Repository navigation
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AUTH carries an ID, numbered densely per side, and SUBSCRIBE, SUBSCRIBE_UPDATE, FETCH, ANNOUNCE_REQUEST, and ANNOUNCE_START/UPDATE/ RESTART carry an Auth field naming one. A named request is admitted by that token's grant alone, waits while it is in flight, and ends with it. A presenter FIN withdraws a token gracefully: it keeps deciding the requests already naming it until they move off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The auth bench sweeps the peer's tokens against the routes naming them, timing one token's change. js/net numbers its Auth Streams, names a route's token by its ID, withdraws with a FIN, and refuses a reused or maximal ID. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Spec the lite-07 AUTH ID and each request's Auth field in the draft, with FIN-linger withdrawal for gapless renewal. Cross the largest nameable ID between Rust and JS and refuse u64::MAX on both. Document named announcements, and split the moq-transport mirror into its own quest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A change to one of the peer's lite-07 tokens bumped the session's auth epoch, so every gate and every announce stream re-decided every route, and every presented token's stream woke on every AUTH_OK. The peer's tokens now live apart from the session state, each request names its token through a Changes set that only that token's changes touch, and an announce stream re-decides only the routes naming a changed token. A presented token's stream waits on its own withdrawal signal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The presenter re-unioned every token's grant on each AUTH_OK, and the acceptor every issued grant on each issue, so one token's change still cost O(tokens). A Tally keeps per-pattern and per-deadline counts, so a change costs that token's own grant. With it the named bench is flat across both axes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Recording the maintainer's decisions on the seven open questions:
(Written by Claude Opus 5.5) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14483f5773
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Important Review skippedWe couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThe change adds AUTH IDs and optional auth fields to lite announcements, subscriptions, updates, and fetches. It tracks named-token grants and lifecycle, then applies those grants to announcement and request admission. Token withdrawal removes grants from session scope while existing named requests remain tied to that token. Tests, interoperability checks, benchmarks, drafts, and documentation are updated. Priority: ➖ Normal
Warning Some tools did not complete. Review the errors below. 🔧 Clippy (1.98.1)
Comment |
# Conflicts: # js/net/src/auth_session.ts # js/net/src/lite/connection.ts
When a route's own token ended, the presenter fell back to naming no token, so its next re-price or restart went out under the session's scope and the receiver reattached a route that should have ended with its credential. The presenter now retracts every advertisement naming a token of ours that ended, and keeps it off the wire until the route names another. Mirrored in js/net, where a withdrawn token also wakes the announce loop. The draft states the sender rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e44c2e93a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The per-token index of received announcements was filed under each token a route named but cleaned only under the ones it still named at retract. A rename dropped before it applied, or one a verdict applied, left the path under the old token, so a peer could grow the index without bound with unique paths. Each route now records the tokens it is filed under and refiles on every rename and verdict, so the index holds exactly what live routes name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b27abad45
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A SUBSCRIBE_UPDATE that renamed a running request only marked its gate stale, and the same pass went on to serve the next group before the gate judged the new token. A rename to an ended token, or one whose grant excludes the path, let one more group out under it. The gate is now checked after reading updates each pass, so nothing is served under a rename until it is judged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5b4476c7de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| match next.as_mut().map_or(scope, |naming| naming.verdict(direction, path)) { | ||
| Verdict::Waiting => {} | ||
| Verdict::Admitted => self.current = self.next.take().expect("checked above"), | ||
| Verdict::Denied => return Verdict::Denied, |
There was a problem hiding this comment.
When an announcement is renamed from token A to token B, or to the session scope, and the replacement has already decided Denied, this return leaves current pointing at A and next at the replacement. The Naming for A therefore remains counted even though the update replaced it; if the presenter then gracefully withdraws A, AuthServe's poll_peer_unnamed never completes, leaving the old AUTH stream and acceptor request open until the advertisement changes or ends. Move the decided replacement into current even when it denies the path so the previous authority is released.
Useful? React with 👍 / 👎.
|
Closing per maintainer decision: lite drops the Auth ID and the per-request (Written by Claude Opus 5.5) |
… race Rewrites quest/m1/auth/request-auth-id.md as quest/m1/auth/request-race.md after the maintainer closed #5927: lite AUTH gets no ID and lite requests no Auth field, so lite requests are judged by the session union alone. The remaining race, a request sent right behind the token it relies on, gets options (acceptor waits, AUTH_WAIT, presenter waits) with a recommendation. The auth README, request-update and token-in-band follow: moq-transport per-request tokens stay acceptor-side, and the first token stays in the CONNECT request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Completes the lite half of
quest/m1/auth/request-auth-id.md. The moq-transport mirror is split intoquest/m1/auth/request-auth-id-ietf.md.What changes
Auth ID (i). The opener numbers its own IDs densely from 0. An ID of 2^64-1 is a PROTOCOL_VIOLATION, because no request could name it as ID plus 1. A reused ID is also a violation.Auth (i), encoded last in the body: SUBSCRIBE, SUBSCRIBE_UPDATE, FETCH, ANNOUNCE_REQUEST, ANNOUNCE_START, ANNOUNCE_UPDATE and ANNOUNCE_RESTART. A value of 0 means the session scope; otherwise the value is the ID plus 1.auth::Authority.Changesset.Route::authis named on its announcements automatically, in both Rust andjs/net. Swapping the token sends an ANNOUNCE_UPDATE. A route whose own token ends is retracted, and stays off the wire until it names another token. It never falls back to the scope (Auth0).js/netencodes and decodes every new field, numbers its AUTH IDs, refuses reused or maximal IDs, and withdraws with a FIN on lite. It does not yet enforce named grants (decision 6).Public API and wire impact
js/netwire helpers are internal, and naming is automatic. No MIGRATE entry.moq-lite-07-wiponly. AUTH and seven request messages gain a field, and Auth Stream withdrawal becomes FIN-linger. Published versions are unchanged. The draft changelog is updated.Decisions
Settled by the maintainer.
aheadset.Subscription::authuntil a consumer asks for it.quest/m1/auth/request-auth-id-ietf.md, so the logic is shared.Tests
lite_07_a_named_route_is_held_to_its_tokenlite_07_renewing_a_route_token_keeps_it_announcedlite_07_a_route_ends_with_its_revoked_tokenlite_auth_id_interopcarries the largest nameable ID across on AUTH and SUBSCRIBE. Both sides refuse u64::MAX.namedbench inrs/moq-net/benches/auth.rs. It sweeps live tokens [1, 16, 128] against named routes [1, 16, 128] and times one token narrowing and restoring. Before and after the per-token wakeups, median of 5 interleaved runs of each binary on the same machine:The cost no longer grows along either axis.
Checks run on the pushed head (merged with
origin/main, including the Codex fix):just checkpasses, including the wasm build that used to fail.just drafts checkpasses.just test interop --allpasses.cargo test -p moq-netpasses (2113 lib tests plus integration).Interop note: the earlier CI failure printed
remote error: 54(Unroutable) on an audio subscribe, right after the chromium cold-start audio FAIL. It shows up while the harness tears down the browsers. The relay's upstream session to the publisher dies, and #5729 maps a dead upstream session to Unroutable. The message is a teardown artifact of that known flake, not this PR. The rerun passed.Follow-ups
quest/m1/auth/request-auth-id-ietf.md(new): the draft-lcurley-moq-auth mirror, JS named enforcement, and thedoc/concept/standard.mdupdate.Subscription::authin Rust and JS, once a consumer needs to name a token on a subscription.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code