fix(vault): #103 follow-up — MapGRPCError + 256MB + tests#106
Merged
Conversation
#103 ported errors.go for envector but missed vault. The hand-rolled grpcStatuser interface in #95's port required Code() to return int, but real *status.Status.Code() returns codes.Code (uint32). Type assertion silently fails for every gRPC error and every call lands in the !ok branch as ErrVaultInternal — hiding the actual code. Worst case: Unauthenticated (token revoked/expired) gets mis-flagged as retryable=true, triggering infinite retry on auth failure. Switch to status.FromError(err) and codes.* constants from google.golang.org/grpc, mirroring the pattern in envector/errors.go MapSDKError. Removes the hand-rolled grpcStatus struct + statusFromError helper + 4-line code constants block.
#103 lowered MaxMessageLength from 256MB to 16MB without justification. Python (vault_client.py:L33) and spec (vault.md §256MB) both call for 256MB. Even with EvalKey no longer in the manifest (Vault now owns EvalKey/SecKey server-side per the GetAgentManifest rename), the manifest_json still carries EncKey JSON content which can be on the order of MBs depending on FHE parameters. The 16MB cap risks ResourceExhausted on future deployments that legitimately need more headroom; 256MB matches Python and the spec without measurable cost.
#103 added envector unit tests but skipped vault. Adds 13 test functions / 18 subtests covering all 4 RPC paths and the error-mapping matrix: - GetAgentManifest: happy path, response.error, malformed JSON, bad DEK length 16 (must be 32 for AES-256) - ParseManifestJSON: silently drops a stray EvalKey.json field if a legacy Vault response includes one (forward compat) - DecryptScores: happy path with token/blob/top_k assertions - DecryptMetadata: happy path pass-through - HealthCheck Tier 1: SERVING / NOT_SERVING - MapGRPCError: 6 gRPC code → sentinel matrix (Unauthenticated / NotFound / Unavailable / DeadlineExceeded / Internal / PermissionDenied default), non-gRPC fallback, nil pass-through Adds NewBufconnClient(*grpc.ClientConn, token) Client constructor factored through newWithConn so NewClient and NewBufconnClient share struct init. Useful for tests + production callers that pool conns externally. Test runs in ~0.6s with no real Vault dependency.
Documents the three follow-up items this PR addresses (MapGRPCError fix, MaxMessageLength 256MB restore, bufconn unit tests + NewBufconnClient injector) against the post-#103 contract (GetAgentManifest, EvalKey ownership shifted to Vault). Includes spec-parity matrix, list of acceptable divergences from Python, and open follow-up items (RUNEVAULT_GRPC_TARGET env override, health client caching, response.error retryable nuance, MetadataRef type asymmetry).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#103 후속 PR입니다. Vault 어댑터에서 빠진 항목 + 회귀된 항목 정리했습니다.
MapGRPCError버그 수정 + server 가 emit 하는 code 전수 커버 — feat(mcp): envector-go-sdk integration #103 가 envector 쪽은 표준 패턴(status.FromError + codes.*)으로 정리했는데 vault 는 수정이 되지 않아서, 기존 hand-rolled interface (Code() int) 가 실제 gRPC 시그니처(codes.Code=uint32)와 안 맞아 모든 에러가VAULT_INTERNAL/Retryable=true로 잘못 분류되고 있었습니다.PermissionDenied/InvalidArgument/ResourceExhausted가 매핑 자체에 빠져있어서 default 분기로 흘러가던 것도 같이 정리했습니다.MaxMessageLength256MB 복원 — #103에서 16MB 로 줄었는데, 일단 기존 Python rune 과 server의MaxMessageSize도 256MB이어서 256MB로 수정했습니다.vault bufconn unit test +
NewBufconnClientinjector 추가GetAgentManifest,DecryptScores,DecryptMetadata,HealthCheck) 의 happy path + gRPC error path + response.error string + boundary inputdecodeAgentDEK의 3 error path (empty / invalid base64 / length matrix 0~64)MapGRPCError9-code matrix (server emit + transport + legacy + default) +Cause보존 +errors.Is/Aschain +Messagecarry-throughParseManifestJSON직접 (empty / missing field / not-json / forward-compat)Endpoint()/Close()멱등성 / ctx cancellation)