transport: take the writer's effective minor at construction #231

Merged

natsukium merged 1 commit from issue-176 into main 2026-09-08 21:49:17 +09:00

Conversation 0 Commits 1 Files changed 17 +143 -94

natsukium commented 2026-09-08 20:41:34 +09:00

Owner

Copy link

FrameWriter::new defaulted its effective_minor to this build's own PROTOCOL_MINOR, so the plain public constructor
plus send() authorized every addition this build knows even though no peer had agreed to any of them — the send gate
was only as strong as the value a forgotten .at_minor call left behind. The minor is now a new parameter, so no send
path can inherit the ceiling by omission. A carrier whose preface has not run takes FrameWriter::baseline (base schema
only); a harness that is both peers takes FrameWriter::at_build_minor, gated behind the test-util feature so no
production dependency compiles it. Connection::from_halves reads the minor off the writer it is handed instead of
taking a second copy that could disagree with it.

Pinned by an_unnegotiated_writer_authorizes_only_the_base_schema (felis-transport): an unnegotiated writer refuses a
minor-1 addition with MinorTooOld and still sends a base-schema Hello on the same writer. The mandatory-parameter
half is pinned by the type system — every call site now states its minor. docs/reference/ipc.md "Versioning" records
the resulting fact. No wire, CLI, config or default changes, so no CHANGELOG entry.

Fixes #176

`FrameWriter::new` defaulted its `effective_minor` to this build's own `PROTOCOL_MINOR`, so the plain public constructor plus `send()` authorized every addition this build knows even though no peer had agreed to any of them — the send gate was only as strong as the value a forgotten `.at_minor` call left behind. The minor is now a `new` parameter, so no send path can inherit the ceiling by omission. A carrier whose preface has not run takes `FrameWriter::baseline` (base schema only); a harness that is both peers takes `FrameWriter::at_build_minor`, gated behind the `test-util` feature so no production dependency compiles it. `Connection::from_halves` reads the minor off the writer it is handed instead of taking a second copy that could disagree with it. Pinned by `an_unnegotiated_writer_authorizes_only_the_base_schema` (felis-transport): an unnegotiated writer refuses a minor-1 addition with `MinorTooOld` and still sends a base-schema `Hello` on the same writer. The mandatory-parameter half is pinned by the type system — every call site now states its minor. `docs/reference/ipc.md` "Versioning" records the resulting fact. No wire, CLI, config or default changes, so no CHANGELOG entry. Fixes #176

natsukium added 1 commit 2026-09-08 20:41:34 +09:00

transport: take the writer's effective minor at construction ... 06bf6d1307

`FrameWriter::new` defaulted `effective_minor` to this build's own
`PROTOCOL_MINOR`, so a writer that had negotiated nothing authorized
every addition this build knows. The send gate is only as strong as its
default: a call site that forgot to narrow the minor emitted additions
no peer had agreed to, and nothing in the ordinary API said so.

The minor is now a `new` parameter, so no send path can inherit the
ceiling by omission. A carrier whose preface has not run takes
`baseline`, which authorizes the base schema alone; a harness that is
both peers takes `at_build_minor`, gated behind `test-util` so no
production dependency compiles it. `Connection::from_halves` reads the
minor off the writer it is handed rather than taking a second copy that
could disagree with it.

Assisted-by: Claude Code

natsukium merged commit 90983704a8 into main 2026-09-08 21:49:17 +09:00

natsukium deleted branch issue-176 2026-09-08 21:49:17 +09:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!231

No description provided.