remoteRF-server 1.1.0.dev50__py3-none-any.whl → 1.1.0.dev52__py3-none-any.whl

remoteRF_server/server/commands.py

@@ -157,6 +157,7 @@ def _table() -> list[Command]:
         Command(("cluster groups",), "Choose which of your groups a cluster shares (interactive)", _federation("groups"), "Clusters"),
         Command(("cluster codes create",), "Codes for your users to join a cluster (interactive)", _federation("codes create"), "Clusters"),
         Command(("cluster codes list",), "List cluster codes", _federation("codes list"), "Clusters"),
+        Command(("cluster peers",), "Partner listeners this lab dials directly: cluster peers [add <id> <host:port> --ca <ca.crt> | remove <id>]", _federation("peers"), "Clusters"),
         Command(("cluster accept",), "", _federation("accept"), "Clusters", hidden=True),
         Command(("global cluster",), "", _federation("cluster"), "Global", hidden=True),
         # ---- gist ----

remoteRF_server/server/direct_path.py

@@ -19,6 +19,11 @@ ICE (aioice) punches one UDP pair between a logged-in client and this Server;
 QUIC (aioquic) carries device RPCs over it, one bidirectional stream per call:
 4-byte big-endian length + GenericRPCRequest, reply likewise. Control RPCs
 (ACC:*) stay on gRPC and are refused here. Signaling is ACC:direct_offer.
+
+A *bound* path is the owner side of a federated reservation (docs/
+deployment-groups.md §7.6): it carries no bearer token, every call is
+re-authorized by the binding and pinned to its device, and a refusal closes
+the path.
 """
 
 from __future__ import annotations
@@ -113,6 +118,7 @@ STUN_SECONDS = 1.5  # a STUN server answers in milliseconds or not at all
 CERT_DIR: Optional[Path] = None  # set by start_server_runtime
 
 _loop: Optional[asyncio.AbstractEventLoop] = None
+_thread: Optional[threading.Thread] = None
 _lock = threading.Lock()
 _paths: dict[str, "_Path"] = {}
 
@@ -177,15 +183,28 @@ def peer_address(ice: Connection) -> tuple[str, int]:
     return ice._nominated[1].remote_addr
 
 
-def _dispatch(request: grpc_pb2.GenericRPCRequest, peer_host: str) -> dict:
+class PathRefused(Exception):
+    """A bound path's authorizer said no: the reply carries why, then the path closes."""
+
+
+def _dispatch(request: grpc_pb2.GenericRPCRequest, peer_host: str, bound: Optional[dict] = None) -> dict:
     """Run one call exactly as GenericRPCServicer.Call does, device plane only."""
     from .rpc_manager import rpc_manager
 
     name = request.function_name
-    if not (name.startswith("IDL:") or rpc_manager._looks_like_device_rpc(name)):
+    device = rpc_manager._looks_like_device_rpc(name)
+    if bound is not None:
+        if not (device or name == "IDL:get_drivers"):
+            return {"a": map_arg(f"{name} is not available on the direct path")}
+        reason = bound["authorize"](name)
+        if reason is not None:
+            raise PathRefused(reason)
+    elif not (device or name.startswith("IDL:")):
         return {"a": map_arg(f"{name} is not available on the direct path")}
     token = RELAYED.set(is_offsite(peer_host))
     try:
+        if bound is not None:
+            return bound["run"](name, dict(request.args))
         return rpc_manager.run_rpc(function_name=name, args=request.args)
     except Exception as exc:  # noqa: BLE001 - the reply carries it, as a device error would
         return {"a": map_arg(str(exc))}
@@ -255,10 +274,11 @@ class _Protocol(QuicConnectionProtocol):
 class _Path:
     """One client session's punched pair and the QUIC connection over it."""
 
-    def __init__(self, key: str, user: str, ice: Connection):
+    def __init__(self, key: str, user: str, ice: Connection, bound: Optional[dict] = None):
         self.key = key
         self.user = user
         self.ice = ice
+        self.bound = bound
         self.peer: Optional[tuple[str, int]] = None
         self.calls = 0
         self.task: Optional[asyncio.Task] = None
@@ -330,7 +350,7 @@ class _Path:
         task.add_done_callback(self.streams.discard)
 
     async def _serve(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
-        bad_frame = None
+        bad_frame = refused = None
         try:
             try:
                 request = grpc_pb2.GenericRPCRequest()
@@ -341,9 +361,13 @@ class _Path:
                 bad_frame = f"bad frame: {type(exc).__name__}: {exc}"
                 results = {"a": map_arg(bad_frame)}
             else:
-                results = await asyncio.get_running_loop().run_in_executor(
-                    None, _dispatch, request, self.peer[0]
-                )
+                try:
+                    results = await asyncio.get_running_loop().run_in_executor(
+                        None, _dispatch, request, self.peer[0], self.bound
+                    )
+                except PathRefused as exc:
+                    refused = str(exc)
+                    results = {"a": map_arg(refused)}
             writer.write(frame(grpc_pb2.GenericRPCResponse(results=results).SerializeToString()))
             writer.write_eof()
             self.calls += 1
@@ -354,6 +378,9 @@ class _Path:
             # still arriving and would only pile up in this stream's buffer.
             printf(f"Direct path dropped: {self.user} sent a {bad_frame}", Sty.GRAY)
             await self.close()
+        if refused is not None:
+            printf(f"Direct path refused: {self.user}: {refused}", Sty.GRAY)
+            await self.close()
 
     async def close(self) -> None:
         if _paths.get(self.key) is self:
@@ -367,7 +394,7 @@ class _Path:
         await close_ice(self.ice)
 
 
-async def _offer(key: str, user: str, remote: dict) -> dict:
+async def _offer(key: str, user: str, remote: dict, bound: Optional[dict] = None) -> dict:
     old = _paths.get(key)
     if old is not None:
         await old.close()
@@ -386,7 +413,7 @@ async def _offer(key: str, user: str, remote: dict) -> dict:
     except Exception:
         await close_ice(ice)
         raise
-    path = _paths[key] = _Path(key, user, ice)
+    path = _paths[key] = _Path(key, user, ice, bound)
     path.task = asyncio.ensure_future(path.run())
     return {
         "ufrag": ice.local_username,
@@ -396,14 +423,15 @@ async def _offer(key: str, user: str, remote: dict) -> dict:
 
 
 def _get_loop() -> asyncio.AbstractEventLoop:
-    global _loop
+    global _loop, _thread
     with _lock:
         if _loop is None:
             _loop = asyncio.new_event_loop()
             quiet_aioice_errors(_loop)
-            threading.Thread(
+            _thread = threading.Thread(
                 target=_loop.run_forever, name="remoterf-direct", daemon=True
-            ).start()
+            )
+            _thread.start()
         return _loop
 
 
@@ -426,11 +454,25 @@ def offer(session_key: str, user: str, ice: str) -> dict:
     return {"ice": map_arg(json.dumps(answer)), "server_name": map_arg(hostname() or "")}
 
