diff --git a/quest/m1/cut-audit/README.md b/quest/m1/cut-audit/README.md index 301115f1f71..6da9a61f927 100644 --- a/quest/m1/cut-audit/README.md +++ b/quest/m1/cut-audit/README.md @@ -55,7 +55,6 @@ leaving JS-only redesigns of `js/net` to [rs2ts](/quest/m2/rs2ts/README.md). ## Required - [Counted field-less `trun` entries](/quest/m1/cut-audit/fmp4-sample-resolver.md) - a moof of field-less runs cannot materialize millions of sample entries -- [A compressed announce path never outgrows its literal form](/quest/m1/cut-audit/announce-path-bytes.md) - lite-07 announce compression cannot build multi-MiB paths - [A reserved group survives a route returning](/quest/m1/cut-audit/reserved-route-return.md) - a route flip A to B to A no longer panics a peeked reader - [JS tracks end clean only on a deliberate finish](/quest/m1/cut-audit/js-close-cause.md) - local close, violations, and unanswered requests end with errors - [Withdrawing a moq-transport FETCH or TRACK_STATUS ends it](/quest/m1/cut-audit/ietf-withdraw-resolve.md) - withdrawal during resolution releases the request diff --git a/quest/m1/cut-audit/announce-path-bytes.md b/quest/m1/cut-audit/announce-path-bytes.md deleted file mode 100644 index e917d253947..00000000000 --- a/quest/m1/cut-audit/announce-path-bytes.md +++ /dev/null @@ -1,39 +0,0 @@ -# [S] A compressed announce path never outgrows its literal form - -## Goal - -A lite-07 ANNOUNCE_START whose base/keep compression resolves to a path -longer than one literal ANNOUNCE_START body could carry closes the session -with PROTOCOL_VIOLATION, in Rust and `@moq/net`. A peer can no longer turn a -12-byte message into a multi-MiB path that the decoder, the origin, and every -forwarded copy hold. - -## Plan - -Found by the 2026-10-24 pre-cut audit at -[151a529670](https://github.com/moq-dev/moq/commit/151a529670). Source-inferred, -inherited from release (worse there under its 64 MiB message cap). Reachable -only while `moq-lite-07-wip` is negotiated, which -[Finalize moq-lite-07](/quest/m1/lite07-finalize.md) turns on by default. - -`Live::resolve_path` (`rs/moq-net/src/lite/compress.rs:48`) bounds a -resolved suffix only by `Path::MAX_PARTS` (32). Thirty-two STARTs that each -keep the previous suffix and append a ~64 KiB segment build a ~2 MiB suffix; -every later START with `keep=31` copies it again for about 12 wire bytes, up -to `Limits::announces` times. `origin.rs` `create_withheld` (about line 2176) -claims a path it accepts "can be re-encoded when forwarded" but checks parts -only. JS `AnnounceHistory` (`js/net/src/lite/announce.ts:383`) has the same -parts-only check. - -- No new constant: the bound is the existing literal one. A resolved suffix, - and the prefix joined with it, must fit in a literal ANNOUNCE_START body - under `MAX_MESSAGE_SIZE`. Compression never expresses a path the literal - form could not. -- Enforce the same byte bound in `create_withheld`, so a locally created - route is never one this wire cannot forward. -- Extend the `announce_stream` fuzz target to assert every resolved path - encodes as a literal START. -- Add the receiver rule to `drafts/draft-lcurley-moq-lite.md` (lite-07 is - unpublished, so this changes no published version). - -Public API: none. Wire: one receiver rule in the lite-07 draft.