Repository navigation
Session initiation protocol v2 - #98
Merged
Merged
Conversation
The client and server now each contribute a session nonce, and the sush nonce becomes their hash, which neither party chose alone. SessionSeq carries the signer's wall clock reading as an opaque, totally ordered sequence number, spoken as three codephrase words. Sequence numbers are not yet included in the session IDs, but will be shortly. Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
The rack serves a fresh server nonce per fetch, the client mixes in its own nonce and stashes it, the signer's nonce and sequence number come back through the operator, and the rack verifies the v2 session id over them all before gossiping Start(id, seq). The state machine carries the seq but does not yet order by it. Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
Session starts gossip the id's preimage, so every sled derives the id and the sequence number it commits to; a forged pairing of id and sequence number is inexpressible. Adoption and the execution floor follow the signer-assigned order: a start wins the session slot by exceeding the active (sequence number, id) pair, and a job runs only when its session exceeds the committed sequence number, resumes the committed session, or arrives live on a sled with no record. The order is total and global, so the causal machinery it replaces is gone: the starts/started lattice, concurrent-session annihilation, the executed-version join, the burned-universe Bloom set, session hops, in-memory floors, and the gossiped error events. Boundary records move to v1, with the sequence number in the committed job; v0 records convert with a floor of zero. Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
Collaborator
|
I looked through this on a call with @plotnick and I think this looks good. I'm good with merging when it's passed CI. |
Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
This was previously allowed in the state machine, but not actually supported end-to-end (e.g., the server nonce wouldn't match). But it's semantically problematic to allow, so just forbid it. Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
Open
This was referenced Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #91. Adds a signer-assigned session sequence number, which allows sessions to be totally ordered across all racks, networks, and restarts. This lets us drop several overly complex pieces of machinery, primarily the Universe flip-flop detection and its associated Bloom filter (see #79). Depends on oxidecomputer/permission-slip#349 for the signer-side pieces.
Nonce and session ID handling has also been reworked (RFD 620 update coming soon). The
sush-nonceis now derived (hashed over) both a client nonce and a server nonce to ensure that no side-channel is leaked from the rack via nonce selection.SessionIdinstances now come only fromSessionPreimage::session_id, which hashes over the baseboard ID, all of the nonces, and the sequence number, thus committing each session to exactly those parameters. GossipedSessionRequest::Startmessages include just the preimage, so the session ID must be correctly re-derived by each server.The boundary record format changed to drop the bloom filter and add the sequence number, so added a new
v1and conversion routine fromv0; we'll see if the migration machinery works soon!The client signer now uses permslip's new session authentication (see oxidecomputer/permission-slip#348). And the
session startandjob startclient commands now assume a relay flow whenPERMSLIP_URLis unset.