cloudflare · itzmanish · May 6, 2026 · May 6, 2026 · May 7, 2026 · May 11, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -0,0 +1,32 @@
+# Repository Guidance
+
+## Scope And Constraints
+
+- This repository targets MoQT `draft-ietf-moq-transport-16`.
+- Core protocol code lives in `moq-transport`; relay behavior lives in `moq-relay-ietf`.
+- `moq-relay-ietf` is production critical, so prefer small, tested changes over broad refactors.
+- Avoid breaking public APIs, wire behavior, CLI flags, and operator workflows unless explicitly requested.
+- Do not add `unsafe` code unless there is a clear performance or FFI need and the safety invariant is documented at the call site.
+- Do not commit or directly edit `docs/draft-16.txt` unless explicitly requested; it is local protocol reference material.
+- Avoid `unwrap()`, `expect()`, `panic!`, `todo!`, `unimplemented!`, and `dbg!` in production paths. Propagate errors or convert lock poisoning to an internal error instead.
+
+## Commands
+
+- Run `cargo fmt --all` after Rust changes.
+- Run `cargo test -p moq-transport` for protocol changes.
+- Run `cargo test -p moq-relay-ietf` or `cargo build -p moq-relay-ietf` for relay-only changes.
+- Run `cargo build --workspace` when shared APIs, relay behavior, or test-client behavior changes.
+- Consider `cargo clippy --workspace --all-targets` before larger changes or when review asks for lint coverage.
+- When tests fail, diagnose from compiler/test output first and keep fixes scoped to the failing behavior.
+
+## Draft-16 Terminology
+
+- Use `PUBLISH_NAMESPACE` terminology in protocol code and docs; older docs and comments may call this Announce.
+- `PublishedNamespace` represents an inbound `PUBLISH_NAMESPACE` received by a subscriber.
+- `TrackNamespacePrefix` is for `SUBSCRIBE_NAMESPACE` prefixes and may be empty; `TrackNamespace` is full and non-empty.
+- `REQUEST_OK`, `REQUEST_ERROR`, and `REQUEST_UPDATE` are shared draft-16 request response/update messages.
+
+## External Contributions
+
+- Treat public GitHub mirror and community PRs with heightened scrutiny for protocol correctness, resource bounds, panic-free production paths, and safe peer-facing errors.
+- Be careful with compatibility: do not rename public CLI flags or remove behavior solely for terminology cleanup without an explicit migration decision.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -17,7 +17,7 @@ members = [
 resolver = "2"
 
 [workspace.dependencies]
-web-transport = "0.10"
+web-transport = "0.10.4"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 

diff --git a/README.md b/README.md
@@ -2,11 +2,11 @@
 
 An implementation of the Media over QUIC Transport (MoQT) protocol for live media delivery over QUIC, as specified by the IETF MoQ working group.
 
-This codebase was originally created by [Luke Curley (@kixelated)](https://github.com/kixelated). [Mike English (@englishm)](https://github.com/englishm) contributed to early design and has maintained this IETF-aligned fork. The project is now maintained by Cloudflare. The implementation targets [draft-ietf-moq-transport-14](https://datatracker.ietf.org/doc/draft-ietf-moq-transport/14/).
+This codebase was originally created by [Luke Curley (@kixelated)](https://github.com/kixelated). [Mike English (@englishm)](https://github.com/englishm) contributed to early design and has maintained this IETF-aligned fork. The project is now maintained by Cloudflare. The implementation targets [draft-ietf-moq-transport-16](https://datatracker.ietf.org/doc/draft-ietf-moq-transport/16/).
 
 ## Protocol Support
 
-The `main` branch targets **draft-14** of the MoQT specification. For draft-07 compatibility (used in [Cloudflare's current production deployment](https://developers.cloudflare.com/moq/)), see the [`draft-ietf-moq-transport-07`](https://github.com/cloudflare/moq-rs/tree/draft-ietf-moq-transport-07) branch.
+The `main` branch targets **draft-16** of the MoQT specification. For draft-07 compatibility (used in [Cloudflare's current production deployment](https://developers.cloudflare.com/moq/)), see the [`draft-ietf-moq-transport-07`](https://github.com/cloudflare/moq-rs/tree/draft-ietf-moq-transport-07) branch.
 