 
+def offer_bound(session_key: str, user: str, ice: str, *, bound: dict) -> dict:
+    """The owner side of a federated reservation's path.
+
+    ``bound["authorize"](function_name)`` decides every call (None allows,
+    else the reason) and ``bound["run"](function_name, args)`` executes it
+    against the reservation's device. Returns the ICE answer; raises when no
+    path could be prepared.
+    """
+    remote = json.loads(ice)
+    key = f"{session_key}/{str(remote.get('id', ''))[:32]}"
+    return asyncio.run_coroutine_threadsafe(_offer(key, user, remote, bound), _get_loop()).result(20)
+
+
 def shutdown() -> None:
-    """Close every path and stop the loop (server stop, tests)."""
-    global _loop
+    """Close every path, stop the loop and release it (server stop, tests)."""
+    global _loop, _thread
     with _lock:
         loop, _loop = _loop, None
+        thread, _thread = _thread, None
     if loop is None:
         return
 
@@ -441,3 +483,8 @@ def shutdown() -> None:
     with contextlib.suppress(Exception):
         asyncio.run_coroutine_threadsafe(_close_all(), loop).result(10)
     loop.call_soon_threadsafe(loop.stop)
+    if thread is not None:
+        thread.join(10)
+    if not loop.is_running():
+        with contextlib.suppress(Exception):
+            loop.close()  # the selector and its wake-up pipe go with it

remoteRF_server/server/federation/__init__.py

@@ -6,9 +6,9 @@ permission aggregation, resources, reservations, or broker authorization.
 
 import remoterf_federation_core as _federation_core
 
-if _federation_core.__version__ != "0.15.0":
+if _federation_core.__version__ != "0.16.0":
     raise RuntimeError(
-        "RemoteRF Server federation requires remoterf-federation-core==0.15.0; "
+        "RemoteRF Server federation requires remoterf-federation-core==0.16.0; "
         f"found {_federation_core.__version__}"
     )
 

remoteRF_server/server/federation/cli.py

@@ -355,8 +355,51 @@ def cmd_cluster(argv: list[str]) -> int:
     return 0
 
 
+def cmd_peers(argv: list[str]) -> int:
+    """`federation peers [list] | add <deployment_id> <host:port> --ca <ca.crt> [--name <tls name>]
+    | remove <deployment_id>`: the partner listeners this HOME dials directly."""
+    from ...common.utils.ansi_codes import Sty
+    from . import cluster
+    from .peers import PeerStore
+
+    store = PeerStore(cluster._db_path())
+    verb = argv[0] if argv else "list"
+    words = [a for a in argv[1:] if not a.startswith("--")]
+    flags = dict(zip([a for a in argv[1:] if a.startswith("--")], [a for a in argv[2:] if not a.startswith("--")]))
+    try:
+        if verb == "list" and not words:
+            rows = store.list()
+            if not rows:
+                _print("  No partner routes; the cluster agent records one from each lab's signed status note.",
+                       Sty.GRAY)
+            for row in rows:
+                _print(f"  {row['display_name']}  {row['deployment_id']}  {row['endpoint']}  "
+                       f"({row['via']}, {row['source']})")
+            return 0
+        if verb == "add" and len(words) == 2 and "--ca" in flags:
+            deployment_id, endpoint = words
+            route = {"grpc_endpoint": endpoint, "tls_server_name": flags.get("--name") or endpoint.rsplit(":", 1)[0],
+                     "ca_pem": Path(flags["--ca"]).read_text("utf-8")}
+            store.upsert(deployment_id=deployment_id, display_name=flags.get("--name") or deployment_id,
+                         route=route, source="admin")
+            _print(f"  {deployment_id} is dialed at {endpoint} from now on.", Sty.GRAY)
+            return 0
+        if verb == "remove" and len(words) == 1:
+            gone = store.remove(words[0])
+            _print(f"  {words[0]}: {'removed; the broker forwards to it again' if gone else 'no such peer'}.", Sty.GRAY)
+            return 0
+    except (ValueError, ContractError, OSError) as exc:
+        _print(f"  {exc}", Sty.WARNING)
+        return 1
+    print("Usage: federation peers [list] | add <deployment_id> <host:port> --ca <ca.crt> [--name <tls name>] "
+          "| remove <deployment_id>", file=sys.stderr)
+    return 2
+
+
 def main(argv) -> int:
     # `cluster <verb> …` from the table; `global cluster …` is the old spelling.
+    if argv and argv[0] == "peers":
+        return cmd_peers(argv[1:])
     if argv and argv[0] in ("cluster", "clusters"):
         argv = argv[1:] or ["list"]
     if argv and argv[0] in ("list", "create", "invite", "join", "accept", "remove", "groups", "codes", "info"):

remoteRF_server/server/federation/cluster.py

@@ -753,16 +753,22 @@ def _publish_roster(name: str, cluster: dict) -> None:
 
 
 def _publish_status(name: str, cluster: dict) -> None:
-    """Any lab: post our counts for this cluster when they change."""
-    sharing = _sharing(name)
-    if sharing == cluster.get("status"):
+    """Any lab: post our counts for this cluster, and the route the other
+    labs may dial us on directly, when either changes."""
+    from .peers import own_route
+
+    note = _sharing(name)
+    route = own_route()
+    if route is not None:
+        note["route"] = route
+    if note == cluster.get("status"):
         return
     key, _, me = g._signing_material()
     owner = me if cluster["role"] == "owner" else cluster["peer"]
-    status = {"cluster_name": name, "owner": owner, "deployment_id": me, "issued_at": int(time.time()), **sharing}
+    status = {"cluster_name": name, "owner": owner, "deployment_id": me, "issued_at": int(time.time()), **note}
     signature = base64.b64encode(key.sign(canonical_json(status).encode())).decode("ascii")
     g.call("POST", "/v2/broker/clusters/roster", {"protocol_version": "2", "status": status, "signature": signature})
-    cluster["status"] = sharing
+    cluster["status"] = note
 
 
 def _take_statuses(name: str, cluster: dict, statuses: list[dict]) -> None:
@@ -777,6 +783,20 @@ def _take_statuses(name: str, cluster: dict, statuses: list[dict]) -> None:
         if _roster_signed_by(peer, status, item.get("signature", "")):
             parties[peer]["sharing"] = {"groups": status["groups"], "devices": status["devices"],
                                         "detail": status.get("detail", [])}
+            if status.get("route"):
+                _pin_route(peer, parties[peer].get("display_name"), status["route"])
+
+
+def _pin_route(peer: str, display_name: str | None, route: dict) -> None:
+    """A lab's own signed route: from now on the HOME dials it directly.
+    A malformed one leaves the broker path in place."""
+    from .peers import PeerStore
+
+    try:
+        PeerStore(_db_path()).upsert(deployment_id=peer, display_name=display_name or peer, route=route,
+                                     source="cluster")
+    except (ValueError, sqlite3.Error):
+        pass
 
 
 def _roster_signed_by(owner: str, roster: dict, signature: str) -> bool:

remoteRF_server/server/federation/devices.py

@@ -18,8 +18,10 @@ replayed because the grant's JTI was already consumed.
 
 from __future__ import annotations
 
+import json
 import sqlite3
 import time
+from contextlib import closing
 from datetime import datetime
 from pathlib import Path
 from uuid import uuid4
@@ -28,6 +30,7 @@ from remoterf_federation_core import (
     DeviceProtocolError,
     canonical_json,
     canonical_uuid,
+    contract_allows,
     decode_device_b64,
     empty_device_payload,
     encode_device_b64,
@@ -45,6 +48,91 @@ from .migrations import configure_connection, migrate_gate_h_reservations_schema
 MAX_DEVICE_RPC_REQUEST_BYTES = (MAX_DEVICE_ACTION_REQUEST_BYTES // 4) * 3
 MAX_DEVICE_RPC_RESPONSE_BYTES = (MAX_DEVICE_RESULT_BYTES // 4) * 3
 
+# The one control-plane RPC a federated caller may run without a live
+# reservation: it returns the driver schema the Client needs to install a
+# driver before its reservation starts.  Natively this RPC is reachable by
+# anyone who knows a device id, so gating it on local visibility is
+# strictly tighter, not looser.
+IDL_FUNCTION = "IDL:get_drivers"
+
+
+def run_bound_rpc(rpc_manager, *, device_id: int, function_name: str, args) -> dict:
+    """One RPC against a device the caller was already authorized for.
+
+    The HOME never holds this deployment's device bearer token, and a
+    federated caller may not smuggle one in to reach another device: the call
+    is pinned to ``device_id`` whatever its arguments name.
+    """
+
+    args = dict(args)
+    args.pop("a", None)
+    args.pop("token", None)
+    if function_name == IDL_FUNCTION:
+        args.pop("device_name", None)
+        args["device_id"] = map_arg(int(device_id))
+        return rpc_manager.run_rpc(function_name=function_name, args=args)
+    return rpc_manager.run_device_rpc_for_gid(
+        gid=int(device_id), function_name=function_name, args=args
+    )
+
+
+def path_authorizer(*, reservations, usergroups_path, claims, reservation_id, device_id, clock):
+    """Per-call authorization for a federated direct path.
+
+    Not a bearer token: each call re-derives that the contract which admitted
+    the grant still allows DEVICE_CONTROL, the proxy is still active, and the
+    reservation is still live (``IDL:get_drivers`` needs visibility only), so
+    a cancel, a suspend or a revoke closes the path within one call.
+    Returns None to allow, else the reason the caller sees.
+    """
+
+    from .destination import ServerFederationExecutor
+
+    issuer, subject = claims["iss"], claims["sub"]
+    contract_id, version = claims["contract_id"], claims["contract_version"]
+
+    def authorize(function_name: str):
+        account_id = None
+        if usergroups_path is not None:
+            with closing(sqlite3.connect(usergroups_path, timeout=10.0)) as conn:
+                conn.row_factory = sqlite3.Row
+                configure_connection(conn)
+                row = conn.execute(
+                    "SELECT * FROM FederationContracts WHERE contract_id=? AND version=?",
+                    (contract_id, version),
+                ).fetchone()
+                principal = conn.execute(
+                    "SELECT status, local_account_id FROM FederatedPrincipals "
+                    "WHERE issuer_deployment_id=? AND remote_subject_id=?",
+                    (issuer, subject),
+                ).fetchone()
+            try:
+                terms = ServerFederationExecutor._terms(row) if row is not None else None
+            except Exception:  # noqa: BLE001 - unreadable terms are no authority
+                terms = None
+            if terms is None or not contract_allows(
+                terms, row["state"], "DEVICE_CONTROL", now=int(clock()),
+                superseded=row["superseded_by_version"] is not None,
+            ):
+                return "the agreement with your home lab is no longer active"
+            if principal is None or principal["status"] != "active":
+                return "your account at this lab is disabled"
+            account_id = int(principal["local_account_id"])
+        if function_name == IDL_FUNCTION and account_id is not None:
+            visible = {
+                int(entry["local_device_id"])
+                for entry in reservations.federated_visible_devices(local_account_id=account_id)
+            }
+            return None if int(device_id) in visible else "device is not visible"
+        live = reservations.federated_live_reservation(
+            issuer_deployment_id=issuer, remote_subject_id=subject, reservation_id=reservation_id,
+        )
+        if live is None or int(live["device_id"]) != int(device_id):
+            return "the reservation has ended"
+        return None
+
+    return authorize
+
 
 class _DeviceHandlerBase:
     """Shared destination-local resolution for every device action."""
@@ -60,8 +148,10 @@ class _DeviceHandlerBase:
         clock=None,
         reservation_handler=None,
         rpc_manager=None,
+        usergroups_path=None,
     ):
         self.reservations_path = Path(reservations_path)
+        self.usergroups_path = Path(usergroups_path) if usergroups_path else None
         self.local_deployment_id = canonical_uuid(local_deployment_id)
         self.display_name = str(display_name)
         self.clock = clock or (lambda: int(time.time()))
@@ -294,12 +384,7 @@ class ServerDeviceRpcHandler(_DeviceHandlerBase):
 
     action = "device_rpc"
 
-    # The one control-plane RPC a federated caller may run without a live
-    # reservation: it returns the driver schema the Client needs to install a
-    # driver before its reservation starts.  Natively this RPC is reachable by
-    # anyone who knows a device id, so gating it on local visibility is
-    # strictly tighter, not looser.
-    IDL_FUNCTION = "IDL:get_drivers"
+    IDL_FUNCTION = IDL_FUNCTION
 
     @staticmethod
     def _parse_frame(payload):
@@ -373,22 +458,10 @@ class ServerDeviceRpcHandler(_DeviceHandlerBase):
         device_id = int(payload["local_device_id"])
         function_name, args = self._parse_frame(payload)
 
-        # The HOME never holds this deployment's device bearer token, and a
-        # federated caller may not smuggle one in to reach another device.
-        args.pop("a", None)
-        args.pop("token", None)
-
         try:
-            if function_name == self.IDL_FUNCTION:
-                # Pin the schema lookup to the device the grant named; a
-                # caller-supplied name or id would otherwise widen it.
-                args.pop("device_name", None)
-                args["device_id"] = map_arg(int(device_id))
-                results = self.rpc.run_rpc(function_name=function_name, args=args)
-            else:
-                results = self.rpc.run_device_rpc_for_gid(
-                    gid=device_id, function_name=function_name, args=args
-                )
+            results = run_bound_rpc(
+                self.rpc, device_id=device_id, function_name=function_name, args=args
+            )
         except Exception:
             raise FederationBusinessError("device_unavailable") from None
 
@@ -412,6 +485,74 @@ class ServerDeviceRpcHandler(_DeviceHandlerBase):
         }
 
