alkhttp/tasks/websocket/review-001-ws-session-limits.md at 509850de3d3d45dd6171e177d4f7d8f687e20cc5

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

2.7 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 WS subsystem lifecycle/staleness findings over src/websocket/upgrade.rs and byte_adapter.rs:

WS-01 (major): the single demux loop means one dribbled chunk stalls all channels indefinitely — alkcall's demux has no read timeout and a peer header [ch=0][len=16 MiB] + one byte/ minute parks the allocation and hangs every outstanding channel-0 call (Sub/Pub pendings until the socket dies). Add a configurable idle timeout on the WS read that closes with 1001 on staleness (deployment knob; default bounds the stall).
WS-07: poll_shutdown drops a fresh clone of write_tx (byte_adapter.rs:269-276) so the channel never closes and the documented ws_sink.close() never runs at shutdown — the from_wss path never emits a WS Close frame at all. Drop the held sender.
WS-08: _pumps is dropped immediately (upgrade.rs:36); the documented forced-teardown lever WsPumps::abort() is never callable on the server path. Retain the handle so a stuck session is evictable in-crate.
WS-09: no cap on WS sessions (post-auth DoS); the assembly layer cannot add one because the route is built inside HttpAdapter. Add a semaphore in ws_upgrade_handler (configurable; document the default).
WS-10: dispatcher/mux tasks outlive a failed session task (upgrade.rs:65-97) — self-healing but a peer-behavior-tied leak window. Document the semantics (the cheap fix) or tie task lifetimes to the session.
Fold-in from review-001-hyper-server-knobs: SRV-10's policy-injection point (channel cap) belongs here if that task doesn't land it.

Acceptance Criteria

Idle timeout bounds a dribble stall (test: dribbling peer's channels fail/bound rather than hang forever)
shutdown() causes a WS Close frame to the peer (test)
_pumps retained; abort() reachable on the server path
Session concurrency cap configurable in HttpAdapter; enforced (test)
Detached-task lifetime semantics documented (WS-10)
cargo test and cargo clippy --all-targets -- -D warnings pass

References

docs/reviews/001-initial-implementation-review.md (Part B, WS-01, WS-07..WS-10)
docs/architecture/decisions/048-websocket-native-session-not-gateway.md

Notes

Agent fills during implementation. Takes the EOF-signal task first (same files, and the lifecycle knobs build on the lossless signal).

Summary

Filled on completion.

2.7 KiB Raw Blame History