id(comms): P0-A core — shared abuse evaluator, token buckets, structured refusal, counter registry (phase of #2244)

Phase of #2244 (P0-A of #2032, per the #2033 design in PR #3834). Triage record: task 5839 on #2244 (CONFIRMED at origin/main 064ce9e).

Build the shared core the frame seam and adapters will consume — no behavior change to existing paths in this phase:

New shared module in pkgs/id (e.g. src/abuse.rs): typed subjects (endpoint EndpointId, connection), one AbusePolicy evaluator owning token buckets for frames and bytes.
Defaults from id: investigate: comms abuse controls — blocks, rate limits, and per-counterparty budgets #2032/id: design: abuse-control primitives v1 for ID comms #2033: authorized endpoint 60 frames/s burst 180 and 512 KiB/s burst 4 MiB; pre-authorization 10 frames/s burst 30; max 4 concurrent connections per peer; the endpoint bucket is shared across that peer's connections (more streams must not multiply allowance).
One structured refusal type: reason (rate_limited | budget_exhausted | blocked_by_operator | unauthorized) + retry_after_ms bounded 1 s floor / 60 s cap for temporary refusals, absent for permanent blocks. (Several local Refusal enums exist — event_store/ingest.rs:109, directory.rs:94 — none is this shared contract; do not add another local one.)
Counter registry: per-(local node, remote endpoint key) frame/byte counters with a snapshot API for the observability surface in the integration phase.

Acceptance:

Evaluator + structured refusal + counter registry land with unit tests: bucket drain/refill, burst, endpoint allowance shared across connections, refusal retry bounds, counter increments.
No existing path changes behavior in this phase.

Parent: #2244 · Design: #2033 (PR #3834) · Program: #2056

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane A
Session / ID: queue task 5845 (small_fix; lane A shift, 2026-11-01)
Found via: queue claim (repo-health-code-pilot)
Task: Implement id(comms): P0-A core — shared abuse evaluator, token buckets, structured refusal, counter registry (phase of #2244) #3881 P0-A core: shared abuse evaluator (token buckets for frames + bytes, endpoint bucket shared across connections), one structured refusal type, and the counter registry in a new pkgs/id/src/abuse.rs — no wiring, no behavior change to existing paths.
Expectation: effort m; done = branch + PR with the module and unit tests (drain/refill, burst, shared endpoint allowance, retry bounds, counter increments).
Links: task 5845 in queue repo-health-code-pilot; parent id(comms): per-peer frame/byte accounting + structured rate-limit refusal (P0 of #2032) #2244; design id: design: abuse-control primitives v1 for ID comms #2033 / PR design(id): #2033 abuse-control primitives v1 #3834

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane A
Session / ID: queue task 5845 (small_fix; lane A shift, 2026-11-01)
Found via: queue claim (repo-health-code-pilot)
Task: id(comms): P0-A core — shared abuse evaluator, token buckets, structured refusal, counter registry (phase of #2244) #3881 P0-A core implemented — PR feat(id): shared abuse evaluator core — buckets, structured refusal, counter registry (#3881) #3891 opened; parked for CI + Codex review instead of waiting on them.
Expectation: resume = confirm CI green on PR feat(id): shared abuse evaluator core — buckets, structured refusal, counter registry (#3881) #3891 (cargo test/clippy for pkgs/id), disposition Codex findings, merge (PR body closes id(comms): P0-A core — shared abuse evaluator, token buckets, structured refusal, counter registry (phase of #2244) #3881), then complete task 5845.
Links: PR feat(id): shared abuse evaluator core — buckets, structured refusal, counter registry (#3881) #3891 · branch queue/5845-3881-abuse-core (4d20bdd) · laptop worktree ~/git/fleet/5845-3881-abuse

State at park

New pkgs/id/src/abuse.rs + lib.rs registration: AbusePolicy (id: investigate: comms abuse controls — blocks, rate limits, and per-counterparty budgets #2032/id: design: abuse-control primitives v1 for ID comms #2033 defaults), AbuseEvaluator (per-endpoint frame/byte token buckets shared across connections, per-peer connection cap 4), Refusal (bounded retry 1s–60s, permanent blocks carry none), CounterRegistry with sorted snapshot API. No existing path touched.
Verification so far: the module is std-only and was tested standalone on the laptop with rustc --edition 2024 --test — 8/8 unit tests pass. The full cargo build for a fresh worktree's cold target dir could not finish inside the shift budget (laptop load ~27, other lanes compiling), so crate-level cargo test/clippy verification is CI's job on PR feat(id): shared abuse evaluator core — buckets, structured refusal, counter registry (#3881) #3891 — that is the resume condition, not a known failure.
One design note: id: investigate: comms abuse controls — blocks, rate limits, and per-counterparty budgets #2032/id: design: abuse-control primitives v1 for ID comms #2033 give no separate pre-authorization byte limits; the pre-auth byte bucket uses the authorized byte numbers until a later phase sets one (documented in the module).

agent-note:v1
{"v":1,"kind":"picked_up","task":5845,"lane":"f","note":"Task 5845 picked up: implementing the P0-A core only — new shared abuse module in pkgs/id (typed subjects, one AbusePolicy evaluator owning frame+byte token buckets, structured refusal type, per-peer counter registry with snapshot API) plus unit tests. No wiring into frames/HTTP/world chat (Packet B), no existing limiter behavior changes. Branch queue/5845-3881-abuse-core in laptop worktree ~/git/fleet/5845; verification via CI on the PR per fleet policy."}

agent-note:v1
{"v":1,"kind":"progress","task":5845,"lane":"f","note":"Correction to the pickup note: the P0-A implementation already exists — a prior lane pushed branch queue/5845-3881-abuse-core and opened PR #3891. No competing work will be created. This lane owns the remaining gate: PR #3891 has ONE unresolved Codex finding (P2, unbounded retained endpoint/counter state, abuse.rs). Fixing it in the existing worktree, then re-requesting Codex review; merge follows a clean round."}

fix(id): bound abuse evaluator retained state with pruning (#3881)

Merge pull request #3891 from developing-today/queue/5845-3881-abuse-…

agent-note:v1
{"v":1,"kind":"done","task":5845,"lane":"f","note":"Task 5845 complete: PR #3891 MERGED (merge commit bc76a7e). The P0-A abuse core landed as built by the prior lane; this lane dispositioned the one outstanding Codex P2 finding (unbounded retained state) in commit 162b374 — prune_idle_endpoints evicts connection-less fully-refilled endpoint states (admission-equivalent to fresh), CounterRegistry gained last-seen stamps + prune() retention, with two new tests. Codex re-review of 162b374: no unresolved findings. Verification: cargo test -p id --lib abuse:: on the laptop — 10 passed, 0 failed. Side finding filed as #3923: workspace cargo test --lib is broken on main by id-core tests using vt100 without an id-core dependency (pre-existing, #3447 split leftover); the -p id run above is the current workaround."}

Navigation Menu

Repository navigation

id(comms): P0-A core — shared abuse evaluator, token buckets, structured refusal, counter registry (phase of #2244) #3881

State at park

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(comms): P0-A core — shared abuse evaluator, token buckets, structured refusal, counter registry (phase of #2244) #3881

Description

Activity

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

State at park

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions