@le-space/rootfs 0.6.40 → 0.6.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.40",
+  "version": "0.6.42",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap-refresh.py

@@ -24,6 +24,20 @@ ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/orbitdb-relay")
 DESCRIBE_SCRIPT = os.environ.get(
     "DESCRIBE_SCRIPT", "/usr/local/sbin/orbitdb-relay-describe.py"
 )
+# The initial registration publish (triggered once by configure.sh) must not
+# give up before the browser path is dialable: Caddy's ACME can only complete
+# after the 2n6 DNS record propagates publicly (observed up to ~6-10 min under
+# load), while a single describe run waits at most its own 240 s window. The
+# next timer firing is 20 min away, so a one-shot publish leaves a dead zone
+# in which the registration advertises no browser-dialable address. Retry
+# describe+publish until a secure browser address exists or this deadline
+# passes (then publish whatever is available, matching the old behaviour).
+PUBLISH_RETRY_TIMEOUT_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_TIMEOUT_SECONDS", "900")
+)
+PUBLISH_RETRY_INTERVAL_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_INTERVAL_SECONDS", "15")
+)
 DEFAULT_API_HOST = os.environ.get("ALEPH_BOOTSTRAP_API_HOST", "https://api.aleph.im")
 DEFAULT_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
 DEFAULT_REF = os.environ.get("ALEPH_BOOTSTRAP_REF", "simple-todo-bootstrap")
@@ -78,6 +92,20 @@ def is_browser_dialable(addr: str) -> bool:
     )
 
 
+def is_secure_browser_dialable(addr: str) -> bool:
+    """Mirror of the consumer-side address policy (testkit/app): a secure
+    websocket, or webtransport/webrtc-direct carrying a certhash. Plain /ws
+    does not count — an HTTPS page cannot dial it."""
+    normalized = addr.lower()
+    if "/tls/ws" in normalized or "/wss" in normalized:
+        return True
+    if (
+        "/webtransport" in normalized or "/webrtc-direct" in normalized
+    ) and "/certhash/" in normalized:
+        return True
+    return False
+
+
 def is_public_multiaddr(addr: str) -> bool:
     parts = split_multiaddr(addr)
     if not parts:
@@ -603,6 +631,62 @@ def main() -> None:
         )
         return
 
+    deadline = time.monotonic() + PUBLISH_RETRY_TIMEOUT_SECONDS
+    result: dict[str, object] | None = None
+    while True:
+        result = attempt_publish(
+            env_values,
+            publisher_private_key,
+            publisher_address,
+            registration_id,
+            channel,
+            ref,
+            post_type,
+            api_host,
+            require_secure_browser_dialable=True,
+        )
+        if result is not None:
+            break
+        if time.monotonic() >= deadline:
+            # Deadline passed without a secure browser address — publish what
+            # exists anyway (probe addresses still serve the Actions path).
+            result = attempt_publish(
+                env_values,
+                publisher_private_key,
+                publisher_address,
+                registration_id,
+                channel,
+                ref,
+                post_type,
+                api_host,
+                require_secure_browser_dialable=False,
+            )
+            break
+        time.sleep(PUBLISH_RETRY_INTERVAL_SECONDS)
+
+    if result is None:
+        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
+        return
+    print(json_dumps(result))
+
+
+def attempt_publish(
+    env_values: dict[str, str],
+    publisher_private_key: str,
+    publisher_address: str,
+    registration_id: str | None,
+    channel: str,
+    ref: str,
+    post_type: str,
+    api_host: str,
+    require_secure_browser_dialable: bool,
+) -> dict[str, object] | None:
+    """One describe→publish cycle. Returns the result record when a
+    registration was published, or None when the caller should retry (no
+    public addresses yet, or — while `require_secure_browser_dialable` — none
+    of them is dialable from an HTTPS page). Nothing is published on the
+    retry path: an early registration without a browser-dialable address
+    makes consumers resolve too soon and fail."""
     describe = subprocess.run([DESCRIBE_SCRIPT], check=True, capture_output=True, text=True)
     metadata = json.loads(describe.stdout.strip() or "{}")
     peer_id = metadata.get("peer_id")
@@ -614,14 +698,22 @@ def main() -> None:
         metadata.get("browser_bootstrap_multiaddrs") or [], browser_only=True
     )
 
