Gate the A.5 Upd' door on content type, refuse rekey while a bind is owed - #120
Merged
Conversation
…owed The Upd' door feeds process_incoming_message on our send-PQ, which applies a commit atomically — so a peer-authored commit smuggled behind the tag would advance our epoch before the kind check refused it, and the refusal wore the fatal Mls disposition. Same gap the A.4 leg doors already closed (#111): read the content type off the plaintext framing first, refuse anything but a proposal with the retriable DecryptionFailed, nothing applied. The door also refuses a rekey while a classical bind is owed — its Commit' would move the epoch the owed bind reserved, failing the discharge with the PQ leaf spent. Honest peers never reach it (owing a bind means the turn is ours); a deviating one is a retriable guard-phase no-op. Both guards mutation-checked. No wire, FFI, or error-variant change; the generated binding is unchanged, so no contract bump (as #111). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: e9081c9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the one substantive gap the post-v0.14 review turned up (pre-existing, not a regression from any of the four merged PRs).
The A.5
Upd'door feedsprocess_incoming_messageon our own send-PQ, which validates and applies a commit atomically. The peer is a member of that group, so it could author a commit there that would apply — moving our send-PQ epoch — before the door's kind check refused it, and the refusal wore the fatalMlsdisposition (asks a host to tear the session down). This is the exact gap #111 closed at the A.4 leg doors; it stopped one door short.DecryptionFailed. Mutation-checked: without it, a smuggled commit applies (send-PQ epoch 1→2).No wire, FFI, or error-variant change — the generated uniffi binding is byte-identical, so no contract bump (following #111). Both new tests build a real, applicable commit/proposal in the peer's recv-PQ mirror of our send-PQ, so they exercise the gate itself rather than a group-id refusal.
🤖 Generated with Claude Code