alkcall/docs/reviews/consumer-findings-ledger.md

Consumer findings ledger — alkhttp consuming alkcall

Findings from writing the first real consumer (alkhttp) against alkcall. alkcall is deliberately minimal; expect missing features and edge-case bugs to surface here first. Extract items into alkcall tasks/reviews as the project sees fit.

Format: date | found-in (alkhttp context) | severity | status.

---

Open

(none)

---

Resolved

CF-004 — services_schema_handler discloses Internal/ACL-restricted op specs — no visibility or AccessControl check (2026-08-30) — RESOLVED 2026-08-31

• Found in: alkhttp Review 002, finding PRJ-16 (alkhttp/docs/reviews/002-post-remediation-review.md, Part F', verified against tree 91483a7 + alkcall source). Filed to this ledger 2026-08-30. src/registry/discovery.rs:327-343 (services_schema_handler) — the handler did a bare registry.registration(&name) and returned spec_to_json(&reg.spec) verbatim, with no Visibility check and no AccessControl::check(peer_identity).
• Fix: the handler now applies the same two gates as OperationRegistry::invoke — the Internal-visibility rejection (!ctx.internal → spec-404) and AccessControl::check with the same identity resolution invoke() uses (handler_identity when internal, identity otherwise). Restricted ops return NOT_FOUND (spec-404) rather than FORBIDDEN — no information leaks about the restricted surface's existence or shape. The gate is in the handler itself, so every transport (wire /call, HTTP routes, MCP tools) is covered.
• Status: resolved — 2026-08-30.

CF-003 — publish_schema compile failure is fail-open on the wire dispatch path (2026-08-30) — RESOLVED 2026-08-30

• Found in: alkhttp Review 001 post-remediation task review-001-publish-schema-validation-robust (the GW-01/#1 follow-up work). While fixing alkhttp's HTTP-side instance of the pattern, the identical instance was verified on the wire dispatch path: src/protocol/dispatch.rs:352-366 (Dispatcher::dispatch, OperationType::Pub arm) — when a Pub op's publish_schema failed to compile, the pump logged a warn and proceeded with validator: None (silent unvalidated ingest, plus per-request recompile cost).
• Fix: fail-closed at the source — publish_schema is now compiled at registration time in both insertion points (OperationRegistry::register and OperationRegistryBuilder::store); an un-compilable schema is a registration error, so an unvalidated-ingest path can never be constructed. The compiled validator is cached per-op (OperationRegistry::publish_validator) and the dispatch path consumes the cache — the per-request compile is gone. The from_call import path inherits the guarantee (imports register through the same choke point); forwarded-chunk validation on the producer side is the remote peer's dispatch path and now inherits the same fail-closed property.
• Behavior change (semver-relevant): register/builder methods return Err for an un-compilable publish_schema (previously: accepted). Code that registered garbage schemas will now get a registration error instead of a silently-unvalidated op.
• Status: resolved — 2026-08-30.

CF-002 — demux TooLarge skip allocates the full peer-declared length up front (up to ~4 GiB from an 8-byte header) (2026-08-30) — RESOLVED 2026-08-30

• Found in: alkhttp Review 001, finding WS-12 (cross-crate; docs/reviews/001-initial-implementation-review.md, Part B, verified against tree 4a825d3). Filed to this ledger 2026-08-30. src/channels/adapter.rs:144 (run_demux_loop_for_client) — the ChunkError::TooLarge arm allocated let mut discard = vec![0u8; length as usize]; before reading: the buffer was sized from the peer's untrusted 8-byte header (u32 length, up to ~4 GiB).
• Fix: stream-skip with a fixed 64 KiB buffer + read_exact loop consuming length bytes — no allocation sized from peer input. Plus a cumulative skipped-bytes budget (256 MiB) that tears down the connection when a peer loops TooLarge headers to burn bandwidth/CPU. The budget resets on each valid chunk, so legitimate isolated oversized chunks (the resync path, covered by the existing test) are unaffected. The existing demux_resyncs_after_oversized_chunk test passes unchanged.
• Status: resolved — 2026-08-30.

CF-001 — call_single_stream write-failure maps to non-retryable INTERNAL (2026-08-29) — RESOLVED 2026-08-30

• Found in: alkhttp from_wss drop-monitor race tests (WS-02/CON-02, review-001-ws-eof-signal). When the transport mux died mid-call, the write path failed fast and the write-failure mapping produced a non-retryable INTERNAL: failed to write request frame — even though the call never reached the producer and a reconnect/retry would be safe.
• Fix: new retryable CallError::connection_closed constructor (CONNECTION_CLOSED code, retryable: true), applied only to write failures where the call is provably undelivered: call.requested frame write failures on all consumer paths (call/subscribe/publish, single-stream and stream-per-request; the publish pump tags its write stages so only the request-frame stage is retryable). Mid-publish and completed-frame write failures stay INTERNAL (delivery ambiguous — retry unsafe), and the producer-side fail_all(...) on connection close stays INTERNAL. The new code string is additive to the wire error vocabulary; CONNECTION_CLOSED is new — consumers should treat unknown codes per their existing policy (the retryable flag is the machine-readable signal).
• Status: resolved — 2026-08-30. alkhttp follow-up: the review-001-ws-eof-signal race test can now tighten back to retryable-only asserts.