fix(core): linearize ABI connect cancellation

core/include/versevdi_core.h

@@ -0,0 +1,206 @@
+#ifndef VERSEVDI_CORE_H
+#define VERSEVDI_CORE_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define VERSE_CORE_ABI_VERSION_1 UINT32_C(1)
+
+typedef uint32_t verse_status_t;
+
+#define VERSE_STATUS_OK UINT32_C(0)
+#define VERSE_STATUS_INVALID_ARGUMENT UINT32_C(1)
+#define VERSE_STATUS_INVALID_STATE UINT32_C(2)
+#define VERSE_STATUS_UNSUPPORTED_ABI UINT32_C(3)
+#define VERSE_STATUS_AUTHORITY_REJECTED UINT32_C(4)
+#define VERSE_STATUS_TLS UINT32_C(5)
+#define VERSE_STATUS_TRANSPORT UINT32_C(6)
+#define VERSE_STATUS_PROTOCOL UINT32_C(7)
+#define VERSE_STATUS_EXPIRED UINT32_C(8)
+#define VERSE_STATUS_QUEUE_FULL UINT32_C(9)
+#define VERSE_STATUS_CANCELLED UINT32_C(10)
+#define VERSE_STATUS_REENTRANT UINT32_C(11)
+#define VERSE_STATUS_BUSY UINT32_C(12)
+#define VERSE_STATUS_INTERNAL UINT32_C(13)
+
+#define VERSE_STATE_CONNECTING UINT32_C(1)
+#define VERSE_STATE_CONNECTED UINT32_C(2)
+#define VERSE_STATE_CANCELLED UINT32_C(3)
+
+#define VERSE_INPUT_KEYBOARD UINT32_C(1)
+#define VERSE_INPUT_MOUSE_BUTTON UINT32_C(2)
+#define VERSE_INPUT_RELATIVE_MOUSE UINT32_C(3)
+#define VERSE_INPUT_TEXT UINT32_C(4)
+#define VERSE_INPUT_CONTROLLER UINT32_C(5)
+#define VERSE_INPUT_ABSOLUTE_MOUSE UINT32_C(6)
+#define VERSE_INPUT_SCROLL UINT32_C(7)
+
+typedef struct verse_core verse_core_t;
+
+/* data may be NULL only when length is zero. The view never transfers ownership. */
+typedef struct verse_bytes_view {
+    const uint8_t *data;
+    size_t length;
+} verse_bytes_view_t;
+
+typedef struct verse_state_event_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    uint32_t state;
+    uint32_t reason;
+} verse_state_event_v1_t;
+
+typedef struct verse_error_event_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    uint32_t code;
+    uint32_t retryable;
+    uint32_t phase;
+    uint32_t reserved;
+} verse_error_event_v1_t;
+
+typedef struct verse_stats_event_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    uint64_t dropped_callbacks;
+    uint64_t dropped_media_units;
+    uint64_t dropped_input_events;
+} verse_stats_event_v1_t;
+
+typedef struct verse_media_event_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    uint32_t channel;
+    uint32_t sequence;
+    uint64_t timestamp_ms;
+    verse_bytes_view_t encoded_unit;
+} verse_media_event_v1_t;
+
+typedef struct verse_control_event_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    uint32_t kind;
+    uint32_t reserved;
+    verse_bytes_view_t payload;
+} verse_control_event_v1_t;
+
+/*
+ * Signers run synchronously inline on the thread invoking the API call.
+ * transcript/tls_message is borrowed only for the callback; signature_out is
+ * exactly 64 writable bytes. Admission may return OK, AUTHORITY_REJECTED,
+ * CANCELLED, or INTERNAL. TLS may return OK, TLS, CANCELLED, or INTERNAL. Any
+ * other value is normalized to INTERNAL.
+ */
+typedef verse_status_t (*verse_sign_admission_v1_fn)(
+    void *signer_context,
+    verse_bytes_view_t transcript,
+    uint8_t signature_out[64]);
+typedef verse_status_t (*verse_sign_tls_ed25519_v1_fn)(
+    void *signer_context,
+    verse_bytes_view_t tls_message,
+    uint8_t signature_out[64]);
+/*
+ * Event callbacks run asynchronously on one core-owned worker thread and are
+ * serialized with one another. Each event and nested byte view is borrowed only
+ * for its callback and must not be retained.
+ */
+typedef void (*verse_state_event_v1_fn)(
+    void *context,
+    const verse_state_event_v1_t *event);
+typedef void (*verse_error_event_v1_fn)(
+    void *context,
+    const verse_error_event_v1_t *event);
+typedef void (*verse_stats_event_v1_fn)(
+    void *context,
+    const verse_stats_event_v1_t *event);
+typedef void (*verse_media_event_v1_fn)(
+    void *context,
+    const verse_media_event_v1_t *event);
+typedef void (*verse_control_event_v1_fn)(
+    void *context,
+    const verse_control_event_v1_t *event);
+
+/*
+ * create copies this table. context and every non-NULL callback must remain valid
+ * until destroy succeeds; BUSY does not end that lifetime.
+ */
+typedef struct verse_core_config_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    void *context;
+    verse_sign_admission_v1_fn sign_admission;
+    verse_sign_tls_ed25519_v1_fn sign_tls_ed25519;
+    verse_state_event_v1_fn on_state;
+    verse_error_event_v1_fn on_error;
+    verse_stats_event_v1_fn on_stats;
+    verse_media_event_v1_fn on_media;
+    verse_control_event_v1_fn on_control;
+} verse_core_config_v1_t;
+
+typedef struct verse_connect_request_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    verse_bytes_view_t manifest_json;
+    verse_bytes_view_t tunnel_credential_json;
+} verse_connect_request_v1_t;
+
+/* values are kind-specific signed fields; every unused field and flags must be zero. */
+typedef struct verse_input_event_v1 {
+    uint32_t struct_size;
+    uint32_t abi_version;
+    uint32_t kind;
+    uint32_t flags;
+    int32_t values[12];
+} verse_input_event_v1_t;
+
+uint32_t verse_core_abi_version(void);
+/*
+ * During a signer callback, every API below except verse_core_abi_version returns
+ * REENTRANT for every handle. During an event callback, only cancel on that event's
+ * originating handle is allowed; all other calls and cross-handle cancel return
+ * REENTRANT. Connect copies both byte inputs before returning, so callers may
+ * mutate or release their buffers afterward.
