sechmachine/VerseVDI-Data-Plane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(gateway): secure control and terminal ownership

Browse Source
This commit is contained in:
sechmachine
2026-07-30 11:15:48 +07:00
parent df75b1d250
commit baf4073f68
16 changed files with 488 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/specs/provider-session-lifecycle/spec.md
+11 -7
View File
@@ -1,22 +1,26 @@
# provider-session-lifecycle Specification
## Purpose
TBD - created by archiving change phase3c-gateway-audit-remediation. Update Purpose after archive.
Define terminal media quiescence, bounded Verse tunnel ownership, provider cleanup, reservation release, and durable lifecycle outcomes.
## Requirements
### Requirement: Provider terminal events end forwarding
Encrypted provider termination and unexpected provider disconnect SHALL quiesce provider ingestion and queued/new media forwarding before the existing reliable typed terminal event is delivered, close the Verse tunnel within a bounded interval, release the session reservation, and report the appropriate durable provider/session state. A fixed drain delay MUST NOT stand in for reliable control delivery.
Encrypted provider termination and unexpected provider disconnect SHALL quiesce provider ingestion and queued/new media forwarding before the existing reliable typed terminal event is delivered. The client SHALL return the Protocol-owned terminal receipt after decoding that event. The gateway SHALL close the Verse tunnel after that receipt or a bounded receipt deadline even when the client keeps the connection open, release the session reservation, and report the appropriate durable provider/session state. The receipt MUST be consumed by the gateway and MUST NOT be forwarded to the provider. A fixed drain delay MUST NOT stand in for reliable control delivery.
#### Scenario: Host termination closes the tunnel
- **WHEN** the native provider emits an authenticated termination event
- **THEN** queued and newly injected media cannot cross the Verse transport after observation, and the client tunnel, reservation, and durable lifecycle transition complete
- **WHEN** the native provider emits an authenticated termination event and an independent client returns its terminal receipt
- **THEN** queued and newly injected media cannot cross the Verse transport after observation, and the gateway closes the tunnel, releases the reservation, and completes the durable lifecycle transition
#### Scenario: Unexpected provider disconnect is reconnectable
- **WHEN** required provider transport disconnects without acknowledged termination
- **THEN** forwarding stops and the Server receives the existing reconnectable lifecycle state rather than a termination claim
- **WHEN** required provider transport disconnects without acknowledged provider termination
- **THEN** forwarding stops, the final typed disconnect reaches the client, and the Server receives the existing reconnectable lifecycle state rather than a termination claim
#### Scenario: Client omits terminal receipt
- **WHEN** the terminal event is written but the client remains open without returning a valid receipt
- **THEN** the gateway closes the tunnel at the bounded receipt deadline and continues cleanup without restoring media forwarding
### Requirement: Cleanup failure remains durable
Gateway cleanup MUST preserve `cleanup_pending` when provider input release, transport cleanup, authorized cancellation, or durable reporting fails.
#### Scenario: Terminal cleanup fails
- **WHEN** a provider terminal event is handled but required cleanup cannot complete
- **THEN** the session is not reported released or reusable and durable state remains cleanup pending
- **THEN** the session is not reported reusable and durable state remains cleanup pending