Module node_origin 

NodeOrigin — the node-to-node cache-miss pull-through origin (#831, ADR 001/022).

A whole-blob cache miss reaches the network through the engine’s origin chain, so the production shape of “on a miss, discover a provider, open a paid channel, pull, and populate the cache” is an Origin implementation injected into that chain (appended last, so configured HTTP/FS/S3 origins are tried first and the paid network pull is the final fallback). On Origin::fetch this:

1. discovers providers for the hash (DHT crate::dht::find_providers, with the origin-directory fallback),
2. probes each candidate for rate + RTT and ranks them by the combined local+network reputation score (crate::selection::rank_candidates),
3. opens (or reuses) a buyer payment channel to the best candidate and streams the whole blob straight into the local cache via the gap-driven [decdn_client::drive] loop (#1682 — resumable, so a channel that runs dry mid-blob is topped up and the pull continues at the paid frontier; no whole-blob buffer is ever held in RAM), falling back through up to crate::selection::MAX_PROVIDER_ATTEMPTS providers,
4. records the per-provider Outcome into the local reputation score (ADR 008 §Local Score Calculation).

Every chunk group of the bao verified-stream is verified against the content root as it lands and admitted straight into the cache (ADR 038, via admit_bao_stream), so a dishonest provider is detected (and scored Outcome::Corruption) rather than surfaced to the caller. On the window path the corruption detector is the cache TEE’s verifying decoder; its verdict reaches the scorer via the pull leg’s post-drive record_outcome (#915).

Deferred initialisation

The engine is constructed early in runtime bring-up — before the endpoint, DHT, buyer-channel service, and reputation handles NodeOrigin depends on exist — and takes its origin chain only at construction (there is no add_origin). So NodeOrigin is built empty, placed in the chain, and its dependencies are injected later via a write-once OnceLock (see NodeOrigin::provision). Until that set lands — the feature is off, or the buyer bootstrap failed — fetch returns OriginFetch::NotFound, a clean miss that leaves the handler behaving exactly as it did before pull-through.

Structs

NodeOrigin

Node-to-node pull-through Origin. Cheap to clone via the shared inner Arc; the runtime holds one and injects its dependencies once.

NodeOriginConfig

Tuning knobs for the node-to-node pull, resolved from [cache] config.

NodeOriginDeps

Dependencies the orchestration needs, injected once after runtime bring-up completes (see the module docs). Built and handed to NodeOrigin::provision by the runtime.

Enums

PullMiss

Why an attempt — one candidate, or a whole walk of them — produced no payload (#1560).