feat(net): portable C network core, POSIX driver, TLS providers (stack B) - #306
Draft
HalfSweet wants to merge 2 commits into
Draft
feat(net): portable C network core, POSIX driver, TLS providers (stack B)#306HalfSweet wants to merge 2 commits into
HalfSweet wants to merge 2 commits into
Conversation
…t client, POSIX driver, TLS providers (stack B) engine/net (stacked PR B of three, on top of A's contracts): HTTP/1.1 client and server, the RFC 6455 client, the strict framing profile, bounded receive/send queues with backpressure, the immutable policy (contracts/spec/network-policy.ts), tick queues with a per-tick budget and readable-before-terminal ordering, and the TLS handshake state machine. The only host interfaces are pnet_driver_ops (a BSD/lwIP driver under drivers/posix) and an optional pnet_tls_ops TlsProvider: the OpenSSL reference provider (drivers/openssl) and the conformance harness — pnet_unit_test (framing, URL, policy, JSON, codecs, tick queue), pnet_host_test (both cores over real loopback sockets against scripted peers) and pnet_tls_test (an in-process OpenSSL PKI: valid chain, unknown CA, expired, hostname mismatch, untrusted clock, development-insecure refusal, WSS echo) under ASan/UBSan.
…nned semantics, policy parser parity (stack B) The review fixes for the C core (stack B): - poll is transactional (reviewer item 2): the batch is sized and reserved before a single visible event is dequeued; an allocation failure leaves the whole visible set in place and the next poll retries, so a handle's terminal end/error is never lost to the heap cap (the ESP host caps the core at 1 MiB). pnet_*_poll_render / _consume expose the two phases for hosts that marshal the batch into a guest value. Unit tests pin the deferred batch, idempotent render and consume-exactly-the-rendered set. - getaddrinfo runs on the driver's resolver worker (item 4): a pthread on desktop, the pnet-dns task on ESP-IDF; the network task's select loop, the sockets and the core's deadlines keep running during a lookup (connectMs covers DNS). The host test drives a hostname through the worker, checks NXDOMAIN → dns, and shows a literal-address exchange completing while a lookup is in flight. - Spec-pinned semantics (item 9): the client uses PNET_METHODS_FORBIDDEN (TRACK included) and PNET_HTTP_CORE_OWNED_REQUEST_HEADERS, framing uses pnet_status_is_bodyless, the redirect plan (pnet_http_redirect_plan) uses the spec's tables, the server refuses content on every null-body status (205 included); pnet_unit_test runs contracts/spec/vectors/ http-semantics.json. - Policy parser parity (item 1/3): pnet_policy_parse accepts exactly the canonical ResolvedNetworkPolicy (version 1, A-label hostnames, no bare wildcard, no wildcard over an IP literal, no leading-zero IPv4 octets) and runs contracts/spec/vectors/network-policy.json; pnet_json records container source spans so a sub-document can be handed to another parser.
This was referenced Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stack B of 3 (on top of #305, stack A).
engine/net: the portable C network core — HTTP/1.1 client and server, RFC 6455 client, strict framing profile, bounded receive/send queues with backpressure, the immutable policy (the plan'sResolvedNetworkPolicy), tick queues with a per-tick budget and readable-before-terminal ordering, the TLS handshake state machine;pnet_driver_ops(BSD/lwIP driver underdrivers/posix) andpnet_tls_ops(OpenSSL reference provider; the ESP-TLS provider is in stack C) are the only host interfaces. The conformance harness (pnet_unit_test,pnet_host_testover real loopback sockets,pnet_tls_testagainst an in-process OpenSSL PKI) runs under ASan/UBSan.Review-round changes in this PR (reviewer items 2, 4, 9, 1/3)
pollis transactional (2). The batch is sized and reserved before a single visible event is dequeued; an allocation failure leaves the visible set intact and the next poll retries — a handle's terminalend/errorcan no longer vanish under the heap cap (the ESP host caps the core at 1 MiB).pnet_*_poll_render/_consumeexpose the two phases for hosts that marshal into a guest value. Unit tests pin the deferred batch, idempotent render, consume-exactly-the-rendered set with a freeze in between. The original repro (cap at current usage →pollreturned NULL,visible_count0, terminal lost) now recovers.getaddrinforuns on the driver's resolver worker (pthread /pnet-dnstask on ESP-IDF); select, sockets and the core's deadlines keep running during a lookup, soconnectMscovers DNS as the spec says. Host test: hostname through the worker, NXDOMAIN →dns, a literal-address exchange completes while a lookup is in flight.spec.h(pnet_http_redirect_plan,pnet_status_is_bodyless,pnet_status_is_null_body); the server refuses content on 205;pnet_unit_testrunscontracts/spec/vectors/http-semantics.json.pnet_policy_parseaccepts exactly the canonical document (version 1, A-label hostnames, no bare wildcard, no wildcard over an IP literal, no leading-zero IPv4 octets) and runscontracts/spec/vectors/network-policy.json— the same decisions as the TypeScript reference and the Rust core. The header comment now states the true provenance (plan → host → core).Validation
ctest --test-dir engine/net/build3/3 under ASan/UBSan: unit 519 checks, host 171 checks, tls 16 checks.