jcp-wire: the endpoint decides at its own clock, and a captured request is decided once #322
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/jcp-wire-endpoint-clock-and-replay"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The defect
The
jcp/1endpoint (jcp-wire, SPEC §11) decided every request at thenowthe request carried, and debited it every time it arrived. The request is signed by its caller, the grant's subject, so the caller chose both:NotAfterit had since left, and be decided as of that moment.The fix
Endpointdecides at its own clock:with_clock, the system clock by default. A request'snowis a freshness stamp. One more than the window (with_skew, default 300 s) from the clock is deniedstale-requestand sealed like any other denial.replayed, neither decided nor debited. Once a stamp leaves the window it is forgotten and a replay of it is stale, so memory stays bounded.DenyReason::StaleRequestandDenyReason::Replayed, with their labels.jcp-wire's only users are the conformance suite and jcp-threshold's test. Both now pin the endpoint's clock to the stamps their requests carry.
Checked
On the build host:
now🤖 Generated with Claude Code
The `jcp/1` endpoint decided every request at the `now` the request carried, and debited it every time it arrived. The request is signed by its caller, the grant's subject, so the caller chose both: - **Time.** A caller could stamp a request before its grant expired, or inside a `NotAfter` it had since left, and be decided as of that moment. - **Replay.** A captured request presented again was decided again and debited again. SPEC §11 described that as intended ("replays into the same deterministic decision and the same budget accounting"). The fix: - **Clock.** `Endpoint` decides at its own clock (`with_clock`; the system clock by default). A request's `now` is a freshness stamp: one more than the window (`with_skew`, default 300 s) from the clock is denied `stale-request` and sealed like any other denial. - **Replay.** Within the window the endpoint remembers each request it decided, by content id. One presented again is denied `replayed`, neither decided nor debited. Once a stamp leaves the window it is forgotten, and a replay of it is stale, so memory stays bounded. - **Deny reasons.** `DenyReason::StaleRequest` and `DenyReason::Replayed` are new, with their labels. - **Spec.** SPEC §11 says the endpoint's clock decides, a request is decided once, and the cost is the holder's measurement. The endpoint debits the declared cost as given, so the requester must be the party that metered the action, the grant's holder at the enforcement point (as a Mesh steward is), never the governed agent reporting its own consumption. - **Conformance.** C8 covers a replay, a stale request, and a grant that expires between a request's stamp and the endpoint's clock. jcp-wire's only users are the conformance suite and jcp-threshold's test. Both now pin the endpoint's clock to the stamps their requests carry. Checked on the build host: - jcp-rs: 517 tests pass, three of them new in jcp-wire. The conformance suite passes all checks, including C8 and C13. - Every vector is byte-identical, and clippy is clean. - Every workspace depending on jcp-schema builds: mesh, jouleclaw, joule-code, sandbox, joule-ui, joulehook, jouledesk. - Mutations each fail tests: deciding at the caller's `now` (also fails C8), deciding a replay again (also fails C8), and no freshness window (also fails C8). - jcp-gateway's process-tree energy tests flaked twice under host load during full runs; alone they pass every time, and this change does not touch that crate. Co-Authored-By: Claude Opus 5.5 <[email protected]>