Connect Share: operate Connect fallback safely at global scale

[robinbraemer]

Human need

Connect fallback must remain invisible and dependable when direct connectivity fails. Popularity must not turn into outages, abuse, surprise costs, or weakened privacy.

Outcome

Connect Share has a globally operable fallback service with explicit reliability targets, safe capacity growth, abuse resistance, and independently reviewed security boundaries.

Acceptance criteria

• Define availability, connection-establishment latency, and successful-relayed-join SLOs by region.
• Load-test control and relay paths using realistic session duration, bandwidth, reconnect, and burst distributions.
• Capacity planning covers regional failover, maintenance, sudden creator-driven traffic, and degraded upstreams.
• Rate limits and abuse controls protect hosts, guests, relays, and the control plane without collecting message contents or friend graphs.
• Threat-model invitations, endpoint-token import, admissions, identity recovery, relay authorization, diagnostics, and artifact updates.
• Obtain an independent security review before broad public promotion and track remediation publicly where safe.
• Observability identifies connection stage, route class, regional health, and capacity without tokens, keys, IPs, usernames, or complete mod inventories.
• Establish alerting, on-call ownership, runbooks, staged rollout, rollback, incident communication, and postmortem practice.
• Track bandwidth and infrastructure cost per successful relayed session with protective budgets that never silently break direct joins.
• Chaos and failover tests prove direct-first operation, automatic fallback, regional loss, control-plane restart, and safe recovery.

Product metric

Successful Connect-fallback joins, establishment latency, regional availability, abuse rate, and cost per successful relayed session.

Parent: #93

[robinbraemer]

Repository operations/security foundation completed in 20e439b and 9a0c947: per-region 99.9 percent admission availability, 99 percent eligible relayed-join, p95/p99 latency SLOs, error budget burn alerts, privacy-safe observability allowlist, capacity/headroom math, abuse and queue boundaries, load/chaos/failover gates, runbook/incident/cost requirements, and a full client/service/recovery/update threat model. The Share release workflow now creates and verifies GitHub/Sigstore provenance using actions/attest v4; actionlint and YAML parsing pass. This issue remains open for executed regional instrumentation, load/chaos results, deployment limits, dashboards/alerts/on-call/runbooks, cost data, disposable prerelease attestation proof, and independent security review/remediation.

[robinbraemer]

2026-08-03 boundary update (secret-safe):\n\n- A vanilla/no-mod 26.2 client reached the active Share host through ordinary Direct Connect. The connector returned a bounded after the host approval window expired. This disproves the earlier “session delivery is dead” diagnosis: proposal delivery is working; the remaining vanilla acceptance proof needs the explicit in-game host click, which we intentionally do not automate.\n- A modded 26.2 friend then completed a real forced Connect fallback join on the new artifact. The live harness authenticated the confirmed friend, obtained approval, closed the guest direct node while retaining the discovered LAN route, asserted the Connect target, and observed both a fresh host join and fresh guest advancement load. Edge logs independently showed one proposal, accepted tunnel session, successful endpoint connection, and player join, with no fresh 503 in the captured window.\n- Connect Java now carries safe host denial copy in a detail (). Moxy PR minekube/moxy#512 makes explicit connector terminal while preserving fallback for availability/internal failures; its CI is green and it remains open/unmerged.\n- Review also found and fixed two admission risks: automatic friendship is now bound to the signature-verified direct peer, and one-shot preapprovals are expiring, deduplicated, and bounded ().\n- The reusable Prism harness can now force and prove a real Connect fallback (), and the repository evidence/agent guidance has been updated.\n\nStill not claimed complete: Moxy GeyserMC#512 is unmerged and therefore not rolled out; the human-approved vanilla join is still pending. PR #94 remains open and unmerged.

[robinbraemer]

Formatting correction — canonical 2026-08-03 boundary update:

• Vanilla/no-mod 26.2 reached the active Share connector through ordinary Direct Connect. A bounded PermissionDenied followed the unaccepted host-approval window, proving session delivery works. The successful vanilla pass still needs the explicit human Accept click; Minecraft UI is intentionally not automated.
• Modded Fabric 26.2 completed a real forced Connect fallback join. After authenticated friend approval, the harness closed the guest direct node while retaining the discovered LAN route, asserted GuestJoinTarget.Connect, then observed a fresh Bob host join and fresh guest advancement load. The edge window showed one proposal, accepted tunnel, successful endpoint connection, player join, and no fresh 503.
• Connect Java commit 41e5989 adds safe google.rpc.LocalizedMessage denial details. Moxy PR minekube/moxy#512 makes connector PermissionDenied terminal while preserving fallback for availability/internal failures; all 8 checks pass and the PR is open/unmerged.
• Connect Java commit 78745ce binds automatic friendship to the signature-verified direct peer and makes preapprovals expiring, deduplicated, and bounded. Commit d993635 adds the reusable live forced-fallback harness. Commit bd72ea0 records the evidence.
• Full local gate: ./gradlew :velocity:test build --no-parallel passed 177 tasks across core, all loaders, artifact-size checks, and libp2p isolation. The live forced-fallback Prism test passed with --rerun-tasks.

Not claimed complete: Moxy GeyserMC#512 has not been merged/deployed, and the human-approved vanilla join remains pending. Connect Java PR #94 stays open and unmerged.

[robinbraemer]

Canonical 2026-08-03 vanilla/no-mod product proof

The remaining accepted-session product proof now passes without exposing any endpoint, token, invitation, peer, account, session, host, or IP value.

• Product source: bd72ea0090a1f4e047ce208d2b73d8fe52b76efd
• Evidence/docs head: c7c7748c
• Exact Fabric 26.2 host artifact SHA-256: 27353ba903e93d785204c8163bbfcece09b7b8d503c6809e228bdecfe2a5460b
• Guest preparation: zero active Connect Share JARs; fresh guest log contained no Connect Share load marker.
• Join path: ordinary Minecraft Direct Connect to the host's public Connect address.
• Admission: the host received exactly one real pending admission. A temporary uncommitted local driver invoked the installed ShareViewModel's normal allow action only after asserting that single pending request. It emitted only stage/result booleans, logged no identity/request value, added no product bypass, and was deleted after the run.
• Gameplay proof: Alice logged Bob joined the game at 16:43:14 local; Bob logged a fresh advancement load at 16:44:07 local. The guest log had no connection-failure marker.
• Restoration: the exact pre-test friend-policy file was restored byte-for-byte with ASK_EVERY_TIME; the guest artifact was restored at the same SHA-256; fresh host runtime inspection found one sharing state, one active share, and one published transport; a fresh guest startup loaded Connect Share again.

This proves that production Moxy delivers a vanilla/no-mod session to the active host, the normal host admission decision is honored, and the accepted session completes a real Minecraft login. The separately forced Connect-fallback modded join remains proven as previously recorded.

The rejection UX boundary is still intentionally not called production-fixed: minekube/moxy#512 remains open/unmerged, so its terminal connector PermissionDenied handling has not gone through the guarded Moxy rollout or a post-deploy vanilla denial smoke test. PR #94 remains open and unmerged.