feat(protocol): carry stream policy and gateway telemetry

2026-07-30 01:45:48 +07:00
parent 59741761ce
commit d26f8b60f8
17 changed files with 991 additions and 42 deletions
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-29
@@ -0,0 +1,36 @@
+## Context
+
+The Data Plane already collects process-wide atomic counters and gauges. Only active connections and egress Kbps cross the authenticated heartbeat boundary.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Carry the existing low-cardinality observations with explicit units.
+- Bound every numeric field and enumerate provider state.
+- Keep registration capacity distinct from measured traffic.
+
+**Non-Goals:**
+
+- Add session, route, endpoint, credential, label, or payload fields.
+- Define a new telemetry transport.
+- Publish a Protocol version.
+
+## Decisions
+
+- Nest the values in required `GatewayTelemetry` so heartbeat telemetry is one strict atomic contract.
+- Use cumulative counters and microsecond delay totals plus processing samples; consumers can derive rates/averages without losing raw observations.
+- Keep loss as parts per million and provider state as a bounded enum.
+
+## Risks / Trade-offs
+
+- [Cumulative counters approach signed integer limits] → Bound at signed 64-bit and saturate consumer conversions.
+- [New required object breaks RC6] → Test locally and publish only under separate immutable-version authorization.
+
+## Migration Plan
+
+Regenerate all bindings locally, update both consumers through the temporary workspace, and stop at the immutable publication boundary.
+
+## Open Questions
+
+None.
@@ -0,0 +1,23 @@
+## Why
+
+Gateway heartbeat currently carries active sessions and one egress rate but cannot transport the required observed process and provider-path telemetry.
+
+## What Changes
+
+- Add one required bounded low-cardinality telemetry object to authenticated gateway heartbeat.
+- Cover counters, delay totals/samples, control RTT/loss/jitter, pending reliability, reconnects, and provider state.
+- Keep configured capacity exclusively in registration and measured egress in heartbeat.
+
+## Capabilities
+
+### New Capabilities
+
+- `gateway-heartbeat-telemetry`: Authenticated heartbeats carry bounded observed gateway telemetry without routes, sessions, credentials, or payload data.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The control-v1 schema, generated Go/Rust/Swift bindings, conformance checks, and both unpublished consumers require coordinated local updates. RC6 remains unchanged.
@@ -0,0 +1,15 @@
+## ADDED Requirements
+
+### Requirement: Heartbeat carries observed gateway telemetry
+Every authenticated `GatewayHeartbeat` SHALL carry the bounded process-level counters, delay totals and samples, control RTT/loss/jitter, pending reliable work, reconnect count, and provider state defined by `GatewayTelemetry`.
+
+#### Scenario: Valid telemetry heartbeat
+- **WHEN** a gateway reports its current observed snapshot
+- **THEN** Go, Rust, and Swift bindings accept the same bounded low-cardinality values and units
+
+### Requirement: Heartbeat telemetry excludes sensitive dimensions
+Heartbeat telemetry MUST reject unknown fields and MUST NOT include session, route, endpoint, credential, label, or payload values.
+
+#### Scenario: Secret or high-cardinality field is attempted
+- **WHEN** a heartbeat contains an unregistered session, route, endpoint, credential, or payload field
+- **THEN** strict contract validation rejects it before authenticated transport
@@ -0,0 +1,11 @@
+## 1. Contract
+
+- [x] 1.1 Add bounded GatewayTelemetry to every heartbeat
+- [x] 1.2 Add Go, Rust, and Swift strict conformance checks
+- [x] 1.3 Regenerate bindings and prove deterministic output
+
+## 2. Consumer Boundary
+
+- [x] 2.1 Verify local Data Plane and Server consumers through a temporary workspace
+- [ ] 2.2 Publish one new never-reused immutable Protocol version under separate authorization
+- [ ] 2.3 Resolve from empty caches and pin exact checksums in both consumers