+    now_ms = int(time.time() * 1000)
     now_seconds = now_ms / 1000
     profile = env_values.get("ALEPH_BOOTSTRAP_PROFILE", DEFAULT_PROFILE).strip() or DEFAULT_PROFILE
     version = env_values.get("ALEPH_BOOTSTRAP_VERSION", "").strip() or None
     published_multiaddrs = select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
+    # Intentionally left empty: consumers read content.multiaddrs (fallback),
+    # and the relayProof signature is byte-order-sensitive — populating
+    # browserMultiaddrs would change the signed payload shape. Cadence, not
+    # wire format, is what this retry loop fixes.
     published_browser_multiaddrs: list[str] = []
     if not published_multiaddrs:
-        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
-        return
+        return None
+    if require_secure_browser_dialable and not any(
+        is_secure_browser_dialable(addr) for addr in published_multiaddrs
+    ):
+        return None
 
     owner_authorization = load_owner_authorization(
         env_values,
@@ -684,24 +776,20 @@ def main() -> None:
         api_host, publisher_address, publisher_private_key, previous_hashes, channel
     )
 
-    print(
-        json_dumps(
-            {
-                "status": "published",
-                "httpStatus": http_status,
-                "itemHash": unsigned_message["item_hash"],
-                "sender": publisher_address,
-                "peerId": peer_id,
-                "publishedMultiaddrs": published_multiaddrs,
-                "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
-                "forgottenHashes": previous_hashes,
-                "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
-                "ownerAuthorizationPresent": owner_authorization is not None,
-                "forgetResponse": forget_response[1] if forget_response else None,
-                "response": response,
-            }
-        )
-    )
+    return {
+        "status": "published",
+        "httpStatus": http_status,
+        "itemHash": unsigned_message["item_hash"],
+        "sender": publisher_address,
+        "peerId": peer_id,
+        "publishedMultiaddrs": published_multiaddrs,
+        "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
+        "forgottenHashes": previous_hashes,
+        "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
+        "ownerAuthorizationPresent": owner_authorization is not None,
+        "forgetResponse": forget_response[1] if forget_response else None,
+        "response": response,
+    }
 
 
 if __name__ == "__main__":

package/reference/orbitdb-relay/rootfs/orbitdb-relay-describe.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 import json
 import os
+import re
 import socket
 import ssl
 import time
@@ -16,33 +17,58 @@ WAIT_INTERVAL_SECONDS = float(os.environ.get("DESCRIBE_WAIT_INTERVAL_SECONDS", "
 AUTOTLS_EXTRA_WAIT_SECONDS = int(os.environ.get("DESCRIBE_AUTOTLS_EXTRA_WAIT_SECONDS", "120"))
 
