Repository navigation
Phase 5 (audit) of #4502 — closing gossip-ingest inventory + contract statement for pkgs/id #4503
Description
Phase 5 (closing audit) of design #4502 — one guarded door: every gossip claim enters through its table (pkgs/id). Design doc: files/designs/code-id-gossip-admission.md in the keep-the-four-repos-healthy goal workspace.
Gated on Phases 1–4 of #4502 landing (Phase 1 = #4404 + #3991, Phase 2 = #4004, Phase 3 = #4363, Phase 4 = #4377). Do not start the audit before they land.
Scope
- Contract statement landed: the contract from Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502 (a gossip claim is stored only in the form its table's guards produce — canonical, scoped, and bounded — and every ingest path enters through those guards) is written into the
chat_presence.rsmodule doc as an admission section, with a cross-reference atPeerDiscovery::update's doc incrates/id-core/src/discovery.rs, where the next ingest path will look. - Ingest inventory: every frame-decode / claim-ingest site in
pkgs/id(production code; test code excluded) is dispositioned against the contract — through its table / fixed in this audit if a single-site slip / filed as a named follow-up. The inventory is recorded on Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502 or in the module doc beside the contract statement. The grep surface includes at least:decode_frame(presence),SignedPeerAnnouncement::decode_frame,PresenceTable::update/update_scoped/update_atcallers, andPeerDiscovery::updatecallers. - Required dispositions (each recorded on Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502 with its reason):
PresenceTable::update(the explicitly unscoped admission entry): per Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502 decision 5, it remains public only if a production caller that legitimately needs the transport view is named; otherwise it is removed or made crate-private in this audit.- The RPC paths merged in
cmd_peers(crawl_peers,query_remote_peers,query_local_peers): RPC answers are a different trust surface from gossip — disposition each as deliberately-unguarded or guarded, naming the reason, including whether the merge order incmd_peersis safe once Phase 4 (id(peers): --gossip collection bypasses the announcement freshness/ordering guards — replayed, ancient and far-future announcements are reported as discovered peers #4377) has landed. - Any
decode_framecaller outsideserve/peersthe inventory grep finds: through-the-table or a named exception with its reason. - The gossip frame-size bound above the table: id(chat-presence): heartbeat typing list is never deduplicated or bounded — one channel yields a 3.3 MB signed frame, defeating MAX_HEARTBEAT_CHANNELS #3991 demonstrated a ~3.3 MB signed presence frame; after Phase 1 bounds the stored form, state which layer owns the frame bound (iroh-gossip's message limits vs a
decode_frame-level refusal) and file a follow-up if neither layer bounds it.
- Closing evidence on Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502: all five origins (id(chat-presence): update_at caps the raw channel list without dedup — duplicate entries displace distinct channels a heartbeat genuinely claims #4404, id(chat-presence): heartbeat typing list is never deduplicated or bounded — one channel yields a 3.3 MB signed frame, defeating MAX_HEARTBEAT_CHANNELS #3991, id(chat-presence): PresenceTable has no node-count bound — every distinct self-signed key is stored for a full TTL, so minted keys grow serve's memory without limit #4004, id(chat-presence): receipt never scopes heartbeats to sender membership — update_scoped has no production caller, serve stores channels unscoped #4363, id(peers): --gossip collection bypasses the announcement freshness/ordering guards — replayed, ancient and far-future announcements are reported as discovered peers #4377) closed or verified already-fixed, the contract statement landed, and the inventory complete.
Acceptance criteria
- The contract statement is present in the
chat_presence.rsmodule doc and cross-referenced fromPeerDiscovery::update's doc, and matches Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502's five decisions. - The ingest inventory covers every production frame-decode / claim-ingest site in
pkgs/id, each with a disposition and a reason or a follow-up link. - All four required dispositions are recorded on Design: one guarded door — every gossip claim enters through its table (pkgs/id presence + peers) #4502.
- No behaviour change beyond the
PresenceTable::updatedisposition (removal / crate-private) and a single-site slip fix; anything larger is filed as a named follow-up, not fixed inside the audit.
Filed by the design architect (pass 39, 2026-11-02) as Phase 5 of design #4502. Gated on Phases 1–4 (#4404, #3991, #4004, #4363, #4377) landing; stays status/blocked until then. Triage: record the gating and enqueue the implementation follow-up once the gating clears; do not start the audit early.
Activity
dezren39 commentedon Nov 2, 2026
Design architect, pass 39 (2026-11-02): this issue is Phase 5 of design #4502 (one guarded door — every gossip claim enters through its table), filed this run and linked as its sub-issue. Design doc:
files/designs/code-id-gossip-admission.md(goal workspace). Gated on Phases 1–4 (#4404, #3991, #4004, #4363, #4377) landing; staysstatus/blockeduntil then. Triage: record the gating and enqueue the implementation follow-up once the gating clears; do not start the audit early.dezren39 commentedon Nov 2, 2026
OpenChamber scheduled lane, 2026-11-02: Picked up queue task #6424 (worker repo-worker-code, lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc). Revalidating the Phase 5 scope and Phase 1–4 gate; no audit implementation will start while any gate remains open.
104 remaining items
dezren39 commentedon Nov 3, 2026
agent-note:v1
task: 6424
lane: code-h
stage: handed_off
execution_lane: opencode
Task 6424 (triage: Phase 5 audit of #4502 for #4503) re-claimed by lane code-h at 2026-11-03T14:47Z; execution-lane assignment returned
opencodewith session ses_e5e62708382ffeCWsVLpIq2vPH already bound from a prior handoff. Handing off to the opencode claimant per the worker runbook — this lane does not work the task directly. Stale labels replaced with the claim set (work/assigned, queue/claimed, status/in-progress).Last recorded gate state (from the task's park reason, not re-verified this shift): phase gates unmet — #4404 OPEN (draft PR #4571, Drew-owned) and #4004 OPEN (draft PR #4160, Drew-owned); #3991/#4363/#4377 closed.
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 6424 (triage, claimed, priority 40) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · handed off
ses_e5e62708382ffeCWsVLpIq2vPHopencodewith a session already bound; handing off to that claimant session.dezren39 commentedon Nov 3, 2026
agent-note:v1
event: done
task: 6424
queue: repo-health-code-pilot
lane: code-a
summary: Triage completed (attempt 11/12, resumed from the recorded verdict; findings already posted in comments 6585362772 and 6606754988). Phase 5 closing audit of #4502 for pkgs/id remains gated: fresh check 2026-11-03T18:15Z shows prerequisite issues #4404 and #4004 still OPEN, and their PRs are Drew-owned — PR #4571 (draft, open) for #4404 and PR #4160 (open) for #4004. The other three prerequisites (#3991, #4363, #4377) are CLOSED. No audit or follow-up packet is possible until both Drew-owned PRs land; when they do, the coverage pass will re-enqueue this issue (it stays open) and the audit can run. Completing as triaged so the task does not die at its attempt cap with the verdict unrecorded in queue state.
outcome: triaged
blocker: Drew-owned PRs #4571 and #4160 open