 ### What's Included
 

diff --git a/deploy/MLOG_SETUP.md b/deploy/MLOG_SETUP.md
@@ -40,8 +40,8 @@ curl https://interop-relay.cloudflare.mediaoverquic.com:443/mlog/22c73802597dcd9
 The output is JSON-SEQ: each record starts with ASCII Record Separator (`0x1e`) and contains a JSON object. The first record is a header; subsequent records are events:
 
 ```json
-{"time":0.179,"name":"moqt:control_message_parsed","data":{"message_type":"client_setup","supported_versions":["DRAFT_14"],...}}
-{"time":0.216,"name":"moqt:control_message_created","data":{"message_type":"server_setup","selected_version":"DRAFT_14",...}}
+{"time":0.179,"name":"moqt:control_message_parsed","data":{"message_type":"client_setup","supported_versions":["DRAFT_16"],...}}
+{"time":0.216,"name":"moqt:control_message_created","data":{"message_type":"server_setup","selected_version":"DRAFT_16",...}}
 ```
 
 - `control_message_parsed` = the relay **received** a message from your client
@@ -74,12 +74,12 @@ cargo run --bin moq-test-client -- \
     "stream_id": 0,
     "message_type": "client_setup",
     "number_of_supported_versions": 1,
-    "supported_versions": ["DRAFT_14"],
+    "supported_versions": ["DRAFT_16"],
     "parameters": [["2", "100"]]
   }
 }
 ```
-The relay parsed your CLIENT_SETUP. It offered version DRAFT_14. The `parameters` array contains SETUP parameters as `[id, value]` pairs (here, PATH with max length 100).
+The relay parsed your CLIENT_SETUP. It offered version DRAFT_16. The `parameters` array contains SETUP parameters as `[id, value]` pairs (here, PATH with max length 100).
 
 ```json
 {
@@ -89,26 +89,26 @@ The relay parsed your CLIENT_SETUP. It offered version DRAFT_14. The `parameters
     "event_type": "control_message_created",
     "stream_id": 0,
     "message_type": "server_setup",
-    "selected_version": "DRAFT_14",
+    "selected_version": "DRAFT_16",
     "parameters": [["2", "100"]]
   }
 }
 ```
-The relay responded with SERVER_SETUP, selecting DRAFT_14. The handshake is complete.
+The relay responded with SERVER_SETUP, selecting DRAFT_16. The handshake is complete.
 
 **What to look for:**
 - If you see `client_setup` parsed but no `server_setup` created, the relay rejected your version or parameters
 - If you see nothing at all, your connection didn't reach the MoQ layer (check QUIC connectivity)
 
-### Example 2: Publishing a namespace (`announce-only`)
+### Example 2: Publishing a namespace (`publish-namespace-only`)
 
 After SETUP, announce a namespace and verify the relay accepts it.
 
 ```bash
 cargo run --bin moq-test-client -- \
   --relay https://interop-relay.cloudflare.mediaoverquic.com:443 \
   --tls-disable-verify \
-  --test announce-only
+  --test publish-namespace-only
 ```
 
 **mlog output** (after the SETUP exchange):
@@ -148,21 +148,21 @@ The relay accepted the namespace with PUBLISH_NAMESPACE_OK. Your client is now r
 - `publish_namespace_ok` created confirms it was accepted
 - The `request_id` ties the response to the request
 
-### Example 3: Full publish-subscribe flow (`announce-subscribe`)
+### Example 3: Full publish-subscribe flow (`publish-namespace-subscribe`)
 
 This test uses two connections: a publisher and a subscriber. The test client reports both Connection IDs:
 
 ```bash
 cargo run --bin moq-test-client -- \
   --relay https://interop-relay.cloudflare.mediaoverquic.com:443 \
   --tls-disable-verify \
-  --test announce-subscribe
+  --test publish-namespace-subscribe
 ```
 
 **TAP output:**
 