 
+class ServerDirectOpenHandler(_DeviceHandlerBase):
+    """Answer a client's ICE offer for one live federated reservation: Gate I
+    across deployments (docs/deployment-groups.md §7.6).
+
+    Authorization (an active proxy, a reservation of its own that is live
+    right now) is decided and the grant consumed inside the executor's
+    transaction; the path itself is opened in finalize(), after commit. Every
+    call on that path is then re-authorized by ``path_authorizer``.
+    """
+
+    action = "direct_open"
+
+    def _live(self, action):
+        claims, payload = action.claims, action.request.value["payload"]
+        live = self.reservations.federated_live_reservation(
+            issuer_deployment_id=claims["iss"],
+            remote_subject_id=claims["sub"],
+            reservation_id=int(payload["reservation_id"]),
+        )
+        if live is None:
+            raise FederationBusinessError("no_active_reservation")
+        return live
+
+    def __call__(self, tx, action):
+        now = int(self.clock())
+        principal_id, _account_id = self._principal(tx, action.claims)
+        live = self._live(action)
+        reservation_id = int(action.request.value["payload"]["reservation_id"])
+        self._receipt(
+            tx, action, code="authorized", principal_id=principal_id,
+            device_id=live["device_id"], reservation_id=reservation_id,
+        )
+        self._audit(
+            tx, action, code="authorized", principal_id=principal_id,
+            metadata={"local_device_id": str(live["device_id"]), "reservation_id": str(reservation_id)},
+        )
+        return {
+            **self._ok(action, empty_device_payload("direct_open"), now=now),
+            "status": "error",
+            "error_code": FINALIZE_PENDING,
+        }
+
+    def finalize(self, action, result):
+        from .. import direct_path
+
+        claims, payload = action.claims, action.request.value["payload"]
+        live = self._live(action)
+        reservation_id = int(payload["reservation_id"])
+        device_id = int(live["device_id"])
+        rpc = self.rpc
+        authorize = path_authorizer(
+            reservations=self.reservations, usergroups_path=self.usergroups_path, claims=claims,
+            reservation_id=reservation_id, device_id=device_id, clock=self.clock,
+        )
+
+        def run(function_name, args):
+            return run_bound_rpc(rpc, device_id=device_id, function_name=function_name, args=args)
+
+        try:
+            answer = direct_path.offer_bound(
+                f"federated/{claims['iss']}/{claims['sub']}/{reservation_id}",
+                live["username"], payload["ice"], bound={"run": run, "authorize": authorize},
+            )
+        except Exception:
+            raise FederationBusinessError("direct_path_unavailable") from None
+        return {**result, "status": "ok", "error_code": None, "payload": {"ice": json.dumps(answer)}}
+
+
 def build_device_handlers(
     *,
     reservations_path,
@@ -420,6 +561,7 @@ def build_device_handlers(
     clock=None,
     reservation_handler=None,
     rpc_manager=None,
+    usergroups_path=None,
 ) -> dict:
     common = {
         "reservations_path": reservations_path,
@@ -428,6 +570,7 @@ def build_device_handlers(
         "clock": clock,
         "reservation_handler": reservation_handler,
         "rpc_manager": rpc_manager,
+        "usergroups_path": usergroups_path,
     }
     return {
         "device_list": ServerDeviceListHandler(**common),
@@ -435,6 +578,7 @@ def build_device_handlers(
         "device_reserve": ServerDeviceReserveHandler(**common),
         "device_cancel": ServerDeviceCancelHandler(**common),
         "device_rpc": ServerDeviceRpcHandler(**common),
+        "direct_open": ServerDirectOpenHandler(**common),
     }
 
 
@@ -451,19 +595,19 @@ def build_server_gate_h_executor(
     reservation_handler=None,
     rpc_manager=None,
 ):
-    """Gate G registry plus the five device actions.
+    """Gate G registry plus the device actions.
 
     The Gate H usergroups migration runs first because it widens the grant
     replay table's action CHECK; without it a device grant's JTI could not be
     consumed and every device action would fail closed as an internal error.
     """
 
-    from .migrations import migrate_gate_h_usergroups_schema
+    from .migrations import migrate_peers_usergroups_schema
     from .permissions import build_server_gate_g_executor
 
     with sqlite3.connect(Path(usergroups_path), timeout=10.0) as conn:
         configure_connection(conn)
-        migrate_gate_h_usergroups_schema(conn)
+        migrate_peers_usergroups_schema(conn)
     executor = build_server_gate_g_executor(
         usergroups_path=usergroups_path,
         reservations_path=reservations_path,
@@ -481,6 +625,7 @@ def build_server_gate_h_executor(
         clock=clock,
         reservation_handler=reservation_handler,
         rpc_manager=rpc_manager,
+        usergroups_path=usergroups_path,
     ).items():
         executor.registry.register(action, handler)
     return executor

remoteRF_server/server/federation/home.py

@@ -12,6 +12,7 @@ from pathlib import Path
 from typing import Mapping
 from uuid import uuid4
 
+import grpc
 import jwt
 import requests
 from cryptography.hazmat.primitives import serialization
@@ -24,6 +25,7 @@ from remoterf_federation_core import (
     BROKER_REQUEST_TYP,
     DEFAULT_ACTION_RETRY_POLICIES,
     FEDERATION_GRANT_TYP,
+    MAX_DEVICE_FORWARD_REQUEST_BYTES,
     MAX_DEVICE_FORWARD_RESPONSE_BYTES,
     MAX_PROTOCOL_INTEGER,
     PERMISSIONS_CONNECT_TIMEOUT_SECONDS,
@@ -53,6 +55,7 @@ from remoterf_federation_core import (
 )
 
 from .migrations import configure_connection, migrate_gate_e_usergroups_schema
+from .peers import PeerStore
 
 FORWARD_PATH = "/v2/broker/federation/forward"
 MAX_FORWARD_RESPONSE_BYTES = 32768
@@ -376,7 +379,13 @@ class ServerHomeGrantIssuer:
 
 
 class HomeFederationOutbound:
-    """Fresh grant and broker credentials per attempt, with one bounded retry."""
+    """Fresh grant per attempt, with one bounded retry.
+
+    A destination with a FederationPeers row is dialed directly: its own
+    FederationV2 listener, TLS pinned to the CA in the row. Any other
+    destination goes through the broker's forward path, as before. Grant,
+    envelope and result verification are the same either way.
+    """
 
     def __init__(
         self,
@@ -404,6 +413,7 @@ class HomeFederationOutbound:
         self.read_timeout = self.timeout
         self.overall_timeout = self.timeout * 2
         self.sender = sender
+        self.peers = PeerStore(issuer.usergroups_path)
         self._sender_accepts_deadline = bool(
             sender is not None
             and len(inspect.signature(sender).parameters) >= 3
@@ -480,6 +490,50 @@ class HomeFederationOutbound:
                 "invalid_transport_response", retryable=False
             ) from None
 
