Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reconnecting guest currently returns its stream immediately after applying configuration, leaving the host without a readiness boundary before ordinary relay traffic can interleave. Add strict
guest_reconnect_ready/guest_reconnect_ready_ackframes tied to the accepted epoch. The guest stays offline until a matching acknowledgment arrives within five seconds (also bounded by delivery TTL and caller cancellation).Lost, malformed, wrong-epoch or late acknowledgments fail closed. The consumed epoch/token require a fresh signed attempt. The executable TCP probe drops an acknowledgment and reconnects with a fresh epoch while retaining the same PTY shell process. Existing fresh boot remains unchanged.
Depends on #116; base is
feat/guest-reconnect-transport. This is still a disabled protocol prerequisite: no shipping listener enablement, fresh host configuration resolver, guarded relay takeover or deployment. The design document records required host ownership checks and acknowledgment/publication ordering.Validation: full Linux CI passed (run 36816477521): make verify including Docker tests, non-root jail ownership, CLI/client race tests, and fleet syntax. Sessiond, relay and shared protocol race suites also pass locally. The built guest executable TCP/PTY probe passed after the local suite. Local make verify passes with Docker explicitly unavailable; the initial Docker attempt encountered the existing credential-helper/registry problem, and an existing latency cleanup timing failure passed in isolation. Independent and adversarial reviews passed with no required findings. Additional adversarial race-enabled probes passed the actual five-second blocked-write/read deadlines and pipelined-byte continuity.