P1 release gate — adversarially prove semantic dialogue/provider/device routing across reconnect and concurrency #161

New issue

Open

opened 2026-08-22 21:53:32 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-22 21:53:32 +00:00

(Migrated from github.com)

Parent epic: #150
Depends on: #160
Integrates with: #132/#133 and #134 where voice/client canonicality matters.

Goal

Prove the complete #150 architecture as a bounded state machine under realistic commands, failures, concurrency, reconnect and malicious input. This is a proof gate, not a feature implementation bucket.

Mandatory matrices

Semantic/dialogue

Run the canonical example-command corpus through complete, missing, invalid, correction, cancel, timeout and ambiguity transitions. Property/fuzz cases cover arbitrary bounded slot values/state transitions and guarantee no invalid state becomes executable.

Principal/session isolation

A/B principals and multiple sessions/devices for one principal: pending answers, plans, actions, events and results cannot cross ownership. Known foreign ids behave like unavailable/missing according to policy.

Provider/action lifecycle

Provider disappears, permission revoked, device disconnects, server service fails, action times out, cancel/result race, duplicate/replayed request, stale reconnect result, slow device, queue/rate exhaustion. No duplicate side effects beyond declared idempotency policy.

Protocol/security

Malformed capability sets/actions, oversized names/args, unknown message types, forged target device/principal, client-advertised fake admin capability, payload identity spoofing, malicious strings resembling shell/import/Prolog goals. Fail closed and bounded.

Routing correctness

Verify server capabilities execute server-side and device capabilities only through the selected authenticated client adapter. Headless/container server must not try xdg-open, clipboard, screenshot, volume or GUI actions.

Required real examples

At least timer complete/pending/correct/cancel, open app pending/complete, text missing message, server search, server memory, device screenshot, unavailable device, two-device provider selection and safe fake tool/service actions.

Performance/resource observations

Bound pending-dialogue count/bytes, action queues, event queues and cleanup after cancellation/disconnect. Add soak/repeated-turn profile sufficient to catch monotonic growth and stale state.

Automation

Add one focused non-interactive top-level semantic/capability release script composed into full repo/Nix CI. Use deterministic fake devices/services; no live network/provider/microphone required.

Acceptance

All matrices green at exact head; no stale/cross-principal state; no arbitrary execution path; server/device placement proven; written migration decision says which legacy command paths remain compatibility-only. Merge only after full repo/Nix and exact-head Actions are green.

Parent epic: #150 Depends on: #160 Integrates with: #132/#133 and #134 where voice/client canonicality matters. ## Goal Prove the complete #150 architecture as a bounded state machine under realistic commands, failures, concurrency, reconnect and malicious input. This is a proof gate, not a feature implementation bucket. ## Mandatory matrices ### Semantic/dialogue Run the canonical example-command corpus through complete, missing, invalid, correction, cancel, timeout and ambiguity transitions. Property/fuzz cases cover arbitrary bounded slot values/state transitions and guarantee no invalid state becomes executable. ### Principal/session isolation A/B principals and multiple sessions/devices for one principal: pending answers, plans, actions, events and results cannot cross ownership. Known foreign ids behave like unavailable/missing according to policy. ### Provider/action lifecycle Provider disappears, permission revoked, device disconnects, server service fails, action times out, cancel/result race, duplicate/replayed request, stale reconnect result, slow device, queue/rate exhaustion. No duplicate side effects beyond declared idempotency policy. ### Protocol/security Malformed capability sets/actions, oversized names/args, unknown message types, forged target device/principal, client-advertised fake admin capability, payload identity spoofing, malicious strings resembling shell/import/Prolog goals. Fail closed and bounded. ### Routing correctness Verify server capabilities execute server-side and device capabilities only through the selected authenticated client adapter. Headless/container server must not try `xdg-open`, clipboard, screenshot, volume or GUI actions. ## Required real examples At least timer complete/pending/correct/cancel, open app pending/complete, text missing message, server search, server memory, device screenshot, unavailable device, two-device provider selection and safe fake tool/service actions. ## Performance/resource observations Bound pending-dialogue count/bytes, action queues, event queues and cleanup after cancellation/disconnect. Add soak/repeated-turn profile sufficient to catch monotonic growth and stale state. ## Automation Add one focused non-interactive top-level semantic/capability release script composed into full repo/Nix CI. Use deterministic fake devices/services; no live network/provider/microphone required. ## Acceptance All matrices green at exact head; no stale/cross-principal state; no arbitrary execution path; server/device placement proven; written migration decision says which legacy command paths remain compatibility-only. Merge only after full repo/Nix and exact-head Actions are green.