prisma-risk / tsoracle / 26436390842

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(driver-openraft): enforce lower-bound on format activation target (#479)

* fix(driver-openraft): enforce lower-bound on format activation target

The all-members activation gate previously checked only
`max_readable_version >= target`, accepting any target a member could read
but not enforcing that the target was at least `MIN_READABLE_VERSION` of
the local binary. With MIN==MAX==4 today, an operator call to
`initiate_format_activation(0..=3)` passed the gate, committed a
`SetFormatVersion` raft entry, and flipped `ActiveWriteVersion` to a value
the encode/decode codec arms reject — wedging subsequent log appends and
snapshot builds.

Add `target_in_local_readable_range` and a new
`FormatActivationError::TargetOutOfRange { target, min, max }` variant.
`run_activation_gate` short-circuits before any peer RPC so an
out-of-range target is rejected fast and unambiguously, regardless of
peer capabilities. The same `rejected_by_gate` counter records the
rejection.

Defense-in-depth at apply: the `SetFormatVersion` arm independently
refuses to flip the cell to a target outside the local binary's range
and emits the new `ApplyOutcome::FormatActivationTargetOutOfRange`
variant plus a distinct `noop_target_out_of_range` counter. This guards
two paths the gate cannot — a fixed binary replaying a log committed by
an older buggy binary, and a protocol-violating peer somehow committing
such an entry. The arm uses only entry data plus the binary's
compile-time constants, so replay is deterministic for any single
binary.

`classify_activation_outcome` maps the new outcome back to
`FormatActivationError::TargetOutOfRange` so the operator-facing surface
is uniform regardless of whether the gate or the apply arm fired.

Tests: new unit tests pin the helper and error message; new apply-arm
tests pin the no-op behavior for target=0, target<MIN, target>MAX, and
the replay-determinism contract for an OOR bump. The existing
`set_format_version_subset_match_sets_cell`, `... (continued)

Coverage Stats

279 of 285 new or added lines in 5 files covered. (97.89%)

8 existing lines in 1 file now uncovered.

13261 of 13894 relevant lines covered (95.44%)

430995.61 hits per line