[trashhalo]

Summary

• replace the Iroh mesh with one Hugging Face network group per cluster and stable scheduler/node aliases
• authenticate and encrypt all Dask scheduler, nanny, worker, driver, and external-client traffic with per-cluster mTLS credentials
• enable HF SSH only for persistent scheduler Jobs and connect external clients through a loopback-only port forward
• delete the Iroh dependency, transport implementation, configuration, workflow hook, and integration test
• pin huggingface_hub to the upstream network-groups implementation until the next compatible release is available

Verification

• mise run check-format
• mise run lint
• mise run test (297 passed, including a real Dask mTLS handshake and wrong-CA rejection)
• mise run docs
• mise run build

[Copilot]

🟡 Changes recommended

Distribution installs do not retain the Git dependency pin, and external clients can incorrectly inherit direct worker communication.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Replaces Iroh networking with HF network groups, per-cluster Dask mTLS, and SSH-forwarded persistent clients.

Changes:

• Adds network-group addressing and certificate lifecycle management.
• Migrates cluster runners and clients to TLS and SSH forwarding.
• Removes Iroh configuration, dependencies, tests, and documentation.

File summaries

File	Description
uv.lock	Updates resolved networking and cryptography dependencies.
tests/test_tls_integration.py	Tests real Dask mTLS and CA rejection.
tests/test_persistent.py	Tests persistent TLS/SSH lifecycle.
tests/test_network.py	Tests aliases and TLS credentials.
tests/test_iroh_integration.py	Removes Iroh integration coverage.
tests/test_hardware.py	Updates topology tests.
tests/test_config.py	Updates network configuration validation.
tests/test_cluster.py	Tests network-group submissions and secrets.
tests/test_cli.py	Updates CLI expectations.
src/hfdask/runner.py	Runs Dask services over network-group mTLS.
src/hfdask/network.py	Implements addressing and credential management.
src/hfdask/jobs.py	Updates networking terminology.
src/hfdask/hardware.py	Removes Iroh service mapping.
src/hfdask/config.py	Replaces mesh schemas with cluster schemas.
src/hfdask/cluster.py	Creates network groups and mTLS identities.
src/hfdask/client.py	Connects through SSH forwarding and mTLS.
src/hfdask/cli.py	Removes Iroh identity generation.
src/hfdask/__init__.py	Updates module documentation.
README.md	Documents the new architecture.
pyproject.toml	Replaces Iroh and pins upstream HF support.
examples/README.md	Removes relay instructions.
examples/inference.yaml	Removes relay configuration.
examples/cpu.yaml	Removes relay configuration.
.github/workflows/pr.yml	Removes Iroh test opt-in.

Review details

• Files reviewed: 23/24 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[trashhalo]

Thanks for flagging network groups as an option @davanstrien it worked great locally. I can't merge this yet though because network groups appears to have been reverted in the latest stable release here huggingface/huggingface_hub@d592df87 by @hanouticelina i'll bump and merge on next release since main line has it back on 🤞