Align Hosted and one-time reference contracts - #904
Merged
Merged
Conversation
Deploying mouseterm with
|
| Latest commit: |
49d144b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://507fee27.mouseterm.pages.dev |
| Branch Preview URL: | https://spec-cleanup-hosted.mouseterm.pages.dev |
dormouse-bot
reviewed
Oct 2, 2026
dormouse-bot
left a comment
dormouse-bot
left a comment
Collaborator
There was a problem hiding this comment.
The reworded RelayRoom FAIL IF in security-hosted.md no longer catches a future RelayRoom RPC reachable from a public route; suggested wording inline keeps the catch-all while carving out the two account-scoped calls.
nedtwigg
requested a deployment
to
hosted-preview
October 2, 2026 06:23 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
dormouse-bot
approved these changes
Oct 2, 2026
nedtwigg
added this pull request to stack #896
October 2, 2026 13:23
The PR swapped accurate, load-bearing spec content for looser prose or pointers: the exact /connect/ CSP literal, the Laptop UI copy, the rendezvous frame shapes (leaving "`ct` is one base64url Noise message" dangling), the ceremony message shapes, the OneTimeState payloads, the account email-paths sentence, and the Durable Object migrations inventory. It also split two one-time.md bullet lists with blank lines, and parked seven audit findings in the specs as "Known gap" lines, two of which admitted the code fails a FAIL IF. Restore each from base, checked against headers.ts, one-time-wire.ts, e2e-ceremony.ts, one-time-runtime.ts, OneTimeConnection.tsx, App.tsx and the Wrangler configs. Two were stale and are corrected: the idle hint's middle sentence reads "Your phone can be on any network." under `phoneOnAnyNetwork`, and `ended` carries an optional `refusal`. Fix the cookie-route gap: `cookieAdmin` checked `Origin` only on state-changing methods, so a GET/HEAD presenting a sibling origin passed the security-hosted.md cookie FAIL IF's "any presented Origin but its own". It now refuses any presented foreign Origin on every method, and still requires one on state-changing requests. The new boundary test goes red against the old gate. With that fixed, revert the rationale line that pointed at the gap. Drop the other Known gap lines. The sweep-read failure needs a policy decision (fail closed vs. a tighter retry), and restored-token reinsertion, the stale /enroll approval, the open() keygen wait, and the phone client's missing pre-open deadline are real; all five go to issues. Approval body buffering (1 KiB bodyLimit), poll entitlement before the lock, last-slot poll ordering, the delayed-outcome direct wait, and the late wall adapter are not reachable failures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 2, 2026
Closed
dormouse-bot
approved these changes
Oct 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit Hosted, one-time connection, and Hosted security references against the unchanged runtime. Correct the implemented admin-account Relay slice, complete-Noise reservation timing, exact expiry instant, authenticated internal Worker RPC boundary, and operator README. Canonical wire/state types, CSP builders, and Wrangler migrations own their inventories.
Retain the deadline and security obligations while explicitly identifying current Origin, revocation, enrollment, and late-completion gaps. Larger runtime proposals are excluded from this reference cleanup. Four documentation files change.
Validation: source-symbol/direction checks; spec lint and 23 mutations; public-doc checks; security lint and 139 mutations. Stacked on #903.
Trimmed in review. Restored the exact
/connect/CSP literal, the Laptop UI copy strings, the frame and ceremony message shapes, theOneTimeStatepayloads, the email-paths sentence and the migrations inventory, with two stale points corrected. The seven parked "Known gap" lines are gone:cookieAdminnow refuses a foreignOriginon every method, so the code satisfies its FAIL IF (regression test inboundary.test.ts).🤖 Generated with Claude Code