forked from unom/punktfunk
enricobuehlerandClaude Fable 5
ef39050dbc
Six parallel audits swept the root docs, docs-site, every per-directory README, and the packaging docs; every claim below was verified against the source before editing. - README: Layout gains the six missing crates (pf-client-core, pf-presenter, pf-console-ui, pf-ffvk, pf-driver-proto, punktfunk-tray), clients/session, api/ and ci/; Linux/Windows client rows reflect the shell + Vulkan-session split and the Vulkan Video -> VAAPI/D3D11VA -> software decode chains; the "every client over a C ABI" claim is corrected (Rust clients link the core directly); tiered stats overlay + console shell noted; Apple row mentions AV1. - CONTRIBUTING: drop the dead CLAUDE.md link (deliberately untracked); point at the README's build/invariants sections. SECURITY: 0.9.0. - host-cli/pairing: --allow-pairing/--require-pairing are no-op legacy names — pairing is required by default, --allow-tofu is the real flag; document --data-port and --idle-timeout-ms. - configuration: document PUNKTFUNK_RECOVER_SESSION_CMD (session-crash recovery hook), PUNKTFUNK_MDNS, PUNKTFUNK_DATA_PORT. - virtual-displays/gnome: GNOME per-client scaling shipped (host- persisted) — flip the ❌ to ✅ and describe how it works. - stats: new "Detail levels" section (Off/Compact/Normal/Detailed + per-platform cycle gestures); retire the GTK hand-off note. - clients/install-client/status/roadmap: decode chains, Windows client validation narrowed to HDR-only pending, adaptive bitrate, console shell, Apple AV1, Windows host vendor list. - Sub-READMEs: clients/linux rewritten for the re-architecture; session Windows decode rung + d3d11va knob; Windows tiered overlay; Android minSdk 28; decky file table; host zerocopy/ path; scripts port 47992 and steamos-host.md; pf-dualsense source path. - packaging: canary version bases are tag-derived (<next-minor> via pf-version.sh/.ps1), codecs-extra not ffmpeg-full, document the pinned offline-Skia tarball + SKIA_BINARIES_URL and vulkan-headers. - Convert 15 dangling design/*.md links to the punktfunk-planning prose convention (those docs live in the private planning repo). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
62 lines
3.3 KiB
Markdown
62 lines
3.3 KiB
Markdown
# punktfunk-core
|
||
|
||
The **shared protocol core** — the one place where punktfunk's transport, forward error correction,
|
||
and crypto live. It's linked into the [host](../punktfunk-host/README.md) and every native client, so
|
||
there's exactly one implementation of the wire format everywhere.
|
||
|
||
Written in Rust with **no async on the per-frame path** (native threads only). It exposes both a
|
||
normal Rust API and a **stable, versioned C ABI**, so the Swift and Kotlin clients — and any C
|
||
embedder — link the same code as the Rust ones.
|
||
|
||
## What's in here
|
||
|
||
- **Transport & session** (`session.rs`, `transport/`, `packet.rs`) — the `punktfunk/1` data plane
|
||
over raw UDP: packetization, reassembly (with attacker-bounded limits), pacing, and socket tuning.
|
||
- **FEC** (`fec/`) — the wall-breaker. Two codes:
|
||
- **GF(2⁸)** classic Reed–Solomon with the *Cauchy* generator matrix — byte-identical to the
|
||
`nanors` library Moonlight uses, so our parity is decodable by a stock Moonlight client.
|
||
- **GF(2¹⁶) Leopard-RS** (SIMD, O(n log n)) — up to 65535 shards/block, which removes the ~1 Gbps
|
||
FEC ceiling. `punktfunk/1` negotiates this one.
|
||
- **Crypto** (`crypto.rs`) — AES-128-GCM session encryption with per-direction nonce salts and
|
||
sequence-as-AAD; SPAKE2 PIN pairing lives behind the `quic` feature.
|
||
- **QUIC control plane** (`quic.rs`, `client.rs`, feature `quic`) — the Hello/Welcome/Start handshake,
|
||
cert pinning/TOFU, reverse audio, and the embeddable `NativeClient` connector. This is the **only**
|
||
place `tokio`/`quinn` are allowed; the feature is **off by default** so the core stays runtime-free.
|
||
- **C ABI** (`abi.rs`) — the versioned surface (`punktfunk_abi_version()`, `PunktfunkConfig` carrying
|
||
its own `struct_size`) that generates [`include/punktfunk_core.h`](../../include/punktfunk_core.h)
|
||
via cbindgen at build time.
|
||
|
||
## Build outputs
|
||
|
||
The crate builds three ways at once (`crate-type = ["lib", "cdylib", "staticlib"]`):
|
||
|
||
| Output | Used by |
|
||
|--------|---------|
|
||
| `lib` (rlib) | the host, probe, and tools link it as a normal Rust crate |
|
||
| `cdylib` (`.so`/`.dylib`) | the Swift / Kotlin clients via the C ABI |
|
||
| `staticlib` (`.a`) | the C test harness and static embedding |
|
||
|
||
## Test
|
||
|
||
```sh
|
||
cargo test -p punktfunk-core # unit + proptest + loopback
|
||
cargo run -p loss-harness # FEC loss-resilience sweep (no network needed)
|
||
bash crates/punktfunk-core/tests/c/run.sh # standalone C-ABI link + round-trip proof
|
||
```
|
||
|
||
## Design invariants (do not regress)
|
||
|
||
- **One core, linked everywhere** — protocol/FEC/crypto live only here, behind the stable C ABI.
|
||
- **No async on the hot path** — the per-frame pipeline is native threads only; `quic` (tokio/quinn)
|
||
is control-plane only, feature-gated, off by default.
|
||
- **Security hardening stays intact** — the reassembler bounds attacker-controlled fields before
|
||
allocating; AES-GCM keeps per-direction nonce salts + seq-as-AAD; the ABI checks `struct_size`.
|
||
Regression tests exist — keep them green.
|
||
|
||
## Related
|
||
|
||
- **[`punktfunk-host`](../punktfunk-host/README.md)** — the streaming host built on this core
|
||
- **[Clients](../../clients/)** — the apps that link this core over the C ABI (or directly, in Rust)
|
||
- **punktfunk-planning: `implementation-plan.md`** (internal planning repo) — why GF(2¹⁶) FEC, the
|
||
latency budget, and the architecture thesis
|