Repository navigation
dt64: bind the frame store to the lane source, not the caller - #1978
Merged
Merged
Conversation
LaneSource gains a required frames() returning the FrameStore that lives with the source's data. bind_lanes and LaneBinding::check/lane refuse Frame(ForeignFrame) unless the caller's frames argument is that store (identity compare), before any lane_of or borrow. A binding made over one source can no longer be checked or read against a substitute whose lane numbers match. The four in-repo impls follow the owner rule: dt64 test Source and dir-sim Directory own their store, soa64 U64Source returns SoaU64::frames(), report AbiLanes already built its store from the batch. report's a_frame_and_store_of_another_source_bind_nothing is re-pinned: the pair is now refused at DT64 (ForeignFrame) instead of only at the adapter (Unbound). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XAqKMMWgnUU9g7Ldyn6sbk
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
AdaWorldAPI
marked this pull request as ready for review
November 7, 2026 21:30
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
BindStore::bind_lanesandLaneBinding::check/lanetook theFrameStoreas a caller argument, separate from theLaneSource. The caller chose which store was paired with which source. A binding made over source S1 could be checked and read against a different source S2 whose lane numbers matched, and S2's values came back. The prior audit measured this: S1[40, 41], S2[30000, 31000], and the read returned S2's values.Change
LaneSourcegains a required method,frames(&self) -> &FrameStore. It returns the store that lives with the data the source borrows from.bind_lanesandcheck(and thereforelane) refuseLaneRefusal::Frame(FrameRefusal::ForeignFrame)unless the caller'sframesis that same store, compared by identity, not value. The refusal happens before anylane_oforborrow. The helper isFrameStore::same_store(pub(crate)).bind_lanes,checkandlaneare unchanged. No new refusal variant. Nounsafe. Validation stays per call.Implementations (all four in the repo)
frames()comes fromSourceAbiLanesU64SourceSoaU64::frames(): swapping the SoA swaps the issuerDirectoryTests
New:
dt64 lane_socket::a_substituted_source_is_refused_not_read. The bound source reads[100, 200, 300]. The substitute (same map and lane numbers, data[30000, 31000, 32000]) is refused when paired with the bound source's store, refused when paired with its own store, and a fresh bind cannot pair the bound source with another store.soa64 socket_refusals::a_source_over_swapped_data_is_refused. Equal data rebuilt is a different store, so the binding is refused with zero borrows, and the original pairing still matches the oracle.Re-pinned:
report lane_source::tests::a_frame_and_store_of_another_source_bind_nothing. It used to document the gap: another source's store and frame passed DT64's check, and only the adapter left the fieldUnbound. DT64 now refuses withFrame(ForeignFrame)first.Disable run
After committing, I replaced the gate with
if true || frames.same_store(...)and asserted the patch applied.a_substituted_source_is_refused_not_readand reporta_frame_and_store_of_another_source_bind_nothing.a_source_over_swapped_data_is_refused. It reaches the swap through the swapped source's own store, soFrameStore::checkrefuses it either way. It pins the owner rule, not the gate.The patch was then restored with
git checkout.Validation
All runs used
CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 CARGO_INCREMENTAL=0.cargo testpasses for lance-graph-dt64, lance-graph-report and lance-graph-dir-sim. dir-sim is run byidentity.yml.cargo test --releasepasses for soa64-u64-lab. It has no workflow, so this was a local opt-in run.cargo clippy --all-targets -D warningsis clean on dt64. Style CI has no clippy line for dt64.cargo fmtwas applied to all four crates.Residual (open)
The trait cannot prove that an implementer's store issued that implementer's bytes. This PR removes the caller's choice, and the in-repo impls follow the owner rule. Implementer trust remains. Closing it needs byte authentication or a sealed trait. No external implementer is known.
Plan note:
.claude/plans/d-lanesock-dr-dt64-lane-socket-v1.md, section "Source issuer".Generated by Claude Code