+ */
+verse_status_t verse_core_create_v1(
+    const verse_core_config_v1_t *config,
+    verse_core_t **out_core);
+verse_status_t verse_core_connect_v1(
+    verse_core_t *core,
+    const verse_connect_request_v1_t *request);
+verse_status_t verse_core_send_input_v1(
+    verse_core_t *core,
+    const verse_input_event_v1_t *event);
+verse_status_t verse_core_request_idr_v1(verse_core_t *core);
+/* Idempotent and nonblocking; it does not wait for an internal state lock. */
+verse_status_t verse_core_cancel_v1(verse_core_t *core);
+/*
+ * OK suppresses all later callbacks, releases session resources, and invalidates
+ * core. Calls admitted before destruction are accounted safely, but no API call
+ * may begin after OK. BUSY retains core, context, and callback ownership and
+ * requires a later retry.
+ */
+verse_status_t verse_core_destroy_v1(verse_core_t *core, uint32_t timeout_ms);
+
+#if defined(__APPLE__) && defined(__aarch64__)
+_Static_assert(sizeof(verse_bytes_view_t) == 16, "verse_bytes_view_t arm64 layout");
+_Static_assert(sizeof(verse_core_config_v1_t) == 72, "verse_core_config_v1_t arm64 layout");
+_Static_assert(offsetof(verse_core_config_v1_t, sign_admission) == 16, "config callback offset");
+_Static_assert(sizeof(verse_connect_request_v1_t) == 40, "verse_connect_request_v1_t arm64 layout");
+_Static_assert(offsetof(verse_connect_request_v1_t, manifest_json) == 8, "request view offset");
+_Static_assert(sizeof(verse_input_event_v1_t) == 64, "verse_input_event_v1_t arm64 layout");
+_Static_assert(sizeof(verse_state_event_v1_t) == 16, "verse_state_event_v1_t arm64 layout");
+_Static_assert(sizeof(verse_error_event_v1_t) == 24, "verse_error_event_v1_t arm64 layout");
+_Static_assert(sizeof(verse_stats_event_v1_t) == 32, "verse_stats_event_v1_t arm64 layout");
+_Static_assert(sizeof(verse_media_event_v1_t) == 40, "verse_media_event_v1_t arm64 layout");
+_Static_assert(sizeof(verse_control_event_v1_t) == 32, "verse_control_event_v1_t arm64 layout");
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

core/src/lib.rs

@@ -1,4 +1,5 @@
-#![forbid(unsafe_code, unsafe_op_in_unsafe_fn)]
+#![deny(unsafe_code)]
+#![forbid(unsafe_op_in_unsafe_fn)]
 
 //! Provider-free wire codecs and bounded session primitives for `VerseVDI` clients.
 //!
@@ -16,3 +17,6 @@ pub mod input;
 pub mod media;
 pub mod session;
 pub mod wire;
+
+#[allow(unsafe_code)]
+mod abi;

core/tests/abi_contract.rs

@@ -0,0 +1,787 @@
+#![allow(
+    unsafe_code,
+    clippy::borrow_as_ptr,
+    clippy::cast_possible_truncation,
+    clippy::items_after_statements
+)]
+
+use std::ffi::c_void;
+use std::mem::{offset_of, size_of};
+use std::ptr;
+use std::sync::atomic::{AtomicBool, AtomicU32, AtomicUsize, Ordering};
+use std::sync::{Condvar, Mutex};
+use std::thread;
+use std::time::{Duration, Instant};
+
+const ABI_V1: u32 = 1;
+const OK: u32 = 0;
+const INVALID_ARGUMENT: u32 = 1;
+const INVALID_STATE: u32 = 2;
+const UNSUPPORTED_ABI: u32 = 3;
+const AUTHORITY_REJECTED: u32 = 4;
+const TLS: u32 = 5;
+const QUEUE_FULL: u32 = 9;
+const CANCELLED: u32 = 10;
+const REENTRANT: u32 = 11;
+const BUSY: u32 = 12;
+const INTERNAL: u32 = 13;
+
+const STATE_CONNECTING: u32 = 1;
+const STATE_CONNECTED: u32 = 2;
+const STATE_CANCELLED: u32 = 3;
+const INPUT_KEYBOARD: u32 = 1;
+
+#[repr(C)]
+struct Core {
+    _private: [u8; 0],
+}
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct BytesView {
+    data: *const u8,
+    length: usize,
+}
+
+#[repr(C)]
+struct StateEvent {
+    struct_size: u32,
+    abi_version: u32,
+    state: u32,
+    reason: u32,
+}
+
+#[repr(C)]
+struct ErrorEvent {
+    struct_size: u32,
+    abi_version: u32,
+    code: u32,
+    retryable: u32,
+    phase: u32,
+    reserved: u32,
+}
+
+#[repr(C)]
+struct StatsEvent {
+    struct_size: u32,
+    abi_version: u32,
+    dropped_callbacks: u64,
+    dropped_media_units: u64,
+    dropped_input_events: u64,
+}
+
+#[repr(C)]
+struct MediaEvent {
+    struct_size: u32,
+    abi_version: u32,
+    channel: u32,
+    sequence: u32,
+    timestamp_ms: u64,
+    encoded_unit: BytesView,
+}
+
+#[repr(C)]
+struct ControlEvent {
+    struct_size: u32,
+    abi_version: u32,
+    kind: u32,
+    reserved: u32,
+    payload: BytesView,
+}
+
+type SignFn = unsafe extern "C" fn(*mut c_void, BytesView, *mut u8) -> u32;
+type StateFn = unsafe extern "C" fn(*mut c_void, *const StateEvent);
+type ErrorFn = unsafe extern "C" fn(*mut c_void, *const ErrorEvent);
