[S1] Gossipsub v1.1 peer scoring: P1–P7 + thresholds + decay + opportunistic graft + D_out

[ch4r10t33r]

Spec

https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md §"Peer Scoring"

Current zig-libp2p only exposes setPeerBehaviourScore and applies discrete deltas (validator reject, GRAFT-during-backoff). No per-topic counters, no decay, no thresholds, no opportunistic graft, no inbound/outbound peer preference — degraded eclipse-attack resistance and mesh-health.

Current state (src/gossipsub/runtime.zig)

• peer_scores: HashMap(PeerId, i32) (line 275) — manually set only.
• No P1 (time in mesh), P2 (first-message deliveries), P3 (mesh-message deliveries), P3b (mesh-message failure), P4 (invalid messages), P5 (app-specific), P6 (IP colocation), P7 (behaviour penalty).
• No thresholds: gossip_threshold, publish_threshold, graylist_threshold, accept_px_threshold, opportunistic_graft_threshold.
• No decay heartbeat — set scores are static.
• D_out (outbound peer preference) — no inbound/outbound flag tracked on connected peers (runtime.zig:1122).
• Opportunistic graft (§4.2) never runs — heartbeat only GRAFTs when mesh_size < D_low (runtime.zig:1401).

Acceptance (suggest sub-PRs)

• Phase 1 — counters + decay: per-topic per-peer counters (time_in_mesh, first_deliveries, mesh_deliveries, mesh_failures, invalid_msgs); score decay applied on heartbeat tick with score_decay_interval_ms.
• Phase 2 — thresholds + score-gated paths: drop IHAVE/IWANT below gossip_threshold, suppress publish forward below publish_threshold, drop all RPC below graylist_threshold, refuse PX below accept_px_threshold.
• Phase 3 — opportunistic graft + D_out: heartbeat selects top-opportunistic_graft_peers over opportunistic_graft_threshold and grafts them in. Tag each connected peer as inbound/outbound (transport tells us); maintain at least D_out outbound mesh peers.
• Cross-impl test: score-based eviction under rust-libp2p peer simulator.

Cross-impl ref: rust-libp2p protocols/gossipsub/src/peer_score.rs.

Severity: S1 — interoperable for delivery, degraded for resilience.