feat(wire): delegate parse-path u32 reassembly to auto-gen u32_be (closes audit finding #5)#37
Merged
Merged
Conversation
Replace `u32::from_be_bytes(b[2..6].try_into().ok()?)` (and the dst-slot equivalent) with `u32_be(b[2], b[3], b[4], b[5])` — the auto-generated function produced by t27c from specs/wire.t27. Byte-order equivalence: - `u32::from_be_bytes([b0,b1,b2,b3])` = (b0<<24)|(b1<<16)|(b2<<8)|b3. - t27c-generated `u32_be(b0,b1,b2,b3)` = same expression (see gen/rust/wire.rs). - `try_into().ok()?` on a 4-byte slice never returns None post the length check on line 82; removing it eliminates a dead error path. Consequence: the parse-side arithmetic now lives under the SSOT contract. spec-drift-guard CI (workflow spec-drift-guard.yml, merged in #35) is the enforcement mechanism — any drift between specs/wire.t27 and gen/rust/wire.rs now covers this reassembly path as well. Closes weak-spot audit finding #5 (post-#33 loop): src/wire.rs still used std::from_be_bytes rather than delegating to the auto-gen equivalent, so the parse-path was outside the SSOT umbrella even though the serialize-path (header_byte + be_byte) was inside. Also re-exports `be_byte` and `u32_be` from the `gen` module for symmetry with the other spec-driven helpers. Verification (local): - `cargo build`: clean. - `cargo test --lib`: 101 passed / 0 failed. In particular `wire::tests::header_roundtrips` still passes, confirming byte-order equivalence end-to-end. Anchor: phi^2 + phi^-2 = 3.
gHashTag
added a commit
that referenced
this pull request
Jul 4, 2026
…n/c (#38) Post t27#1337 (ExprCast lowered for Zig and C emitters), specs/wire.t27 can now round-trip through three text backends. This PR commits the generated files and extends spec-drift-guard.yml to enforce byte-identity on all of them. Backends now under drift-guard: - Rust: gen/rust/wire.rs (via t27c gen-rust) — from #35 - Zig: gen/zig/wire.zig (via t27c gen) — new - C: gen/c/wire.c (via t27c gen-c) — new Verified locally with t27c built from t27@3c912d9 (post-#1337 master): - diff -u vs regenerated output on all three: empty. - Zig cast form: @as(u8, @intcast((w >> 24) & 255)) etc. - C cast form: ((uint8_t)(((w >> 24) & 255))) etc. - 0 occurrences of 'unsupported: ExprCast' in Zig or C output. - cargo test --lib: 101 passed / 0 failed. Docs refresh: - docs/T27_FIRST_MIGRATION.md: ExprCast section marked resolved on all four backends (Rust #1320, Zig+C #1337, Verilog pre-#1320). Build section notes drift-guard covers all three text backends. - docs/T27_PORT_STATUS.md: wire.rs row now says 'T27-FIRST (full, multi-target)' and lists all three gen files. Option B closed end-to-end: upstream ExprCast in all four emitters, tri-net multi-target drift-guard live, parse-path delegates to auto-gen u32_be (#37). Anchor: phi^2 + phi^-2 = 3. Co-authored-by: Perplexity Computer <agent@perplexity.ai>
gHashTag
pushed a commit
that referenced
this pull request
Jul 4, 2026
…dit-trail primitive Bounded expansion (not full v1). The skeleton previously proposed the auditability primitive abstractly (Sections 1-4); this commit adds Section 5 reporting that the primitive is now empirically realized end-to-end at tri-net main dc1bebb + t27 master 3c912d9. Section 5 subsections: - 5.1 What is materialized -- one spec (specs/wire.t27), three generated backends (gen/{rust,zig,c}/wire.*), one workflow (spec-drift-guard.yml), consumer path under the same umbrella (src/wire.rs -> u32_be). - 5.2 Audit-trail tuple (concrete instance) -- (tri-net@dc1bebb, t27@3c912d9, spec-drift-guard run) is the minimal fetch set for a third party to independently verify byte-identity. - 5.3 Merge chain table -- 5 tri-net PRs (#33/#34/#35/#37/#38) + 2 t27 PRs (#1320/#1337) with merge SHAs. - 5.4 Empirical checks at HEAD -- three diff -u results (all empty), zero 'unsupported: ExprCast' in Zig/C output, 101 lib tests green including header_roundtrips as empirical byte-order-equivalence proof. - 5.5 What this reference impl does NOT show -- byte-identity is not functional correctness; only one spec is covered so far; no silicon; trust in t27c itself is not eliminated (moved, per Carrone 2026). Sync updates across the doc: - Header cross-link: 91a5b63 -> dc1bebb (post-#38). - Section 3.1: describes all three gen targets, not just Rust. - Section 3.2: drift-guard covers Rust + Zig + C; links to #35 + #38. - Section 3.3: ExprCast marked resolved on all four backends (Rust #1320, Zig+C #1337, Verilog pre-#1320). - Section 6 (Limits): removed obsolete 'Rust-only SSOT until #1333' bullet; added trust-surface-of-t27c and no-HDL-target-yet bullets. - Section 7 (Future work): struck through completed Zig+C drift-guard item; added protocol-stack expansion, t27c deterministic-build items. - Appendix A: three-target reproducibility recipe (8 steps), pins tri-net@dc1bebb + t27@3c912d9. Draft only -- not for external circulation. Anchor: phi^2 + phi^-2 = 3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replace
u32::from_be_bytes(b[2..6].try_into().ok()?)(and the dst-slot equivalent) insrc/wire.rs::Header::parsewith the auto-generatedu32_be(b[2], b[3], b[4], b[5])fromgen/rust/wire.rs(produced byt27c gen-rust specs/wire.t27).Also re-exports
be_byteandu32_befrom thegenmodule for symmetry with the other spec-driven helpers.Why
Post-merge weak-spot audit finding #5 (this loop). Before this PR:
Header::to_bytesviaheader_byte+be_byte): under SSOT umbrella.Header::parse): usedstd::u32::from_be_bytes, outside the SSOT.Byte-order equivalence:
u32::from_be_bytes([b0,b1,b2,b3])=(b0<<24)|(b1<<16)|(b2<<8)|b3.u32_be(b0,b1,b2,b3)= same expression (seegen/rust/wire.rs).try_into().ok()?on a 4-byte slice never returnsNonepost the length check on line 82; removing it also eliminates a dead error path.Consequence: the parse-side arithmetic is now covered by spec-drift-guard (merged in #35). Any future drift between
specs/wire.t27andgen/rust/wire.rsfails CI, and this call site is downstream of that.Verification (local)
cargo build: clean.cargo test --lib: 101 passed / 0 failed. In particularwire::tests::header_roundtripsstill passes, confirming byte-order equivalence end-to-end.wire::tests::bad_version_rejectedalso unchanged.Scope
gen/**— this PR modifies hand-writtensrc/wire.rsonly. Drift-guard will run because of the path filter matchingsrc/**? No — drift-guard filters only onspecs/**,gen/**,build.rs, and the workflow itself. This PR falls outside those filters; regular CI (build + test (-sim baseline)) will run as usual.Follow-ups
gen/zig+gen/c): blocked on #1337 merge.Anchor: phi^2 + phi^-2 = 3.