based fan-out to a
ReliableChannel listener) is replaced by `admit(msg): Future[Result[
void, RateLimitError]]`. Callers now branch directly on the result
instead of subscribing to an event.
- `channelId`, `SdsChannelID` and the SDS import are dropped — the
messaging layer has no notion of channels; SDS was a channels-layer
concern that only survived on this type because of the old broker
fan-out.
- `brokerCtx` is dropped for the same reason.
Epoch config (`epochPeriodSec`), the wall-clock `currentEpochStart`,
`queue`, `dequeueReady`, and `resetEpoch` are preserved exactly as the
original owner designed them — this refactor is intentionally scoped
to the API surface, not the epoch mechanism.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: meter SendService transmissions through RateLimitManager
Wires the relocated RateLimitManager into the messaging layer at the
transmission stage rather than the API entry point:
- MessagingClientConf gains a rateLimit: RateLimitConfig field
(defaulting to DefaultEpochPeriodSec / DefaultMessagesPerEpoch), and
MessagingClient.new hands the constructed manager to SendService.
- SendService consults admit() before the first transmission of a
task, both in send() and in the retry loop. Re-publishes of an
already-propagated message (firstPropagatedTime set) skip admission:
they resend the same bytes, which reuse the same RLN proof/nullifier
and consume no fresh epoch slot.
- An over-budget task parks in the task cache as NextRoundRetry; the
service loop re-admits it as the epoch budget frees up. The skeleton
admit() is a pass-through, so behaviour is unchanged today.
Gating transmissions instead of MessagingClient.send keeps SDS repair
rebroadcasts free of API-entry rejection (SDS decides that a repair is
needed; the transmission scheduler decides when it fits the budget)
while every wire transmission still draws from one node-wide budget --
which network-side RLN enforcement applies to repairs regardless of
any local bypass. It is also where RLN proof attachment must happen,
since proofs bind to the epoch current at transmission time.
Adds tests/messaging/test_rate_limit_manager.nim covering the current
disabled + enabled pass-through behaviour, wired into
all_tests_waku.nim.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: make MessagingClientConf.rateLimit reachable, warn on dead channel knobs
Addresses two review findings on the move PR:
- `rateLimit` was a plain `RateLimitConfig`, but `merge` only copies
`Opt` fields (`when oField is Opt`), so every override path
(`LogosDeliveryConf.init`, JSON `messagingOverrides`) silently dropped
it and the field was always taken from `base` — unsettable by any
caller. Make it `Opt[RateLimitConfig]` like every other field;
`MessagingClient.new` falls back to `DefaultRateLimitConfig` (new
const, rate limiting disabled) when unset. Adds a merge test.
- The channel-level knobs (`rateLimitEnabled` /
`rateLimitEpochPeriodSec` / `rateLimitMessagesPerEpoch`) are still
parsed but unread since rate limiting moved to the messaging client,
so setting them was silently ignored. `ReliableChannelManager.new`
now logs a deprecation warning when any is set. Full removal remains a
follow-up API decision.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* WIP logosdeliverynode app initial commit
* WIP - extra cli option
* WIP: messaging client REST endpoints
* Add event poll for messaging rest with cache mechanism
* Messaging rest tests
* test: assert 404 via raw string client in messaging REST test
presto's typed REST client raises RestDecodingError when it cannot decode
a non-2xx text error body into the response type. Add a RestResponse[string]
stub (messagingGetSendEventsByIdRawV1) and point the "already-polled id ->
404" assertion at it, matching the relay REST test pattern.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* remove customized cli args as confutils has no support for it
* Introduce --entry-layer and re-introduce --mode flags into cli args, applied new driver into LogosDelivery + tests
* Add messaging REST client test
* Add docker image build of logosdeliverynode for CI builds
* Fix tests
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Refactor Messaging REST API to better match Messaging Send and Receive APIs
* chore: migrate messaging REST API to Opt[T]
Follow-up to the rebase onto master's repo-wide Option[T] -> Opt[T] change
(#4035). Converts the code this branch adds to the new convention:
- messaging/rest_api/types.nim: MessagingJsonEnvelope fields to Opt[T],
Opt.some/Opt.none, and json_serialization/pkg/results instead of
json_serialization/std/options.
- tests: WakuNodeConf.clusterId is now Opt[uint16]; DTO fields are Opt.
