fix(ipc): foundation review remediation

Addresses the full ipc-codegen/ipc-runtime review (68 findings):
- runtime: NAPI lifecycle (close/join, TSFN leak, sync deadline), zero-length
  response deadlock, u64 timeout truncation, max-frame guards, crash cleanup,
  unified constants, UDS timeouts, new cpp/rust/ts test suites
- codegen: schema validation (required error variant, name pairing, reserved
  words), unified server error wrapping, zig comptime handler injection,
  uniform --strip-method-prefix, skeleton/dead-code removal
- wire fixes: rust Option<bytes>/[bytes;N] serde, ts u64 bigint bridging +
  bin32 guards, zig signed-int tolerance, cpp union ordering + PrimAlias so
  schema reflection of generated types round-trips aliases
- tests: golden corpus extended (error variant pinned) with cpp/zig runners,
  error-path + boundary-value steps in every matrix combo, FFI compile checks

Author: charlielye

ipc-codegen/SCHEMA_SPEC.md

@@ -31,8 +31,25 @@ from C++ type metadata via the `MsgpackSchemaPacker` infrastructure.
 ```
 
 - `commands` and `responses` are both **NamedUnion** types (see below).
-- Commands and responses are positionally paired: the Nth command corresponds to the Nth
-  non-error response. The error response (ending in `ErrorResponse`) is shared across all commands.
+- Commands and responses are paired by name: command `Foo` corresponds to the
+  response named `FooResponse`. The error response (ending in `ErrorResponse`)
+  is shared across all commands.
+
+### Validation rules
+
+Schemas are validated at generation time; violations are hard errors:
+
+- Exactly one response variant named `*ErrorResponse` must exist, with
+  exactly one field `message: string`. Generated servers wrap handler
+  failures into this variant; generated clients surface its message.
+- Every command `Foo` must have a matching response `FooResponse`, and the
+  number of commands must equal the number of non-error responses.
+- Command names must be unique.
+- Response schemas must be struct definitions, not type-name strings.
+- Field names must not map (via the snake_case or camelCase projection) to a
+  reserved word in any target language, and two field names in one struct
+  must not collapse to the same projected identifier.
+- C++ `SERIALIZATION_FIELDS` supports at most 20 fields per struct.
 
 ## Type Encodings
 

ipc-codegen/bootstrap.sh

@@ -46,10 +46,15 @@ function test_cmds {
   local prefix="$hash:CPUS=1:TIMEOUT=120s"
   local script="ipc-codegen/echo_example/scripts/run_cross_language_test.sh"
 
-  # Golden tests (Rust + TS each verify they can deserialize the goldens
-  # baked by build()).
+  # Generator unit tests (schema validation).
+  echo "$prefix node --experimental-strip-types --no-warnings ipc-codegen/test/schema_visitor.test.ts"
+
+  # Golden tests (each language verifies it can deserialize the goldens
+  # baked by build(), and re-encode them byte-identically).
   echo "$prefix $script golden rust"
   echo "$prefix $script golden ts"
+  echo "$prefix $script golden cpp"
+  echo "$prefix $script golden zig"
   echo "$prefix ipc-codegen/echo_example/cpp/build/bin/schema_reflection_test --schema ipc-codegen/echo_example/schema/schema.json"
   echo "$prefix ipc-codegen/echo_example/ts_package/test.sh uds"
   echo "$prefix ipc-codegen/echo_example/ts_package/test.sh shm"
@@ -71,14 +76,12 @@ function test_cmds {
     done
   done
 
-  # TS SHM client coverage requires the NAPI addon built by
-  # ipc-runtime/bootstrap.sh under ts/build/<arch>-<os>/.
-  local napi_dir="$(cd ../ipc-runtime/ts 2>/dev/null && pwd)/build"
-  if [ -d "$napi_dir" ] && compgen -G "$napi_dir/*/ipc_runtime_napi.node" > /dev/null; then
-    for server in "${shm_server_langs[@]}"; do
-      echo "$prefix $script matrix $server ts shm"
-    done
-  fi
+  # TS SHM client coverage. The NAPI addon is built by ipc-runtime/bootstrap.sh
+  # during build(); a missing addon should fail these tests loudly rather than
+  # silently dropping coverage.
