Skip to content

Guard iOS RPC handoff, cancellation and node failover - #83

Draft
takemiyamakoto wants to merge 2 commits into
codex/ios-production-dependency-sourcefrom
codex/ios-authorized-rpc-transport
Draft

takemiyamakoto wants to merge 2 commits into
codex/ios-production-dependency-sourcefrom
codex/ios-authorized-rpc-transport

Conversation

@takemiyamakoto

@takemiyamakoto takemiyamakoto commented Sep 22, 2026 •

Copy link
Copy Markdown

Guarded JSON-RPC mutations previously could outlive queued cancellation or be replayed after reconnect. This candidate carries application-owned authorization to the exact pinned Starscream writer, prevents replay, distinguishes known non-submission from unknown outcomes, and keeps cancellation effective even before request-ID publication. It also fixes node-failover delegate deadlocks, restarts replacement endpoints, and protects legacy subscription IDs against concurrent allocation and cancellation.

This PR is stacked on #82's exact wallet compatibility base. Starscream is pinned to b6ef58590241babdb4fe52e916a02c9e2b749e3d (soramitsu/fearless-starscream#5); no resolved checkout is patched. Ordinary read options retain their defaults. Callback delivery and identity-aware cleanup preserve pending reads and watchers.

Validation: python3 scripts/test-authorized-rpc.py passes 37 distinct tests with no skips, compiling byte-identical production source. Coverage includes real writer cancellation during ID publication, accepted/unknown outcomes, loopback node replacement, callback reentry, active subscriptions, concurrent ID reservation/registration and full ID-space exhaustion. The strict runner records and verifies source hashes. Existing native compatibility CI remains required. The app is being rebuilt against this revised candidate; the earlier 341-test app result belongs to the preceding commit.

This remains a draft implementation candidate. Independent security/release review, protected-base checks including the Jenkins gate, immutable app publication, real-device testing and store-delivered acceptance remain required. Retired physical NWConnection callbacks during same-WebSocket reconnect are a separate open transport issue being addressed before production qualification. No feature is enabled and no funded transaction is authorized by this PR.

@takemiyamakoto takemiyamakoto changed the title Guard RPC writes and preserve uncertain transaction outcomes Guard iOS RPC handoff, cancellation and node failover Sep 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant