Repository navigation
id(world): F12.18 denial-of-service test suite in CI #560
Description
What and why
A suite that tries to exhaust fuel, memory, journal size, frame size, session count, schedule count and provider bounds, and asserts each is refused with the documented code while the node stays responsive. Bounds are tested one at a time in different files, so nothing shows the node stays up when a guest pushes on all of them.
Source
Current status
Implemented on main except the journal-size bullet (re-verified 2026-11-03).
pkgs/id/tests/world_dos.rs drives the suite through one probe harness: provider
bounds (CapError codes), wants/args byte bounds, schedule id bounds and the
hostile-program responsiveness probe landed in 06d4ef2e9; fuel
(trap, world poisoned), guest memory growth, out-of-memory output, frame size,
session ceiling (ResolveError::Busy), open-world ceiling (TooManyWorlds) and
schedule count/horizon were folded in by 62c883f2b (queue task 3840), per the
merged design doc/2026-11-01_design_id560.md (PR #3884). Each refusal asserts
its actual documented outcome — F11.13 CapError codes only for capability
denials. CI needs no workflow edit: pkgs/id/scripts/test-shard-sandbox.sh globs
tests/*.rs, so world_dos is picked up automatically (currently shard 1 of 4).
Remaining: journal size only. FileJournal has no absolute byte cap or
refusal to assert, and inventing one is production behaviour, not test work —
open decision for Drew (A/B/C in the design record), tracked by user/escalated.
Acceptance criteria
- A suite tries to exhaust fuel, memory, journal size, frame size, session count, schedule count and provider bounds
- Each attempt is refused with the documented error code (F11.13)
- A probe client stays responsive throughout
- The suite runs in CI
Size
M
Prerequisites
- id(world): F11.13 error taxonomy: stable codes plus reasons on the wire #554 — D1-013 F11.13 Error taxonomy: stable codes plus reasons on the wire
Activity
test(id): F12.18 consolidated denial-of-service suite
dezren39 commentedon Oct 24, 2026
Progress (Session C, PR #801): added
pkgs/id/tests/world_dos.rs— a consolidated DoS suite covering provider bounds (documented F11.13 codes), wants-document size, schedule ids, and a hostile program whose 64 requests are all refused while the node keeps serving chat + caps. Fuel/memory, journal/frame, session/open-world and schedule-count bounds are mapped to their dedicated tests in the module doc; consolidating those into the one probe-driven harness remains (they need the session/hub test harness).docs(id): Phase 14 plan — close-out: finish, measure, verify, open th…
dezren39 commentedon Oct 26, 2026
Intake review
Fleet-monitor intake pass (2026-10-26). Body already carries a full
## Acceptance criteriasection, so this pass is label normalization plus a liveness check — no body edit.APPEARS SOLVED — not closed. Commit
06d4ef2eon main, "test(id): F12.18 consolidated denial-of-service suite", addedpkgs/id/tests/world_dos.rs, whose header explicitly frames it as the F12.18 suite: a hostile program pushes on provider bounds, wants-document size, and schedule ids in one place, and the header maps the remaining bounds (fuel/memory/message size, journal/frame size, session/open-world ceilings, schedule count/horizon) to their dedicated tests. That covers the shape of every acceptance bullet, including the probe-stays-responsive intent.Why this is not being closed by the monitor: no merged PR or commit message explicitly references this issue (#560), and the monitor has not independently verified the suite's CI status or that each refusal asserts the F11.13 documented codes. Per the lifecycle protocol, an issue that only looks solved gets the evidence linked, not a close.
Remaining check for a worker/sweep: confirm
world_dos.rsruns in CI and that the refusal assertions name the documented F11.13 codes; if both hold, close this issue as completed citing06d4ef2e.Related: prerequisite #554 (F11.13 error taxonomy) is still open and unenriched — if its codes are not yet stable, that is the one acceptance bullet that may still be genuinely open.
