Repository navigation
id(world): F14.17 revised — fold real-refusal bounds into the world_dos probe harness (assert each bound's documented refusal outcome) #3840
Description
What and why
F14.17 (.opencode/plans/phase-14-close-out.md:142, origin issue #560) asks to fold the bounds pkgs/id/tests/world_dos.rs maps to other files into the one probe-driven harness. The original packet (queue task 4834) blocked on 2026-11-01: it required every refusal to assert an F11.13 CapError code, but most of these bounds do not refuse with a CapError code — verified at main 927f3830:
- fuel / memory: trap + world poison in
pkgs/id/src/sandbox.rs:1732/:1773/:1717— no cap code. - frame size:
MAX_FRAME_BYTES(pkgs/id/src/frames.rs:20) refused with a generic framing error (frames.rs:41,:89,:159); dedicated test atframes.rs:192. - session / open-world counts:
ResolveError::Busy/TooManyWorlds(pkgs/id/src/world_hub.rs:111-114); dedicated tests atworld_hub.rs:1102/:1122. - schedule count / horizon: reason-carrying refusal, dedicated test at
pkgs/id/src/world/tests.rs:3516.
This issue is the revised, test-only phase: assert each bound's own documented refusal outcome, not a code it does not produce.
Scope
- Extend
pkgs/id/tests/world_dos.rsso the probe-driven harness drives: fuel, memory, frame size, session count, open-world count, and schedule count/horizon, alongside the provider / wants / schedule-id bounds it already covers (world_dos.rs:56,:93,:110,:119). - Each refusal asserts the bound's documented outcome (trap/poison, framing error,
ResolveErrorvariant, schedule reason, or — only where F11.13 defines one — theCapErrorcode frompkgs/id/src/world_caps.rs:360). - A probe participant stays responsive while the hostile program pushes the bounds.
- Update the
world_dos.rs:1-21header map so it no longer lists bounds the suite now drives directly. - Confirm the suite's target is covered by a CI shard partition (
pkgs/id/flake.nix:321-329: the four test shards together run every integration target).
Excluded
- Journal size —
FileJournal(pkgs/id/src/world_store.rs:38, append at:177) has no byte cap and no refusal to assert; that bound is a separate decision on origin issue id(world): F12.18 denial-of-service test suite in CI #560, not part of this packet. - Any production behavior or public-surface change. This is the Phase 14 verification plane (
.opencode/plans/phase-14-close-out.md:90: tests only, no new runtime behaviour unless a test exposes a bug — a bug found gets its own issue).
Acceptance criteria
- The probe harness drives all six bounds above in
world_dos.rs, each asserting its documented refusal outcome - Probe client stays responsive throughout
- Header map in
world_dos.rsupdated to match reality - Suite confirmed in a CI check partition; targeted tests pass on the laptop or in CI
Origin
Design record: triage queue task 5757 on issue #560 (2026-11-01). Supersedes the blocked packet of queue task 4834.
Activity
dezren39 commentedon Nov 1, 2026
Agent note (task 5830, lane E): DONE — PR #3878 opened (branch
queue/5830-3840-world-dos-bounds, 62c883f). The world_dos harness now drives fuel, memory, frame size, session count, open-world count, and schedule count/horizon through the public API, asserting each documented refusal outcome; header map updated; journal size untouched (stays on #560). Verified on the laptop:cargo test --test world_dos— 11 passed. One finding from testing: the admin schedule path replaces a pending id in place (#807 semantics), so the duplicate refusal is asserted only where it exists (the program path, dedicated test in world/tests.rs) and the admin replacement behaviour is asserted as documented.Merge pull request #3878 from developing-today/queue/5830-3840-world-…
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done
pkgs/id/tests/world_dos.rsheader map now describes the consolidated suite, and the harness drives fuel (fuel_exhaustion_traps_instead_of_hanging), memory (guest_memory_growth_is_bounded_and_poisons_the_world,guest_output_outside_memory_is_rejected), frame size (a_frame_over_the_size_bound_is_refused), session count (the_session_ceiling_refuses_with_busy_then_recovers), open-world count (the_open_world_ceiling_refuses_with_too_many_worlds), and schedule count/horizon (schedule_bounds_refuse_with_their_reasons), plus probe responsiveness (a_hostile_program_is_refused_without_taking_the_node_down) — each asserting its documented refusal outcome. The issue stayed open only because PR test(id): fold real-refusal bounds into the world_dos probe harness (#3840) #3878 did not auto-close it; the 2026-11-03 coverage pass's "still live" verdict was a false positive. Closing with evidence; no follow-up needed.