protocol: refuse a mismatched correlation where the frame is encoded #218

Merged

natsukium merged 1 commit from fix/correlation-encode-gate-196 into main 2026-09-08 03:11:06 +09:00

Conversation 0 Commits 1 Files changed 10 +316 -44

natsukium commented 2026-09-08 02:22:41 +09:00

Owner

Copy link

Fixes #196.

A correlation violation was only caught at the receiver, where the driver
refuses the frame and drops the connection: the sender saw a bare EOF and the
diagnosis stayed in the daemon's log. Worse, the reachable spelling of a
subscribe — send(&msg) with no envelope — was exactly the wrong one, so a
satellite client's standing subscription died silently under a redial loop.

CheckedFrame now applies the class half of the same rule at encode time: it
bounds both paths on Directed and refuses a correlated arm handed no
envelope, an uncorrelated arm handed one, and an id of the wrong kind in either
direction. Every FrameWriter::send*, the client's outgoing queue and the
daemon's fan-out inherit the check. It reads the arm's CorrelationClass,
never whether a message happens to carry an id (Conn::Cancel/End/Error
name a stream in an ordinary field and stay uncorrelated). Identity — the next
unissued id, an outstanding request, a live stream — remains the driver's, so
the two ends keep one ledger. TransportError::Correlation mirrors
DriverError::Correlation field for field, so one pairing renders one sentence
on both ends.

Doc cascade: docs/reference/ipc.md states the encoder-side refusal beside the
receiver-side rule, docs/explanation/architecture/ipc.md carries why the
class check is duplicated at the encoder while identity is not, and
docs/reference/testing.md tracks the moved coverage.

Verified: just check green (fmt, clippy, nextest, deny, proto-compat); reviewed
by pi luna + pi sol; docs proofread by Gemini gemini-3.8-flash-high

Deferred

• No proptest or Kani coverage of the full class-by-envelope matrix: five
  classes by three envelope states; the four refusal shapes and the honest
  pairings are each covered by a focused test, and a generator would only
  restate the same matches! arm.

Fixes #196. A correlation violation was only caught at the receiver, where the driver refuses the frame and drops the connection: the sender saw a bare EOF and the diagnosis stayed in the daemon's log. Worse, the reachable spelling of a subscribe — `send(&msg)` with no envelope — was exactly the wrong one, so a satellite client's standing subscription died silently under a redial loop. `CheckedFrame` now applies the class half of the same rule at encode time: it bounds both paths on `Directed` and refuses a correlated arm handed no envelope, an uncorrelated arm handed one, and an id of the wrong kind in either direction. Every `FrameWriter::send*`, the client's outgoing queue and the daemon's fan-out inherit the check. It reads the arm's `CorrelationClass`, never whether a message happens to carry an id (`Conn::Cancel`/`End`/`Error` name a stream in an ordinary field and stay uncorrelated). Identity — the next unissued id, an outstanding request, a live stream — remains the driver's, so the two ends keep one ledger. `TransportError::Correlation` mirrors `DriverError::Correlation` field for field, so one pairing renders one sentence on both ends. Doc cascade: `docs/reference/ipc.md` states the encoder-side refusal beside the receiver-side rule, `docs/explanation/architecture/ipc.md` carries why the class check is duplicated at the encoder while identity is not, and `docs/reference/testing.md` tracks the moved coverage. Verified: just check green (fmt, clippy, nextest, deny, proto-compat); reviewed by pi luna + pi sol; docs proofread by Gemini gemini-3.8-flash-high ## Deferred - No proptest or Kani coverage of the full class-by-envelope matrix: five classes by three envelope states; the four refusal shapes and the honest pairings are each covered by a focused test, and a generator would only restate the same `matches!` arm.

natsukium added 1 commit 2026-09-08 02:22:41 +09:00

protocol: refuse a mismatched correlation where the frame is encoded ... fe96e99b28

A correlation violation is fatal at the receiver: the driver refuses the
frame and ends the connection, so a caller that sent one reads a bare EOF
and the diagnosis lives only in the daemon's log. Nothing on the sending
side said so, and the reachable spelling of a subscribe -- `send(&msg)`
without an envelope -- was exactly the wrong one, leaving a satellite
client's standing subscription silently dead under a redial loop.

The encoder now checks the class half of the same rule: `CheckedFrame`
bounds both paths on `Directed` and refuses a correlated arm handed no
envelope, an uncorrelated arm handed one, and an id of the wrong kind in
either direction, so every `FrameWriter::send*`, the client's outgoing
queue and the daemon's fan-out inherit it. The check reads the arm's
class, never whether a message carries an id: `Conn::Cancel`/`End`/`Error`
name a stream in an ordinary field and are uncorrelated. Identity -- the
next unissued id, an outstanding request, a live stream -- stays the
driver's, since duplicating that ledger would give the two ends two
answers.

`TransportError::Correlation` mirrors `DriverError::Correlation` field for
field so one pairing renders one sentence on both ends: a caller reading
the refusal at the call site and a maintainer reading the daemon's log are
chasing the same text, not two spellings of it.

Refs #196

natsukium force-pushed fix/correlation-encode-gate-196 from fe96e99b28 to b11050b6d5 2026-09-08 02:34:25 +09:00 Compare

natsukium merged commit 6840ca08c7 into main 2026-09-08 03:11:06 +09:00

natsukium deleted branch fix/correlation-encode-gate-196 2026-09-08 03:11:06 +09:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!218

No description provided.