+type StatsFn = unsafe extern "C" fn(*mut c_void, *const StatsEvent);
+type MediaFn = unsafe extern "C" fn(*mut c_void, *const MediaEvent);
+type ControlFn = unsafe extern "C" fn(*mut c_void, *const ControlEvent);
+
+#[repr(C)]
+struct Config {
+    struct_size: u32,
+    abi_version: u32,
+    context: *mut c_void,
+    sign_admission: Option<SignFn>,
+    sign_tls_ed25519: Option<SignFn>,
+    on_state: Option<StateFn>,
+    on_error: Option<ErrorFn>,
+    on_stats: Option<StatsFn>,
+    on_media: Option<MediaFn>,
+    on_control: Option<ControlFn>,
+}
+
+#[repr(C)]
+struct ConnectRequest {
+    struct_size: u32,
+    abi_version: u32,
+    manifest_json: BytesView,
+    tunnel_credential_json: BytesView,
+}
+
+#[repr(C)]
+struct InputEvent {
+    struct_size: u32,
+    abi_version: u32,
+    kind: u32,
+    flags: u32,
+    values: [i32; 12],
+}
+
+unsafe extern "C" {
+    fn verse_core_abi_version() -> u32;
+    fn verse_core_create_v1(config: *const Config, out_core: *mut *mut Core) -> u32;
+    fn verse_core_connect_v1(core: *mut Core, request: *const ConnectRequest) -> u32;
+    fn verse_core_send_input_v1(core: *mut Core, event: *const InputEvent) -> u32;
+    fn verse_core_request_idr_v1(core: *mut Core) -> u32;
+    fn verse_core_cancel_v1(core: *mut Core) -> u32;
+    fn verse_core_destroy_v1(core: *mut Core, timeout_ms: u32) -> u32;
+}
+
+const MANIFEST: &[u8] = br#"{
+  "version":"1","purpose":"launch","session_id":"session","reconnect_sequence":0,
+  "gateway":{"id":"gateway","addresses":["gateway.test:443"],"public_identity":"gateway.test"},
+  "tunnel":{"versions":["verse-gateway-v1/1"],"features":["control.v1","input.absolute.v1","input.scroll.v1"]},
+  "profile":{"id":"standard","bounds":{"minimum_kbps":1000,"target_kbps":5000,"maximum_kbps":10000},"display_mode":{"resolution_width":1920,"resolution_height":1080,"fps":60}},
+  "grant":{"opaque_value":"ggggggggggggggggggggggggggggggggggggggggggg","expires_at":"2099-01-01T00:00:00Z","audience":"audience"},
+  "correlation_id":"correlation"
+}"#;
+const CREDENTIAL: &[u8] = br#"{"client_device_id":"device","device_key_id":"key","certificate_chain_pem":"-----BEGIN CERTIFICATE-----\nAQID\n-----END CERTIFICATE-----","trust_bundle_pem":"-----BEGIN CERTIFICATE-----\nAQID\n-----END CERTIFICATE-----","expires_at":"2099-01-01T00:00:00Z"}"#;
+
+struct Context {
+    core: AtomicUsize,
+    admission_calls: AtomicUsize,
+    tls_calls: AtomicUsize,
+    admission_status: AtomicU32,
+    tls_status: AtomicU32,
+    admission_input: Mutex<Vec<u8>>,
+    tls_input: Mutex<Vec<u8>>,
+    states: Mutex<Vec<u32>>,
+    wake: Condvar,
+    reentry_cancel: AtomicU32,
+    reentry_send: AtomicU32,
+    reentry_destroy: AtomicU32,
+    block_callbacks: AtomicBool,
+    release_callbacks: AtomicBool,
+    callback_active: AtomicUsize,
+    callback_max: AtomicUsize,
+    cancel_on_connecting: AtomicBool,
+    reentry_target: AtomicUsize,
+    reentry_results: Mutex<Vec<u32>>,
+}
+
+impl Default for Context {
+    fn default() -> Self {
+        Self {
+            core: AtomicUsize::new(0),
+            admission_calls: AtomicUsize::new(0),
+            tls_calls: AtomicUsize::new(0),
+            admission_status: AtomicU32::new(OK),
+            tls_status: AtomicU32::new(OK),
+            admission_input: Mutex::new(Vec::new()),
+            tls_input: Mutex::new(Vec::new()),
+            states: Mutex::new(Vec::new()),
+            wake: Condvar::new(),
+            reentry_cancel: AtomicU32::new(u32::MAX),
+            reentry_send: AtomicU32::new(u32::MAX),
+            reentry_destroy: AtomicU32::new(u32::MAX),
+            block_callbacks: AtomicBool::new(false),
+            release_callbacks: AtomicBool::new(false),
+            callback_active: AtomicUsize::new(0),
+            callback_max: AtomicUsize::new(0),
+            cancel_on_connecting: AtomicBool::new(false),
+            reentry_target: AtomicUsize::new(0),
+            reentry_results: Mutex::new(Vec::new()),
+        }
+    }
+}
+
+unsafe fn context<'a>(raw: *mut c_void) -> &'a Context {
+    // Test invariant: every callback receives the live Box<Context> supplied at create.
+    unsafe { &*raw.cast::<Context>() }
+}
+
+unsafe extern "C" fn sign_admission(raw: *mut c_void, input: BytesView, output: *mut u8) -> u32 {
+    // Test invariant: ABI promises input is readable for input.length during this callback.
