feat(protocol): add gateway transport authority contracts

2026-07-29 05:59:46 +07:00
parent b2c24b3fa3
commit b5558133e3
21 changed files with 1898 additions and 15 deletions
@@ -0,0 +1,24 @@
+## Decisions
+
+- Use the existing generated JSON binding pipeline and add only object definitions that
+  consumers need now.
+- Keep registration/authority messages distinct from `ConnectionManifest`; the latter is
+  client-facing and contains no provider route, certificate, identity, or credential.
+- Encode capability domains as bounded registered strings (`transport`, `framing`, `media`,
+  `audio`, `source_rate_control`, `client_decode`) so unknown or empty required domains
+  cannot silently fall back.
+- Use a fixed 21-byte big-endian datagram header with application flow IDs and a payload
+  limit below the path MTU; control channels 1-3 remain compatible with Phase 3A.
+
+## Bounds and failure behavior
+
+All arrays, strings, payloads, fragments, and timestamps are bounded by the JSON schema or
+frame registry. Generated decoders reject unknown fields, trailing values, invalid versions,
+and missing required fields. Provider address, RTSP, credential, and private-key names are
+not added to client-facing definitions.
+
+## Compatibility
+
+The current wire version remains `1`; current, N-1, and N-2 declarations remain unchanged.
+New identifiers are additive. Consumers must reject an unknown major or no-overlap selection
+before provider launch.
@@ -0,0 +1,32 @@
+## Why
+
+Phase 3A defines gateway-only manifests and control datagrams but has no versioned
+contracts for the separately deployed gateway's registration, admission authority,
+capability intersection, lifecycle, or encoded relay framing. Phase 3C-G needs those
+contracts frozen before Data Plane or Connection Server consumers change.
+
+## What Changes
+
+- Add bounded JSON bindings for gateway registration, heartbeat/drain, tunnel admission,
+  session-scoped authority, capability selection, channel framing, provider state, and
+  stable errors.
+- Extend the tunnel protobuf descriptor with the same versioned control messages.
+- Register only gateway-owned media/input flow identifiers; keep provider endpoints and
+  credentials out of client-facing manifests.
+
+## Ownership and provenance
+
+Protocol owns the wire contract. The contract is original VerseVDI work derived from the
+Phase 3A schemas and public Apollo/Moonlight behavior recorded in the Planning Hub. No
+GPL source is copied into this repository.
+
+## Non-goals
+
+- Provider implementation, database policy, QUIC implementation, media decoding, or client
+  rendering.
+- Direct client-to-Apollo routing, provider endpoint exposure, or a speculative plugin ABI.
+
+## Stop conditions
+
+Unknown versions, malformed bounds, no capability overlap, downgrade without explicit
+acknowledgement, forbidden provider fields, and oversized frames fail closed.
@@ -0,0 +1,37 @@
+## ADDED Requirements
+
+### Requirement: Versioned gateway authority contracts
+Gateway registration, heartbeat, drain, admission, capability selection, channel framing,
+provider state, and stable errors SHALL use bounded versioned objects with strict decoding.
+
+#### Scenario: Unknown or malformed gateway message
+- **WHEN** a consumer receives an unknown version, missing required field, unknown field,
+  invalid bound, or trailing JSON value
+- **THEN** it rejects the message before allocating provider or media state with a stable
+  validation error.
+
+### Requirement: Gateway-only client manifest
+Client-facing manifests SHALL expose only the selected gateway, tunnel/profile identifiers,
+policy bounds, opaque grant, audience, expiry, session, and correlation data.
+
+#### Scenario: Provider route injection
+- **WHEN** a manifest or client-facing authority contains a provider address, RTSP URL,
+  certificate, pairing identity, credential, or private key field
+- **THEN** schema validation rejects it and no generated client binding accepts it.
+
+### Requirement: Explicit capability intersection
+Transport, framing, media, audio, source-rate-control, and client-decode capabilities SHALL
+remain separate and no-overlap or unknown-required-profile results SHALL fail closed.
+
+#### Scenario: No capability overlap
+- **WHEN** policy, gateway, provider, and client capabilities have no allowed intersection
+- **THEN** negotiation returns a stable no-overlap error before provider launch or media flow.
+
+### Requirement: Bounded encoded datagrams
+Encoded media and approved sequenced input SHALL use registered application flow identifiers,
+validated fixed headers, bounded fragments, and payload bytes that are not codec-transformed.
+
+#### Scenario: Malformed or oversized datagram
+- **WHEN** a datagram is truncated, has an unknown flow, invalid fragment, length mismatch,
+  or exceeds its registered payload limit
+- **THEN** the datagram is rejected without allocation proportional to the claimed payload.
@@ -0,0 +1,5 @@
+- [x] Add versioned gateway and authority definitions to the schema and tunnel descriptor.
+- [x] Add registered media/audio/sequenced-input flow identifiers and positive/negative fixtures.
+- [x] Regenerate Go/Rust/Swift bindings and descriptor outputs.
+- [x] Run strict validation, cross-language conformance, and deterministic fixture hashing.
+- [ ] Freeze the local Protocol candidate commit and record its hash for consumers.