`Option[ContentBody]` in the handlers is presto's own API and stays as-is.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* move MessagingClientConf to api/conf/messaging_conf
* move ReliableChannelManagerConf to new api/conf/channels_conf
* impl modules now import their conf module, not the reverse
* logos_delivery_conf uses channels_conf, not reliable_channel_manager
* cleanup import lists
* remove --mode from the CLI
* move WakuMode to the messaging layer
* expose store backend (db url, max connections) and a remote store node on the messaging surface
* wakunode2 with no flags now runs as a full service node (store still opt-in)
* add rateLimitMessagesPerEpoch
* channel rate-limiting auto-enables if epochPeriodSec or messagesPerEpoch is set
* fix JSON conf parser to be generic (works over all config types)
* messaging config = mode + preset + messagingOverrides + channelsOverrides
* add full messaging plus selective kernel config options to MessagingClientConf
* mode (Core/Edge) expands to kernel protocol flags in the messaging layer
* create_node parses the messaging config, drops the flat WakuNodeConf JSON entrypoint
* wire channelsOverrides (segmentation/SDS/rate-limit) into channel creation
* fix liblogosdelivery.h comments and README for the new config shape
* messaging conf tests: switch names, reject-unknown, set-twice, field->kernel
* add kernel log-level, log-format, nodekey to the messaging surface
* Port 0 (ephemeral) default for messaging entry points
* KernelConf alias for WakuNodeConf
* rewrite the FFI examples to the new config shape
* C/C++ examples use preset status.prod
* drop operator-only confs from the examples
* remove duplicate tests & misc test fixes
* Delete p2pReliability from Kernel (Waku) resolver and config (keep preset definition)
* Delete NodeConfig API (deprecation completed by p2pReliability removal from kernel)
* Rename test_messaging_conf.nim to test_conf.nim (tests Logos Delivery config in general)
* Rename messaging_conf_json.nim to logos_delivery_conf_json.nim
* Add logos_delivery_conf.nim (defines LogosDeliveryConf aggregate)
* misc docs/comments cleanups
* squash original commits and rebase to master: removed sendHandler and replaced by MessagingSend BrokerRequest
* Needed to adapt to new messaging source structure to avoid cyclic imports
* Relocate MessagingSend request broker and eliminate api/requests
* fix ci fails
* Reshape per-layer API into api/ folders and thin the FFI over them
Each layer now separates its constructible core from its public surface:
- core module (waku.nim / messaging_client.nim /
reliable_channel_manager.nim): the type plus new/start/stop and the
private construction helpers.
- api/ folder: one module per differentiated set of operations
(waku: topics/relay/filter/lightpush/store/peer_manager/discovery/
debug/health) plus an events surface.
The waku api is reshaped to be the complete operation surface the C
bindings need, so the library no longer reaches into node internals:
relayPublish returns the message hash, relaySubscribe takes an optional
handler, filter/lightpush auto-select the service peer, connectedPeersInfo
returns structured data, pingPeer honours the timeout, plus
relayNumPeersInMesh / relayNumConnectedPeers / isOnline. library/ is now a
thin C-ABI shim: each {.ffi.} proc only marshals cstring/JSON/callbacks and
delegates to ctx.myLib[].waku.<op> (or messagingClient.<op>).
app_callbacks re-exports the modules defining its handler types, which the
included FFI files previously relied on by leakage.
Events move next to the surface that owns them, with each dependency kept
pointing the right way:
- waku/events/ relocated under waku/api/events/.
- channel events live in channels/api/events.nim.
- the four messaging-level message events move to messaging/api/events;
MessageSeenEvent stays in waku because it is emitted by waku core, so
moving it would make waku depend on the messaging layer.
- delivery_events renamed to filter_subscribe_events to match the
OnFilterSubscribe/Unsubscribe events it actually declares.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Add reliable-channel FFI ops + events (nim-ffi v0.1.3)
Expose the reliable-channel layer through the v0.1.3 FFI:
- channel_create / channel_send / channel_close call the
ReliableChannelManager api (createReliableChannel / send / closeChannel),
marshalling channel id + base64 payload + ephemeral by hand
- channel message received / sent / errored are surfaced by listening to the
channel-layer broker events in start_node and forwarding them through
callEventCallback (received payload base64-encoded), dropped in stop_node
Stays on nim-ffi v0.1.3 (no typed/CBOR rewrite).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Expose reliable-channel ops in the stable C header (#3851)
The library already ships as a single .so with a tiered header surface
(liblogosdelivery.h = stable Messaging/Reliable-Channels, liblogosdelivery_kernel.h
= advanced Kernel). Per that tiering, the reliable-channel ops belong on the
stable surface, so declare channel_create / channel_send / channel_close in
liblogosdelivery.h and document the channel lifecycle events delivered through
the event callback.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Graft PR#3975 interface layer onto decomposed foundation (events deduped)
Add IKernel/IMessagingClient/IReliableChannelManager/ILogosDelivery interface
classes under logos_delivery/api/. The EventBroker types PR#3975 hoisted into
these files already exist in PR#3989's decomposed */api/events/ modules, so the
interface files re-export those modules instead of redefining the types
(avoids 8 duplicate EventBroker definitions). api/types.nim kept at the
foundation version (ChannelId stays in channels/types.nim, which the decomposed
modules import).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Wire impl classes to interfaces (inherit; relocate SendHandler)
- Waku : IKernel, MessagingClient : IMessagingClient,
ReliableChannelManager : IReliableChannelManager.