+    let bytes = unsafe { std::slice::from_raw_parts(input.data, input.length) };
+    let ctx = unsafe { context(raw) };
+    ctx.admission_calls.fetch_add(1, Ordering::SeqCst);
+    *ctx.admission_input.lock().expect("admission lock") = bytes.to_vec();
+    // Test invariant: ABI promises a writable 64-byte Rust-owned signature buffer.
+    unsafe { ptr::write_bytes(output, 0xA5, 64) };
+    ctx.admission_status.load(Ordering::SeqCst)
+}
+
+unsafe extern "C" fn sign_tls(raw: *mut c_void, input: BytesView, output: *mut u8) -> u32 {
+    // Test invariant: ABI promises input is readable for input.length during this callback.
+    let bytes = unsafe { std::slice::from_raw_parts(input.data, input.length) };
+    let ctx = unsafe { context(raw) };
+    ctx.tls_calls.fetch_add(1, Ordering::SeqCst);
+    *ctx.tls_input.lock().expect("tls lock") = bytes.to_vec();
+    // Test invariant: ABI promises a writable 64-byte Rust-owned signature buffer.
+    unsafe { ptr::write_bytes(output, 0x5A, 64) };
+    ctx.tls_status.load(Ordering::SeqCst)
+}
+
+unsafe extern "C" fn sign_admission_probes_global_reentry(
+    raw: *mut c_void,
+    input: BytesView,
+    output: *mut u8,
+) -> u32 {
+    let ctx = unsafe { context(raw) };
+    let target = ctx.reentry_target.load(Ordering::SeqCst) as *mut Core;
+    let results = [
+        unsafe { verse_core_abi_version() },
+        unsafe { verse_core_create_v1(ptr::null(), ptr::null_mut()) },
+        unsafe { verse_core_connect_v1(target, ptr::null()) },
+        unsafe { verse_core_send_input_v1(target, ptr::null()) },
+        unsafe { verse_core_request_idr_v1(target) },
+        unsafe { verse_core_cancel_v1(target) },
+        unsafe { verse_core_destroy_v1(target, 0) },
+    ];
+    ctx.reentry_results
+        .lock()
+        .expect("signer reentry results")
+        .extend(results);
+    unsafe { sign_admission(raw, input, output) }
+}
+
+unsafe extern "C" fn on_state_probes_global_reentry(raw: *mut c_void, event: *const StateEvent) {
+    let ctx = unsafe { context(raw) };
+    // Test invariant: ABI promises a readable state record for the callback duration.
+    let state = unsafe { (*event).state };
+    ctx.states.lock().expect("states lock").push(state);
+    ctx.wake.notify_all();
+    if state != STATE_CONNECTED {
+        return;
+    }
+    let origin = ctx.core.load(Ordering::SeqCst) as *mut Core;
+    let other = ctx.reentry_target.load(Ordering::SeqCst) as *mut Core;
+    let results = [
+        unsafe { verse_core_abi_version() },
+        unsafe { verse_core_create_v1(ptr::null(), ptr::null_mut()) },
+        unsafe { verse_core_connect_v1(origin, ptr::null()) },
+        unsafe { verse_core_send_input_v1(origin, ptr::null()) },
+        unsafe { verse_core_request_idr_v1(origin) },
+        unsafe { verse_core_cancel_v1(other) },
+        unsafe { verse_core_destroy_v1(origin, 0) },
+        unsafe { verse_core_cancel_v1(origin) },
+    ];
+    ctx.reentry_results
+        .lock()
+        .expect("event reentry results")
+        .extend(results);
+}
+
+unsafe extern "C" fn on_state(raw: *mut c_void, event: *const StateEvent) {
+    let ctx = unsafe { context(raw) };
+    let active = ctx.callback_active.fetch_add(1, Ordering::SeqCst) + 1;
+    ctx.callback_max.fetch_max(active, Ordering::SeqCst);
+    // Test invariant: ABI promises a readable state record for the callback duration.
+    let state = unsafe { (*event).state };
+    ctx.states.lock().expect("states lock").push(state);
+    ctx.wake.notify_all();
+
+    if state == STATE_CONNECTING && ctx.cancel_on_connecting.load(Ordering::SeqCst) {
+        let core = ctx.core.load(Ordering::SeqCst) as *mut Core;
+        ctx.reentry_cancel
+            .store(unsafe { verse_core_cancel_v1(core) }, Ordering::SeqCst);
+    }
+
+    if ctx.block_callbacks.load(Ordering::SeqCst) && !ctx.release_callbacks.load(Ordering::SeqCst) {
+        let mut states = ctx.states.lock().expect("states lock");
+        while !ctx.release_callbacks.load(Ordering::SeqCst) {
+            states = ctx.wake.wait(states).expect("callback wait");
+        }
+    }
+
+    if state == STATE_CONNECTED && ctx.reentry_cancel.load(Ordering::SeqCst) == u32::MAX {
+        let core = ctx.core.load(Ordering::SeqCst) as *mut Core;
+        // Test invariant: the stored handle is live until this callback and its destroy complete.
+        ctx.reentry_cancel
+            .store(unsafe { verse_core_cancel_v1(core) }, Ordering::SeqCst);
+        let event = keyboard_event();
+        // Test invariant: event and handle remain valid for the synchronous call.
+        ctx.reentry_send.store(
+            unsafe { verse_core_send_input_v1(core, &event) },
+            Ordering::SeqCst,
+        );
+        // Test invariant: the callback intentionally probes the documented reentry rejection.
+        ctx.reentry_destroy
+            .store(unsafe { verse_core_destroy_v1(core, 1) }, Ordering::SeqCst);
+    }
+    ctx.callback_active.fetch_sub(1, Ordering::SeqCst);
+}
+
+unsafe extern "C" fn sign_admission_reenters(
+    raw: *mut c_void,
+    input: BytesView,
+    output: *mut u8,
+) -> u32 {
+    let ctx = unsafe { context(raw) };
+    ctx.reentry_cancel.store(
+        unsafe { verse_core_cancel_v1(ctx.core.load(Ordering::SeqCst) as *mut Core) },
+        Ordering::SeqCst,
+    );
+    unsafe { sign_admission(raw, input, output) }
+}
+
+unsafe extern "C" fn sign_admission_waits_for_cancel(
+    raw: *mut c_void,
+    input: BytesView,
+    output: *mut u8,
+) -> u32 {
+    let ctx = unsafe { context(raw) };
+    let deadline = Instant::now() + Duration::from_secs(2);
+    while ctx.reentry_cancel.load(Ordering::SeqCst) == u32::MAX {
+        assert!(
+            Instant::now() < deadline,
+            "connecting callback did not cancel"
+        );
+        thread::yield_now();
+    }
+    unsafe { sign_admission(raw, input, output) }
+}
+
+fn config(ctx: &mut Context) -> Config {
+    Config {
+        struct_size: size_of::<Config>() as u32,
+        abi_version: ABI_V1,
+        context: ptr::from_mut(ctx).cast(),
+        sign_admission: Some(sign_admission),
+        sign_tls_ed25519: Some(sign_tls),
+        on_state: Some(on_state),
+        on_error: None,
+        on_stats: None,
+        on_media: None,
+        on_control: None,
+    }
+}
+
+fn request(manifest: &[u8], credential: &[u8]) -> ConnectRequest {
+    ConnectRequest {
+        struct_size: size_of::<ConnectRequest>() as u32,
+        abi_version: ABI_V1,
+        manifest_json: BytesView {
+            data: manifest.as_ptr(),
+            length: manifest.len(),
+        },
+        tunnel_credential_json: BytesView {
+            data: credential.as_ptr(),
+            length: credential.len(),
+        },
+    }
+}
+
+fn keyboard_event() -> InputEvent {
+    let mut values = [0; 12];
+    values[0] = 1;
+    values[2] = 30;
+    InputEvent {
+        struct_size: size_of::<InputEvent>() as u32,
+        abi_version: ABI_V1,
+        kind: INPUT_KEYBOARD,
+        flags: 0,
+        values,
+    }
+}
+
+fn create(ctx: &mut Context) -> *mut Core {
+    let mut core = ptr::null_mut();
+    let config = config(ctx);
+    // Test invariant: config/out pointers remain valid for the synchronous create call.
+    assert_eq!(unsafe { verse_core_create_v1(&config, &mut core) }, OK);
+    assert!(!core.is_null());
+    ctx.core.store(core as usize, Ordering::SeqCst);
+    core
+}
+
+fn connect(core: *mut Core, manifest: &[u8], credential: &[u8]) -> u32 {
+    let request = request(manifest, credential);
+    // Test invariant: request and backing byte slices remain valid for the synchronous call.
+    unsafe { verse_core_connect_v1(core, &request) }
+}
+
+fn wait_for(ctx: &Context, predicate: impl Fn(&[u32]) -> bool) {
+    let deadline = Instant::now() + Duration::from_secs(2);
+    let mut states = ctx.states.lock().expect("states lock");
+    while !predicate(&states) {
+        let remaining = deadline.saturating_duration_since(Instant::now());
+        assert!(
+            !remaining.is_zero(),
+            "callback deadline exceeded: {states:?}"
+        );
+        (states, _) = ctx
+            .wake
+            .wait_timeout(states, remaining)
+            .expect("callback wait");
+    }
+}
+
+fn destroy(core: *mut Core) -> u32 {
+    // Test invariant: caller retains the handle until destroy reports success.
+    unsafe { verse_core_destroy_v1(core, 2_000) }
+}
+
+#[test]
+fn arm64_c_layout_is_exact_and_version_is_fixed() {
+    assert_eq!(versevdi_core::session::INPUT_QUEUE_CAPACITY, 64);
+    assert_eq!(size_of::<BytesView>(), 16);
+    assert_eq!(size_of::<Config>(), 72);
+    assert_eq!(offset_of!(Config, sign_admission), 16);
+    assert_eq!(size_of::<ConnectRequest>(), 40);
+    assert_eq!(offset_of!(ConnectRequest, manifest_json), 8);
+    assert_eq!(size_of::<InputEvent>(), 64);
+    assert_eq!(size_of::<StateEvent>(), 16);
+    assert_eq!(size_of::<ErrorEvent>(), 24);
+    assert_eq!(size_of::<StatsEvent>(), 32);
+    assert_eq!(size_of::<MediaEvent>(), 40);
+    assert_eq!(size_of::<ControlEvent>(), 32);
+    // Test invariant: no pointer arguments are involved.
+    assert_eq!(unsafe { verse_core_abi_version() }, ABI_V1);
+}
+
+#[test]
+fn create_validates_prefix_callbacks_output_and_trailing_bytes() {
+    let mut ctx = Context::default();
+    let mut core = ptr::dangling_mut::<Core>();
+    let mut cfg = config(&mut ctx);
+
+    cfg.struct_size = 7;
+    // Test invariant: config/out are readable/writable for this call.