+  for server in "${shm_server_langs[@]}"; do
+    echo "$prefix $script matrix $server ts shm"
+  done
 }
 
 function test {

ipc-codegen/echo_example/cpp/.gitignore

@@ -1,4 +1,2 @@
 build/
-echo_client
-echo_server
 src/generated/

ipc-codegen/echo_example/cpp/CMakeLists.txt

@@ -50,3 +50,6 @@ target_link_libraries(echo_client PRIVATE echo_common ipc_runtime)
 
 add_executable(schema_reflection_test src/schema_reflection_test.cpp)
 target_link_libraries(schema_reflection_test PRIVATE echo_common)
+
+add_executable(golden_test src/golden_test.cpp)
+target_link_libraries(golden_test PRIVATE echo_common)

ipc-codegen/echo_example/cpp/bootstrap.sh

@@ -10,10 +10,10 @@ $NODE "$CODEGEN/src/generate.ts" \
   --lang cpp \
   --server \
   --client \
-  --uds \
+  --strip-method-prefix \
   --out "$DIR/src/generated" \
   --prefix Echo \
   --cpp-namespace echo
 
 cmake -S "$DIR" -B "$DIR/build"
-cmake --build "$DIR/build" --target echo_server echo_client schema_reflection_test
+cmake --build "$DIR/build" --target echo_server echo_client schema_reflection_test golden_test

ipc-codegen/echo_example/cpp/src/echo_client.cpp

@@ -4,10 +4,18 @@
 #include "generated/echo_ipc_client.hpp"
 
 #include <array>
-#include <cassert>
 #include <iostream>
 #include <string_view>
 
+// Explicit check (not assert): verification must survive NDEBUG builds.
+#define CHECK(cond, label)                                                     \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      std::cerr << "echo_client(cpp): " << (label) << " FAIL\n";               \
+      return 1;                                                                \
+    }                                                                          \
+  } while (0)
+
 namespace {
 echo::Fr test_hash(uint8_t base) {
   echo::Fr hash{};
@@ -33,24 +41,26 @@ int main(int argc, char **argv) {
 
   {
     auto resp = client.bytes({.data = {0xDE, 0xAD, 0xBE, 0xEF, 0x42}});
-    assert((resp.data == std::vector<uint8_t>{0xDE, 0xAD, 0xBE, 0xEF, 0x42}));
+    CHECK((resp.data == std::vector<uint8_t>{0xDE, 0xAD, 0xBE, 0xEF, 0x42}),
+          "EchoBytes");
     std::cerr << "echo_client(cpp): EchoBytes OK\n";
   }
 
   {
     auto resp =
         client.fields({.a = 42, .b = 999999, .name = "hello wire compat"});
-    assert(resp.a == 42 && resp.b == 999999 &&
-           resp.name == "hello wire compat");
+    CHECK(resp.a == 42 && resp.b == 999999 && resp.name == "hello wire compat",
+          "EchoFields");
     std::cerr << "echo_client(cpp): EchoFields OK\n";
   }
 
   {
     auto resp =
         client.nested({.inner = {.values = {{1, 2, 3}, {4, 5}}, .flag = true}});
-    assert((resp.inner.values ==
-            std::vector<std::vector<uint8_t>>{{1, 2, 3}, {4, 5}}));
-    assert(resp.inner.flag == true);
+    CHECK((resp.inner.values ==
+           std::vector<std::vector<uint8_t>>{{1, 2, 3}, {4, 5}}),
+          "EchoNested values");
+    CHECK(resp.inner.flag == true, "EchoNested flag");
     std::cerr << "echo_client(cpp): EchoNested OK\n";
   }
 
@@ -61,13 +71,63 @@ int main(int argc, char **argv) {
                                 .hash = hash,
                                 .maybeHash = second,
                                 .hashes = {hash, second}});
-    assert(resp.treeId == 7);
-    assert(resp.hash == hash);
-    assert(resp.maybeHash == second);
-    assert((resp.hashes == std::vector<echo::Fr>{hash, second}));
+    CHECK(resp.treeId == 7, "EchoAliases treeId");
+    CHECK(resp.hash == hash, "EchoAliases hash");
+    CHECK(resp.maybeHash == second, "EchoAliases maybeHash");
+    CHECK((resp.hashes == std::vector<echo::Fr>{hash, second}),
+          "EchoAliases hashes");
     std::cerr << "echo_client(cpp): EchoAliases OK\n";
   }
 
+  // Optional-absent over live IPC.
