The contract stops over-promising and under-recording - #60
Merged
Conversation
Issue #13 findings C10, C9 (formats), D15, and the D17 remnant — all doc rulings, no behavior change. C10: connect no longer promotes the v0 dial narrowing to contract. Dial-path selection from addr.addrs is implementation-defined — prefer, race, or fall back are all conforming — so an upstream-backed implementation of this surface (which always races) is no longer non-conformant by construction. This implementation's actual selection stays recorded where the narrowings live (endpoint/src/lib.rs); the matrix rows that lean on no-fallback assert that recorded latitude, not the contract. C9: transport-addr's string formats are specified — relay is an http(s) base URL with one-spelling-per-relay guidance (normalization is implementation-defined beyond the exact string), ip is dotted-quad or bracketed IPv6 with scope-id support implementation-defined and unparseable entries ignored for dialing. D15, resolved as a ruling rather than a declaration: the built component's import set includes a toolchain wasi 0.2 tail (io, cli, clocks, filesystem, random — bind's reset and token keys ride wasi:random through the language's entropy source). Declaring one of those interfaces in the source world at a pinned version would fight toolchain drift and split the import in two on mismatch. The world's doc now states what the world is (the deliberately-bound surface) and names the artifact's embedded WIT as the authoritative import manifest. D17 remnant: read(max: 0) resolving some([]) is documented. Addresses #13 findings C9, C10, D15, D17.
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #13 findings C10, C9 (formats), D15, and the D17 remnant — the contract-truthfulness sweep discussed on the C/D tail. Doc rulings only; no behavior changes. Stacked on #59 (shared
connectparagraph).C10 — the dial narrowing is latitude again
"There is no fallback between dial paths" was v0 implementation latitude written as normative text — the one sentence that made an upstream-backed implementation of this WIT non-conformant by construction (upstream always races paths).
connectnow states dial-path selection as implementation-defined (prefer one entry, race several, or fall back — all conforming), with the failure split along #59's taxonomy: exhaustion without an answer istimed-out, refusal or handshake failure isconnect-failed.The narrowing itself doesn't move an inch:
endpoint/src/lib.rsalready records it ("no racing or fallback between dial paths"), and the matrix rows that lean on it ("a passing echo is the assertion that QUIC flowed over UDP") keep working — they assert this implementation's recorded latitude rather than the contract.C9 — address string formats
relay: anhttp(s)base URL; one spelling per relay, normalization implementation-defined beyond the exact string (the current pool's trailing-slash insensitivity stays an implementation detail rather than becoming contract).ip:ip:port, dotted-quad or bracketed IPv6; scope-id support implementation-defined; an entry that does not parse is ignored for dialing but preserved.D15 — resolved as a ruling, not a declaration
The investigation changed the shape of this one. The built component imports a whole toolchain wasi 0.2 tail —
wasi:io,wasi:cli,wasi:clocks@0.2,wasi:filesystem, andwasi:random@0.2.9— versioned by wasi-libc, not by this repository. Declaringwasi:randomalone in the source world would be arbitrary (the world would still under-declare the rest of the tail), and pinning it at today's 0.2.9 would fight toolchain drift: on mismatch the declared import and getrandom's actual import stop unifying and the component imports both.So the ruling, written at the world: the world names the deliberately-bound surface; the composed artifact's embedded WIT is the authoritative import manifest (
wasm-tools component wit <component>); andbind's deliberate entropy use (reset and token keys) rideswasi:randomthrough the language's entropy source — stated, not hidden, without a brittle declaration.D17 remnant
read(max: 0)resolvingsome([])without waiting or consuming is documented — the last of D17's unrecorded divergences.Verified
just check,just matrix(15 rows),just exam-deltic(6/6). Doc-only, but the full gates ran anyway.Addresses #13 (C9, C10, D15, D17).