sechmachine/VerseVDI-Protocol
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(protocol): harden gateway contract validation
Verify Protocol / verify (push) Canceled after 0s
Details
Verify Protocol / module (push) Successful in 2m12s
Details

Browse Source
This commit is contained in:
sechmachine
2026-07-29 21:16:53 +07:00
parent 0ea21cd3f2
commit ebfe07376d
18 changed files with 337 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/phase3c-apollo-input-feedback/specs/gateway-input-feedback/spec.md
+8 -3
View File
@@ -33,7 +33,7 @@ an implementation-specific release-all provider command.
packets reliably before starting provider disconnect.
### Requirement: Bounded provider feedback control envelope
The bidirectional reliable control flow SHALL define an ASCII `VGF1` envelope
The registered bidirectional reliable `control.ack.v1` flow SHALL define an ASCII `VGF1` envelope
with a direction byte, type byte, big-endian payload length, and exact payload
bytes. Only host termination, rumble, and HDR feedback SHALL be valid from the
gateway to the client; only IDR and FEC/loss feedback SHALL be valid from the
@@ -53,7 +53,8 @@ certificate, credential, or opaque provider packet.
### Requirement: Policy-bound text clipboard envelope
The reliable `clipboard.text.v1` flow SHALL carry only a typed UTF-8 text
envelope with exact direction and a bounded loop token. The Server SHALL mint
envelope with exact direction and a 16--128 character canonical unpadded ASCII
base64url loop token. The Server SHALL mint
the enabled directions, maximum text bytes, and maximum updates per minute in
authenticated provider work. The gateway SHALL reject disabled direction,
unknown fields, files, file URLs, client folders, binary data, malformed UTF-8,
@@ -62,11 +63,15 @@ SHALL not put clipboard content, provider routes, or credentials in telemetry,
audit, state, or errors.
#### Scenario: Clipboard audit metadata
- **WHEN** the gateway accepts, suppresses, or rejects a clipboard update
- **WHEN** the gateway successfully delivers, suppresses, or rejects a clipboard update
- **THEN** it sends an authenticated Server audit record with only direction,
bounded byte count, outcome, and a fixed reason; it never includes text or
the loop token.
#### Scenario: Clipboard delivery failure
- **WHEN** provider-to-client control delivery fails
- **THEN** the gateway does not report the update as forwarded.
#### Scenario: Reflected clipboard value
- **WHEN** a client-originated text value returns from the provider with the
matching retained token/value pair