 
-def caddy_cert_serves(hostname: str) -> bool:
-    """True only once Caddy actually serves a publicly-trusted TLS certificate
-    for `hostname`.
-
-    Mode-B failure: describe.py used to advertise the 2n6 proxy-wss address as
-    soon as PROXY_HOSTNAME was configured, but Caddy acquires the Let's Encrypt
-    certificate asynchronously *after* it (re)starts (the caddy-ready file only
-    marks the restart). Browsers dialing before the cert is live got
-    net::ERR_SSL_PROTOCOL_ERROR. Verify the real browser-facing certificate with
-    a TLS handshake to the local Caddy (127.0.0.1:443) using the public
-    hostname as SNI — done locally so hairpin-NAT to the VM's own public IP is
-    irrelevant, and validated against the system CA store so Caddy's internal
-    self-signed fallback (served before ACME completes) is rejected.
+def tls_endpoint_serves(hostname: str, port: int) -> bool:
+    """True only once the local listener on `port` serves a publicly-trusted
+    TLS certificate for `hostname`.
+
+    The recurring failure shape ("advertise before the certificate serves"):
+    an address is announced as browser-dialable while its Let's Encrypt cert
+    is still being acquired, so browsers dialing it fail the TLS handshake
+    with net::ERR_SSL_PROTOCOL_ERROR. This bit twice — first for Caddy's 2n6
+    proxy (cert acquired asynchronously after the caddy restart), then for
+    libp2p AutoTLS (multiaddrs appear before the *.libp2p.direct cert is
+    live). Verify the real browser-facing certificate with a TLS handshake to
+    the local listener using the public hostname as SNI — done locally so
+    hairpin-NAT to the VM's own public IP is irrelevant, and validated
+    against the system CA store so any self-signed placeholder (Caddy's
+    pre-ACME fallback) is rejected.
     """
     if not hostname:
         return False
     context = ssl.create_default_context()
     try:
-        with socket.create_connection(("127.0.0.1", CADDY_HTTPS_PORT), timeout=8) as raw:
+        with socket.create_connection(("127.0.0.1", port), timeout=8) as raw:
             with context.wrap_socket(raw, server_hostname=hostname) as tls:
-                # A validated peer cert here means the handshake a browser will
-                # perform to wss://<hostname>:443 succeeds too.
+                # A validated peer cert here means the handshake a browser
+                # will perform against this hostname succeeds too.
                 return bool(tls.getpeercert())
     except (ssl.SSLError, OSError, ValueError):
         return False
 
 
+def caddy_cert_serves(hostname: str) -> bool:
+    return tls_endpoint_serves(hostname, CADDY_HTTPS_PORT)
+
+
+def autotls_cert_serves(autotls_addrs: list[str]) -> bool:
+    """Verify the AutoTLS *.libp2p.direct certificate actually serves.
+
+    The libp2p WebSocket listener terminates the AutoTLS certificate itself,
+    so a CA-validated handshake to 127.0.0.1:<port> with the libp2p.direct
+    hostname as SNI proves what a browser's wss:// dial will experience. Both
+    the hostname AND the port must come from the multiaddr — the TLS is
+    served on the announced port (e.g. .../tcp/24007/tls/ws/...), NOT on the
+    plain-ws upstream Caddy proxies to.
+    """
+    for addr in autotls_addrs:
+        host_match = re.search(r"/dns[46]/([^/]+)/", addr) or re.search(r"/sni/([^/]+)/", addr)
+        port_match = re.search(r"/tcp/(\d+)/", addr)
+        if host_match and port_match:
+            if tls_endpoint_serves(host_match.group(1), int(port_match.group(1))):
+                return True
+    return False
+
+
 def parse_env_file(path: str) -> dict[str, str]:
     values: dict[str, str] = {}
     if not os.path.exists(path):
@@ -184,27 +210,38 @@ def main() -> None:
             grouped = build_grouped_multiaddrs(env_values, all_multiaddrs, peer_id)
             proxy_hostname = env_values.get("PROXY_HOSTNAME", "").strip()
 
-            # Only treat the 2n6 proxy-wss address as browser-dialable once
-            # Caddy actually serves a valid certificate for it. Until then, drop
-            # the synthetic (not-yet-serving) proxy address so the relay never
-            # advertises an endpoint that would fail a browser's TLS handshake.
+            # Symmetric certificate gate for BOTH browser paths. Whichever of
+            # Caddy/2n6 and libp2p AutoTLS finishes its ACME first varies per
+            # VM; breaking on the mere *presence* of AutoTLS multiaddrs made
+            # the outcome a per-VM coin flip — a fast AutoTLS zone produced an
+            # acknowledgement containing only libp2p.direct addresses whose
+            # cert was not serving yet (ERR_SSL_PROTOCOL_ERROR in browsers),
+            # while the verifiable 2n6 address never made it in. Only
+            # cert-verified addresses are advertised, and the wait ends as
+            # soon as at least one verified browser path exists.
             proxy_cert_ready = bool(
                 proxy_hostname
                 and grouped["proxy_wss_multiaddrs"]
                 and caddy_cert_serves(proxy_hostname)
             )
+            autotls_cert_ready = bool(
+                grouped["autotls_wss_multiaddrs"]
+                and autotls_cert_serves(grouped["autotls_wss_multiaddrs"])
+            )
+
+            unverified: set[str] = set()
             if grouped["proxy_wss_multiaddrs"] and not proxy_cert_ready:
-                proxy_set = set(grouped["proxy_wss_multiaddrs"])
+                unverified.update(grouped["proxy_wss_multiaddrs"])
+            if grouped["autotls_wss_multiaddrs"] and not autotls_cert_ready:
+                unverified.update(grouped["autotls_wss_multiaddrs"])
+            if unverified:
                 grouped["browser_bootstrap_multiaddrs"] = [
-                    addr for addr in grouped["browser_bootstrap_multiaddrs"] if addr not in proxy_set
+                    addr
+                    for addr in grouped["browser_bootstrap_multiaddrs"]
+                    if addr not in unverified
                 ]
 
-            # Break as soon as a genuinely dialable browser address exists:
-            # AutoTLS libp2p.direct (only announced once its cert is live) or a
-            # cert-verified 2n6 proxy address.
-            if grouped["autotls_wss_multiaddrs"]:
-                break
-            if proxy_cert_ready:
+            if proxy_cert_ready or autotls_cert_ready:
                 break
             if not proxy_hostname and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
                 break

package/reference/uc-go-peer/rootfs/uc-go-peer-bootstrap-refresh.py

@@ -22,6 +22,20 @@ except ImportError as error:  # pragma: no cover - runtime dependency
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/uc-go-peer")
 DESCRIBE_SCRIPT = os.environ.get("DESCRIBE_SCRIPT", "/usr/local/sbin/uc-go-peer-describe.py")
+# Port of the orbitdb-relay cadence fix (relay-button #75): the initial
+# registration publish is triggered once by configure.sh, while the refresh
+# timer's first firing is 20 minutes away — a one-shot publish that catches
+# the peer before a browser-dialable address exists leaves consumers a dead
+# zone. Retry describe+publish until a secure browser address exists or the
+# deadline passes (then publish whatever is available, the old behaviour).
+# The go peer usually announces certhash-bearing webtransport/webrtc-direct
+# addresses right at startup, so the first attempt normally succeeds.
+PUBLISH_RETRY_TIMEOUT_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_TIMEOUT_SECONDS", "900")
+)
+PUBLISH_RETRY_INTERVAL_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_INTERVAL_SECONDS", "15")
+)
 DEFAULT_API_HOST = os.environ.get("ALEPH_BOOTSTRAP_API_HOST", "https://api.aleph.im")
 DEFAULT_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
 DEFAULT_REF = os.environ.get("ALEPH_BOOTSTRAP_REF", "simple-todo-bootstrap")
@@ -75,6 +89,20 @@ def is_browser_dialable(addr: str) -> bool:
     return "/ws" in normalized or "/wss" in normalized
 
 
+def is_secure_browser_dialable(addr: str) -> bool:
+    """Mirror of the consumer-side address policy (testkit/app): a secure
+    websocket, or webtransport/webrtc-direct carrying a certhash. Plain /ws
+    does not count — an HTTPS page cannot dial it."""
+    normalized = addr.lower()
+    if "/tls/ws" in normalized or "/wss" in normalized:
+        return True
+    if (
+        "/webtransport" in normalized or "/webrtc-direct" in normalized
+    ) and "/certhash/" in normalized:
+        return True
+    return False
+
+
 def is_public_multiaddr(addr: str) -> bool:
     parts = split_multiaddr(addr)
     if not parts:
@@ -567,6 +595,47 @@ def main() -> None:
         print(json_dumps({"status": "skipped", "reason": "missing publisher key"}))
         return
 
