2 Commits

Include renames

Author	SHA1	Message	Date
Dario LipicarandClaude Opus 5	c0df466172	fix: integer signedness in the codec, and a shape check on the pending-call sentinel (#31) ... * fix(codec): signedness and range are part of the integer type Codec<T>::from accepted any integral JSON number and handed it to .get<T>(). That is silent in both directions: .get<uint64_t>() on -1 -> 18446744073709551615 (a sign flip) .get<int32_t>() on 2^40 -> truncated Both now reject with the usual path-carrying CodecError instead. Rejecting is the codec's existing contract — a value the declared type cannot represent must not reach business logic wearing a different one — this just extends it to the half of the integer domain it was skipping. Note the check is on the JSON category, not the value: a negative literal parses as number_integer and never as number_unsigned, so `is_number_unsigned()` is the reliable discriminator rather than a comparison after conversion. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(async): the pending-call sentinel is matched by shape, not by key presence All four detection sites tested `m.contains(pendingCallKey())` and nothing else, so ANY user map carrying that key was taken for a deferred call: the consumer extracted a call id, found no completion, and waited out a nested event loop. The measured outcome is a ~20s HANG, not a fast failure. An `any` slot is enough to reach it — anything a user can put in a map. logos::isPendingCallSentinel now requires the canonical shape: exactly one entry, under the sentinel key, holding a non-empty string. Shape and signature are mirrored from isUnauthorizedSentinel (logos_rpc_status.h), QJsonObject arm included — the two are the same kind of in-band marker and there was no reason for them to be guarded differently. That guard, and isTaggedBytes's, both already existed in this repo; the difference was chronology, not principle. Behaviour-preserving: the generated glue builds this map with exactly one entry whose value is a QString call id, so no real sender changes. The concurrent dispatch tests pass unchanged. NARROWS, DOES NOT CLOSE — and the tests say so out loud. A one-key, string-valued forgery IS the sentinel; no predicate can separate them. It still hangs, and because call ids are a per-object counter from 0, a forged "lc-0" can collide with a genuine in-flight completion and steal its result. Closing that needs an out-of-band channel for "deferred", which the single-QVariant dispatch slot cannot express without an ABI break — the constraint is stated at logos_rpc_status.h:24-27 and is real. tests: 10 new, including one asserting the forgery still matches, so a future reader cannot mistake the green cells for "the sentinel is safe". 236/236. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-07-29 11:50:18 -03:00
Dario LipicarandClaude Opus 4.8	4ea32a314a	Per-module concurrent dispatch: async provider seam + transports (#5) ... * feat: per-module concurrent dispatch (concurrency:"multi") — zero ABI change A "multi" module serves calls concurrently behind the ORDINARY callMethod — no new provider/host vtable method, so LogosProviderObject's ABI is byte-identical to before and an old host/daemon loads and forwards a multi module unmodified. Mechanism: a multi module's generated glue returns a pending sentinel ({"__logos_pending_call__": callId}) from callMethod and pushes the real result back later as a __logos_call_complete__ event keyed by callId, over the existing event channel. The consumer transport detects the sentinel and awaits the completion transparently, so generated clients are unchanged. - logos_async_dispatch.h: shared wire constants + the contract. - remote_transport.cpp (QtRO) / plain_logos_object.{h,cpp} (plain): consumer sentinel detection + await keyed by callId. The host is a pure forwarder. - logos_protocol.h + nix/default.nix: protocol 0.2.0 (additive minor; same MAJOR stays compatible, so an old host accepts a 0.2 "multi" module). - rpc_server.cpp: fix a teardown self-deadlock (stop() held m_mu while invoking a per-connection error handler that re-locks m_mu) that the new in-process subscription path exposed. - tests/protocol/test_concurrent_dispatch.cpp: proves a multi provider overlaps two concurrent calls (peak 2) while single serializes (peak 1), over the plain transport, with the host unchanged from master. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: coalesce concurrent async requestModule handshakes (+ async fan-out test) A driver that fans out N async calls to an un-tokened target before any completes used to fire N separate requestModule handshakes. Each mints a distinct capability token and informs the target, and the later inform OVERWRITES the earlier token there (the target stores one token per caller), so the already-dispatched calls carried a superseded token and the target rejected them as unauthorized ("auth token not recognized"). The sync path never hit this — it blocks per call, so handshakes never overlap. Coalesce in LogosAPIClient::invokeRemoteMethodAsync: the first async call to an un-tokened target starts ONE handshake; concurrent calls to the same target queue behind it and all drain with the single minted token when it resolves. m_pendingHandshakes is touched only on the owner thread, so no lock (appended last per the class's ABI note). This is what lets a concurrency: "multi" worker actually run a single-threaded driver's fan-out concurrently — otherwise the fanned-out calls are rejected before reaching dispatch. Also add MultiProviderOverlapsAsync / SingleProviderSerializesAsync to the concurrent-dispatch gtest: they fire N concurrent callMethodAsync() calls (the fan-out pattern over the async consumer path, which the sync tests don't exercise) and assert peak overlap 4 for "multi", 1 for "single". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-19 15:54:42 -03:00