feat(federation): route state-sync / invites / notifications via FIPS first

Every federation peer-to-peer call now prefers FIPS (direct ULA dial
over `fips0`, ~LAN latency) and falls back to Tor only on network
failure. Per-method ed25519 signatures are preserved on both
transports so authenticity doesn't change.

- fips::dial::PeerRequest — fluent builder that owns transport
  selection. Returns the Response plus the TransportKind that carried
  it, so handlers can log or expose which path was used.
- fips::dial::is_service_active — free-standing async probe used by
  migration sites (the transport::fips::is_available cache is keyed
  to a `&self`, not usable from static contexts).
- federation/sync.rs: sync_with_peer + deploy_to_peer drop the
  hand-rolled reqwest::Proxy dance, call PeerRequest instead.
- federation/invites.rs: notify_join takes the remote's fips_npub
  (already parsed out of the invite code since v1.4) and dials over
  FIPS when available. The "peer-joined" signature domain is
  unchanged.
- api/rpc/federation/handlers.rs: DID rotation broadcast loops over
  federated peers through PeerRequest; the per-peer result payload
  gains a `transport` field so the UI can surface mesh vs. onion.
- api/rpc/tor/mod.rs: onion-address-change propagation is now the
  most useful FIPS-first call — fips_npub is stable across onion
  rotation, so peers get the new address even when the old onion
  is already dead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/federation/invites.rs

@@ -180,9 +180,10 @@ pub async fn accept_invite(
     });
     save_invites(data_dir, &invites).await?;
 
-    // Notify remote node (best-effort over Tor)
+    // Notify remote node (best-effort, FIPS-first → Tor fallback)
     let _ = notify_join(
         &node.onion,
+        node.fips_npub.as_deref(),
         local_did,
         local_onion,
         local_pubkey,
@@ -195,22 +196,18 @@ pub async fn accept_invite(
 }
 
 /// Best-effort notification to the remote node that we joined their federation.
-/// Signs the message with our ed25519 key so the remote peer can verify authenticity.
+/// Prefers FIPS (if the remote advertised an npub in their invite) and
+/// falls back to Tor. Signs the message with our ed25519 key so the
+/// remote peer can verify authenticity regardless of transport.
 async fn notify_join(
     remote_onion: &str,
+    remote_fips_npub: Option<&str>,
     local_did: &str,
     local_onion: &str,
     local_pubkey: &str,
     local_fips_npub: Option<&str>,
     sign_fn: impl FnOnce(&[u8]) -> String,
 ) -> Result<()> {
-    let host = if remote_onion.ends_with(".onion") {
-        remote_onion.to_string()
-    } else {
-        format!("{}.onion", remote_onion)
-    };
-    let url = format!("http://{}/rpc/v1", host);
-
     // Sign the canonical message: "peer-joined:{did}:{onion}:{pubkey}"
     // Signature domain intentionally unchanged — fips_npub is carried
     // as an unsigned informational field. The FIPS daemon's own Noise
@@ -234,15 +231,10 @@ async fn notify_join(
         "params": params,
     });
 
-    let proxy =
-        reqwest::Proxy::all(crate::constants::TOR_SOCKS_PROXY).context("Invalid Tor proxy")?;
-    let client = reqwest::Client::builder()
-        .proxy(proxy)
+    let _ = crate::fips::dial::PeerRequest::new(remote_fips_npub, remote_onion, "/rpc/v1")
         .timeout(std::time::Duration::from_secs(30))
-        .build()
-        .context("Failed to build HTTP client")?;
-
-    let _ = client.post(&url).json(&body).send().await;
+        .send_json(&body)
+        .await;
     Ok(())
 }
 

core/archipelago/src/federation/sync.rs

@@ -1,26 +1,24 @@
 //! Federation state sync and remote deployment.
+//!
+//! Requests prefer FIPS (direct ULA dial, ~LAN latency) and fall back to
+//! Tor on any network failure. See `crate::fips::dial::PeerRequest` for
+//! the fallback mechanics.
 
