feat(peer): Leg B relayed-connect responder + nat_identity injection (#1532)

Cargo.toml

@@ -31,7 +31,7 @@ edition = "2021"
 # the ROOT manifest (`[workspace.package].version`), so it MUST be set here for a
 # release to fire (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet)
 # keep their own independent versions — only the released binary tracks the workspace version.
-version = "0.54.1"
+version = "0.55.0"
 
 # Release hardening, matching digstore: keep integer-overflow checks ON in release.
 # The node parses untrusted serialized input and does offset/length arithmetic over
@@ -54,8 +54,8 @@ overflow-checks = true
 # standalone. `native-tls` is NOT patched: dig-gossip is pulled with
 # `default-features = false, features = ["rustls", "relay"]`, so the OpenSSL/native-tls path is off.
 [patch.crates-io]
-chia-protocol = { git = "https://github.com/DIG-Network/dig-gossip", rev = "5bb335360ee16a856b217b429f205eead31dee80" }
-chia-sdk-client = { git = "https://github.com/DIG-Network/dig-gossip", rev = "5bb335360ee16a856b217b429f205eead31dee80" }
+chia-protocol = { git = "https://github.com/DIG-Network/dig-gossip", rev = "90c12ac5a89a4d143ed86cc755cd42678aa1aa4f" }
+chia-sdk-client = { git = "https://github.com/DIG-Network/dig-gossip", rev = "90c12ac5a89a4d143ed86cc755cd42678aa1aa4f" }
 
 # The dig-nat unification patch is RETIRED (#1280 crates.io cascade): dig-nat 0.7 is on crates.io and
 # the ENTIRE peer stack (dig-gossip 0.7.1, dig-dht 0.2.2, dig-download 0.2.1, dig-peer-selector 0.2.1,

crates/dig-node-core/Cargo.toml

@@ -106,23 +106,25 @@ getrandom = "0.2"
 # consumes both to auto-discover peers via relay.dig.net, maintain a pool, and serve/issue the L7 peer
 # RPC over mTLS (peer_id = SHA256(TLS SPKI DER)).
 #
-# Sourcing (#1280/#1393/#1494 crates.io cascade): dig-nat 0.10 is on crates.io — the whole peer stack
-# (dig-gossip 0.12.0, dig-dht 0.5.0, dig-download 0.6.0, dig-peer-selector 0.5.0) now depends on dig-nat
-# "0.10" from crates.io, so consuming it here as a plain crates.io version unifies the ENTIRE graph on
-# ONE dig-nat 0.10 instance (the old bare-git unification patch is retired). 0.10 ships the SPKI-pinned
-# dialer (#1422, the relayed-connect fix) on top of 0.8's STUN happy-eyeballs reflexive discovery, and
-# auto-composes the FULL NAT ladder via `connect_with_runtime` + `NatRuntime`, taking a CA-signed NodeCert.
-dig-nat = "0.10"
-# dig-gossip is the ONE peer-stack exception: at v0.13.0 (on dig-nat 0.10 + dig-tls 0.3, crates.io
+# Sourcing (#1280/#1393/#1494 crates.io cascade): dig-nat 0.11 is on crates.io — the whole peer stack
+# (dig-gossip 0.15.0, dig-dht 0.5.1, dig-download 0.7.1, dig-peer-selector 0.5.2) now depends on dig-nat
+# ">=0.10, <0.12" from crates.io, so consuming it here as a plain crates.io version unifies the ENTIRE
+# graph on ONE dig-nat 0.11 instance (the old bare-git unification patch is retired). 0.11 adds the
+# relayed RESPONDER path — `RelayStatus::enable_accept` surfaces an introduced circuit as a
+# `RelayTunnel`, and `RelayAcceptor` runs the mTLS SERVER half over it (#1536, Leg B) — on top of
+# 0.10's SPKI-pinned dialer (#1422) and the STUN happy-eyeballs reflexive discovery, and auto-composes
+# the FULL NAT ladder via `connect_with_runtime` + `NatRuntime`, taking a CA-signed NodeCert.
+dig-nat = "0.11"
+# dig-gossip is the ONE peer-stack exception: at v0.15.0 (on dig-nat 0.11 + dig-tls 0.3, crates.io
 # deps) but NOT yet published to crates.io — its own publish is guarded pending dig-peer-protocol (#681).
-# So it stays a git dependency, PINNED to the v0.13.0 tag commit (rev 5bb335360ee1, #1517 relay-circuit
-# auto-dial: threads the discovered peer_id into the mTLS SPKI pin + dials the full NAT ladder incl. the
-# relay circuit after Direct fails). Pulled rustls-only (no
+# So it stays a git dependency, PINNED to the v0.15.0 tag commit (rev 90c12ac5a89a, #1541 — injects the
+# node's PERSISTENT `nat_identity` NodeCert into the dig-nat transport so every transport presents the
+# ONE advertised peer_id, on top of #1517's relay-circuit auto-dial). Pulled rustls-only (no
 # native-tls). Its dig-nat/dig-tls/dig-constants come from crates.io (same versions as here), so the
 # graph still unifies to ONE of each. The vendored chia-protocol/chia-sdk-client forks it path-patches
 # are re-declared at this SAME rev in the workspace `[patch.crates-io]` (a git dep's own patches do not
-# apply transitively).
-dig-gossip = { git = "https://github.com/DIG-Network/dig-gossip", rev = "5bb335360ee16a856b217b429f205eead31dee80", default-features = false, features = ["rustls", "relay"] }
+# apply transitively — the #1529 3-rev lockstep: this dep rev + the two patch revs move together).
+dig-gossip = { git = "https://github.com/DIG-Network/dig-gossip", rev = "90c12ac5a89a4d143ed86cc755cd42678aa1aa4f", default-features = false, features = ["rustls", "relay"] }
 # The canonical DIG network id (genesis challenge) for the gossip handshake / introducer scope. From
 # crates.io: dig-nat 0.7 requires `>=0.4, <0.6` and dig-gossip 0.7.1 requires `>=0.2, <0.5`, so `0.4`
 # sits in both windows and the whole graph resolves to ONE crates.io dig-constants 0.4.x.
@@ -166,7 +168,7 @@ dig-pex = "0.1"
 # dig-dht types). 0.6 keeps the injectable `SourceSelector` seam (dig-node implements it over
 # dig-peer-selector, see `seams/dig_peer/selector_adapter.rs`), records range outcomes internally, and the
 # fetch leg composes the FULL NAT ladder from an injected shared `NatRuntime` (`NatRangeTransport::new_with_runtime`).
-dig-download = "0.6"
+dig-download = "0.7"
 # -- Self-optimizing peer selection (#178) ------------------------------------------------------------
 # The decision + learning layer between dig-dht discovery and dig-download execution: it ranks the
 # providers `find_providers` returns (learning throughput/rtt/reliability + a per-class saturation