{
 "number": 36608,
 "input_hash": "c94a90d369174beb",
 "model": "ledger",
 "prompt_hash": null,
 "created": "2026-10-24T01:19:00+00:00",
 "result": {
  "summary": "Replaces Bitcoin Core's private broadcast implementation with an isolated, node-stateless job engine and introduces a standalone bitcoin-privbcast CLI tool. Transaction broadcast targets are selected by resolving DNS seeds through Tor SOCKS5 proxies using dedicated circuits, and connections are established strictly over BIP324 v2 transport according to a pre-calculated random schedule. The PR removes legacy private broadcast peer connections and relay code from net and PeerManager, and extends the new engine to support 1-parent-1-child package relay via submitpackage.",
  "problem": "The existing in-tree private broadcast mechanism relies on node state (such as addrman, peer discouragement, and mempool arrival monitoring). This creates observable timing oracles and fingerprinting vectors that an adversary can probe or manipulate via address gossip. In addition, the existing subsystem lacks package relay support, preventing private broadcast of low-fee transactions needing child-pays-for-parent to enter the mempool.",
  "card": "This PR completely replaces Bitcoin Core's private broadcast subsystem with an isolated, node-stateless job runner and introduces a standalone bitcoin-privbcast utility. The new design contacts DNS seeds over Tor to find IPv4/IPv6 peers and connects according to a predetermined randomized schedule over BIP324 v2 transport, eliminating reliance on internal node state and addrman. It removes the previous private broadcast peer connection and relay logic from net and PeerManager and adds 1-parent-1-child package relay support to submitpackage. The change is motivated by recurring privacy leaks in the legacy design, including direct proxy bypasses and clearnet peer discouragement oracles. It touches P2P networking, package validation, RPC, and CLI tooling across 121 files.",
  "evidence": [
   "PR description details historical privacy regressions and leaks from relying on node state, including a proxy bypass on v2-to-v1 retry (#35319/#35410), peer discouragement creating a clearnet oracle (#36312), mempool inspection leaking completion timing (#36277), and addrman state pollution (#35032)",
   "PR description notes that drawing destinations from addrman allows remote peers to influence and fingerprint destination selection through address gossip",
   "Commit ee5719d0c6 fixes a validation bug where two prioritisetransaction deltas near INT64_MIN caused a modified fee sum overflow in package handling"
  ],
  "scope_notes": "Very large multi-part change (+17k/-4.4k lines across 121 files) organized in four distinct sections: moving shared transport and BIP324 code into the common library, specifying and implementing the standalone bitcoin-privbcast tool, refactoring bitcoind -privatebroadcast into job queues while deleting legacy net/peerman broadcast logic, and adding 1P1C package validation and relay support. More than 11,000 lines are new unit, functional, and fuzz tests.",
  "changed_since_previous": "",
  "thread": {
   "last_event_at": "2026-10-23T16:46:02Z",
   "events": 1,
   "head_sha": "eec78ccf7d59f5b39d4525980e8e3a7fe6c60242",
   "schema_floor": 2,
   "schema": 2
  },
  "waiting_on": [
   {
    "at": "2026-10-23",
    "id": "c:6369998981",
    "on": "author",
    "url": "https://github.com/bitcoin/bitcoin/pull/36608#issuecomment-6369998981",
    "what": "PR is in draft; author pointed reviewers to slimmed down PR #36628"
   },
   {
    "at": "2026-10-23",
    "id": "c:6369998981",
    "on": "author",
    "url": "https://github.com/bitcoin/bitcoin/pull/36608#issuecomment-6369998981",
    "what": "PR is in draft; author directed review to PR #36628 instead"
   }
  ],
  "risk": {
   "level": "high",
   "touches": [
    "p2p",
    "validation",
    "rpc_api",
    "tooling"
   ],
   "why": "Mistakes in the new SOCKS5 proxy state machine or BIP324 attempt loops could leak user IP addresses or fail transaction broadcasting entirely, while changes to package acceptance logic in validation could introduce mempool inconsistencies or crashes."
  },
  "discussion": {
   "author_status": "last statement processed 2026-10-23",
   "open_concerns": [],
   "resolved_concerns": []
  },
  "reviewability": {
   "state": "Ready",
   "label": "Needs rebase",
   "reason": "Conflicts with master; review the logic now, the rebase is mechanical."