- The operation procs already live in PR#3989's decomposed */api/ modules and
stay as plain procs (nothing dispatches through the interface types, so no
method-ization is needed).
- SendHandler now lives in reliable_channel_manager_api.nim (its PR#3975 home);
removed the duplicate from reliable_channel.nim, which re-exports the
interface module so channels/api/{channel_lifecycle,send} still see it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Wire LogosDelivery to ILogosDelivery orchestrator interface
LogosDelivery : ILogosDelivery; start/stop/isOnline become method overrides.
Peripheral PR#3975 edits (lightpush/store clients, self_req_handlers,
statistics) are import-reorg artifacts of deleting waku/utils/requests.nim,
which the decomposed structure keeps -- so they are intentionally not ported.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Dedup EventConnectionStatusChange (re-export from health_events)
9th duplicate EventBroker type: defined in both logos_delivery_api.nim and the
decomposed waku/api/events/health_events.nim. The interface file now re-exports
it. liblogosdelivery builds clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Move events back into interface-class source files (restore #3975 placement)
Reverses the earlier dedup-by-re-export: event TYPE definitions now live in the
interface classes, and the emptied decomposed event files are removed.
- MessageSeenEvent -> logos_delivery/api/kernel_api.nim
- Message{Sent,Error,Propagated,Received}Event -> api/messaging_client_api.nim
- ChannelMessage{Received,Sent,Error}Event -> api/reliable_channel_manager_api.nim
- EventConnectionStatusChange -> api/logos_delivery_api.nim
Deleted (became empty after the move):
- logos_delivery/waku/api/events/message_events.nim
- logos_delivery/messaging/api/events.nim
- logos_delivery/channels/api/events.nim
health_events.nim keeps its two remaining events (content/shard topic health).
Rewiring: each layer re-exports its interface module (waku->kernel_api,
messaging_client->messaging_client_api, reliable_channel->reliable_channel_manager_api,
which also re-exports messaging_client_api). Deep emitters/listeners
(subscription_manager, waku_node, waku_node/relay, node_health_monitor,
recv_service, send_service) import the owning interface module directly.
kernel_api stays below node level (types/topics/message/store-common) so the
node->kernel_api imports are acyclic. liblogosdelivery builds.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* nph formatting
---------
Co-authored-by: Ivan FB <ivansete@status.im>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* move rln specific procs and types
* Renaming and restructuring RLN module
* Rename waku_rln_relay to waku_rln
* rename rln-relay types to rln
* Fix linting
* update logScope topics to match new rln module name
* Rename waku_rln module to rln
* Rename WakuRln type to Rln, rename FFI raw type to RlnRaw to avoid collision
* Apply nph formatting
* Rename local rlnRelay to rln in mountRlnRelay
* Move waku.nim from waku/factory to under waku/
* remove unused
* Realize Kernel API in scope of Waku class
* Refactor waku/api into messaging_client, waku/api/types and api_conf into logos_delivery/api
* Make liblogosdelivery and wakunode2 compile, remove waku/api.nim as it was just a import orchestrator
* make test compile and run
* Reconcile master's new send tests to LogosDelivery API after rebase
master commits #3965/#3669-followup added two test cases (Edge lightpush
delivery #3847, store-validation timeout) written against the removed
waku/api.nim createNode helper. Rewrite them to the LogosDelivery shape:
createNode -> LogosDelivery.new, node.node -> node.waku.node,
node.brokerCtx -> node.waku.brokerCtx, node.send -> node.messagingClient.send,
and drop the now-implicit mountMessagingClient calls (LogosDelivery.new
mounts the client internally).
* ConnectionStatus transition to connected now trigger store query
* Query period computed over period in which the node was disconnected
* remove periodic 5min store query
* add connection status edge-triggered test case
* refactor RecvService test suite
Co-authored-by: Ivan FB <128452529+Ivansete-status@users.noreply.github.com>
