[v0.43.3] Complete the robustness adversarial audit (Kimi handoff)

[SisyphusZheng]

Category: Test / Release
Priority: P2
Target: v0.43.3
Executor: Kimi (handoff requested by the maintainer)

Context

The v0.43.2 stabilization branch fixed the evidence-backed runtime and reference-starter findings. A final adversarial runtime audit was intentionally separated because the OpenAI environment previously interrupted the network-shaped robustness exercise. That interruption is INCONCLUSIVE, not a product failure and not a pass.

Required baseline

• Branch: codex/043x-stabilization
• Baseline commit: 8c2e9be
• Rebase the audit input onto the eventual v0.43.2 release commit if it differs.

Safety boundary

• Loopback, in-process fixtures and local workerd only.
• No scanning or access to external targets.
• No writes to real Supabase, Stripe, Cloudflare or other providers.
• Do not publish npm, tags, GitHub Releases or remote schema.
• Audit first; do not implement fixes in the same evidence pass.

Required coverage

1. Node bridge: mid-request abort, response disconnect, drain backpressure, stream cancellation, listener cleanup and keep-alive.
2. Preact: first hydration, updates, real detach, same-turn DOM move, reconnect and exactly-once teardown.
3. Router: dispose during programmatic/browser guards, redirect chains and rejected guards.
4. Action wire: undefined, function, Symbol and circular payload parity across Hono dev and Nitro build.
5. Starter: Stripe chunked overflow, dishonest Content-Length and stalled body; Notes expiry/401/cross-origin; upload finalize/Storage/RPC fault matrix.
6. Repetition: listener, file-descriptor, timer and memory growth plus unhandled rejections.

Acceptance output

• PASS / FAIL / INCONCLUSIVE per case; unexecuted cases are never PASS.
• Exact commands, environment, iterations, thresholds and raw evidence paths.
• Minimal root cause for every failure.
• Classification as Framework / SaaS reference / Tooling / Docs / Test / Release and P0-P3.
• Explicit GO / NO-GO for v0.43.3.
• One follow-up issue per confirmed finding before any fix.

[SisyphusZheng]

Acceptance snapshot for codex/043x-stabilization@8c2e9bebf89b51907b365c6b53fab6435d8b3e65 (2026-08-24):

• Runtime adversarial harness: 8/8 PASS under --allow-net=127.0.0.1,localhost.
• Existing Node/Preact/Router contracts: 67/67 PASS with --repeats=4 --trace-leaks (five executions per test).
• Existing Starter contracts: 60/60 PASS with --repeats=4 --trace-leaks (five executions per test).
• Node keep-alive stress: ten executions x 500 requests; one socket per execution, FD 42 -> 42, listener delta never positive, post-GC heap growth converged from 1,599,248 bytes to 60,752 bytes.
• Node standalone and Wrangler 4.123.0 local workerd qualification: PASS, repeated inside an OS network sandbox allowing localhost only; Node/workerd HTML was byte-identical.
• No Framework or SaaS-reference runtime failure was confirmed.

Confirmed Test/Tooling P2: #1147. The canonical Hono parity helper attempts unspecified-interface listeners under Vite 8, so it cannot run unchanged with strict loopback-only Deno permissions. The actual Hono Action versus Nitro behavior passed after the temporary acceptance harness forced the Node listen boundary to 127.0.0.1.

Current v0.43.2 impact: no confirmed P0/P1 blocker. The broader v0.43.3/Kimi audit remains open; this snapshot covers only the explicitly authorized loopback/process-fixture/local-workerd boundary.

[SisyphusZheng]

Audit complete — explicit GO for v0.43.3 (audit axis)

Executor: Kimi, 2026-08-26. Audit input: post-v0.43.2 dev plus the #1148 (ADR-0142) working tree — i.e. the code v0.43.3 ships, per the rebase instruction.

Full record with per-case PASS/FAIL, exact commands, iterations, thresholds and raw evidence paths: docs/audit/2026-08-26-v0.43.3-robustness-adversarial-audit.md.

Coverage summary (all six required areas executed; nothing unexecuted marked PASS)

• Node bridge: abort/disconnect/drain/cancel vectors (unit + live loopback against both openElement start and the generated standalone server), listener-cleanup assertions on every terminal path, keep-alive socket reuse (50 sequential requests, one socket), 5×100 abort cycles with listener/FD stability (lsof), 3×500 keep-alive heap convergence (7.17→7.30→7.49 MiB, pre-registered thresholds), zero unhandled rejections, timer-growth pinned by inspection test.
• Preact: first hydration over real SSR children (node identity), hydrate→update→detach→reconnect exactly-once, double-clientActivate idempotency.
• Router: dispose mid-redirect-chain, hash-mode browser-guard dispose, synchronously-throwing guards, unhandled-rejection storm with a verified negative control.
• Action wire: five unserializable fail() kinds on BOTH the fetch and native/page channels (Hono dev + Nitro build), 64-level/64 KiB nested payload integrity, symbol-keyed objects, 20-way concurrent mixed-channel burst.
• Starter: dishonest Content-Length (declared-over-cap fast-reject without body read; under-cap lie caught by the streaming cap), handler-level stalled-body 408, upload double-finalize race (both orders), abandoned-intent expiry surviving Storage failure, Notes 401→refresh→retry-once (see test(starter): extract notes-live reconcile fetch pipeline into an injectable helper (401→refresh→retry-once testability) #1153).
• Repetition: listener/FD/timer/heap growth and unhandled rejections as above.

Confirmed findings — one follow-up issue each, filed before any fix, all fixed and flipped to PASS

Finding	Severity	Status
#1152 writeWebResponse misses disconnects that precede it (body never cancelled, listener leak)	P1	Fixed; live + unit evidence tests pass unchanged
#1154 cancelBody awaits reader.cancel() before cleanup (hanging cancel leaks listeners)	P3	Fixed; evidence test passes unchanged
#1153 notes-live reconcile pipeline untestable without a browser (audit case INCONCLUSIVE)	P3	Seam extracted (no behavior change); case now PASS with 6 unit tests

Suite counts on the audit tree: adapter-vite 634 passed, app 114 passed, starter 150 passed, element 292 passed; full root task exit 0.

Boundary compliance

Loopback / in-process fixtures / local spawned servers only. No external targets scanned; no real Supabase/Stripe/Cloudflare writes; nothing published by the audit. The only case not executed as originally scoped is the Notes 401 check against a live project in a real browser (boundary-excluded); its wiring is now unit-tested instead (#1153).

GO/NO-GO

GO for v0.43.3 on the audit axis. No P0; both P1/P3 findings fixed and evidence-locked. The separate #1148 external-evidence item is tracked there and does not change this verdict.