  },
  "agreement": {
   "state": "Crickets",
   "summary": "Crickets: no substantive comment either way",
   "reason": "Initial record for draft PR. No reviewer comments yet; the author noted in c:6369998981 that #36628 is the branch to review. / Initial record. Draft PR with no reviewer comments; the author directed review to slimmed-down PR #36628.",
   "evidence": [],
   "objections": [],
   "support": [],
   "participants": [],
   "derivation": "no substantive comment either way",
   "model_state": null,
   "corrections": [],
   "notes": "Initial record for draft PR. No reviewer comments yet; the author noted in c:6369998981 that #36628 is the branch to review. / Initial record. Draft PR with no reviewer comments; the author directed review to slimmed-down PR #36628."
  },
  "dependencies": {
   "depends_on": [],
   "enables": []
  },
  "categories": [
   {
    "name": "build",
    "member": false,
    "evidence": "Build and CMake changes merely support compiling the new tool and test binaries.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Build modifications only follow from the addition of the new executable and test suites, not changes to the build system itself."
   },
   {
    "name": "docs",
    "member": false,
    "evidence": "Design documents and release notes accompany code changes rather than forming a standalone documentation PR.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Documentation updates are auxiliary to the implementation of the new private broadcast subsystem and tool."
   },
   {
    "name": "ipc",
    "member": false,
    "evidence": "Touches to node interfaces do not alter IPC transport mechanics or process separation.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Interface modifications are routine adjustments to expose private broadcast methods rather than changes to the IPC architecture."
   },
   {
    "name": "kernel",
    "member": false,
    "evidence": "Incidental touch to chainparams does not alter the libbitcoinkernel API or library boundary.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "The PR does not modify kernel interfaces or decouple validation from node state."
   },
   {
    "name": "mempool",
    "member": true,
    "evidence": "Modifies package acceptance and relay handling in src/rpc/mempool.cpp and fixes package fee validation logic.",
    "band": "P3",
    "reason_tag": "bug fix",
    "score": 0.4,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Adds 1-parent-1-child package support to private broadcast and fixes a package fee overflow bug. Commit ee5719d0c6 fixes a validation bug where prioritisetransaction deltas near INT64_MIN caused a modified fee sum overflow in package handling."
   },
   {
    "name": "p2p",
    "member": true,
    "evidence": "Carries the 'Private Broadcast' label and rewrites P2P private broadcast connection, relay, and peer management logic in src/net.cpp and src/net_processing.cpp.",
    "band": "P1",
    "reason_tag": "bug fix",
    "score": 0.88,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Eliminates severe deanonymization risks and timing oracles in transaction broadcasting. Relying on node state creates observable timing oracles, addrman manipulation vectors, and proxy bypasses (#35319/#35410, #36312, #36277), making an isolated broadcast engine critical for network privacy."
   },
   {
    "name": "rpc",
    "member": false,
    "evidence": "RPC file edits simply expose the underlying broadcast engine methods rather than altering RPC transport or JSON-RPC infrastructure.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Changes to RPC files merely surface private broadcast capabilities and do not change RPC protocol behavior."
   },
   {
    "name": "tests",
    "member": false,
    "evidence": "Extensive unit, functional, and fuzz test additions specifically validate the private broadcast engine and tool.",
    "band": "Unranked",
    "reason_tag": "test coverage",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "The extensive test additions pin the behavior of the private broadcast feature rather than modifying core test framework machinery."
   },
   {
    "name": "tools",
    "member": true,
    "evidence": "Adds the new standalone bitcoin-privbcast command-line utility in src/bitcoin-privbcast.cpp.",
    "band": "P3",
    "reason_tag": "new feature",
    "score": 0.4,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Introduces bitcoin-privbcast as an isolated standalone tool for private transaction relay. It allows broadcasting over Tor SOCKS5 and BIP324 without requiring bitcoind node state."
   },
   {
    "name": "utils",
    "member": false,
    "evidence": "Movement of BIP324 and transport code to libcommon serves P2P networking rather than generic utilities.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Extracted transport code is specific to network communication and does not represent changes to general-purpose utility libraries."
   },
   {
    "name": "validation",
    "member": false,
    "evidence": "Package fee handling adjustments in validation files relate to mempool package policy rather than consensus rules.",
    "band": "Unranked",
    "reason_tag": "bug fix",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "The PR does not substantively change consensus validity rules or UTXO chainstate management."
   }
  ],
  "confidence": "high",
  "uncertainties": [],
  "needs": [
   "rest_of_diff"
  ]
 },
 "cost_usd": 0.0,
 "source": {
  "record": "2026-10-24T01:19:00+00:00",
  "code": "2026-10-24T01:21:56+00:00",
  "judgments": 11
 }
}