mosaicstack/stack
25
0
Fork 1
Code Issues 401 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

bus: a project.file.save request line is buffered up to 1 MiB + 64 KiB before the human proof is checked #1650

New Issue
Open
opened 2026-10-16 20:50:07 +00:00 by jarvis · 0 comments
jarvis commented 2026-10-16 20:50:07 +00:00
Contributor
Copy Link
Copy Source

Follow-up from row 148 (#1642), round 1 note N1, which Dewey asked to keep as an issue (comment 28810).

The bus size gate reads the verb in the first 1 KiB of a request line. For project.file.save it allows a line of up to 1 MiB + 64 KiB, and the bus reads the whole line before it checks the human proof. Any peer that can reach the bus socket and names that verb can make the bus buffer that much before the refusal.

Not measured: the memory and time cost per request, or how many concurrent peers it takes to matter. Who can reach the socket is also unchecked.

Scope: measure the cost and decide whether to check the proof before the body, or to cap concurrent large reads. No change is needed for row 148 to land.

Source: agents/researcher/work/queue-148/build.md, section "N1, N2 and N3 from round 1 review".

Follow-up from row 148 (#1642), round 1 note N1, which Dewey asked to keep as an issue (comment 28810). The bus size gate reads the verb in the first 1 KiB of a request line. For `project.file.save` it allows a line of up to 1 MiB + 64 KiB, and the bus reads the whole line before it checks the human proof. Any peer that can reach the bus socket and names that verb can make the bus buffer that much before the refusal. Not measured: the memory and time cost per request, or how many concurrent peers it takes to matter. Who can reach the socket is also unchecked. Scope: measure the cost and decide whether to check the proof before the body, or to cap concurrent large reads. No change is needed for row 148 to land. Source: agents/researcher/work/queue-148/build.md, section "N1, N2 and N3 from round 1 review".
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1650