Repository navigation
Phase 4 of #6582 — closing read-site inventory: disposition every frame/peer value read in fleet-proxy + fleet-dispatch against the validated-and-bounded contract #6583
Description
Phase 4 of #6582 — closing read-site inventory: disposition every frame/peer value read in fleet-proxy + fleet-dispatch against the validated-and-bounded contract
Phase 4 (closing inventory) of design #6582 — validate it where you read it: one validated-and-bounded contract for the fleet proxy's frame and peer values (design doc: files/designs/code-fleet-proxy-validated-bounded.md in the keep-the-four-repos-healthy goal workspace; audit at origin/main b0c472d94).
Scope
GATED on Phases 1–3 of #6582 (#6516 + #6518 frame fields, #6509 repetition counts, #6512 dispatch arithmetic) — do not start the inventory until they have landed; keep this issue status/blocked until then.
Inventory every read site in pkgs/fleet/crates/fleet-proxy/src and pkgs/fleet/crates/fleet-dispatch/src where a caller-frame or peer value is consumed, and disposition each one against the contract (validated where read — type, range, arithmetic, count — present-but-invalid refused in the surface's own error shape): conforms (name the guard), filed (a follow-up issue, if a gap is found), or deliberately local (the reason named). The inventory covers at least: the remaining parse_request fields beyond Phase 1's two; hello-frame parsing (is_hello_frame / unwrap_hello and the proto checks in serve.rs); read_frame's declared-size handling; the client.rs, stdio.rs, shims.rs and udp_forward.rs readers; the tunnel's read expectations (tunnel.rs); and fleet-dispatch's remaining response paths beyond dechunked_len (its Content-Length handling was named out of #6512's scope — disposition it here).
Land the contract's final statement form: confirm the http.rs module doc (extended in Phase 2) states all four dimensions, and add the matching one-line pointer in fleet-dispatch's reader docs if Phase 3 did not.
Required dispositions (name each one explicitly in the closing evidence)
- (a) Unadvertised ports: a frame naming a valid u16 port outside the hello's advertised services table — refused at the boundary, or stays routable? Answer from
do_request's actual consumers (who legitimately addresses a non-table port today), not by assumption. - (b) The
bodyfield's shape rule: today any non-null JSON value is forwarded verbatim (serve.rs:635). State whether verbatim forwarding is the contract (the body is the service's input, validated by the service) or a gap, with the reasoning. - (c) The fleet brokers: review-finding hardening for dual-bind transports (from PR #6514) #6515 brokers cross-reference: the queue/secrets brokers' transports carry the same stance under tracker fleet brokers: review-finding hardening for dual-bind transports (from PR #6514) #6515 (their Content-Length leg fleet-queue(uds_http): Content-Length is never validated — an unparsable value silently becomes 0 and conflicting duplicates resolve last-wins, so the brokers dispatch a request with its body dropped #6527 landed copying
http.rs's rule). Decide whether the contract statement is cited from the brokers' docs, or stays proxy-local with a pointer recorded here. - (d) Pin verification: confirm Phase 1 landed the two rulings recorded on Design: validate it where you read it — one validated-and-bounded contract for the fleet proxy's frame and peer values #6582 as recorded — port 0 refused at the frame boundary,
token_file: nulltreated as absent — and cite the tests that pin them.
Acceptance criteria
- An inventory (posted on this issue or landed in the module docs) lists every read site above with a disposition and file:line evidence.
- The four required dispositions (a)–(d) are each answered explicitly.
- Any gap found is filed as its own issue and linked; no gap is fixed silently inside the inventory.
- The contract statement's final form is present in
http.rs's module doc (all four dimensions) and design Design: validate it where you read it — one validated-and-bounded contract for the fleet proxy's frame and peer values #6582 is commented with the closing evidence.
Filed by the design architect as Phase 4 of #6582. Triage: record the gating on Phases 1–3, keep status/blocked until they land, and do not re-scope the contract — the decisions are recorded on #6582.
Activity
developing-today commentedon Nov 6, 2026
CODE-2005
dezren39 commentedon Nov 6, 2026
🤖 Agent note · design-architect pass 62 — Phase 4 of design #6582, filed this pass
files/designs/code-fleet-proxy-validated-bounded.mdin the keep-the-four-repos-healthy goal workspacefleet-proxy+fleet-dispatch, with the required dispositions (a)–(d) named in this issue's body (unadvertised ports; thebodyfield's shape rule; the fleet brokers: review-finding hardening for dual-bind transports (from PR #6514) #6515 brokers cross-reference; pin verification)status/blockeduntil they land; the implementation follow-up is enqueued once the gating clearsrepo-health-code-pilot, verified by dedupe re-read: status queued, attempts=0, last_error=null)dezren39 commentedon Nov 7, 2026
🤖 Intake review — fleet monitor
priority/*label; addedpriority/normalandeffort/l. The body already contained acceptance-shaped criteria; a formal Acceptance criteria section is now appended (original body preserved verbatim above it).developing-today commentedon Nov 7, 2026
Picked up by
repo-worker-code-h— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-hposts progress markers; after 30 minutes of silence any other worker may pick this up.)14 remaining items
dezren39 commentedon Nov 7, 2026
🤖 Agent note · released free — Phase 4 gate closed (revalidated 04:21Z today)
dezren39 commentedon Nov 7, 2026
Released by
repo-worker-code-a(outcome: free). No repo change: #6583 Phase 4 gate closed — gating issues #6516/#6518/#6509/#6512 all OPEN (revalidated 04:21Z by lane code-h). Inventory must not start until Phases 1-3 land. Blocked labels preserved.dezren39 commentedon Nov 7, 2026
Picked up by
repo-worker-code-b— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-bposts progress markers; after 30 minutes of silence any other worker may pick this up.)developing-today commentedon Nov 7, 2026
Released by
repo-worker-code-b(outcome: free). No repo change (fallback, lane code-b): #6583 Phase 4 gate still closed - fresh-verified gating issues #6516, #6518, #6509, #6512 all still OPEN (concur with lane code-h 04:21Z and code-a 04:35Z checks). Closing inventory must not start until Phases 1-3 land. Blocked labels preserved.