 use anyhow::{Context, Result};
 use std::path::Path;
 
 use super::storage::update_node_state;
 use super::types::{AppStatus, FederatedNode, NodeStateSnapshot, TrustLevel};
+use crate::fips::dial::PeerRequest;
 
-/// Sync state with a single federated peer over Tor.
+/// Sync state with a single federated peer. Tries FIPS first; falls back
+/// to Tor on any transport-level failure.
 pub async fn sync_with_peer(
     data_dir: &Path,
     peer: &FederatedNode,
     local_did: &str,
     sign_fn: impl FnOnce(&[u8]) -> String,
 ) -> Result<NodeStateSnapshot> {
-    let host = if peer.onion.ends_with(".onion") {
-        peer.onion.clone()
-    } else {
-        format!("{}.onion", peer.onion)
-    };
-    let url = format!("http://{}/rpc/v1", host);
-
-    // Sign current timestamp for authentication
     let timestamp = chrono::Utc::now().to_rfc3339();
     let signature = sign_fn(timestamp.as_bytes());
 
@@ -29,26 +27,17 @@ pub async fn sync_with_peer(
         "params": {}
     });
 
-    let proxy =
-        reqwest::Proxy::all(crate::constants::TOR_SOCKS_PROXY).context("Invalid Tor proxy")?;
-    let client = reqwest::Client::builder()
-        .proxy(proxy)
-        .timeout(std::time::Duration::from_secs(30))
-        .build()
-        .context("Failed to build HTTP client")?;
-
-    let resp = client
-        .post(&url)
+    let (resp, transport) = PeerRequest::new(peer.fips_npub.as_deref(), &peer.onion, "/rpc/v1")
         .header("X-Federation-DID", local_did)
-        .header("X-Federation-Sig", &signature)
-        .header("X-Federation-Timestamp", &timestamp)
-        .json(&body)
-        .send()
+        .header("X-Federation-Sig", signature)
+        .header("X-Federation-Timestamp", timestamp)
+        .timeout(std::time::Duration::from_secs(30))
+        .send_json(&body)
         .await
         .context("Failed to reach federated peer")?;
 
     if !resp.status().is_success() {
-        anyhow::bail!("Peer returned {}", resp.status());
+        anyhow::bail!("Peer returned {} (via {})", resp.status(), transport);
     }
 
     let result: serde_json::Value = resp.json().await.context("Invalid response from peer")?;
@@ -109,13 +98,6 @@ pub async fn deploy_to_peer(
         );
     }
 
-    let host = if peer.onion.ends_with(".onion") {
-        peer.onion.clone()
-    } else {
-        format!("{}.onion", peer.onion)
-    };
-    let url = format!("http://{}/rpc/v1", host);
-
     let timestamp = chrono::Utc::now().to_rfc3339();
     let signature = sign_fn(timestamp.as_bytes());
 
@@ -128,26 +110,17 @@ pub async fn deploy_to_peer(
         }
     });
 
-    let proxy =
-        reqwest::Proxy::all(crate::constants::TOR_SOCKS_PROXY).context("Invalid Tor proxy")?;
-    let client = reqwest::Client::builder()
-        .proxy(proxy)
-        .timeout(std::time::Duration::from_secs(120))
-        .build()
-        .context("Failed to build HTTP client")?;
-
-    let resp = client
-        .post(&url)
+    let (resp, transport) = PeerRequest::new(peer.fips_npub.as_deref(), &peer.onion, "/rpc/v1")
         .header("X-Federation-DID", local_did)
-        .header("X-Federation-Sig", &signature)
-        .header("X-Federation-Timestamp", &timestamp)
-        .json(&body)
-        .send()
+        .header("X-Federation-Sig", signature)
+        .header("X-Federation-Timestamp", timestamp)
+        .timeout(std::time::Duration::from_secs(120))
+        .send_json(&body)
         .await
         .context("Failed to reach federated peer for deploy")?;
 
     if !resp.status().is_success() {
-        anyhow::bail!("Remote node returned HTTP {}", resp.status());
+        anyhow::bail!("Remote node returned HTTP {} (via {})", resp.status(), transport);
     }
 
     let result: serde_json::Value = resp.json().await.context("Invalid response from peer")?;