Repository navigation

Correctness and robustness fixes from a deep audit against the C reference - #394

Merged

pavel-kirienko merged 35 commits into

masterfrom

dev

Jul 18, 2026

Commits on Jul 18, 2026
- Fix RX-path crash on crafted gossip names; guard CAN reader ingest
  
  pavel-kirienko
  and
  claude
  committed
  b78e47f
- Wrap the subject-ID hash+evictions² sum mod 2^64 to match the reference
  
  pavel-kirienko
  and
  claude
  committed
  ac84d05
- Make the UDP fragment-tree right-neighbor lookup inclusive per the reference
  
  pavel-kirienko
  and
  claude
  committed
  d2102a6
- Seed the UDP transfer-ID history with the unmasked 64-bit sentinel
  
  pavel-kirienko
  and
  claude
  committed
  feef062
- Destroy idle slot-free CAN RX sessions at the transfer-ID timeout
  
  pavel-kirienko
  and
  claude
  committed
  43e57de
- Fix CAN FD framing: the frame format follows the interface, never BRS
  
  pavel-kirienko
  and
  claude
  committed
  af3af85
- Classify wildcards by whole segment, not by character containment
  
  pavel-kirienko
  and
  claude
  committed
  d5e3e5f
- Allow CAN unicast to remote node-ID 0
  
  pavel-kirienko
  and
  claude
  committed
  03f278e
- Drop SLCAN standard-ID data frames instead of aliasing them as extended
  
  pavel-kirienko
  and
  claude
  committed
  deee162
- Restrict Linux multicast RX sockets to their own group membership
  
  pavel-kirienko
  and
  claude
  committed
  fa40030
- Validate subject_id_modulus with the reference predicate
  
  pavel-kirienko
  and
  claude
  committed
  7aaae71
- Wake a parked SocketCAN reader on close/fail
  
  pavel-kirienko
  and
  claude
  committed
  bbab7ab
- Send UDP redundant interfaces concurrently with per-socket serialization
  
  pavel-kirienko
  and
  claude
  committed
  a5c4ef1
- Use conforming subject-ID moduli in tests after the modulus validation
  
  pavel-kirienko
  and
  claude
  committed
  b56395e
- Bound subject_id_modulus validation against oversized values
  
  pavel-kirienko
  and
  claude
  committed
  93833db
- Harden the UDP concurrent send path
  
  pavel-kirienko
  and
  claude
  committed
  8993ad0
- Refine SocketCAN close/fail RX semantics
  
  pavel-kirienko
  and
  claude
  committed
  7d015c1
- Make node and transport setup paths transactional
  
  pavel-kirienko
  and
  claude
  committed
  e414d6b
- Keep response streams alive across node close and implicit GC
  
  pavel-kirienko
  and
  claude
  committed
  4bcbf69
- Bound per-remote state under untrusted traffic
  
  pavel-kirienko
  and
  claude
  committed
  6c20570
- Update docs and changelog for the correctness fixes
  
  pavel-kirienko
  and
  claude
  committed
  b5b3551
- Address review round 1: doc gaps, TX-socket rollback, comment cleanup
  
  pavel-kirienko
  and
  claude
  committed
  7d4b57e
- Simplify per review consensus: dedicated node housekeeping task
  
  pavel-kirienko
  and
  claude
  committed
  af9f4c0
- Fix Windows CI: avoid a real loopback multicast send in the lock test
  
  pavel-kirienko
  and
  claude
  committed
  a0439dc
- Bump version and clean the changelog
  pavel-kirienko
  committed
  cf148b0
- Update the review-loop skill
  pavel-kirienko
  committed
  15daf8a
- Set FDF and BRS on every CAN FD frame
  
  pavel-kirienko
  and
  claude
  committed
  f5761e3
- Stop acting on a closed node; guard the last constructor acquisition
  
  pavel-kirienko
  and
  claude
  committed
  01e8c23
- Count a cancelled interface as a failed send, not a delivery
  
  pavel-kirienko
  and
  claude
  committed
  a1fbcd5
- Keep the periodic housekeeping loops alive across a faulty sweep
  
  pavel-kirienko
  and
  claude
  committed
  4b3bbb9
- Fix media teardown: deregister before close, and don't misreport a clean close
  
  pavel-kirienko
  and
  claude
  committed
  7970964
- Record why three unbounded-looking structures are correct as written
  
  pavel-kirienko
  and
  claude
  committed
  51c01ba
- Run ruff in CI, test on Python 3.14, and tidy loose ends
  
  pavel-kirienko
  and
  claude
  committed
  ba5316a
- Tolerate event loops without reader/writer registration
  
  pavel-kirienko
  and
  claude
  committed
  aca2eec
- Downsize the comments and docs added by this branch
  
  pavel-kirienko
  and
  claude
  committed
  6e3b369

Navigation Menu

Repository navigation

Correctness and robustness fixes from a deep audit against the C reference - #394

Correctness and robustness fixes from a deep audit against the C reference#394
pavel-kirienko merged 35 commits into
masterfrom
dev

Commits on Jul 18, 2026

Fix RX-path crash on crafted gossip names; guard CAN reader ingest

Wrap the subject-ID hash+evictions² sum mod 2^64 to match the reference

Make the UDP fragment-tree right-neighbor lookup inclusive per the reference

Seed the UDP transfer-ID history with the unmasked 64-bit sentinel

Destroy idle slot-free CAN RX sessions at the transfer-ID timeout

Fix CAN FD framing: the frame format follows the interface, never BRS

Classify wildcards by whole segment, not by character containment

Allow CAN unicast to remote node-ID 0

Drop SLCAN standard-ID data frames instead of aliasing them as extended

Restrict Linux multicast RX sockets to their own group membership

Validate subject_id_modulus with the reference predicate

Wake a parked SocketCAN reader on close/fail

Send UDP redundant interfaces concurrently with per-socket serialization

Use conforming subject-ID moduli in tests after the modulus validation

Bound subject_id_modulus validation against oversized values

Harden the UDP concurrent send path

Refine SocketCAN close/fail RX semantics

Make node and transport setup paths transactional

Keep response streams alive across node close and implicit GC

Bound per-remote state under untrusted traffic

Update docs and changelog for the correctness fixes

Address review round 1: doc gaps, TX-socket rollback, comment cleanup

Simplify per review consensus: dedicated node housekeeping task

Fix Windows CI: avoid a real loopback multicast send in the lock test

Bump version and clean the changelog

Update the review-loop skill

Set FDF and BRS on every CAN FD frame

Stop acting on a closed node; guard the last constructor acquisition

Count a cancelled interface as a failed send, not a delivery

Keep the periodic housekeeping loops alive across a faulty sweep

Fix media teardown: deregister before close, and don't misreport a clean close

Record why three unbounded-looking structures are correct as written

Run ruff in CI, test on Python 3.14, and tidy loose ends

Tolerate event loops without reader/writer registration

Downsize the comments and docs added by this branch