Repository navigation
Cross-machine submissions + cold-start audit fixes - #13
Merged
Merged
Conversation
'jobkit submit' no longer requires the blobs to already exist in the coordinator's store. After authentication the submitter uploads the three blobs (manifest, elf, input) as content-addressed frames before the descriptor: - Trust comes from the hash, not the sender: BLAKE3(bytes) must equal the claimed id — a wrong-hash upload is rejected and the descriptor refused. - The descriptor is accepted only when all three blobs are present in the coordinator's store, so an old client that skips the upload gets an actionable 'blob missing: <label> (id) — send BlobUpload first' instead of a failed materialize minutes later. - Bounds: 16 MiB per blob, 8 uploads per connection (a descriptor has exactly three); the admission PoW already prices the connection. 'jobkit submit' now uploads from its own store automatically and prints the hash-verified upload step; the network test drives the full cross-machine flow (separate submitter store, wrong-hash rejection, actionable refusal, quorum accept by two workers). Also fixes a cold-start audit find: the scaffold wrote abi/abi.rs but no abi/Cargo.toml, so every fresh 'jobkit new' + 'build' failed the abi path dependency.
… two-party flow, scaffold regression fixes The cold-start audit (fresh clone, README-only, timed) caught four real defects in the product flow; all fixed and the audit re-run green end to end (new -> build -> TLS coordinator -> TLS workers -> TLS submit with uploads -> quorum accept -> outcome delivered -> evidence bundle). 1. Submitters were dispatched as workers. Hello now carries an explicit role (worker|submitter, serde-defaulted for old clients); the coordinator excludes submitters from candidate pools, reserve pools, and pool-readiness counts. A submitter going idle is a client waiting for its outcome, not an available executor. 2. The submitter's outcome notification raced the directory scanner: a submission accepted before the scanner created the PendingJob registered no subscriber, and the outcome was never delivered. Subscriptions now live in a job-id map that merges into the PendingJob when the scanner creates it. 3. 'jobkit submit' had no TLS support while party-a.sh runs TLS by default — the documented two-party flow could not work as written. submit gains --server-cert (fingerprint-pinned TLS via a shared wire::tls::client_stream_pinned helper, deduplicating the daemon's inline wrap); party-b.sh takes the coordinator certificate. 4. Scaffold regressions: the abi sub-crate was missing its Cargo.toml entirely, then its [lib] path, then no_std, then main.rs's 'use abi' — four accumulated breakages in the 'new'->'build' flow that nothing tested end to end. README quickstart rewritten to match reality (cert copy step, TLS flags, upload description).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the last functional gap (blobs must travel with the submission) and fixes every defect the cold-start audit found in the documented user journey.
Blob upload over the wire.
jobkit submituploads the three blobs (manifest, elf, input) as authenticated content-addressed frames before the descriptor. Trust = hash:BLAKE3(bytes) == id, verified on arrival; wrong-hash uploads are rejected and the descriptor refused. Bounds: 16 MiB/blob, 8 uploads/connection, admission PoW on top. Old clients that skip uploads get an actionableblob missing: <label> — send BlobUpload firstinstead of a late materialize failure.Cold-start audit findings, all fixed
role; submitters are excluded from candidate pools, reserves, and pool-readiness counts. The audit actually showed the job being dispatched to[submitter, worker-1]— after the fix it dispatches to[worker-1, worker-2].submit exit=0with result + vindication printed).jobkit submithad no TLS and party-b passed no certificate.submit --server-certandparty-b.sh <addr> [id] [cert]close it, via a sharedwire::tls::client_stream_pinnedhelper that deduplicates the daemon's inline wrap.new→build(missing abi Cargo.toml, missing [lib] path, missing no_std, missing 'use abi') — every fresh scaffold was broken.Validated: fresh-clone container audit run green end to end with the updated README; full workspace suite green; new network test drives the cross-machine flow including the wrong-hash and missing-blob negatives.