feat: NMv3: unmetered ephemeral client sessions

[jstuczyn]

Lets an authorised network monitor agent open a gateway client session without holding ecash ticketbooks, which is what makes v3 gateway liveness testing possible. A session whose registration handshake authenticates an ed25519 identity announced on-chain for an authorised agent is unmetered and persists nothing: no shared-key row, no bandwidth entry, no inbox push.

Changes

• New crate nym-authorised-network-monitors - holds AuthorisedMonitorIdentities, the identity-keyed set derived from the contract's authorised-agent set. Shared because its reader (the gateway) sits outside the node that folds the set; the two IP-keyed structures stay where their readers are.
• nym-node - the startup contract load and the nyxd websocket events now fold through one AuthorisedAgentsView, the sole writer to all three derived structures, instead of two hand-maintained copies of that logic. Key parsing moved to the boundary (AuthorisedAgent::parse_announced).
• credential-verification - BandwidthStorageManager gains a Persisted / Ephemeral discriminator. An ephemeral manager holds neither a storage handle nor a client id, so "no reads or writes" is structural rather than a discipline; it seeds a synthetic allowance that cannot expire. Spending a credential against one is a new Error::UnmeteredSession.
• gateway - ClientDetails.id is now Option<i64> (absent = never registered); grants_ephemeral_session isolates the policy; finalise_registration picks the session shape after the handshake and skips register_client entirely for a monitor.

Notes for reviewers

• Ordinary client registration and authentication are unchanged; a monitor cannot authenticate (no stored key) so it re-registers per run, which now costs nothing.
• Inert until an agent announces an identity on-chain, so this is safe to roll out ahead of the agent side.
• One behaviour fix fell out of the refactor: two agents on one host announced in different address forms (1.2.3.4 vs ::ffff:1.2.3.4) used to collapse onto one canonical noise-map key at startup, silently dropping one.

---

This change is 

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-nextra	Ready	Preview	Aug 19, 2026 3:29pm
nym-explorer-v2	Ready	Preview	Aug 19, 2026 3:29pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
nym-node-status	Ignored	Preview	Aug 19, 2026 3:29pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: de570521-8f08-4268-a8d8-a38910c1d838

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}