docs(openspec): archive terminal receipt repair
This commit is contained in:
sechmachine
@@ -0,0 +1,2 @@
|
||||
schema: spec-driven
|
||||
created: 2026-07-30
|
||||
@@ -0,0 +1,27 @@
|
||||
## Context
|
||||
|
||||
RC8's canonical requirement names a terminal receipt, but its frame grammar, fixed fixture, and all Protocol validators reject the exact receipt accepted by Data Plane. The existing VGF1 envelope and generated conformance machinery already cover the required boundary.
|
||||
|
||||
## Goals / Non-Goals
|
||||
|
||||
**Goals:**
|
||||
|
||||
- Make one fixed empty client-direction type `0x03` receipt valid in every Protocol validator.
|
||||
- Preserve all existing VGF1 direction, type, size, and payload validation.
|
||||
- Make independent clients able to construct the receipt from Protocol-owned evidence.
|
||||
|
||||
**Non-Goals:**
|
||||
|
||||
- No new envelope, feedback framework, transport, or acknowledgement protocol.
|
||||
- No change to gateway-to-client termination, rumble, HDR, client IDR, or FEC payloads.
|
||||
|
||||
## Decisions
|
||||
|
||||
- Extend the existing VGF1 grammar and fixed TSV corpus; generated and native validators remain consumers of that single contract.
|
||||
- Reserve type `0x03` only for client direction with a zero-length payload. Direction and exact-length checks remain prior trust-boundary requirements.
|
||||
- Publish the verified change as a new immutable version; RC8 remains unchanged.
|
||||
|
||||
## Risks / Trade-offs
|
||||
|
||||
- [A validator diverges from the fixed corpus] → Require normalized cross-language conformance in `make verify`.
|
||||
- [Receipt handling is accepted outside terminal state] → Keep state authorization in Data Plane; Protocol validates only the wire shape.
|
||||
@@ -0,0 +1,23 @@
|
||||
## Why
|
||||
|
||||
The canonical terminal-receipt requirement contradicts the fixed VGF1 grammar and every generated validator, so RC8 cannot provide an executable cross-language contract for gateway-owned terminal closure.
|
||||
|
||||
## What Changes
|
||||
|
||||
- Define client-direction VGF1 type `0x03` as an empty terminal receipt in the existing frame grammar.
|
||||
- Add fixed conformance vectors for valid receipt handling and invalid direction, body, truncation, length, and unknown-type cases.
|
||||
- Generate consistent Go, Rust, Swift, and Python validation behavior from the Protocol source.
|
||||
|
||||
## Capabilities
|
||||
|
||||
### New Capabilities
|
||||
|
||||
None.
|
||||
|
||||
### Modified Capabilities
|
||||
|
||||
- `gateway-input-feedback`: Make the already-required terminal receipt executable and cross-language conformant without weakening other VGF1 validation.
|
||||
|
||||
## Impact
|
||||
|
||||
Protocol frame documentation, conformance fixtures, generators, generated bindings, native validator tools, and immutable Protocol consumers. RC8 remains unchanged and a new immutable Protocol version is required.
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
## MODIFIED Requirements
|
||||
|
||||
### Requirement: Bounded provider feedback control envelope
|
||||
The registered bidirectional reliable `control.ack.v1` flow SHALL define an ASCII `VGF1` envelope
|
||||
with a direction byte, type byte, big-endian payload length, and exact payload
|
||||
bytes. Only host termination, rumble, and HDR feedback SHALL be valid from the
|
||||
gateway to the client. Only IDR, FEC/loss feedback, and client-direction type
|
||||
`0x03` with an empty payload as terminal receipt SHALL be valid from the client
|
||||
to the gateway. The fixed conformance corpus and every generated or native
|
||||
Protocol validator SHALL accept that exact receipt and reject unknown types,
|
||||
wrong direction, nonempty receipt bodies, truncation, and length mismatch. The
|
||||
terminal receipt SHALL be valid only while the same session awaits receipt of
|
||||
its one terminal event and MUST NOT be forwarded to the provider. The envelope
|
||||
SHALL contain no provider address, certificate, credential, or opaque provider
|
||||
packet.
|
||||
|
||||
#### Scenario: Host termination forwarding
|
||||
- **WHEN** the Apollo adapter receives an authenticated host termination packet
|
||||
- **THEN** the gateway forwards a bounded `VGF1` termination envelope over reliable Verse control and reports the provider state separately
|
||||
|
||||
#### Scenario: Terminal event receipt
|
||||
- **WHEN** a client receives the reliable typed terminal event
|
||||
- **THEN** it sends the fixed empty client-direction type `0x03` receipt and the gateway owns bounded tunnel closure without forwarding the receipt to the provider
|
||||
|
||||
#### Scenario: Unauthorized or malformed feedback
|
||||
- **WHEN** feedback is disabled by policy, has an invalid direction/type/length, contains a forbidden provider field, or sends a terminal receipt outside the awaiting-terminal state
|
||||
- **THEN** the gateway rejects it without forwarding or provider mutation
|
||||
@@ -0,0 +1,15 @@
|
||||
## 1. Red Conformance
|
||||
|
||||
- [x] 1.1 Add fixed valid and invalid terminal-receipt vectors and prove Python, Go, Rust, and Swift reject the required valid vector
|
||||
- [x] 1.2 Add a Data Plane independent-client regression that consumes the Protocol fixed vector rather than the production encoder
|
||||
|
||||
## 2. Contract Repair
|
||||
|
||||
- [x] 2.1 Update the VGF1 grammar and Protocol validator sources for the exact empty client-direction type `0x03` receipt
|
||||
- [x] 2.2 Regenerate bindings normally and prove deterministic generation has no drift
|
||||
- [x] 2.3 Run complete Protocol verification and strict OpenSpec validation
|
||||
|
||||
## 3. Immutable Release
|
||||
|
||||
- [x] 3.1 Verify the next version is unused locally and remotely, publish one immutable annotated tag, and verify its object and peeled commit
|
||||
- [x] 3.2 Resolve the version from separate empty caches and pin exact fetched checksums in Data Plane and Connection Server
|
||||
Reference in New Issue
Block a user