+    def peer(self, deployment_id: str) -> dict | None:
+        """The FederationPeers row for a destination, or None (broker path)."""
+        return self.peers.get(deployment_id)
+
+    def _dial(self, route: dict, grant: str, request_json: str, deadline: float) -> dict:
+        """FederationV2.Execute on the peer's own listener, pinned to its CA."""
+        from ...common.grpc import federation_pb2 as pb
+        from ...common.grpc import federation_pb2_grpc as rpc
+
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise TimeoutError()
+        credentials = grpc.ssl_channel_credentials(
+            root_certificates=route["ca_pem"].encode("utf-8")
+        )
+        options = (
+            ("grpc.ssl_target_name_override", route["tls_server_name"]),
+            ("grpc.default_authority", route["tls_server_name"]),
+            ("grpc.max_send_message_length", MAX_DEVICE_FORWARD_REQUEST_BYTES),
+            ("grpc.max_receive_message_length", MAX_DEVICE_FORWARD_RESPONSE_BYTES),
+        )
+        # ponytail: one channel per call; cache per peer if the handshake
+        # ever shows up in a fan-out budget.
+        with grpc.secure_channel(route["endpoint"], credentials, options=options) as channel:
+            response = rpc.FederationV2Stub(channel).Execute(
+                pb.FederationRequest(
+                    protocol_version="2", grant=grant, request_json=request_json
+                ),
+                timeout=remaining,
+            )
+        return {
+            "protocol_version": response.protocol_version,
+            "signed_result": response.signed_result or None,
+            "error": (
+                {
+                    "code": response.error.code,
+                    "message": response.error.message,
+                    "retryable": response.error.retryable,
+                }
+                if response.HasField("error")
+                else None
+            ),
+        }
+
     def _broker_token(self, body: bytes) -> str:
         now = int(self.issuer.clock())
         claims = build_broker_request_claims(
@@ -531,6 +585,13 @@ class HomeFederationOutbound:
         )
         own_deadline = time.monotonic() + budget
         deadline = own_deadline if deadline is None else min(float(deadline), own_deadline)
+        route = None if self.sender is not None else self.peer(destination_deployment_id)
+        logger.info(
+            "federation_transport destination=%s action=%s via=%s",
+            canonical_uuid(destination_deployment_id),
+            action,
+            "in-process" if self.sender is not None else route["via"] if route else "broker",
+        )
         for attempt in range(attempts):
             if time.monotonic() >= deadline:
                 raise TransportFailure("route_unavailable", retryable=False)
@@ -544,25 +605,30 @@ class HomeFederationOutbound:
                 code_name=code_name,
                 device_payload=device_payload,
             )
-            body = canonical_json(
-                {
-                    "protocol_version": "2",
-                    "grant": issued.grant,
-                    "request_json": issued.request.json,
-                }
-            ).encode("utf-8")
-            outer = self._broker_token(body)
             try:
-                received = (
-                    self.sender(body, outer, deadline)
-                    if self._sender_accepts_deadline
-                    else self.sender(body, outer)
-                    if self.sender is not None
-                    else self._send(
-                        body, outer, deadline, max_forward_response_bytes(action)
+                if route is not None:
+                    received = self._dial(
+                        route, issued.grant, issued.request.json, deadline
                     )
-                )
-            except (requests.RequestException, TimeoutError, ConnectionError, OSError):
+                else:
+                    body = canonical_json(
+                        {
+                            "protocol_version": "2",
+                            "grant": issued.grant,
+                            "request_json": issued.request.json,
+                        }
+                    ).encode("utf-8")
+                    outer = self._broker_token(body)
+                    received = (
+                        self.sender(body, outer, deadline)
+                        if self._sender_accepts_deadline
+                        else self.sender(body, outer)
+                        if self.sender is not None
+                        else self._send(
+                            body, outer, deadline, max_forward_response_bytes(action)
+                        )
+                    )
+            except (requests.RequestException, grpc.RpcError, TimeoutError, ConnectionError, OSError):
                 if attempt + 1 < attempts:
                     continue
                 raise TransportFailure("route_unavailable", retryable=False) from None

remoteRF_server/server/federation/home_devices.py

@@ -382,7 +382,7 @@ class ServerHomeDevices:
         with self._connect() as conn:
             rows = conn.execute(
                 "SELECT r.res_id, r.salt, r.hash, a.alias_id, a.owner_deployment_id, "
-                "a.remote_device_id, h.local_account_id "
+                "a.remote_device_id, h.local_account_id, h.remote_reservation_id "
                 "FROM HomeFederatedReservations h "
                 "JOIN Reservations r ON r.res_id=h.res_id "
                 "JOIN FederatedDeviceAliases a ON a.alias_id=r.device_id"
@@ -402,6 +402,38 @@ class ServerHomeDevices:
             ).fetchone()
         return int(row[0]) if row else None
 
+    def direct_offer(self, *, local_account_id: int, token: str, ice: str) -> dict:
+        """Have the owner answer this client's ICE offer for the reservation
+        behind a HOME-minted token (docs/deployment-groups.md §7.6).
+
+        Returns the answer plus what the client needs to pin the owner's QUIC
+        handshake: the owner's TLS name and CA from its FederationPeers row.
+        Without that row there is no direct route, and the client simply
+        keeps driving the device through this HOME.
+        """
+
+        route = self.resolve_token(token)
+        if route is None or int(route["local_account_id"]) != int(local_account_id):
+            raise HomeDeviceError("That token does not name a partner device of yours.")
+        owner = route["owner_deployment_id"]
+        peer = self.outbound.peer(owner)
+        if peer is None:
+            raise HomeDeviceError("No direct route to the partner lab is known yet.")
+        candidate = self._destination(local_account_id, owner, "DEVICE_CONTROL")
+        try:
+            result = self._forward(
+                local_account_id, candidate, "direct_open",
+                reservation_id=str(route["remote_reservation_id"]), ice=ice,
+            )
+        except Exception as exc:  # noqa: BLE001
+            raise HomeDeviceError(_failure_text(exc)) from None
+        return {
+            "ice": result["payload"]["ice"],
+            "server_name": peer["tls_server_name"],
+            "ca_pem": peer["ca_pem"],
+            "owner": owner,
+        }
+
     def rpc(self, *, local_account_id: int, alias, function_name: str, args: dict) -> dict:
         """Run one device RPC on the owner; returns the owner's results map."""
 

remoteRF_server/server/federation/migrations.py

@@ -44,6 +44,12 @@ GATE_H_JTI_ACTIONS = (
     "device_cancel",
     "device_rpc",
 )
+# Schema 8: where each partner's FederationV2 listener is and the CA pinned
+# for it (the HOME dials it directly instead of the broker), and the
+# federated direct path's `direct_open` grants join the replay table.
+PEERS_MIGRATION_VERSION = 8
+PEERS_MIGRATION_NAME = "federation_peers_direct_open_v1"
+PEERS_JTI_ACTIONS = GATE_H_JTI_ACTIONS + ("direct_open",)
 FEDERATED_PASSWORD_SALT = "!remoterf-federated-salt-v2!"
 FEDERATED_PASSWORD_HASH = "!remoterf-federated-no-password-v2!"
 
@@ -423,6 +429,28 @@ _GATE_H_MIGRATION_CHECKSUM = hashlib.sha256(
 
 # Written into reservations.db so a federated reservation row and the record
 # authorizing it commit together in one transaction.
+# The Gate H rebuild, once more, with the direct path's action admitted.
+_PEERS_JTI_REBUILD = _GATE_H_JTI_REBUILD.replace(
+    _GATE_H_JTI_ACTION_CHECK, ",".join(f"'{name}'" for name in PEERS_JTI_ACTIONS)
+).replace("FederationGrantJTIsGateH", "FederationGrantJTIsPeers")
+
+_PEERS_DDL = """
+CREATE TABLE IF NOT EXISTS FederationPeers (
+    deployment_id TEXT PRIMARY KEY CHECK(length(deployment_id)=36),
+    display_name TEXT NOT NULL,
+    endpoint TEXT NOT NULL,
+    tls_server_name TEXT NOT NULL,
+    ca_pem TEXT NOT NULL,
+    via TEXT NOT NULL CHECK(via IN ('direct','relay')),
+    source TEXT NOT NULL CHECK(source IN ('admin','cluster')),
+    updated_at INTEGER NOT NULL
+);
+"""
+
+_PEERS_MIGRATION_CHECKSUM = hashlib.sha256(
+    (_PEERS_JTI_REBUILD + _PEERS_DDL).encode("utf-8")
+).hexdigest()
+
 _GATE_H_RESERVATIONS_DDL = """
 CREATE TABLE IF NOT EXISTS FederatedReservations (
     res_id INTEGER PRIMARY KEY,
@@ -840,6 +868,39 @@ def migrate_gate_h_reservations_schema(conn: sqlite3.Connection) -> None:
     conn.executescript(_GATE_H_RESERVATIONS_DDL)
 
