fix(remote): fit the hosted path inside relay transport limits - #429
Conversation
The real-stack remote scenarios hit four transport limits: the relay closed busy connections with rate_limited, every connection was dropped at the 60 s ticket expiry, daemon messages above one E2EE frame could not be sent, and requests sealed under a superseded grant generation sat in the device outbox forever. - Separate the connection lease (30 min) from the single-use 60 s ticket. - Carry the frame budget in the admission limits, sized per role (100 frames per 10 s for devices, 1,000 for the daemon), and pace SDK sends below it. - Batch live deliveries into daemon_deliveries envelopes and fragment messages above 60,000 bytes, reassembled by the SDK with bounded state. - Answer stale-generation envelopes once with daemon_rejected so the device fails the request instead of retrying it. - Follow the relay's route view for the paired device, and release each sent envelope from the native outbox so daemon state stays bounded. Signed-off-by: Lokesh <lokeshselvam7025@gmail.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
1 participant
Summary
Step 2 of the remote control roadmap. It fixes the transport limits that failed in the real-stack remote scenarios (real OpenMLS endpoints, real Elixir relay, real control plane, real daemon, real SDK). All 9 scenarios now pass.
rate_limitedstale_grant_generation, leaves the outboxChanges
maxFramesPerWindowandrateWindowMsare now part of the admission limits, validated by the protocol, the control plane, and the relay. Defaults are 100 frames per 10 s for a device and 1,000 for the daemon.RemoteRelayConnectionpaces its sends to 90% of the budget using a bounded queue.daemon_deliveries. A batch waits up to 50 ms and keeps growing while earlier batches are in flight. A reply flushes pending deliveries first, so results never overtake the events before them.daemon_fragmentmessages, each sealed under its own derived operation. The cap is 4 MiB.RemoteDaemonMessageAssemblerreassembles them with bounded state: 4 pending sets, a 60 s lifetime, conflict detection, and no nested fragments.daemon_rejectedand never decrypted. The rejection goes to the frame's source route without moving the reply route. The SDK completes the matching outbox record and publishes afailedstate withdaemonRejection.bridge.observeRelayRoutes()follows the relay's route for the paired device, so a reconnected device gets deliveries before it sends anything.Docs:
e2ee-transport-preflight.mdgets a new "Connection lease and frame budget" section.remote-hosted-path.mdgets a new "Daemon delivery shape" section.decisions.mdrecords the lease and budget decision.Validation
pnpm typecheck,pnpm lint,pnpm format:check,check:boundaries,check:generated: clean.remote-*tests pass (141/141 run, 1 skipped). The daemon hosted-path integration (AXL_RUN_HOSTED_PATH_INTEGRATION=1) passes.mix test17 tests, 0 failures,--warnings-as-errorsclean. New test: "enforces the frame budget carried in the admission limits".pnpm test: 1025/1026 pass. The failure ispackages/tui"pending steering and follow-ups display their actual injection order", which this branch does not touch and which fails about 1 in 3 isolated runs.Notes for review
daemon_rejectedper distinct stale operation (the last 256 are remembered). Its own relay frame budget still bounds this.