Repository navigation
Decide socket DoS budgets: fix in-map or defer #109
Description
Question
Audit finding #5 (medium), the map's one defer-or-fix scope call (HITL): authorized socket peers can perform low-cost availability attacks — frame size is capped but there are no connection, in-flight-request, or read/write-idle limits, and commit/rollback requests queue without a per-peer budget (evidence: crates/agenticd/src/server.rs:140, crates/agentic-proto/src/framing.rs:70).
Threat-model context for the call: the v1.0 topology is a co-located sidecar over a Unix socket with UID-allowlisted peers, pre-design-partner — the "attacker" is your own worker.
To settle:
- Fix in-map now, or defer to post-launch backlog?
- If FIX: graduate the fog (connection limits, frame-read deadlines, per-UID concurrency/rate budgets, queue-depth metrics) into concrete tickets on this map.
- If DEFER: open a regular tracked issue (not a wayfinder child) capturing the finding, and record the defer rationale here.
Resolution records: the call, plus either new ticket links or the backlog issue link.
Activity
tonibergholm commentedon Jul 9, 2026
Resolution (grilling session with Toni, 2026-07-10)
Decision: defer, with a carve-out (option b).
The v1.0 threat model makes the bulk of this non-blocking: agenticd is a co-located Cloud Run sidecar over a Unix socket with UID-allowlisted peers, so the only party who can open the socket is the operator's own Coding worker at a known UID — no untrusted caller exists until design-partner onboarding (post-launch). The audit ranked this lowest of the six findings, and stapling a multi-part hardening effort onto the map would stretch the destination past what the audit made urgent.
Carved out and kept in-map: Read-idle timeout on the agenticd connection loop — a few lines closing the cheapest, most embarrassing slice (a peer that opens a socket and never completes a frame holding a
spawn_localtask forever). Wired as a blocker of the map-close verification.Deferred to backlog (regular tracked issue, not a wayfinder child): Socket availability hardening: connection caps, per-UID budgets, queue-depth metrics — per-connection/per-UID concurrency caps, rate budgets,
commit_lockqueue-depth metric, write-idle deadline. Revisit trigger recorded there: any deployment shape beyond the single-tenant co-located sidecar, or the first design partner.Grounding facts: the accept loop
spawn_locals connection handlers unboundedly (crates/agenticd/src/main.rs:298); the connection loop has no read/write-idle deadline (server.rs:140); frame size is capped but frame timing is not (framing.rs:70);commit_lockqueues without a depth bound.Add a read-idle timeout to the agenticd connection loop (#123)