Skywire Development Update — October 27, 2026

The twenty-seventh of October was the busiest day of the month, with 52 pull requests across Skywire, Skycoin and skycoin.com. The deployment services stopped binding plain HTTP listeners by default, their deregistration endpoints now trust only the authenticated key of a dmsg stream, and their specifications were rewritten against the code. A day of heap profiles on the deployment host turned into sixteen changes that each removed a specific allocation, from noise frame buffers to transport discovery’s metrics days. The services’ repeated startup code was shared, about 4,500 lines no build reached were removed along with the unused network monitor, five flaky tests were fixed, and the browser visor is now tested end to end in CI. Visors got an address book, and skycoin.com started writing its pages in Markdown.

Skywire: Deployment Services Leave Plain HTTP

The deployment services are reached over dmsg and, through their host visor, over skynet, but a service with a key still defaulted to mode dual and bound a plain HTTP listener nothing should use. 5845 makes dmsg the default. dmsg discovery keeps dual, since dmsg servers register with it over plain HTTP before dmsg exists, and the test deployments set dual explicitly because they curl the services. Production sets its mode explicitly too, so this changes nothing there until those configs are switched.

5844 closed a replay. The deregistration endpoints still accepted a plain HTTP caller that sent a key and a signature of that key, which a captured header pair could replay. They now authorize only the authenticated remote key of a dmsg stream, including a stream a host visor relays from skynet. 5840 had already moved the four services’ copies of that check into one shared whitelist, and 5837 fixed the nonce in signed requests, which only advanced on exactly 200, so a transport registration answered with 201 could be replayed over plain HTTP. Requests over dmsg skip the nonce, so production was not exposed.

5836 rewrote the deployment service specifications, which had drifted far from the code. Several described designs that no longer exist, others had wrong routes, status codes and defaults, and all of them listed clearnet hostnames the services no longer serve. Each spec now ties every format and constant to the Go identifier that defines it, follows a new conventions document taken from the libp2p specs and BCP 14, and documents the services as reached only over dmsg HTTP. Four new specs cover the transport setup node, CXO feeds, STUN and the network graph. 5834 removed the network monitor service, which was not deployed, and 5835 made a negative ar_transport_limit actually keep a visor out of the address resolver, as the route setup node expects.

Skywire: A Day of Heap Profiles

The deployment host’s heap profiles turned into a long list of fixes, each measured. Idle streams were the largest share. 5875 gives each noise stream one 4 kB frame buffer instead of two, 50 MB across about 6,000 mostly idle streams, and 5857 takes the write and plaintext buffers from a pool for each call instead of keeping them per stream. 5874 lets a vstream’s read queue grow only while frames wait, where every vstream had made a 1,024 frame channel up front, and an idle stream now allocates 576 bytes instead of 27,680. 5865 does the same for CXO connections’ send queues, 62 MB across about 5,000 connections, with the frame limit, the stuck connection timeout and frame order unchanged.

CXO’s encoding had its own copies. 5870 encodes an object in one allocation instead of two copies of its value, 5 GB in under an hour on the host, 5850 stopped every four byte length read from copying the whole remaining object, 1.46 GB, and 5861 reuses gunzip readers and sizes the output from the gzip trailer, capped so a forged trailer cannot force a large allocation.

Transport discovery and the route finder had the rest. 5868 writes the edge endpoint’s JSON into one buffer, the largest transport discovery allocator at 9.4 GB in under an hour, and 5869 copies only the absent transports during a reconcile instead of all of a reporter’s transports. 5849 streams saved metrics days one record at a time, where two reads decoded about 15 MB days whole, 5855 splits a large day from its previous part count instead of compressing it whole first on every tick, and 5860 stops an open day’s body from carrying its buffer’s spare capacity. 5859 encodes each edge key once per read, 5858 stops five byte transport types from pinning 144 byte Redis values, and 5866 holds paced telemetry in fewer bytes per key. 5854 keeps the route finder’s landmark routes in one direction only, which halved those tables on a 3,000 visor test mesh.

Skywire: Less Code, Shared Code

5839 removed about 4,500 lines that the dead code tool reported unreachable from main on the Linux, Windows and browser builds alike, most of them tests of the removed code. 5842 moved the startup that the address resolver, service discovery, transport discovery and route finder each repeated into shared helpers, 5841 did the same for the transports’ address resolver bind and listen loops, so squicr and swtr now retry a failed refresh with backoff as stcpr did, and 5843 gave the three registration feeds one announce loop. 5838 gave service discovery the request ID, panic recovery and logging middleware the other services had, and fixed two small address resolver bugs. 5846 has the visor register every embedded deployment service itself, after a TinyGo build on the deployment host started only five of its nine.

Skywire: Tests That Test

develop’s test workflow had been red on a different test each run. 5847 reran the suite with CI’s options on a four core host and fixed the five flaky tests that showed up, each for a specific cause. 5848 stopped four dmsg tests and the VPN checks from skipping on every run. They dialed the production network and traced a public hostname, and now use the test deployment and trace a fixed address one hop away. 5852 runs the browser visor’s tests under Node in CI, and 5853 runs the browser visor itself under Node against the test deployment, checking that it registers in dmsg discovery and takes a dmsg transport from a native visor. 5862 retries a failed first discovery publish on the backoff ladder, which had left route setup unreachable for about four minutes on a fresh stack.

5872 fixed a proxy test that failed about one run in 25 because any error containing “202” counted as transient, including a random key that happened to hold those digits. 5851 fixed a data race in the pty client, 5873 a race in a queue test, and 5856 skips the test jobs on pull requests that are merged as soon as they open, since each one cancelled the queued develop run. 5863 rewrote the agent skills shipped in the repository against the current command tree and added a test that checks every command and flag they mention, and 5871 and 5876 fixed that test’s lint and Windows runs.

Skywire: Address Book and Sites

5877 added the visor’s address book: one vCard 4.0 file per contact beside the visor’s local directory, with a name, skywire keys, mail and payment addresses, groups and notes, served over RPC and managed with skywire cli contacts. The files are private to the visor’s user and nothing is published. Skychat nicknames, CLI aliases and the Android mail screen each kept their own list before, and moving them onto the book comes next. 5864 lists a visor’s sites on home.skynet when it forwards port 80 to a local Caddy, and 5867 adds skywire cli serve sites off for an operator who would rather not list them. 5833 clears a deleted reward address in memory, and 5831 added a rewards card to the Android app’s settings.

Skycoin and skycoin.com

skycoin#3172 is a design note for fiber chains that name several block signers and finalize a block once enough of them sign, so no single key can halt or censor the chain. It reuses the separate signature transport of the post-quantum block signatures, and nothing is implemented yet.

skycoin.com#80 lets the site’s pages be written as Markdown files, one file per page, and rewrote /skywire in it as a shorter overview with the CLI help and links into the docs, with the deployment services on their own page. skycoin.com#84 moved the ecosystem, CXO, Fiber, Obelisk, terms, legal and press release pages to Markdown, and rewrote the Obelisk page to say plainly that Obelisk was never deployed. skycoin.com#82 and skycoin.com#83 add a notice to every CX page that CX is not under active development, with a status page that says the language still builds and runs. skycoin.com#81 dropped the network monitor from the help it shows.