Runtime contact and persistence review
Review date: 2026-10-11. Reviewer: independent runtime/contact review agent. Human release approval: reviewer ___ / date ___ / outcome ___. This review is technical evidence for reversible development; it does not authorize publication or imply production readiness.
The shared HTTP application and account controller are exercised through both the Node adapter and actual workerd with SQLite Durable Objects and R2. Tests are local; no remote account, message, deployment or provider resource was changed.
Findings and disposition
| Finding | Evidence and disposition |
|---|---|
| Archive/update race | The original controller protected warm() and alarm() with a gate, but left accepted metadata updates outside it. An update committed after the snapshot read could be erased by the later archive deletion and restored stale. The coordinator was notified; the regression test pauses archive upload, starts an owner update, resumes archiving, and checks the committed update after restore. Fixed and verified in the deterministic Node archive/update/ingress regression. |
| Restore between owner touch and mutation | HTTP touch and mutation are separate RPC calls. Serializing each RPC alone still permits shelving between them. Each operation that needs cold metadata must restore it within its own serialized operation. The gated invocation now restores the operations that read or modify cold metadata; the regression passes. |
| Signed endpoint authority | The new core binds the signature to exact endpoint path, owner, issuer and immutable recorded claims; new inbox JWTs use a distinct type, parent authority and at most five minutes of validity. All eight actual workerd contact tests pass, including rejection and revocation cases. |
| Metadata and payload separation | Message rows store an immutable blob reference; metadata patches should avoid R2 body reads. Actual workerd verified zero blob reads for metadata PATCH and restore, followed by exactly one read for explicit download. |
| Durable Object fault isolation | Actual workerd initially turned rejected contact signatures into HTTP 500 because a domain exception escaped the blockConcurrencyWhile callback and reset the object. The coordinator moved the awaited operation and fault conversion inside the gate. The full invalid-signature, scope, quota and revocation suite now passes without this reset. |
| Device registry concurrency | Actual workerd test passed concurrent user-code uniqueness and compare-and-swap approval/denial with exactly one winner. |
| Node network trust | Static review confirms the socket adapter checks configured Host, strips supplied CF-Connecting-IP, X-Forwarded-For and X-Real-IP, then takes the network identity from the socket. Factory fetch() tests exercise shared application behavior, not this socket boundary. A trusted reverse-proxy identity adapter remains separate work. |
| Key and contact URL custody | Account private signing keys and saved contact URLs use AES-GCM envelopes; verification records explicitly construct a public JWK without d. Node restart/custody verification passed. The operator holds the encryption key: this is not end-to-end encryption. |
Focused regression coverage
tests/worker/contact.test.mjs: actual HTTP representation negotiation, scanner-safe GET/HEAD and OPTIONS, stateless repeated bearer minting, exact signed URL/path/query binding, malformed signatures, wrong issuer, multipart delivery, quotas shared across minted tokens, idempotency, bounded/duplicate metadata, scope rejection, parent quarantine/revocation/expiry/key retirement, R2 metadata-only updates and cold restoration, device registry CAS.tests/node-contact.test.mjs: the same application through the Node factory, configured issuer, encrypted persisted contact URL/key records, SQLite/file-bucket restart, revocation after restart, and archive/update/ingress interleaving.tests/worker/harness.mjs: test-only workerd subclasses expose storage inspection and blob-read counters. They are not in the production Worker entry point.
Execution results: node --test tests/worker/contact.test.mjs passed 8/8 in actual workerd; the full npm run test:worker suite passed 15/15; node --test tests/node-contact.test.mjs passed 2/2. Both suites exercise implemented behavior, not mocked HTTP results. Initial sandbox execution failed with EPERM on localhost; the scoped automatic approval review allowed the test command with local sockets, after which workerd ran successfully. This is a local environment constraint, not a skipped or simulated Worker test. During suite integration, cancellation of intentionally oversized uploads caused Miniflare/Undici connection-pool resets on later requests. The test client now consumes rejection responses and requests connection closure for those oversized uploads only. Application errors are not retried. Default keepalive behavior after an interrupted upload remains outside this verification.
Remaining release and operations limits
- R2/file payload writes and metadata commits are separate stores. A successful payload write followed by a failed metadata transaction can leave an orphan. Failed payload deletions are recorded as
blob-garbage/, but there is no verified garbage collector or reconciliation/retry horizon. Upload compensation, crash recovery and orphan accounting remain release work. - Cold shelving uses a single current per-account snapshot. The digest detects accidental payload changes, not rollback by an operator controlling storage. There is no verified versioned backup/restore drill, archive migration, encryption-key rotation or snapshot retirement policy. Node file writes rename temporary files without explicit file/directory fsync; process restart tests do not establish power-loss durability.
- Revoked/expired grants, encrypted contact URLs, receipts, notification events, device requests and other records need a specified retention/retry policy and bounded collection. Inbox deletion frees payload quota but does not establish bounded auxiliary metadata growth. The fixed 1,000-grant limit counts retained grants.
- Query-signed contact links are capabilities. Application responses use no-store/no-referrer protections, but that does not prove redaction from CDN, reverse-proxy, observability or external browser history systems. Log redaction and browser capability-history/service-worker checks require separate evidence.
- Identity/account status is checked in the directory before a separate account operation. Cross-object revocation linearizability and authority during an already-running request are not established by per-account CAS. The directory remains a shared bootstrap bottleneck; no high-scale/cost claim follows from these tests.
- Shared policy/controller extraction is useful portability. Account RPC still exposes a general operation interface internally; it does not yet establish the narrow resource-capability architecture described in the architecture audit. Federation, general preference grants, provider conformance, notification delivery and destructive inactivity lifecycle are not completed by these contact changes.
- These tests do not establish live passkey-device interoperability, mail/push delivery, third-party storage-provider conformance, production CAPTCHA/WAF operation, browser usability or deployment readiness. Preserve the existing release gates and independent browser/security review checkpoints.
Unsigned design changes remain provisional. The coordinator should link verified fixes and test counts into DEVLOG.md and reconcile the older fragment-link decision with the new signed endpoint design before reporting completion.