feat: NMv3: gateway liveness probes

[jstuczyn]

This is the piece that makes a gateway liveness assignment actually get executed.

What a gateway run is

One indivisible run over one client session, measuring two independent interfaces in opposite directions:

client ingest agent --ws--> GW --forwarded verbatim--> agent's mixnet listener
client delivery agent --noise--> GW --final hop unwrapped--> that same session

Both legs are one-hop sphinx routes, because there the tested node and the packet's last hop are the same machine. Neither phase may abort the other, and the score denominator is fixed at two measurements, so a phase that produced nothing is submitted as a zero rather than omitted.

The new wire

mixnet/client_session/ sits beside mixnet/sphinx/ rather than under the Noise files, because it is a second wire carrying the same packet format: no Noise handshake, no static keys, authentication by the gateway's own registration handshake.

It is a purpose-built minimal client rather than nym-gateway-client since a lot of the logic from there didn't apply (like bandwidth claiming, routing packets by size, etc.

Three things the session does differently from that client, each forced by the measurement:

• arrival time is stamped where the frame is read, because the payload's round trip is the measurement
• a gateway error is a filed event, not an Err that ends the reader - a phase failure must not abort the run
• no reconnection; a session silently re-established mid-probe would repair the very thing being measured

Additional manual CLI commands

test-node is renamed and joined by two siblings, named for the (kind, role) pairs the orchestrator hands out:

• test-mixnode-stress (was test-node)
• test-mixnode-liveness
• test-gateway-liveness

All three now name the target by its HTTP api alone and read its identity, noise key, sphinx key, key rotation, mix port, announced addresses and client websocket port off the node itself, following the orchestrator's get_node_details_inner`. Six env vars for keys and ports are gone. Host-information signatures are verified, so a stale key fails immediately instead of as a run that scores zero.

---

This change is 

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-nextra	Ready	Preview	Sep 4, 2026 3:44pm UTC
nym-explorer-v2	Ready	Preview	Sep 4, 2026 3:44pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
nym-node-status	Ignored	Preview	Sep 4, 2026 3:44pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: c76c9211-200a-4fe3-bc56-0870ce747cb4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}