+    assert_eq!(
+        unsafe { verse_core_create_v1(&cfg, &mut core) },
+        INVALID_ARGUMENT
+    );
+    assert!(core.is_null());
+
+    cfg = config(&mut ctx);
+    cfg.abi_version = 2;
+    assert_eq!(
+        unsafe { verse_core_create_v1(&cfg, &mut core) },
+        UNSUPPORTED_ABI
+    );
+    assert!(core.is_null());
+
+    cfg = config(&mut ctx);
+    cfg.sign_tls_ed25519 = None;
+    assert_eq!(
+        unsafe { verse_core_create_v1(&cfg, &mut core) },
+        INVALID_ARGUMENT
+    );
+    assert!(core.is_null());
+
+    #[repr(C)]
+    struct Extended {
+        base: Config,
+        ignored: [u8; 32],
+    }
+    let extended = Extended {
+        base: config(&mut ctx),
+        ignored: [0xEE; 32],
+    };
+    let mut extended = extended;
+    extended.base.struct_size = size_of::<Extended>() as u32;
+    assert_eq!(
+        unsafe { verse_core_create_v1(&extended.base, &mut core) },
+        OK
+    );
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn connect_copies_inputs_and_calls_purpose_specific_signers_once() {
+    let mut ctx = Context::default();
+    let core = create(&mut ctx);
+    let mut manifest = MANIFEST.to_vec();
+    let mut credential = CREDENTIAL.to_vec();
+    assert_eq!(connect(core, &manifest, &credential), OK);
+    manifest.fill(b'x');
+    credential.fill(b'y');
+
+    assert_eq!(ctx.admission_calls.load(Ordering::SeqCst), 1);
+    assert_eq!(ctx.tls_calls.load(Ordering::SeqCst), 1);
+    assert_eq!(&*ctx.admission_input.lock().expect("admission"), MANIFEST);
+    assert_eq!(&*ctx.tls_input.lock().expect("tls"), CREDENTIAL);
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn tables_and_slices_reject_short_unsupported_null_and_oversized_inputs() {
+    let mut ctx = Context::default();
+    ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+    let core = create(&mut ctx);
+    let mut req = request(MANIFEST, CREDENTIAL);
+
+    req.struct_size = 7;
+    assert_eq!(
+        unsafe { verse_core_connect_v1(core, &req) },
+        INVALID_ARGUMENT
+    );
+    req.struct_size = size_of::<ConnectRequest>() as u32;
+    req.abi_version = 2;
+    assert_eq!(
+        unsafe { verse_core_connect_v1(core, &req) },
+        UNSUPPORTED_ABI
+    );
+    req.abi_version = ABI_V1;
+    req.manifest_json = BytesView {
+        data: ptr::null(),
+        length: 1,
+    };
+    assert_eq!(
+        unsafe { verse_core_connect_v1(core, &req) },
+        INVALID_ARGUMENT
+    );
+    req.manifest_json = BytesView {
+        data: ptr::null(),
+        length: 0,
+    };
+    assert_eq!(
+        unsafe { verse_core_connect_v1(core, &req) },
+        INVALID_ARGUMENT
+    );
+    req.manifest_json.length = 1_048_577;
+    assert_eq!(
+        unsafe { verse_core_connect_v1(core, &req) },
+        INVALID_ARGUMENT
+    );
+
+    let mut input = keyboard_event();
+    input.struct_size = 7;
+    assert_eq!(
+        unsafe { verse_core_send_input_v1(core, &input) },
+        INVALID_ARGUMENT
+    );
+    input.struct_size = size_of::<InputEvent>() as u32;
+    input.abi_version = 2;
+    assert_eq!(
+        unsafe { verse_core_send_input_v1(core, &input) },
+        UNSUPPORTED_ABI
+    );
+
+    #[repr(C)]
+    struct ExtendedRequest {
+        base: ConnectRequest,
+        ignored: [u8; 24],
+    }
+    let mut trailing_request = ExtendedRequest {
+        base: request(MANIFEST, CREDENTIAL),
+        ignored: [0xEE; 24],
+    };
+    trailing_request.base.struct_size = size_of::<ExtendedRequest>() as u32;
+    assert_eq!(
+        unsafe { verse_core_connect_v1(core, &trailing_request.base) },
+        OK
+    );
+
+    #[repr(C)]
+    struct ExtendedInput {
+        base: InputEvent,
+        ignored: [u8; 24],
+    }
+    let mut trailing_input = ExtendedInput {
+        base: keyboard_event(),
+        ignored: [0xEE; 24],
+    };
+    trailing_input.base.struct_size = size_of::<ExtendedInput>() as u32;
+    assert_eq!(
+        unsafe { verse_core_send_input_v1(core, &trailing_input.base) },
+        OK
+    );
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn callback_order_is_serial_and_only_cancel_is_reentrant() {
+    let mut ctx = Context::default();
+    let core = create(&mut ctx);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), OK);
+    wait_for(&ctx, |states| states.contains(&STATE_CANCELLED));
+
+    assert_eq!(
+        ctx.states.lock().expect("states").as_slice(),
+        [STATE_CONNECTING, STATE_CONNECTED, STATE_CANCELLED]
+    );
+    assert_eq!(ctx.reentry_cancel.load(Ordering::SeqCst), OK);
+    assert_eq!(ctx.reentry_send.load(Ordering::SeqCst), REENTRANT);
+    assert_eq!(ctx.reentry_destroy.load(Ordering::SeqCst), REENTRANT);
+    assert_eq!(ctx.callback_max.load(Ordering::SeqCst), 1);
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn signer_callbacks_cannot_reenter_even_cancel() {
+    let mut ctx = Context::default();
+    let mut cfg = config(&mut ctx);
+    cfg.sign_admission = Some(sign_admission_reenters);
+    let mut core = ptr::null_mut();
+    assert_eq!(unsafe { verse_core_create_v1(&cfg, &mut core) }, OK);
