mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-11-07 03:11:02 +00:00
Josh Siviour
93d14a4a24
* feat(sts): revoke one Lambda environment session by scope and revision * fix(sts): keep the access key out of Lambda session revoke errors * feat(lambda): add the test-link control socket with peer UID checks * fix(lambda): bound the test-link reply wait and keep cancellation sticky * fix(lambda): cap the test-link write by the reply bound and refuse a zero bound * test(lambda): bound the control-socket peer waits and surface peer errors * feat(lambda): issue and revoke the execution session around each test-link Invoke * feat(lambda): serve test-link requests on the control socket and deliver the execution credential to the guest The daemon answers the gateway on the abstract control socket instead of NATS and hands the guest the execution-role credential in its first frame. Test-link builds negotiate spinifex-lambda-testlink/2 on both ends, so a mismatched host and guest fail the handshake before any request is sent, and the agent refuses a frame without a credential. * test(lambda): run the composed test-link seam on real STS and a real control socket The seam now issues and revokes sessions through the real STS service and reaches the daemon's attempt steps over a real abstract control socket. New cases show the guest's credential resolving as the role session with its Lambda labels under the base ARN until Invoke returns, both orders of a give-up revoke against the first frame, a failed revoke staying unknown without the key in logs, a write error after full delivery being unknown and revoked, and legacy NATS forgeries never reaching the caller. * test(lambda): show the test-link daemon refuses only before the VM starts A started process whose launch identity cannot be recorded replies unknown, proven with a stub VM that is alive when its identity is read and an injected write failure. A source check pins every refused reply in the launch path before the VM start. The files the attempt leaves, its reply and the log carry neither the credential nor the code URL. * test(lambda): fail a delivered write at the control client and bound the seam waits A test-only writer at the control client's write boundary forwards both frames, waits until the daemon has read them, then fails the write; the client reports an outcome that is not ErrNotSent. Seam tests now bound every wait, open their gates and cancel their contexts at cleanup, and join the inner exchange they start. * docs(lambda): note the test-link ALPN protocol in the guest contract README * test(sts): satisfy lint in the Lambda session revoke tests * test(lambda): mark the new in-package test-link tests with their reason * fix(lambda): report a refused test-link attempt with a failed revoke as unknown and run the handshake tests in CI