32 remaining items
dezren39 commentedon Nov 1, 2026
Design summary
world_dostarget covers capability codes, wants/args limits, schedule IDs, and 64 hostile denials while a probe participant still chats.CapErrorcodes.FileJournalhas no absolute byte cap or refusal to assert today.world_dosintegration target; no new workflow is needed.Design PR: #3884
Phased plan: (1) reusable probe helper + sandbox limits; (2) frame and session/open-world ceilings; (3) schedule count/horizon, update the inventory, and verify the existing CI shard.
Question for Drew — journal size: (A) remove it from this test suite (recommended; no byte budget is invented here); (B) design a separate production cap with its refusal semantics; or (C) add the cap to F14.17 (not recommended: breaks the test-only boundary). The answer does not block existing test-only packet #3840. No other Drew-only questions.
Merge pull request #3884 from developing-today/design/id-560
dezren39 commentedon Nov 3, 2026
Agent note — task 6888 picked up, handed off (lane L shift)
code-lat 2026-11-03T13:59Z.opencode(assignment row 745). Per the worker runbook §1b, this task is handed off: the laptopopencode-claimantlaunches a bound opencode session to drive the triage to a terminal state.user/escalated— the claimant/Drew-owned decision flag is preserved and noted in the task checkpoint.dezren39 commentedon Nov 3, 2026
agent-note:v1
task: 6888
lane: code-h
stage: handed_off
execution_lane: opencode
Task 6888 (triage: #560 — id(world) F12.18 denial-of-service test suite in CI) re-claimed by lane code-h at 2026-11-03T14:57Z; execution-lane assignment returned
opencodewith no session bound yet. Handing off to the opencode claimant per the worker runbook — this lane does not work the task directly. Claim labels on #560 were already synced.Flag for the claimant: #560 carries
user/escalated— a Drew decision may be required on this item; the escalation predates this handoff and is not resolved by it.dezren39 commentedon Nov 3, 2026
🤖 Agent note · re-triage verdict: implemented on main; one Drew decision left (task 6888)
mainf4fce2b90(fresh fetch, 2026-11-03)This issue's "Current status: Not started" was stale — I updated the body. What is actually on main:
pkgs/id/tests/world_dos.rsprovider_bounds_refuse_with_the_documented_codesCapErrorcodes by namea_wants_document_is_bounded_in_bytes_and_argsschedule_ids_are_refused_when_out_of_boundsa_hostile_program_is_refused_without_taking_the_node_downfuel_exhaustion_traps_instead_of_hangingguest_memory_growth_is_bounded_and_poisons_the_world,guest_output_outside_memory_is_rejecteda_frame_over_the_size_bound_is_refusedthe_session_ceiling_refuses_with_busy_then_recoversResolveError::Busythe_open_world_ceiling_refuses_with_too_many_worldsTooManyWorldsschedule_bounds_refuse_with_their_reasons62c883f2b(queue task 3840) against the merged designdoc/2026-11-01_design_id560.md(PR design(id): #560 DoS suite contract #3884, merged by Drew 2026-11-02T15:48Z) — every refusal asserts its real documented outcome,CapErrorcodes only for capability denials, exactly as the design recommended.pkgs/id/scripts/test-shard-sandbox.shglobstests/*.rs, soworld_dosis auto-assigned (currently shard 1 of 4). Caveat: main'sid-checkruns are all queued right now (backlog since 14:33Z), so I cannot cite a green shard run from today; the code and the discovery mechanism are both on main.Why this is not closed and not a new packet: the only unmet bullet is journal size, and it is not implementable as test work —
FileJournalhas no absolute byte cap, so a test would have to invent one (production behaviour). The merged design defers that choice to Drew, and merging the record did not answer it. The options fromdoc/2026-11-01_design_id560.md:Drew: answer A/B/C and this closes the same day — A means a one-line plan edit plus closing this issue; B/C means a new production issue and this one narrows to it.
user/escalatedkept, task blocked asescalated-to-userso the coverage pass stops re-filing triage for it.