 
+def _peers_jti_needs_rebuild(conn: sqlite3.Connection) -> bool:
+    row = conn.execute(
+        "SELECT sql FROM sqlite_master WHERE type='table' AND name=?",
+        ("FederationGrantJTIs",),
+    ).fetchone()
+    return row is not None and "'direct_open'" not in (row[0] or "")
+
+
+def migrate_peers_usergroups_schema(conn: sqlite3.Connection) -> None:
+    """Schema 8: FederationPeers, and `direct_open` in the replay table."""
+
+    migrate_gate_h_usergroups_schema(conn)
+    row = conn.execute(
+        "SELECT checksum FROM SchemaMigrations WHERE name=?",
+        (PEERS_MIGRATION_NAME,),
+    ).fetchone()
+    if row is not None and row[0] != _PEERS_MIGRATION_CHECKSUM:
+        raise SchemaNotReady("Peers migration checksum mismatch")
+    if _peers_jti_needs_rebuild(conn):
+        conn.executescript(_PEERS_JTI_REBUILD)
+    conn.executescript(_PEERS_DDL)
+    conn.execute(
+        "INSERT OR IGNORE INTO SchemaMigrations "
+        "(version,name,checksum,applied_at) VALUES (?,?,?,?)",
+        (
+            PEERS_MIGRATION_VERSION,
+            PEERS_MIGRATION_NAME,
+            _PEERS_MIGRATION_CHECKSUM,
+            int(time.time()),
+        ),
+    )
+
+
 def migrate_home_devices_reservations_schema(conn: sqlite3.Connection) -> None:
     conn.executescript(_HOME_DEVICES_RESERVATIONS_DDL)
 

remoteRF_server/server/federation/peers.py

@@ -0,0 +1,150 @@
+# Copyright (C) 2026 RemoteRF
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+"""FederationPeers: where a partner's FederationV2 listener is and the CA
+pinned for it, so the HOME dials the partner itself instead of asking the
+broker to forward.
+
+A row arrives one of two ways: an admin adds it (`serverrf federation peers
+add`), or the cluster agent takes it from the partner's own signed status
+note, verified with the key pinned at join -- so Global relays the route but
+can never substitute one. An admin row is never overwritten by the agent.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sqlite3
+import time
+from contextlib import closing
+from pathlib import Path
+
+from cryptography import x509
+from remoterf_federation_core import canonical_uuid
+
+from .migrations import configure_connection, migrate_peers_usergroups_schema
+
+MAX_CA_PEM_BYTES = 16384
+_ENDPOINT = re.compile(r"^(\[[0-9a-fA-F:.]+\]|[A-Za-z0-9.-]+):([1-9][0-9]{0,4})$")
+_HOSTNAME = re.compile(r"^(?=.{1,253}$)([A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)*[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$")
+ROUTE_FIELDS = frozenset({"grpc_endpoint", "tls_server_name", "ca_pem"})
+
+
+def validate_route(route: object) -> dict:
+    """The route a lab advertises for itself, as the store keeps it."""
+    if type(route) is not dict or set(route) != ROUTE_FIELDS:
+        raise ValueError("route has the wrong fields")
+    endpoint, name, ca_pem = route["grpc_endpoint"], route["tls_server_name"], route["ca_pem"]
+    if type(endpoint) is not str or _ENDPOINT.match(endpoint) is None:
+        raise ValueError("route endpoint must be host:port")
+    if type(name) is not str or _HOSTNAME.match(name) is None:
+        raise ValueError("route tls_server_name must be a hostname")
+    if type(ca_pem) is not str or not 0 < len(ca_pem) <= MAX_CA_PEM_BYTES:
+        raise ValueError("route ca_pem is missing or too large")
+    try:
+        x509.load_pem_x509_certificate(ca_pem.encode("utf-8"))
+    except ValueError:
+        raise ValueError("route ca_pem is not a PEM certificate") from None
+    return {"grpc_endpoint": endpoint, "tls_server_name": name, "ca_pem": ca_pem}
+
+
+def via(endpoint: str) -> str:
+    """'relay' for a Global relay name, 'direct' for anything the admin gave."""
+    from .. import global_onboarding
+
+    host = endpoint.rsplit(":", 1)[0]
+    return "relay" if host.endswith("." + global_onboarding.domain()) else "direct"
+
+
+class PeerStore:
+    def __init__(self, usergroups_path):
+        self.path = Path(usergroups_path)
+        self._ready = False
+
+    def _connect(self) -> sqlite3.Connection:
+        conn = sqlite3.connect(self.path, timeout=10.0)
+        conn.row_factory = sqlite3.Row
+        configure_connection(conn)
+        if not self._ready:
+            migrate_peers_usergroups_schema(conn)
+            conn.commit()  # the migration's writes must not leave a transaction open
+            self._ready = True
+        return conn
+
+    def get(self, deployment_id: str) -> dict | None:
+        with closing(self._connect()) as conn:
+            row = conn.execute(
+                "SELECT * FROM FederationPeers WHERE deployment_id=?", (canonical_uuid(deployment_id),)
+            ).fetchone()
+        return dict(row) if row is not None else None
+
+    def list(self) -> list[dict]:
+        with closing(self._connect()) as conn:
+            return [dict(row) for row in conn.execute("SELECT * FROM FederationPeers ORDER BY display_name")]
+
+    def upsert(self, *, deployment_id: str, display_name: str, route: dict, source: str) -> bool:
+        """Record a route; a cluster note never replaces what an admin set."""
+        if source not in ("admin", "cluster"):
+            raise ValueError("source must be admin or cluster")
+        clean = validate_route(route)
+        deployment_id = canonical_uuid(deployment_id)
+        with closing(self._connect()) as conn, conn:
+            conn.execute("BEGIN IMMEDIATE")
+            row = conn.execute(
+                "SELECT source FROM FederationPeers WHERE deployment_id=?", (deployment_id,)
+            ).fetchone()
+            if row is not None and row["source"] == "admin" and source == "cluster":
+                return False
+            conn.execute(
+                "INSERT INTO FederationPeers "
+                "(deployment_id,display_name,endpoint,tls_server_name,ca_pem,via,source,updated_at) "
+                "VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(deployment_id) DO UPDATE SET "
+                "display_name=excluded.display_name, endpoint=excluded.endpoint, "
+                "tls_server_name=excluded.tls_server_name, ca_pem=excluded.ca_pem, "
+                "via=excluded.via, source=excluded.source, updated_at=excluded.updated_at",
+                (
+                    deployment_id, str(display_name or deployment_id)[:256], clean["grpc_endpoint"],
+                    clean["tls_server_name"], clean["ca_pem"], via(clean["grpc_endpoint"]), source,
+                    int(time.time()),
+                ),
+            )
+        return True
+
+    def remove(self, deployment_id: str) -> bool:
+        with closing(self._connect()) as conn, conn:
+            return conn.execute(
+                "DELETE FROM FederationPeers WHERE deployment_id=?", (canonical_uuid(deployment_id),)
+            ).rowcount > 0
+
+
+def own_route() -> dict | None:
+    """This lab's relay route, for its status note: the name clients dial,
+    the relay's gRPC port, and the CA every client already pins."""
+    from .. import global_onboarding
+
+    host = global_onboarding.hostname()
+    port = global_onboarding.load().get("GLOBAL_RELAY_GRPC_PORT")
+    ca_path = Path(os.getenv("REMOTERF_CERT_DIR", global_onboarding.cfg_dir() / "certs")) / "ca.crt"
+    try:
+        ca_pem = ca_path.read_text("utf-8")
+    except OSError:
+        return None
+    if not host or not port:
+        return None
+    try:
+        return validate_route({"grpc_endpoint": f"{host}:{port}", "tls_server_name": host, "ca_pem": ca_pem})
+    except ValueError:
+        return None

remoteRF_server/server/reservation.py

@@ -168,6 +168,21 @@ class ReservationHandler:
                 username = unmap_arg(args['un'])
                 password = unmap_arg(args['pw'])
                 if self.login_user(username, password) == {"UC": map_arg(f'{username}')}:
+                    if 'a' in args:
+                        # A partner device: the owner answers, over the HOME's
+                        # grant; the client then punches to the owner itself.
+                        from .federation.home_devices import HomeDeviceError
+
+                        if self.federation_devices is None:
+                            return {"ace": map_arg("This home has no partner devices.")}
+                        try:
+                            answer = self.federation_devices.direct_offer(
+                                local_account_id=self.get_uid(username),
+                                token=unmap_arg(args['a']), ice=unmap_arg(args['ice']),
+                            )
+                        except HomeDeviceError as exc:
+                            return {"ace": map_arg(str(exc))}
+                        return {key: map_arg(value) for key, value in answer.items()}
                     from .direct_path import offer
                     return offer(self._session_hash(password), username, unmap_arg(args['ice']))
                 else:
@@ -1407,6 +1422,35 @@ class ReservationHandler:
         )
         return {"cancelled": True}
 
+    @db_connection
+    def federated_live_reservation(
+        self,
+        *,
+        issuer_deployment_id: str,
+        remote_subject_id: str,
+        reservation_id: int,
+        now: datetime | None = None,
+    ) -> dict | None:
+        """{local_account_id, device_id, username} for a federation-created
+        reservation of this exact principal that is live right now, else None."""
+
+        row = self.cursor.execute(
+            "SELECT f.local_account_id, r.device_id, r.username, r.start_time, r.end_time "
+            "FROM FederatedReservations f JOIN Reservations r ON r.res_id = f.res_id "
+            "WHERE f.res_id = ? AND f.issuer_deployment_id = ? AND f.remote_subject_id = ?",
+            (int(reservation_id), canonical_uuid(issuer_deployment_id), canonical_uuid(remote_subject_id)),
+        ).fetchone()
+        if row is None:
+            return None
+        moment = now or datetime.now()
+        try:
+            live = _parse_reservation_datetime(row[3]) <= moment < _parse_reservation_datetime(row[4])
+        except ValueError:
+            return None
+        if not live:
+            return None
+        return {"local_account_id": int(row[0]), "device_id": int(row[1]), "username": row[2]}
+
     @db_connection
     def federated_active_reservation(
         self, *, local_account_id: int, device_id: int, now: datetime | None = None

remoteRF_server/server/rpc_manager.py

@@ -170,10 +170,15 @@ class RpcManager:
     def _federated_rpc(self, federated, *, function_name: str, args: dict) -> dict:
         local_account_id, alias = federated
         try:
-            return reservation_handler.federation_devices.rpc(
+            results = reservation_handler.federation_devices.rpc(
                 local_account_id=local_account_id, alias=alias,
                 function_name=function_name, args=args,
             )
+            if function_name.startswith("IDL:"):
+                # The Client learns here that this token drives a partner's
+                # device, and opens its direct path to that lab (Gate I).
+                results["federated"] = map_arg(alias["owner_deployment_id"])
+            return results
         except Exception as e:
             key = 'error' if function_name.startswith("IDL:") else 'a'
             return {key: map_arg(str(e))}

{remoterf_server-1.1.0.dev50.dist-info → remoterf_server-1.1.0.dev52.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remoteRF-server
-Version: 1.1.0.dev50
+Version: 1.1.0.dev52
 Summary: RemoteRF server-side control package
 License: GPL-3.0-or-later
 Classifier: Programming Language :: Python :: 3
@@ -9,7 +9,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: remoterf-federation-core==0.15.0
+Requires-Dist: remoterf-federation-core==0.16.0
 Requires-Dist: grpcio<2.0.0,>=1.81.1
 Requires-Dist: protobuf<7.0.0,>=6.33.5
 Requires-Dist: numpy

{remoterf_server-1.1.0.dev50.dist-info → remoterf_server-1.1.0.dev52.dist-info}/RECORD

