linus-dandClaude Opus 4.8
9d9d5ce41c
Builds the browser game around the existing Rust runtime: a window into the universe, not a second simulation. Pure std, no external crates. New crates: - protocol: versioned, hashable client/server messages + hand-rolled JSON value and total parser (malformed packet -> Err, never panic). - game_runtime: authoritative match state. Resolves turns through the INDEPENDENT interpreter (runtime_under_test::native_resolve), not the reference engine; filters visibility/knowledge; records and regenerates replays. A match is a pure function of (seed, roster, ordered inputs). - web_assets/web_client: embedded browser client (arena, rune editor, knowledge panels, replay viewer) + static HTTP delivery. - server: std::net HTTP + WebSocket (hand-rolled SHA-1/base64/RFC-6455 framing), turn timer, disconnect handling, panic-proof dispatch, poison-tolerant lock. - web_tests: dependency-free WebSocket test client + Phase H gates. Trust hardening per review: - game_runtime no longer delegates to reference_runtime::execute; it runs the independent interpreter that the runtime-equivalence gate proves correct. - Protocol/socket/replay/visibility/resilience gates are merge-blocking (added to the merge_group-required job in merge-gates.yml): 1k matches/0 drift, 10k fuzz/0 panics, 100 headless socket E2E, 0 hidden-state leaks. - Rendered-browser E2E is marked EXTERNAL-BLOCKED: Playwright runs advisory-only (continue-on-error, artifacts) until CI infrastructure with a browser exists; it is treated as unsatisfied, not green. The headless 100-match gate is labeled protocol-level coverage, not rendered-browser coverage. - README documents the hand-rolled crypto/parser audit risk explicitly. Fixes an integer-overflow panic in observed-volatility inference (i64 sum / abs near i64::MIN) that could poison the server mutex. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85 lines
3.0 KiB
Rust
85 lines
3.0 KiB
Rust
//! Phase H gate: protocol fuzzing. The web CI minimum is "10,000 protocol fuzz
|
|
//! cases" with "0 server panics". Decoding is total, so every byte string must
|
|
//! yield `Ok` or `Err` — never an unwind. A sample is also fired at a live
|
|
//! server to prove a malformed packet cannot bring it down.
|
|
|
|
use protocol::{json, ClientMessage};
|
|
use web_tests::{spawn_test_server, WsClient};
|
|
use world_model::Rng;
|
|
|
|
/// Generate a pseudo-random byte string from a seed, with a bias toward
|
|
/// JSON-ish characters so the parser's deeper paths are exercised.
|
|
fn fuzz_bytes(seed: u64) -> Vec<u8> {
|
|
let mut rng = Rng::derive(seed, "fuzz");
|
|
let alphabet = b"{}[]\":,0123456789tfnuelavabcdef.- \\/\n\t";
|
|
let len = rng.below(80);
|
|
(0..len)
|
|
.map(|_| {
|
|
if rng.chance(0.85) {
|
|
alphabet[rng.below(alphabet.len())]
|
|
} else {
|
|
rng.next_u64() as u8
|
|
}
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
#[test]
|
|
fn ten_thousand_fuzz_cases_never_panic() {
|
|
let mut ok = 0u64;
|
|
let mut err = 0u64;
|
|
for seed in 0..10_000u64 {
|
|
let bytes = fuzz_bytes(seed);
|
|
let text = String::from_utf8_lossy(&bytes);
|
|
// Raw JSON parse must be total.
|
|
let _ = json::parse(&text);
|
|
// Full client-message decode must be total.
|
|
match ClientMessage::decode(&text) {
|
|
Ok(_) => ok += 1,
|
|
Err(_) => err += 1,
|
|
}
|
|
}
|
|
// The point is the absence of a panic; both counters are just evidence the
|
|
// loop ran to completion.
|
|
assert_eq!(ok + err, 10_000);
|
|
}
|
|
|
|
#[test]
|
|
fn structured_but_invalid_messages_are_rejected_not_panicked() {
|
|
let cases = [
|
|
"{}",
|
|
"{\"v\":1}",
|
|
"{\"v\":2,\"type\":\"Ping\",\"body\":{}}", // wrong version
|
|
"{\"v\":1,\"type\":\"Nope\",\"body\":{}}", // unknown type
|
|
"{\"v\":1,\"type\":\"SubmitTurn\",\"body\":{}}", // missing fields
|
|
"{\"v\":1,\"type\":\"JoinMatch\",\"body\":{\"name\":5}}", // wrong type
|
|
];
|
|
for c in cases {
|
|
assert!(ClientMessage::decode(c).is_err(), "should reject: {c}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn live_server_survives_malformed_packets() {
|
|
let addr = spawn_test_server(30);
|
|
let mut c = WsClient::connect(&addr).expect("connect");
|
|
// Fire a burst of garbage frames (kept modest so the join reply is not
|
|
// starved behind a flood of rejection reports; decode breadth is covered by
|
|
// the 10k case test above).
|
|
for seed in 0..40u64 {
|
|
let bytes = fuzz_bytes(seed);
|
|
let _ = c.send_raw_bytes(&bytes);
|
|
}
|
|
// Also send raw garbage text.
|
|
for s in ["", "{", "garbage", "{\"v\":1,\"type\":\"X\",\"body\":1}"] {
|
|
let _ = c.send_raw_text(s);
|
|
}
|
|
// The server must still be alive and respond to a valid join.
|
|
c.send(&ClientMessage::JoinMatch { name: "after-fuzz".into(), match_id: None })
|
|
.expect("send join");
|
|
let m = c
|
|
.recv_until(|m| matches!(m, protocol::ServerMessage::MatchState { .. }))
|
|
.expect("server still serving after fuzz");
|
|
assert!(matches!(m, protocol::ServerMessage::MatchState { .. }));
|
|
}
|