libmesh covers:
- peer discovery
- setup signaling
- relay fallback
libmesh does not implement ICE/STUN/TURN.
- Peer identity is anchored to
libself(NodeId,did:key). - Peer records are signed and verified with
libself. - Relay session admission requires identity-authenticated endpoints.
PeerRecord fields:
node_id- optional
did published_at_msexpires_at_msendpoints[]relay_hints[]signature
Encoding:
- canonical payload for signing
- wire payload includes canonical fields plus
sig=<hex>
Message kinds:
publishlookuprefreshwithdrawresponse
Frame format:
kind|correlation_id|node_hex|payload
Server rules:
publish: parse signed wire record, verify signer fromdid:key, store recordlookup: return signed wire record if found, elsenot_foundrefresh: parse + verify + replace existing recordwithdraw: remove record if present
Message kinds:
connect_requestconnect_acceptconnect_rejectcandidatesetup_payload
Frame format:
kind|from_node|to_node|correlation_id|payload
setup_payload is intentionally generic so external orchestrators can carry ICE-related data for libdice.
Message kinds:
openacceptdenystream_chunkdatagramclose
Frame format:
kind|session_id|payload
Relay flow:
- Open authenticated session
- Match reverse peer pair
- Forward streams (required)
- Forward datagrams (optional)
Decision order:
- direct
- signaling_then_direct (when traversal orchestration is needed)
- relay fallback
The external node/client may invoke libdice after signaling when direct traversal is required.
libmesh -> libself: identity/signature/trustlibmesh -> libfast: QUIC transport target materialization and control framinglibmesh -X-> libdice: no direct dependency; consumed externally by orchestrator