+    deadline = time.monotonic() + PUBLISH_RETRY_TIMEOUT_SECONDS
+    result: dict[str, object] | None = None
+    while True:
+        result = attempt_publish(
+            env_values,
+            publisher_private_key,
+            registration_id,
+            require_secure_browser_dialable=True,
+        )
+        if result is not None:
+            break
+        if time.monotonic() >= deadline:
+            # Deadline passed without a secure browser address — publish what
+            # exists anyway (probe addresses still serve the Actions path).
+            result = attempt_publish(
+                env_values,
+                publisher_private_key,
+                registration_id,
+                require_secure_browser_dialable=False,
+            )
+            break
+        time.sleep(PUBLISH_RETRY_INTERVAL_SECONDS)
+
+    if result is None:
+        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
+        return
+    print(json_dumps(result))
+
+
+def attempt_publish(
+    env_values: dict[str, str],
+    publisher_private_key: str,
+    registration_id: str | None,
+    require_secure_browser_dialable: bool,
+) -> dict[str, object] | None:
+    """One describe→publish cycle. Returns the result record when a
+    registration was published, or None when the caller should retry (no
+    public addresses yet, or — while `require_secure_browser_dialable` — none
+    of them is dialable from an HTTPS page). Nothing is published on the
+    retry path: an early registration without a browser-dialable address
+    makes consumers resolve too soon and fail."""
     describe = subprocess.run([DESCRIBE_SCRIPT], check=True, capture_output=True, text=True)
     metadata = json.loads(describe.stdout.strip() or "{}")
     peer_id = metadata.get("peer_id")
@@ -592,10 +661,16 @@ def main() -> None:
         )
     api_host = env_values.get("ALEPH_BOOTSTRAP_API_HOST", DEFAULT_API_HOST).strip() or DEFAULT_API_HOST
     published_multiaddrs = select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
+    # Intentionally left empty: consumers read content.multiaddrs (fallback),
+    # and the relayProof signature is byte-order-sensitive — populating
+    # browserMultiaddrs would change the signed payload shape.
     published_browser_multiaddrs: list[str] = []
     if not published_multiaddrs:
-        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
-        return
+        return None
+    if require_secure_browser_dialable and not any(
+        is_secure_browser_dialable(addr) for addr in published_multiaddrs
+    ):
+        return None
 
     owner_authorization = load_owner_authorization(
         env_values,
@@ -658,24 +733,20 @@ def main() -> None:
         api_host, publisher_address, publisher_private_key, previous_hashes, channel
     )
 
-    print(
-        json_dumps(
-            {
-                "status": "published",
-                "httpStatus": http_status,
-                "itemHash": unsigned_message["item_hash"],
-                "sender": publisher_address,
-                "peerId": peer_id,
-                "publishedMultiaddrs": published_multiaddrs,
-                "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
-                "forgottenHashes": previous_hashes,
-                "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
-                "ownerAuthorizationPresent": owner_authorization is not None,
-                "forgetResponse": forget_response[1] if forget_response else None,
-                "response": response,
-            }
-        )
-    )
+    return {
+        "status": "published",
+        "httpStatus": http_status,
+        "itemHash": unsigned_message["item_hash"],
+        "sender": publisher_address,
+        "peerId": peer_id,
+        "publishedMultiaddrs": published_multiaddrs,
+        "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
+        "forgottenHashes": previous_hashes,
+        "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
+        "ownerAuthorizationPresent": owner_authorization is not None,
+        "forgetResponse": forget_response[1] if forget_response else None,
+        "response": response,
+    }
 
 
 if __name__ == "__main__":

package/reference/uc-go-peer/rootfs/uc-go-peer-describe.py

@@ -4,16 +4,58 @@ from __future__ import annotations
 import json
 import os
 import re
+import socket
+import ssl
 import subprocess
 import time
 
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/uc-go-peer")
 SERVICE_NAME = os.environ.get("SERVICE_NAME", "uc-go-peer.service")
+CADDY_HTTPS_PORT = int(os.environ.get("CADDY_HTTPS_PORT", "443"))
 WAIT_TIMEOUT_SECONDS = int(os.environ.get("DESCRIBE_WAIT_TIMEOUT_SECONDS", "240"))
 WAIT_INTERVAL_SECONDS = float(os.environ.get("DESCRIBE_WAIT_INTERVAL_SECONDS", "2"))
 AUTOTLS_EXTRA_WAIT_SECONDS = int(os.environ.get("DESCRIBE_AUTOTLS_EXTRA_WAIT_SECONDS", "120"))
 