+    ctx.core.store(core as usize, Ordering::SeqCst);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), OK);
+    assert_eq!(ctx.reentry_cancel.load(Ordering::SeqCst), REENTRANT);
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn signer_callback_rejects_every_stateful_api_across_handles() {
+    let mut other_ctx = Context::default();
+    other_ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+    let other = create(&mut other_ctx);
+
+    let mut ctx = Context::default();
+    ctx.reentry_target.store(other as usize, Ordering::SeqCst);
+    let mut cfg = config(&mut ctx);
+    cfg.sign_admission = Some(sign_admission_probes_global_reentry);
+    let mut core = ptr::null_mut();
+    assert_eq!(unsafe { verse_core_create_v1(&cfg, &mut core) }, OK);
+    ctx.core.store(core as usize, Ordering::SeqCst);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), OK);
+    assert_eq!(
+        ctx.reentry_results
+            .lock()
+            .expect("signer results")
+            .as_slice(),
+        [ABI_V1, REENTRANT, REENTRANT, REENTRANT, REENTRANT, REENTRANT, REENTRANT]
+    );
+
+    assert_eq!(connect(other, MANIFEST, CREDENTIAL), OK);
+    assert_eq!(destroy(core), OK);
+    assert_eq!(destroy(other), OK);
+}
+
+#[test]
+fn event_callback_allows_only_originating_handle_cancel() {
+    let mut other_ctx = Context::default();
+    other_ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+    let other = create(&mut other_ctx);
+
+    let mut ctx = Context::default();
+    ctx.reentry_target.store(other as usize, Ordering::SeqCst);
+    let mut cfg = config(&mut ctx);
+    cfg.on_state = Some(on_state_probes_global_reentry);
+    let mut core = ptr::null_mut();
+    assert_eq!(unsafe { verse_core_create_v1(&cfg, &mut core) }, OK);
+    ctx.core.store(core as usize, Ordering::SeqCst);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), OK);
+    wait_for(&ctx, |states| states.contains(&STATE_CANCELLED));
+    assert_eq!(
+        ctx.reentry_results
+            .lock()
+            .expect("event results")
+            .as_slice(),
+        [ABI_V1, REENTRANT, REENTRANT, REENTRANT, REENTRANT, REENTRANT, REENTRANT, OK]
+    );
+
+    assert_eq!(connect(other, MANIFEST, CREDENTIAL), OK);
+    assert_eq!(destroy(core), OK);
+    assert_eq!(destroy(other), OK);
+}
+
+#[test]
+fn signer_statuses_are_purpose_specific_and_unknown_values_are_internal() {
+    for (admission, expected) in [
+        (OK, OK),
+        (AUTHORITY_REJECTED, AUTHORITY_REJECTED),
+        (CANCELLED, CANCELLED),
+        (INTERNAL, INTERNAL),
+        (TLS, INTERNAL),
+        (u32::MAX, INTERNAL),
+    ] {
+        let mut ctx = Context::default();
+        ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+        ctx.admission_status.store(admission, Ordering::SeqCst);
+        let core = create(&mut ctx);
+        assert_eq!(connect(core, MANIFEST, CREDENTIAL), expected);
+        assert_eq!(destroy(core), OK);
+    }
+
+    for (tls, expected) in [
+        (OK, OK),
+        (TLS, TLS),
+        (CANCELLED, CANCELLED),
+        (INTERNAL, INTERNAL),
+        (AUTHORITY_REJECTED, INTERNAL),
+        (u32::MAX, INTERNAL),
+    ] {
+        let mut ctx = Context::default();
+        ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+        ctx.tls_status.store(tls, Ordering::SeqCst);
+        let core = create(&mut ctx);
+        assert_eq!(connect(core, MANIFEST, CREDENTIAL), expected);
+        assert_eq!(destroy(core), OK);
+    }
+}
+
+#[test]
+fn cancel_during_connect_preserves_state_order_and_stops_before_tls_signing() {
+    let mut ctx = Context::default();
+    ctx.cancel_on_connecting.store(true, Ordering::SeqCst);
+    let mut cfg = config(&mut ctx);
+    cfg.sign_admission = Some(sign_admission_waits_for_cancel);
+    let mut core = ptr::null_mut();
+    assert_eq!(unsafe { verse_core_create_v1(&cfg, &mut core) }, OK);
+    ctx.core.store(core as usize, Ordering::SeqCst);
+
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), CANCELLED);
+    wait_for(&ctx, |states| states.contains(&STATE_CANCELLED));
+    assert_eq!(
+        ctx.states.lock().expect("states").as_slice(),
+        [STATE_CONNECTING, STATE_CANCELLED]
+    );
+    assert_eq!(ctx.tls_calls.load(Ordering::SeqCst), 0);
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn send_input_is_nonblocking_bounded_and_cancel_is_idempotent() {
+    let mut ctx = Context::default();
+    ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+    let core = create(&mut ctx);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), OK);
+    let event = keyboard_event();
+    for _ in 0..64 {
+        assert_eq!(unsafe { verse_core_send_input_v1(core, &event) }, OK);
+    }
+    assert_eq!(
+        unsafe { verse_core_send_input_v1(core, &event) },
+        QUEUE_FULL
+    );
+    assert_eq!(unsafe { verse_core_request_idr_v1(core) }, OK);
+    assert_eq!(unsafe { verse_core_cancel_v1(core) }, OK);
+    assert_eq!(unsafe { verse_core_cancel_v1(core) }, OK);
+    assert_eq!(unsafe { verse_core_send_input_v1(core, &event) }, CANCELLED);
+    assert_eq!(destroy(core), OK);
+}
+
+#[test]