+  {
+    auto hash = test_hash(0x10);
+    auto resp = client.aliases({.treeId = 7,
+                                .hash = hash,
+                                .maybeHash = std::nullopt,
+                                .hashes = {hash}});
+    CHECK(!resp.maybeHash.has_value(), "EchoAliases none");
+    std::cerr << "echo_client(cpp): EchoAliases none OK\n";
+  }
+
+  // uint64 wire encoding above 2^32 over live IPC.
+  {
+    const uint64_t big = (1ULL << 53) - 1;
+    auto resp = client.fields({.a = 42, .b = big, .name = "big"});
+    CHECK(resp.b == big, "EchoFields u64");
+    std::cerr << "echo_client(cpp): EchoFields u64 OK\n";
+  }
+
+  // Optional bytes Some/None and fixed [bytes; 2].
+  {
+    auto resp = client.blobs({.maybeData = std::vector<uint8_t>{0xAA, 0xBB},
+                              .parts = {{{1, 2, 3}, {4}}}});
+    CHECK((resp.maybeData == std::vector<uint8_t>{0xAA, 0xBB}),
+          "EchoBlobs maybeData");
+    CHECK((resp.parts == std::array<std::vector<uint8_t>, 2>{{{1, 2, 3}, {4}}}),
+          "EchoBlobs parts");
+    auto resp_none =
+        client.blobs({.maybeData = std::nullopt, .parts = {{{}, {9}}}});
+    CHECK(!resp_none.maybeData.has_value(), "EchoBlobs none");
+    std::cerr << "echo_client(cpp): EchoBlobs OK\n";
+  }
+
+  // Server error surfaces with its message.
+  {
+    bool threw = false;
+    std::string message;
+    try {
+      client.fail({.message = "deliberate failure"});
+    } catch (const std::exception &e) {
+      threw = true;
+      message = e.what();
+    }
+    CHECK(threw, "EchoFail threw");
+    CHECK(message.find("deliberate failure") != std::string::npos,
+          "EchoFail message");
+    std::cerr << "echo_client(cpp): EchoFail OK\n";
+  }
+
   std::cerr << "echo_client(cpp): all tests passed\n";
   return 0;
 }

ipc-codegen/echo_example/cpp/src/echo_server.cpp

@@ -5,6 +5,7 @@
 #include "generated/echo_ipc_server.hpp"
 
 #include <iostream>
+#include <stdexcept>
 #include <string_view>
 
 namespace echo {
@@ -38,6 +39,17 @@ wire::EchoAliasesResponse handle_aliases(EchoCtx & /*ctx*/,
           .hashes = std::move(cmd.hashes)};
 }
 
+template <>
+wire::EchoBlobsResponse handle_blobs(EchoCtx & /*ctx*/, wire::EchoBlobs &&cmd) {
+  return {.maybeData = std::move(cmd.maybeData),
+          .parts = std::move(cmd.parts)};
+}
+
+template <>
+wire::EchoFailResponse handle_fail(EchoCtx & /*ctx*/, wire::EchoFail &&cmd) {
+  throw std::runtime_error(cmd.message);
+}
+
 } // namespace echo
 
 int main(int argc, char **argv) {