[v0.1/P1] Validate drained uniform payloads before dropping them #305

Closed

opened 2026-09-21 12:08:09 +09:00 by natsukium · 1 comment

natsukium commented

2026-09-21 12:08:09 +09:00

Owner

Problem

ConnectionDriver::admit_drained has a fast path for uniform uncorrelated Grid, Image, and Push traffic. It checks kind columns, envelope status, and correlation, but deliberately does not decode the protobuf body before dropping it.

This contradicts the IPC contract that an undecodable body is corruption. A malformed or non-protobuf body can therefore be accepted and discarded when the receiving role does not consume that family, while the same frame would fail when decoded by a window client.

The current code comment also says the frame is untrustworthy but still returns Ok(()), which makes the actual corruption policy ambiguous.

Proposed resolution

Choose and document one policy before the wire freeze:

Validate the body in the drain path even when the delivery is discarded; or
Explicitly change the protocol contract so unread uniform payloads are not body-validated, including the consequences for cross-language clients.

The preferred option is a validation-only decode on the non-hot discard path, with tests for malformed protobuf, unknown oneof arms, and invalid row/image payloads.

Acceptance criteria

The implementation and docs/reference/ipc.md agree on whether drained payload bodies are validated.
Malformed drained payloads have a deterministic result and do not silently weaken the corruption contract.
Tests cover both a valid drained uniform frame and malformed/unknown-body variants.

Sources

crates/felis-transport/src/driver.rs (admit_drained)
docs/reference/ipc.md (corruption and frame validation)
crates/felis-transport/src/driver/tests.rs

## Problem `ConnectionDriver::admit_drained` has a fast path for uniform uncorrelated `Grid`, `Image`, and `Push` traffic. It checks kind columns, envelope status, and correlation, but deliberately does not decode the protobuf body before dropping it. This contradicts the IPC contract that an undecodable body is corruption. A malformed or non-protobuf body can therefore be accepted and discarded when the receiving role does not consume that family, while the same frame would fail when decoded by a window client. The current code comment also says the frame is untrustworthy but still returns `Ok(())`, which makes the actual corruption policy ambiguous. ## Proposed resolution Choose and document one policy before the wire freeze: 1. Validate the body in the drain path even when the delivery is discarded; or 2. Explicitly change the protocol contract so unread uniform payloads are not body-validated, including the consequences for cross-language clients. The preferred option is a validation-only decode on the non-hot discard path, with tests for malformed protobuf, unknown oneof arms, and invalid row/image payloads. ## Acceptance criteria - The implementation and `docs/reference/ipc.md` agree on whether drained payload bodies are validated. - Malformed drained payloads have a deterministic result and do not silently weaken the corruption contract. - Tests cover both a valid drained uniform frame and malformed/unknown-body variants. ## Sources - `crates/felis-transport/src/driver.rs` (`admit_drained`) - `docs/reference/ipc.md` (corruption and frame validation) - `crates/felis-transport/src/driver/tests.rs`

natsukium added the

priority/P1

release/v0.1.0

type/bug

labels

2026-09-21 12:08:16 +09:00

natsukium referenced this issue

2026-09-21 12:22:46 +09:00

[v0.1/P1] Reject impossible Grid coordinates instead of normalizing them #315

natsukium referenced this issue

2026-09-21 12:23:11 +09:00

[v0.1/Tracker] Close release blockers before v0.1.0 #12

natsukium referenced this issue

2026-09-21 13:02:36 +09:00

[v0.1/Tracker] Close release blockers before v0.1.0 #12

natsukium commented

2026-09-21 13:02:46 +09:00

Author

Owner

Direction agreed 2026-09-21 after three sol design-review rounds (final verdict PASS). Full plan and batch order: see the comment on #12.

#305 — option 1 with an explicit boundary. The uniform drain path
(Grid/Image/Push) runs a validation-only protobuf decode before discarding,
so an undecodable body is corruption on every role. What the drain path
cannot check is stated, not hidden: packed_cells is opaque to
felis-protocol and felis-transport depends only on felis-protocol, so
row-codec contents, coordinates relative to shadow dimensions, and image
transfer sequencing are semantic invariants that only a consuming shadow can
judge. docs/reference/ipc.md names the two tiers: wire-level validation
(protobuf structure, unknown arms, stateless limits) on every path; semantic
validation (ShadowError, image state) on consumers. The uniform fast-path
decision in docs/explanation/architecture/ipc.md is rewritten in place.
Tests cover malformed protobuf and unknown arms on the drain path, and a
malformed opaque row is shown to be a consumer-tier failure.

Direction agreed 2026-09-21 after three `sol` design-review rounds (final verdict PASS). Full plan and batch order: see the comment on #12. - **#305** — option 1 with an explicit boundary. The uniform drain path (Grid/Image/Push) runs a validation-only protobuf decode before discarding, so an undecodable body is corruption on every role. What the drain path cannot check is stated, not hidden: `packed_cells` is opaque to `felis-protocol` and `felis-transport` depends only on `felis-protocol`, so row-codec contents, coordinates relative to shadow dimensions, and image transfer sequencing are semantic invariants that only a consuming shadow can judge. `docs/reference/ipc.md` names the two tiers: wire-level validation (protobuf structure, unknown arms, stateless limits) on every path; semantic validation (`ShadowError`, image state) on consumers. The uniform fast-path decision in `docs/explanation/architecture/ipc.md` is rewritten in place. Tests cover malformed protobuf and unknown arms on the drain path, and a malformed opaque row is shown to be a consumer-tier failure.

natsukium referenced this issue from a pull request that will close it,

2026-09-21 13:21:00 +09:00

transport: decode drained uniform bodies before dropping them #317

natsukium closed this issue

2026-09-21 15:58:12 +09:00

natsukium referenced this issue from a commit

2026-09-21 15:58:13 +09:00

transport: decode drained uniform bodies before dropping them (#317)

natsukium referenced this issue

2026-09-21 21:35:04 +09:00

[v0.1/Tracker] Close release blockers before v0.1.0 #12

Commenting is not possible because the repository is archived.