2 Commits

Include renames

Author	SHA1	Message	Date
Dario Gabriel LipicarandClaude Opus 5	e514c53ef5	fix(tokens): separate the INBOUND and OUTBOUND stores — a grant one way was a grant both ways ... TokenManager was one flat map with no direction tag, written from both sides of every relationship: the client stored the token it PRESENTS to a callee under the CALLEE's name, and a token RECEIVED from a caller was stored under the CALLER's name. Same namespace, last write wins. This was documented as safe by topology — separate images keep the two directions apart — and pending only for the shared-runtime migration. That was wrong. It is live in the DEFAULT out-of-process configuration, and the chain needs no attacker: 1. capability_module mints one token so M may call B. 2. It pushes it to B -> B's store gets ["M"] = T (inbound) 3. It returns it to M -> M's store gets ["B"] = T (outbound) 4. B then calls M. B's client looks in its OWN store for something to present to M, finds T because step 2 put it there, and therefore SKIPS requestModule entirely. 5. M authorizes T, having cached the identical value in step 3. One grant M->B silently produces B->M, with no handshake, nothing logged, and capability_module's access policy never consulted. Reproduced on the pre-split tree, both halves red: B's outbound lookup for M returned the token M was issued for calling B Actual: false Expected: true B authorized at M using the token minted for M -> B Actual: true Expected: false A second defect from the same cause: an inbound push CLOBBERS the outbound cache under the same key, so M's next call to B goes out carrying B's own inbound token, is rejected, and burns the single re-exchange recovering from a collision it caused itself. THREE ROLES, TWO MAPS AND A SCALAR: m_outbound callee -> what I present when calling out m_inbound caller -> what I issued to that caller m_credential MY OWN host-issued credential The anchor is what made a two-way split look impossible: it is genuinely both directions, presented outbound to capability_module and compared against inbound. But it is not a MAP. It is one value under two role labels — "core" and "capability_module" — that collide with module names by accident, and adoptCredential already wrote a single credential under every bootstrap key. As a scalar it has no key namespace, so no reverse lookup can produce a name from it. A key living in both maps would have been a rename, not a split. The hoped-for cheap route did not exist: logos_module_accept_token forwards to lp_token_save in BOTH backends, and the Qt glue calls that one export for an inbound caller token in one place and the module's own anchor in another. The doors were never divided, so this could not be done by routing two existing C ABI doors to two maps — but it needs no new door either. Four detector tests red before, green after. Constant time survives at the instruction level and the comparison count stays input-independent. KNOWN GAP, deliberately not fixed here: the generated glue writes the same inbound token through BOTH doors (lidl_gen_cdylib_glue.cpp:371-380). Safe only while module cdylibs are separate images — which is exactly what the shared-runtime migration collapses. Closing it means a dedicated inbound export on the module-impl C ABI: a MINOR bump plus a definition in both backends in the same wave. Price it before that migration lands, not after. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-23 12:07:42 -03:00
Dario Gabriel LipicarandClaude Opus 5	6c24fcb132	feat(caller): resolve who is calling, and declare the export that carries it ... A module can now learn which module is calling it. Not via the LIDL — this is not part of any module's interface, and the callee already has the identity from the token the call carried; the only question was surfacing it. So it is ambient: logos::currentCaller(), no declared parameter, no contract change, no per-method opt-in. WHAT THIS PR CONTAINS * LogosCaller — Unknown | HostAnchor | Module{name, instance?} | Derived{parent, leaf} | Operator{name} — std-typed and Qt-free. * CallerScope, an RAII save/restore around a thread-local STACK. Not a slot: A calling B calling back into A on one thread must nest, and an exception thrown from a handler must still pop. * resolveCaller, replacing the bool fold in ModuleProxy. It reads the INBOUND store #69 made direction-pure — the only store that may legitimately name a caller. * logos_module_set_call_caller DECLARED, and MINOR 5 -> 6. WHY AMBIENT, AND WHY IT MUST CROSS AN IMAGE BOUNDARY LogosProviderObject::callMethod is a vtable slot, and this codebase avoids vtable changes on purpose. But the deeper reason is measured, not stylistic: nm on real binaries shows the host and the module plugin EACH define ModuleProxy::callRemoteMethod and TokenManager::instance, each with its own function-local static at a distinct address, and neither with a single undefined reference to the other's. Mach-O is TWOLEVEL; PE has no interposition. A thread_local opened host-side is NOT the one a handler reads. Since --backend qt is now refused outright, every module is a cdylib and the C ABI push is the only path, not a fallback. The pull is only safe through QMetaObject::invokeMethod on the host's LogosAPI, because metaObject()/qt_metacall are virtual and the vptr was written by the host's constructor — LogosAPI is duplicated across images too, meta-object included, so a direct call would bind to the plugin's copy and read the plugin's TLS, silently empty forever. A dynamic property cannot carry it either: one process-global slot, so two overlapping concurrency:"multi" calls from different callers would clobber each other. Nothing here is spelled "verified". capability_module checks only that an asserted name EXISTS as a key, so the strongest honest word is token-bound. HostAnchor carries no name because core and capability_module hold one token VALUE under two keys by construction. Unknown is the fail-closed value and is always in-band, never spelled by absence. The constant-time fold survives: the matched key is accumulated into a fixed-width buffer with no data-dependent branch, verified at the instruction level (csel, not a branch) with the comparison count invariant. THE BUMP IS SAFE BECAUSE THE BACKENDS WENT FIRST logos-protocol only DECLARES this ABI; every backend owes the definition, and that gap shipped twice. logos-cpp-sdk#147 and logos-rust-sdk#47 already define logos_module_set_call_caller, gated on >= 0.6 and therefore inert until this lands. Verified on x86_64-linux: with this tree as the protocol, BOTH backends at master pass their ABI checks and define the export; manifest reports 0.6.0 with 11 exports. No repo is red at any point. Rule 6 is now normative on a point the two backends had silently diverged on — a present-but-unreadable "instance" is dropped and the module still identified — each having pinned its own answer with a passing test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 17:28:00 -03:00