Music Hub Network

Core add-on preview: Music Hub Network is the reference bundled add-on for the Plugin API. It is disabled by default and can be enabled or disabled in Desktop Add-ons without changing Mobile-to-Hub pairing.

Music Hub Network lets opted-in hubs compare metadata for a known canonical track identity. It returns field-level values, contributing-peer counts, confidence/disagreement and bounded evidence. The user selects the fields to apply; the Desktop host accepts only the short-lived opaque result IDs it issued, resolves the verified values locally, and records provenance and undo information.

Privacy and protocol boundary

The network is metadata-only. It does not transfer audio, expose local file paths, publish complete library inventories, provide media URLs, reuse mobile pairing credentials or enable downloads. A future owner-consented media availability feature would be a separate plugin, protocol and security review.

The add-on uses a dedicated Iroh identity, endpoint and service namespace, plus short-lived signed peer presence. Presence is discovery only: a hub serves or queries metadata only after the owner explicitly approves the peer ID; two hubs must approve each other for an exchange. It is separate from Sovereign Mobile-Hub pairing and playback. Enabling, disabling or failing the add-on must not change the existing mobile connection path.

Desktop shows the hub's public peer identity in network diagnostics so an owner can share it with a trusted hub, approve or revoke that peer, and maintain an independent local blocklist. Neither the identity nor presence includes library contents, paths or audio data.

Current workflow and limits

The initial workflow is known-ID enrichment: search peers for a canonical ID, aggregate at most one response per peer, show consensus and disagreement, and turn the result into a metadata proposal. Peer responses are bounded, validated, rate limited, memory-bounded, locally blocklistable and subject to explicit peer approval. Signed presence may include validated direct socket candidates and a relay-discovery fallback; it does not itself confer network access.

Automated coverage includes a two-node local Iroh consensus lookup, selected metadata apply and undo, plus a failed-peer case. Real-hub owner QA remains the release gate.

Free-text network discovery, global inventory search, DHT discovery, audio transfer, downloads and fallback playback are not part of this plugin contract.