@@ -52,35 +52,36 @@ remoteRF_server/host/host_tunnel_server.py,sha256=sz06xOtFbaDZSy1UQfw6faKhJmuOy5
 remoteRF_server/server/__init__.py,sha256=-1h_xQjiE66oiWRO-vnLGJ4smpgUNhFuV-ZreW9_tD4,667
 remoteRF_server/server/acc_perms.py,sha256=2loCvstVu8uvsb2uCv2Sk7iNQ5GyO_sBIkPQFzqOaRI,13334
 remoteRF_server/server/cert_provider.py,sha256=CRDrZL4DSf-eL6wzPJzwucrzPLOr2PvNRq5V--oZtr0,6272
-remoteRF_server/server/commands.py,sha256=ccb_Ab1mbIkosBsFGJnDSccrjWtR_Lymvvn3IqhOnyc,17519
+remoteRF_server/server/commands.py,sha256=J70-S7TdpD5vkjUqDLnGhWv5bwNogNx9GAp85LHrACE,17701
 remoteRF_server/server/console.py,sha256=J91LfwPVmBgielOxfE740NOYduekggyZkqi-47y_A4w,4472
 remoteRF_server/server/control.py,sha256=Uq1Fk0zIoHHX_EXfz3OuNle8urvO_UhAiB5Lk5cs2e4,5177
 remoteRF_server/server/device_manager.py,sha256=PPuCwlPSmjfVpCqy_hCaOr9WvFgE8mqtLMhWOAgXNDA,39281
-remoteRF_server/server/direct_path.py,sha256=TrL0aWCUXN9Lmuww-v_AXtLIOqTkckm2vPW91xcnOLI,17875
+remoteRF_server/server/direct_path.py,sha256=gXBNNf5eG7NSe0YpkAz1n874LRzfRPbSNJ-MAgRFCR0,19995
 remoteRF_server/server/dynamic_v2.py,sha256=AMhQEFhNAvCNcF-PdfCCQQLmeoaR7s1Os8et1KFGn_8,70814
 remoteRF_server/server/global_onboarding.py,sha256=NcKG8TYhCJEiaCtdXL1jEgVm-R_xWpOIj5KI4bWfkr0,39942
 remoteRF_server/server/grpc_server.py,sha256=91FpJubzN_Wfuk6fW_owIEzNCukd333sAGW68FUU8pk,46787
 remoteRF_server/server/host_dynamic_v2.py,sha256=1rJQwP4knSd0EXkByrSn_ryjLx81f6sp6SNYr_aEass,8105
-remoteRF_server/server/reservation.py,sha256=BQJLGNVAdKMZu2Lg4DGO9UhuJ0b1GSF8K1DgIOFrYUg,67816
-remoteRF_server/server/rpc_manager.py,sha256=BDvsTSVRxwNF2ujuMbIb5TYNAUI6AH4xXBuXrb8lltM,17223
+remoteRF_server/server/reservation.py,sha256=r7XE7lPj_KdRx8nCMcr0b0NJuUFzNFmdIXEQW4c8LY4,69959
+remoteRF_server/server/rpc_manager.py,sha256=qG81UtoVRiamyaI0mHrxBOV3oYaDP6DHClV5no-ehpo,17529
 remoteRF_server/server/user_group_cli.py,sha256=0QbsGfeIqkyU6E1naGwR-i7BxptPMMTQCi1m7yM03JM,26259
 remoteRF_server/server/user_group_handler.py,sha256=1ax73W_P3H6GDxQS13evwA7G7skIElFVLuS0MFqsFyU,41780
 remoteRF_server/server/v2_errors.py,sha256=IS3hIhf5tDe7jaOrDAVQPjGBpqAjN7442BlJYgfJo7g,3331
 remoteRF_server/server/deployment/__init__.py,sha256=YV86uafd8XiGD7sLaqNfO5xxmt5te2R6DUhD-w1lZuY,77
 remoteRF_server/server/deployment/capabilities.py,sha256=20RxmGG03VoQQZnV3jGhc-3i9B5hOl5fCopnsErFjPk,872
-remoteRF_server/server/federation/__init__.py,sha256=auqdGiGnEGIKQiXX2jFVt8iWmfyZ-V3w4dUmtWDKAZE,735
+remoteRF_server/server/federation/__init__.py,sha256=CxdBYJpp1uFwOpC1NpDMxrDOXjxk_4vjUSpVI6vFE14,735
 remoteRF_server/server/federation/admin.py,sha256=t3F17FIytekzclPICmaFJEA4-F5OuWcDx3rgmFga17A,9187
-remoteRF_server/server/federation/cli.py,sha256=TIPfOdYxYDok7pR5g6COf_jUlcTFcj9o728kkLKcDqs,16351
-remoteRF_server/server/federation/cluster.py,sha256=LunLUF5tk-kOjKV3DIxPTaeGow2zvOZsae2fs1XBSQE,38469
+remoteRF_server/server/federation/cli.py,sha256=S7K7dM3h-WlJ6sGiVj47J26PXte39gVPx_vc-cAQwVs,18559
+remoteRF_server/server/federation/cluster.py,sha256=MKg6vE7WIz33zl2-yghnutIdDEXz6aGJDv-Uo-cXwk8,39215
 remoteRF_server/server/federation/contracts.py,sha256=NYh7lb_9etJHFfzXwevjC4HfSBUypLxg5xGeBgydLF4,29305
 remoteRF_server/server/federation/destination.py,sha256=XawmGCiVbL_MfNNn8xwV9_bYxUDW1L7efCpL11K2JAc,35909
-remoteRF_server/server/federation/devices.py,sha256=n5MvnD0UZyl4sFpiekG9ProanWXTYizYq6YchCflLgY,18061
+remoteRF_server/server/federation/devices.py,sha256=2Wwt7kRHx_aVHaJpBlIWrnryAGWviVM7_ZVXKaie8LY,24257
 remoteRF_server/server/federation/enrollment.py,sha256=HsyyPpMzuQ289sxHj4XLTbiCVpp3er1YXBXQ6OZyEfw,23168
-remoteRF_server/server/federation/home.py,sha256=-_0__wJN50Y1-Dd396_iUZjGESBkoBNGISXb8gbLrjM,23982
-remoteRF_server/server/federation/home_devices.py,sha256=lbsw201HBOYPP5vbN172vdm2O_ouCdZBo1cRYCVScmg,18754
+remoteRF_server/server/federation/home.py,sha256=x80xTGyS4zRQLAVtYOW0XMN3dceW_xE3Yhk8z7Tw5Ko,27006
+remoteRF_server/server/federation/home_devices.py,sha256=NQaIw9xPS8oNwRWOm3WU6L0wHgQ1TJgzWCGUPvRWcx0,20302
 remoteRF_server/server/federation/identity.py,sha256=UtQJKm2mChWZto0ZCg385k_ObrwOUtxY7XFyU_s5Q10,7436
 remoteRF_server/server/federation/legacy_state.py,sha256=SpeTZHFqymNYGWG7A3B-78dIRIVLYltBbE2zGDWzt-Q,19838
-remoteRF_server/server/federation/migrations.py,sha256=opPIfoNvR3BwoN9BaZsuEs14cT-zz4ghXWHV0hno7QI,50958
+remoteRF_server/server/federation/migrations.py,sha256=bKdURVs4jmFYzIJXrgtmspAcg1_UKStg4JMAEwlsuuY,53270
+remoteRF_server/server/federation/peers.py,sha256=VsmI_5tWciLltDCtQL84bMjdk_ZAwwr4e2ATXDMH15M,6618
 remoteRF_server/server/federation/permissions.py,sha256=ou4uFsMAGHnDeBW6zbpGeUTwp0thlYXT5nIAgd3B1rg,15861
 remoteRF_server/server/federation/principals.py,sha256=CsRYa8POmtMaxKzAGwY14sxBTNS5uKjM1nUE19mjpoQ,10410
 remoteRF_server/server/federation/runtime.py,sha256=5CoDlu0jSQrFdwRoGL2Z4_CWxnA46B3j6-eNQo8N2FI,7624
@@ -90,9 +91,9 @@ remoteRF_server/tools/gen_certs.py,sha256=Vbyu8JjRu__UYPVmyCRXt5SOw0Za1HV7g1md3G
 remoteRF_server/tools/gist_status.py,sha256=SFv2iQgQrIKT9gxKrU-_Dr7S0p0rE4wQM6J3OC6FcoM,4649
 remoteRF_server/tools/gist_status_testing.py,sha256=IYw7UkPjAUpKDTtIlnYGb5g6SJkwz4TRGUfJJ6f4LhQ,2690
 remoteRF_server/tools/introspect_uhd.py,sha256=vUpPb0rM9tsHPxWadS3EfMDE-gMd-TvNV0TjrZOQqBY,4531
-remoterf_server-1.1.0.dev50.dist-info/licenses/LICENSE,sha256=OXLcl0T2SZ8Pmy2_dmlvKuetivmyPd5m1q-Gyd-zaYY,35149
-remoterf_server-1.1.0.dev50.dist-info/METADATA,sha256=jy_xvhBrCSFGJ5x5I_ZBgDynd1Hwe7uFv-1KaC-Fs60,42069
-remoterf_server-1.1.0.dev50.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-remoterf_server-1.1.0.dev50.dist-info/entry_points.txt,sha256=_bbKk65PfYi-n6zUjqOiOwcalf_Ws1TCGATIe1TukxE,136
-remoterf_server-1.1.0.dev50.dist-info/top_level.txt,sha256=NuYWe8dSx3qdbxshWBwOgx68EHmJ9I8Zvxam4ARsQ_I,30
-remoterf_server-1.1.0.dev50.dist-info/RECORD,,
+remoterf_server-1.1.0.dev52.dist-info/licenses/LICENSE,sha256=OXLcl0T2SZ8Pmy2_dmlvKuetivmyPd5m1q-Gyd-zaYY,35149
+remoterf_server-1.1.0.dev52.dist-info/METADATA,sha256=LmVnJnoF5UA5wujJps0P7UC8xRVFb3PYy6RejNW310o,42069
+remoterf_server-1.1.0.dev52.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+remoterf_server-1.1.0.dev52.dist-info/entry_points.txt,sha256=_bbKk65PfYi-n6zUjqOiOwcalf_Ws1TCGATIe1TukxE,136
+remoterf_server-1.1.0.dev52.dist-info/top_level.txt,sha256=NuYWe8dSx3qdbxshWBwOgx68EHmJ9I8Zvxam4ARsQ_I,30
+remoterf_server-1.1.0.dev52.dist-info/RECORD,,