Enforce or retire the service-side one-time connection-ticket consumption invariant #36

New Issue

2026-08-22T23:29:31+02:00

Kyuubi commented

2026-08-22 23:29:31 +02:00

Parent: #1
Identified by: v1.0.0 pre-release security review (2026-08-22). Severity: minor/informational — no exploitable hole; an ADR-stated service invariant is dead code.

Finding

InMemoryEphemeralRendezvousStore.ConsumeConnectionTicket (InMemoryEphemeralRendezvousStore.cs:756-799) has no production call site — only tests reference it (NatMediationProcessorTests.cs:111, JoinAttemptServiceTests.cs:230, 284-336). ADR 0003 states "Connection ticket lifetime | 20 seconds and one successful host consumption", but single-use is enforced only host-locally in the SDK (ConnectionTicketValidator.cs:44-80, AlreadyConsumed). Server-side replay is in practice closed by IntroductionConsumed (one introduction per attempt) plus the 20 s ticket deadline — so the system invariant holds, but not by the mechanism the ADR names, and the dead store method suggests an unfinished wiring.

Outcome

Either wire service-side consumption where the ADR claims it (and cover it with a production-path test), or delete the dead method and amend ADR 0003 to name the actual enforcing mechanisms (SDK single-use + one-shot introduction + deadline).

Acceptance criteria

No dead consumption path remains; ADR text matches the enforced mechanism.
A test exercises ticket replay against whichever mechanism is authoritative and proves rejection.

Parent: #1 Identified by: v1.0.0 pre-release security review (2026-08-22). Severity: minor/informational — no exploitable hole; an ADR-stated service invariant is dead code. ## Finding `InMemoryEphemeralRendezvousStore.ConsumeConnectionTicket` (`InMemoryEphemeralRendezvousStore.cs:756-799`) has no production call site — only tests reference it (`NatMediationProcessorTests.cs:111`, `JoinAttemptServiceTests.cs:230, 284-336`). ADR 0003 states "Connection ticket lifetime | 20 seconds and one successful host consumption", but single-use is enforced only host-locally in the SDK (`ConnectionTicketValidator.cs:44-80`, `AlreadyConsumed`). Server-side replay is in practice closed by `IntroductionConsumed` (one introduction per attempt) plus the 20 s ticket deadline — so the *system* invariant holds, but not by the mechanism the ADR names, and the dead store method suggests an unfinished wiring. ## Outcome Either wire service-side consumption where the ADR claims it (and cover it with a production-path test), or delete the dead method and amend ADR 0003 to name the actual enforcing mechanisms (SDK single-use + one-shot introduction + deadline). ## Acceptance criteria - No dead consumption path remains; ADR text matches the enforced mechanism. - A test exercises ticket replay against whichever mechanism is authoritative and proves rejection.

Kyuubi referenced this issue

2026-08-22 23:29:54 +02:00

Harden tenant isolation, rate limits, replay defense, parsers, and overload behavior #15

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#36