+
+def tls_endpoint_serves(hostname: str, port: int) -> bool:
+    """True only once the local listener on `port` serves a publicly-trusted
+    TLS certificate for `hostname`.
+
+    Port of the orbitdb-relay fix (relay-button #74/#75): announcing a wss
+    address before its Let's Encrypt certificate actually serves makes
+    browsers fail the TLS handshake with net::ERR_SSL_PROTOCOL_ERROR. The
+    handshake runs against the local listener with the public hostname as
+    SNI — local, so hairpin-NAT to the VM's own public IP is irrelevant, and
+    CA-validated, so self-signed placeholders are rejected.
+    """
+    if not hostname:
+        return False
+    context = ssl.create_default_context()
+    try:
+        with socket.create_connection(("127.0.0.1", port), timeout=8) as raw:
+            with context.wrap_socket(raw, server_hostname=hostname) as tls:
+                return bool(tls.getpeercert())
+    except (ssl.SSLError, OSError, ValueError):
+        return False
+
+
+def caddy_cert_serves(hostname: str) -> bool:
+    return tls_endpoint_serves(hostname, CADDY_HTTPS_PORT)
+
+
+def autotls_cert_serves(autotls_addrs: list[str]) -> bool:
+    """Verify the AutoTLS *.libp2p.direct certificate actually serves. Host
+    AND port come from the multiaddr — TLS is terminated on the announced
+    port; every candidate is tried until one verifies."""
+    for addr in autotls_addrs:
+        host_match = re.search(r"/dns[46]/([^/]+)/", addr) or re.search(r"/sni/([^/]+)/", addr)
+        port_match = re.search(r"/tcp/(\d+)/", addr)
+        if host_match and port_match:
+            if tls_endpoint_serves(host_match.group(1), int(port_match.group(1))):
+                return True
+    return False
+
 PEER_ID_PATTERNS = [
     re.compile(r"PeerID:\s+(\S+)"),
     re.compile(r"Host created with PeerID:\s+(\S+)"),
@@ -221,9 +263,42 @@ def main() -> None:
 
         grouped = build_probe_multiaddrs(env_values, peer_id, listening_addrs)
         proxy_hostname = env_values.get("PROXY_HOSTNAME", "").strip()
-        if grouped["autotls_wss_multiaddrs"]:
-            break
-        if proxy_hostname and grouped["proxy_wss_multiaddrs"] and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
+
+        # Symmetric certificate gate (port of relay-button #74/#75): both wss
+        # paths — Caddy/2n6 proxy and libp2p AutoTLS — are only advertised
+        # once a CA-validated local TLS handshake proves their certificate
+        # serves; breaking on the mere presence of AutoTLS multiaddrs made
+        # the outcome a per-VM ACME race. certhash-bearing webtransport /
+        # webrtc-direct addresses need no ACME (the hash IS the
+        # authentication), so they count as browser-dialable immediately and
+        # end the wait on their own — unverified wss addresses join the
+        # registration on a later refresh cycle once their cert is live.
+        proxy_cert_ready = bool(
+            proxy_hostname
+            and grouped["proxy_wss_multiaddrs"]
+            and caddy_cert_serves(proxy_hostname)
+        )
+        autotls_cert_ready = bool(
+            grouped["autotls_wss_multiaddrs"]
+            and autotls_cert_serves(grouped["autotls_wss_multiaddrs"])
+        )
+        certhash_ready = bool(
+            grouped["webtransport_multiaddrs"] or grouped["webrtc_direct_multiaddrs"]
+        )
+
+        unverified: set[str] = set()
+        if grouped["proxy_wss_multiaddrs"] and not proxy_cert_ready:
+            unverified.update(grouped["proxy_wss_multiaddrs"])
+        if grouped["autotls_wss_multiaddrs"] and not autotls_cert_ready:
+            unverified.update(grouped["autotls_wss_multiaddrs"])
+        if unverified:
+            grouped["browser_bootstrap_multiaddrs"] = [
+                addr
+                for addr in grouped["browser_bootstrap_multiaddrs"]
+                if addr not in unverified
+            ]
+
+        if proxy_cert_ready or autotls_cert_ready or certhash_ready:
             break
         if not proxy_hostname and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
             break