Wire dig-sex admission (SPEC 8.5) into the inbound path, metered by authenticated identity

[MichaelTaylor3d]

Task

dig_sex::admission -- AdmissionMeter::admit / release, AdmissionLimits, WorkKind, Refusal -- is implemented, tested, and gates nothing. The node does the work first and has no admission step at all.

Why it matters

Admit before you work. The value of an admission meter is that it refuses before spending anything. Calling it after the expensive part is decoration.

Meter by the AUTHENTICATED identity, never a placeholder. AuthenticatedPeer is a newtype for exactly this reason. Passing a constant, a connection id, or an unauthenticated claim collapses every requestor into one shared bucket, which turns a per-peer limit into a global one -- so a single peer can exhaust the allowance for everybody. That failure looks like working DoS protection right up until it matters.

Context

• The inbound request handlers in crates/dig-node-core/src/lib.rs. admit goes before any read, fetch or decode.
• release must be called on every exit path from admitted work, including error paths. A release skipped on failure leaks allowance until the node refuses everything.
• dig-sex SPEC.md section 8.5.

Scope

Thinnest path: gate the request kinds that actually cost something. Do not invent limit categories beyond what WorkKind already declares.

Evidence

A test that fails without the fix: exceed the per-peer limit and assert a Refusal before the work is performed, then assert a second peer is unaffected. That second half is what catches the shared-bucket mistake.

Parent

Orchestrator epic: https://github.com/DIG-Network/dig_ecosystem/issues/3138

[MichaelTaylor3d]

Lane loop/batch-digsex (worktree dn-digsex) owns this. Draft PR #456, branch loop/batch-digsex.

Measured before starting: dig-sex latest published is 0.5.0 (not 0.4 as the sibling ticket says), and dig-node already declares dig-sex = "0.5" at crates/dig-node-core/Cargo.toml:509. dig_sex::conduct, dig_sex::admission and dig_sex::reward have zero references anywhere in crates/ — so these three are genuinely unwired, as filed.

[MichaelTaylor3d]

Wired. PR #456.

crates/dig-node-core/src/seams/dig_peer/admission.rs holds one node-wide AdmissionMeter. It is consulted at the top of NodeResponder::handle_json_rpc and handle_availability (peer.rs) — ahead of the method allowlist and every dispatch, so a refusal costs a hex decode and a counter bump rather than a read, a decode or a DHT lookup.

One meter per NODE, not per connection or per responder. A per-connection meter would let a peer buy more allowance simply by opening more connections — the same collapse as a caller-chosen key wearing a different shape.

Metered by the authenticated identity. The key is the mTLS-verified peer_id, decoded with the existing hex64. A session with no verified identity is refused (AdmissionRefusal::Unauthenticated), never admitted unmetered and never metered under a placeholder — admitting it would make "present no identity" the cheapest way to escape the meter. Nothing on the loopback admin / in-process FFI path routes through the responder, so this costs no legitimate caller.

Release is structural. AdmissionGuard releases on Drop, so allowance returns on every exit path including the error paths a hand-written release is forgotten on. The guard is held by value across the work, so "return before releasing" is not expressible.

requested_units is the attacker-chosen quantity, clamped at the boundary: handle_availability passes items.len(), which is the thing the request actually asks the node to do.

Tests — 5 passing, and proven load-bearing

• exhausting_one_peers_share_does_not_refuse_a_different_peer
• a_dropped_guard_returns_its_allowance
• an_unauthenticated_session_is_refused_rather_than_metered_under_a_placeholder
• an_oversized_request_is_refused_and_the_at_bound_request_is_admitted — pins the bound from both sides (9 refused, 8 admitted); a bound tested only from below can only confirm itself
• relayed_work_exhausts_the_relay_ceiling_while_own_work_still_admits

Revert-proof. Replacing the derived key with a constant — AuthenticatedPeer::from_verified_session([0u8; 32]), i.e. exactly the shared-bucket mistake this ticket names — fails exhausting_one_peers_share_does_not_refuse_a_different_peer and nothing else (4 passed, 1 failed). So the second-peer half is the assertion carrying the property, and the first half alone would have passed the defect: a constant-keyed meter also refuses at the limit, it just refuses everybody.

The limits are AdmissionLimits::default() (global 64, per-peer 8, relay 16, 1024 tracked peers, 256 max units). Making them operator-configurable is not in scope here and is not needed for the gate to bind.