+fn destroy_timeout_keeps_ownership_suppresses_late_callbacks_and_allows_retry() {
+    let mut ctx = Context::default();
+    ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+    ctx.block_callbacks.store(true, Ordering::SeqCst);
+    let core = create(&mut ctx);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), OK);
+    wait_for(&ctx, |states| !states.is_empty());
+
+    assert_eq!(unsafe { verse_core_destroy_v1(core, 1) }, BUSY);
+    let count_at_timeout = ctx.states.lock().expect("states").len();
+    ctx.release_callbacks.store(true, Ordering::SeqCst);
+    ctx.wake.notify_all();
+    assert_eq!(destroy(core), OK);
+    assert_eq!(ctx.states.lock().expect("states").len(), count_at_timeout);
+}
+
+#[test]
+fn preconnect_and_postcancel_state_checks_are_stable() {
+    let mut ctx = Context::default();
+    ctx.reentry_cancel.store(OK, Ordering::SeqCst);
+    let core = create(&mut ctx);
+    let event = keyboard_event();
+    assert_eq!(
+        unsafe { verse_core_send_input_v1(core, &event) },
+        INVALID_STATE
+    );
+    assert_eq!(unsafe { verse_core_request_idr_v1(core) }, INVALID_STATE);
+    assert_eq!(unsafe { verse_core_cancel_v1(core) }, OK);
+    assert_eq!(connect(core, MANIFEST, CREDENTIAL), CANCELLED);
+    assert_eq!(destroy(core), OK);
+}

core/tests/ffi/abi_smoke.c

@@ -0,0 +1,96 @@
+#include "versevdi_core.h"
+
+#include <assert.h>
+#include <stdatomic.h>
+#include <stdlib.h>
+#include <string.h>
+
+static const char MANIFEST[] =
+    "{\"version\":\"1\",\"purpose\":\"launch\",\"session_id\":\"session\","
+    "\"reconnect_sequence\":0,\"gateway\":{\"id\":\"gateway\",\"addresses\":["
+    "\"gateway.test:443\"],\"public_identity\":\"gateway.test\"},\"tunnel\":{"
+    "\"versions\":[\"verse-gateway-v1/1\"],\"features\":[\"control.v1\"]},"
+    "\"profile\":{\"id\":\"standard\",\"bounds\":{\"minimum_kbps\":1000,"
+    "\"target_kbps\":5000,\"maximum_kbps\":10000},\"display_mode\":null},"
+    "\"grant\":{\"opaque_value\":\"ggggggggggggggggggggggggggggggggggggggggggg\","
+    "\"expires_at\":\"2099-01-01T00:00:00Z\",\"audience\":\"audience\"},"
+    "\"correlation_id\":\"correlation\"}";
+static const char CREDENTIAL[] =
+    "{\"client_device_id\":\"device\",\"device_key_id\":\"key\","
+    "\"certificate_chain_pem\":\"-----BEGIN CERTIFICATE-----\\nAQID\\n-----END CERTIFICATE-----\","
+    "\"trust_bundle_pem\":\"-----BEGIN CERTIFICATE-----\\nAQID\\n-----END CERTIFICATE-----\","
+    "\"expires_at\":\"2099-01-01T00:00:00Z\"}";
+
+typedef struct smoke_context {
+    atomic_uint admission_calls;
+    atomic_uint tls_calls;
+    atomic_uint state_calls;
+} smoke_context_t;
+
+static verse_status_t sign_admission(
+    void *raw,
+    verse_bytes_view_t input,
+    uint8_t signature[64]) {
+    smoke_context_t *context = raw;
+    assert(input.length == sizeof(MANIFEST) - 1U);
+    memset(signature, 0xA5, 64U);
+    atomic_fetch_add(&context->admission_calls, 1U);
+    return VERSE_STATUS_OK;
+}
+
+static verse_status_t sign_tls(
+    void *raw,
+    verse_bytes_view_t input,
+    uint8_t signature[64]) {
+    smoke_context_t *context = raw;
+    assert(input.length == sizeof(CREDENTIAL) - 1U);
+    memset(signature, 0x5A, 64U);
+    atomic_fetch_add(&context->tls_calls, 1U);
+    return VERSE_STATUS_OK;
+}
+
+static void on_state(void *raw, const verse_state_event_v1_t *event) {
+    smoke_context_t *context = raw;
+    assert(event->struct_size == sizeof(*event));
+    assert(event->abi_version == VERSE_CORE_ABI_VERSION_1);
+    atomic_fetch_add(&context->state_calls, 1U);
+}
+
+int main(void) {
+    smoke_context_t context = {0};
+    verse_core_config_v1_t config = {
+        .struct_size = sizeof(config),
+        .abi_version = VERSE_CORE_ABI_VERSION_1,
+        .context = &context,
+        .sign_admission = sign_admission,
+        .sign_tls_ed25519 = sign_tls,
+        .on_state = on_state,
+    };
+    verse_core_t *core = NULL;
+    assert(verse_core_abi_version() == VERSE_CORE_ABI_VERSION_1);
+    assert(verse_core_create_v1(&config, &core) == VERSE_STATUS_OK);
+    assert(core != NULL);
+
+    const verse_connect_request_v1_t request = {
+        .struct_size = sizeof(request),
+        .abi_version = VERSE_CORE_ABI_VERSION_1,
+        .manifest_json = {(const uint8_t *)MANIFEST, sizeof(MANIFEST) - 1U},
+        .tunnel_credential_json = {(const uint8_t *)CREDENTIAL, sizeof(CREDENTIAL) - 1U},
+    };
+    assert(verse_core_connect_v1(core, &request) == VERSE_STATUS_OK);
+
+    verse_input_event_v1_t input = {
+        .struct_size = sizeof(input),
+        .abi_version = VERSE_CORE_ABI_VERSION_1,
+        .kind = VERSE_INPUT_KEYBOARD,
+        .values = {1, 0, 30},
+    };
+    assert(verse_core_send_input_v1(core, &input) == VERSE_STATUS_OK);
+    assert(verse_core_request_idr_v1(core) == VERSE_STATUS_OK);
+    assert(verse_core_cancel_v1(core) == VERSE_STATUS_OK);
+    assert(verse_core_cancel_v1(core) == VERSE_STATUS_OK);
+    assert(verse_core_destroy_v1(core, 2000U) == VERSE_STATUS_OK);
+    assert(atomic_load(&context.admission_calls) == 1U);
+    assert(atomic_load(&context.tls_calls) == 1U);
+    return EXIT_SUCCESS;
+}