 ```
-ok 1 - announce-subscribe
+ok 1 - publish-namespace-subscribe
   ---
   duration_ms: 3436
   publisher_connection_id: 71d4b5eb1a807779af03331c330d5fa9

diff --git a/moq-clock-ietf/src/main.rs b/moq-clock-ietf/src/main.rs
@@ -66,7 +66,7 @@ async fn main() -> anyhow::Result<()> {
             tokio::select! {
                 res = session.run() => res.context("session error")?,
                 res = clock_publisher.run() => res.context("clock error")?,
-                res = publisher.announce(tracks_reader) => res.context("failed to serve tracks")?,
+                res = publisher.publish_namespace(tracks_reader) => res.context("failed to serve tracks")?,
             }
         } else {
             tracing::info!("publishing clock via streams");
@@ -82,7 +82,7 @@ async fn main() -> anyhow::Result<()> {
             tokio::select! {
                 res = session.run() => res.context("session error")?,
                 res = clock_publisher.run() => res.context("clock error")?,
-                res = publisher.announce(tracks_reader) => res.context("failed to serve tracks")?,
+                res = publisher.publish_namespace(tracks_reader) => res.context("failed to serve tracks")?,
             }
         }
     } else {

diff --git a/moq-native-ietf/Cargo.toml b/moq-native-ietf/Cargo.toml
@@ -17,7 +17,7 @@ categories = ["multimedia", "network-programming", "web-programming"]
 [dependencies]
 moq-transport = { path = "../moq-transport", version = "0.14" }
 web-transport = { workspace = true }
-web-transport-quinn = { version = "0.11", default-features = false, features = ["ring"] }
+web-transport-quinn = { version = "0.11.8", default-features = false, features = ["ring"] }
 
 rustls = { version = "0.23", features = ["ring"] }
 rustls-pemfile = "2"

diff --git a/moq-native-ietf/src/quic.rs b/moq-native-ietf/src/quic.rs
@@ -426,9 +426,18 @@ impl Server {
                 .await
                 .context("failed to receive WebTransport request")?;
 
+            let moqt_protocol = std::str::from_utf8(moq_transport::setup::ALPN)
+                .context("invalid MoQT ALPN")?
+                .to_string();
+            let response = if request.protocols.contains(&moqt_protocol) {
+                web_transport_quinn::proto::ConnectResponse::OK.with_protocol(moqt_protocol)
+            } else {
+                web_transport_quinn::proto::ConnectResponse::OK
+            };
+
             // Accept the CONNECT request.
             let session = request
-                .ok()
+                .respond(response)
                 .await
                 .context("failed to respond to WebTransport request")?;
             (session, Transport::WebTransport)
@@ -552,10 +561,17 @@ impl Client {
             .to_string();
 
         let (session, transport) = match url.scheme() {
-            "https" => (
-                web_transport_quinn::Session::connect(connection, url.clone()).await?,
-                Transport::WebTransport,
-            ),
+            "https" => {
+                let moqt_protocol = std::str::from_utf8(moq_transport::setup::ALPN)
+                    .context("invalid MoQT ALPN")?
+                    .to_string();
+                let request = web_transport_quinn::proto::ConnectRequest::new(url.clone())
+                    .with_protocol(moqt_protocol);
+                (
+                    web_transport_quinn::Session::connect(connection, request).await?,
+                    Transport::WebTransport,
+                )
+            }
             "moqt" => (
                 web_transport_quinn::Session::raw(
                     connection,

diff --git a/moq-pub/src/main.rs b/moq-pub/src/main.rs
@@ -85,7 +85,7 @@ async fn main() -> anyhow::Result<()> {
         res = run_media(media) => {
             res.context("media error")?
         },
-        res = publisher.announce(reader) => res.context("publisher error")?,
+        res = publisher.publish_namespace(reader) => res.context("publisher error")?,
     }
 
     Ok(())

diff --git a/moq-pub/src/media.rs b/moq-pub/src/media.rs
@@ -174,7 +174,7 @@ impl Media {
             let mut selection_params = moq_catalog::SelectionParam::default();
 
             let mut track = moq_catalog::Track {
-                init_track: Some(self.init.name.clone()),
+                init_track: Some(self.init.name.to_string()),
                 name: name.clone(),
                 namespace: Some(self.broadcast.namespace.to_utf8_path()),
                 packaging: Some(moq_catalog::TrackPackaging::Cmaf),

diff --git a/moq-relay-ietf/src/bin/moq-relay-ietf/main.rs b/moq-relay-ietf/src/bin/moq-relay-ietf/main.rs
@@ -32,8 +32,8 @@ pub struct Cli {
     #[arg(long)]
     pub mlog_dir: Option<PathBuf>,
 
-    /// Forward all announces to the provided server for authentication/routing.
-    /// If not provided, the relay accepts every unique announce.
+    /// Forward all PUBLISH_NAMESPACE messages to the provided server for auth/routing.
+    /// If not provided, the relay accepts every unique namespace publish.
     #[arg(long)]
     pub announce: Option<Url>,