{
 "number": 36170,
 "input_hash": "916f5fa6bc840d39",
 "model": "openrouter/google/gemini-3.8-flash",
 "batch": false,
 "created": "2026-09-17T15:58:36+00:00",
 "provider": "Google",
 "stop_reason": "end_turn",
 "usage": {
  "input_tokens": 14346,
  "cache_creation_input_tokens": 0,
  "cache_read_input_tokens": 0,
  "output_tokens": 4434
 },
 "cost_usd": 0.027387,
 "error": null,
 "result": {
  "display": {
   "goal": [
    "Prevent incoming Tor connections from sharing a standard P2P bind address",
    "Avoid misclassifying Tor peers and inadvertently granting them IP whitelist permissions"
   ],
   "reviewability": [
    "Ready for review",
    "Author has not yet replied to scope questions on wildcard onion binds"
   ],
   "agreement": [
    "Positive with early reviewer interest",
    "Concept ACK and question about wildcard bind edge cases (jeanpablojp)",
    "Approach ACK (winterrdog)"
   ],
   "categories": [
    {
     "name": "p2p",
     "why": [
      "P3 because it eliminates an edge-case network classification and permission bypass",
      "Tor connections routed through standard binds can inherit unintended local whitelist permissions",
      "Value is real but impact is limited to specific custom bind setups"
     ]
    }
   ]
  },
  "summary": "This PR requires that nodes using explicit `-bind` configurations specify a dedicated onion bind (`-bind=<addr>=onion`) when automatic Tor onion services are enabled (`-listenonion`). If no dedicated onion bind is provided, the node will refuse to start instead of routing incoming onion connections to the first normal P2P bind.",
  "problem": "When the automatic onion service lacks a dedicated onion bind, incoming Tor connections forward to a normal P2P bind. The node cannot differentiate these from direct IP connections, leading to incorrect peer network classification and potentially granting anonymous Tor peers permissions associated with the Tor proxy IP.",
  "discussion": {
   "open_concerns": [
    "jeanpablojp noted that `-bind=0.0.0.0:8334=onion` passes the check while failing to tag connections properly, and asked whether disallowing wildcard onion binds is in scope.",
    "jeanpablojp suggested updating documentation in doc/tor.md and simplifying test assertions."
   ],
   "resolved_concerns": [],
   "author_status": "silent since 2026-09-04"
  },
  "reviewability": {
   "state": "Ready",
   "label": "Ready",
   "reason": "The patch is small and functional. Open questions regarding whether to disallow wildcard onion binds are scoping discussions rather than pending rework that would invalidate a review."
  },
  "agreement": {
   "state": "Positive",
   "summary": "Positive: Concept ACK from jeanpablojp and Approach ACK from winterrdog without objections.",
   "reason": "Reviewers support the approach recommended in prior issue discussion (#34892), with minor open questions regarding scope and documentation.",
   "evidence": [
    "jeanpablojp: Concept ACK and raised an edge case regarding wildcard onion binds.",
    "winterrdog: Approach ACK."
   ]
  },
  "dependencies": {
   "depends_on": [],
   "enables": []
  },
  "categories": [
   {
    "name": "p2p",
    "member": true,
    "evidence": "Modifies P2P listener configuration and bind enforcement to ensure correct network identification and permissions for incoming Tor connections.",
    "band": "P3",
    "reason_tag": "bug fix",
    "score": 0.38,
    "factors": {
     "security_stability": 2,
     "bug_severity": 1,
     "performance": 0,
     "user_value": 1,
     "leverage": 0
    },
    "rationale": "Prevents accidental privilege inheritance for incoming Tor connections on custom `-bind` setups where peers might otherwise inherit localhost whitelist permissions. The scenario is specific to custom node configurations and reasonably deferrable."
   },
   {
    "name": "docs",
    "member": false,
    "evidence": "Includes a release note for the breaking startup configuration change, but documentation is incidental to the P2P networking change.",
    "band": "Unranked",
    "reason_tag": "",
    "score": 0.0,
    "factors": {
     "security_stability": 0,
     "bug_severity": 0,
     "performance": 0,
     "user_value": 0,
     "leverage": 0
    },
    "rationale": "Release note updates accompanying behavior changes belong to the affected area."
   },
   {
    "name": "utils",
    "member": false,
    "evidence": "Modifies init.cpp, but the startup check is specific to P2P network binding rather than general utility or options infrastructure.",
    "band": "Unranked",
    "reason_tag": "",
    "score": 0.0,
    "factors": {
     "security_stability": 0,
     "bug_severity": 0,
     "performance": 0,
     "user_value": 0,
     "leverage": 0
    },
    "rationale": "Argument and init checks serving one area's specific behavior belong to that area."
   }
  ],
  "confidence": "high",
  "uncertainties": [
   "Whether the author will choose to expand the scope to disallow wildcard onion binds like 0.0.0.0."
  ],
  "needs": [],
  "card": "PR 36170 requires a dedicated onion bind option (-bind=<addr>=onion) whenever explicit -bind arguments are passed and automatic Tor listening is active, refusing startup otherwise. This prevents Tor connections from arriving on standard binds where they cannot be differentiated from direct IP connections and might inherit unintended whitelist privileges. The change is small, follows recommendations from #34892, and has an Approach ACK from winterrdog and a Concept ACK from jeanpablojp with open questions about wildcard bind edge cases."
 },
 "raw_text": null
}