[P2] Bound TCP operations by an end-to-end deadline including name resolution

[wsdt]

Audit: 2026-09-05, commit 2b3b1ee24da2.
Classification: Static performance/reliability finding; proposed stronger deadline contract. Priority: P2.

Finding

The explicit Rust TCP provider uses a 30-second timeout per address attempt and per socket read/write, but has no aggregate operation deadline.

In src/network_provider/tcp.rs, to_socket_addrs() runs synchronously before any timeout, each address gets a fresh SOCKET_TIMEOUT, and write_all can perform several writes. Consequently “30 seconds” is not a bound on the total connect/send operation. This is a static finding; no slow external endpoint was contacted during the audit.

The evaluator's fuel budget limits language steps, not time spent in an injected provider. docs/BOUNDED-LANGUAGE-NETWORK-IO-V1.md currently documents blocking sockets and an explicitly injected provider, so treat this as a deliberate contract extension rather than a claim of a sandbox escape.

Proposed slice

Add one caller-selected monotonic deadline policy for an invocation or operation, with a safe fixed maximum. Cover resolution, all address attempts, partial writes, reads, and readiness waits. Name resolution must use an explicitly injected bounded resolver or an independently owned cancellable worker; a detached resolver thread is not cancellation. Propagate remaining duration instead of restarting the full timeout per sub-operation.

Keep the fixture provider deterministic, and retain no-network behavior when no provider is granted. Audit the generated native networking implementation for the equivalent timeout contract; do not claim parity from the Rust seam alone.

Acceptance criteria

• Several failing candidate addresses cannot multiply the aggregate connection budget.
• Slow DNS resolution and a trickle-writing peer terminate under the declared aggregate bound.
• Interrupted system calls preserve the same deadline and selected failure.
• Timeout/cancellation leaves no retained connection or unmanaged resolver task.
• Scripted resolver/socket/clock tests cover budget boundaries without waiting 30 seconds each.
• A small explicit loopback integration test verifies the real adapter.
• Documentation distinguishes per-syscall timeout, operation deadline, and invocation budget. Do not promise forced cancellation where the selected host cannot enforce it.

Agent handoff

Recheck the working revision and existing issues first. Read AGENTS.md, the relevant completion-matrix row, and the owning versioned specifications. This proposed slice must preserve canonical source, independent replay, precise target admission, and separately granted authority. Place regressions in the existing owning harness. Execute the applicable quality gates and record what actually ran; unrun native, hosted, or device evidence must stay unpromoted.

Later source recheck

At e1c5b5622678, the same resolver/per-address timeout chain remains in connect_socket. The new TLS client/server paths add handshakes, so their lifecycle must also receive an explicit aggregate deadline. The separate Reqwest HTTPS client has its own configured request timeout; this finding does not assert that it inherits the raw TCP timeout defect. No live slow-endpoint test was run.

Audit revision scope

Runtime observations in this ticket belong to commit 2b3b1ee. A final source-tree comparison against e1c5b56 was used to check for obvious superseding changes. That later snapshot was not rebuilt or exhaustively retested. Reproduce on the intended fixing revision before implementation.

Audit ID: SPX-AUDIT-20260905-11

Suggested scope: L. Dependencies: None required.

[wsdt]

Fixed in d35492cb (rebased onto main as part of acc6f648).

Verified current state first — the defect was real and unfixed at the working revision. src/network_provider/tcp.rs::connect_socket ran (host, port).to_socket_addrs() inline with no bound, then gave each candidate address a fresh 30 s SOCKET_TIMEOUT and set per-socket read/write timeouts of 30 s, while send used write_all, which can issue many writes. The generated native C11 adapter had the same shape.

What changed

• src/network_provider/deadline.rs — a MonotonicClock seam (SystemClock, ScriptedClock), DeadlinePolicy (caller-selected, clamped to a fixed 30 s maximum as the issue required), Deadline with remaining/slice/slice_capped, and DeadlineSocket, a borrowed socket that re-derives its per-syscall timeout from the deadline before every read and write — so remaining duration is propagated instead of the full timeout restarting per sub-operation.
• src/network_provider/resolver.rs — a NameResolver trait taking the remaining budget. SystemResolver answers a literal address with no worker at all; otherwise it runs the platform resolver on a worker it owns, and abandoned workers stay registered and are reaped rather than detached. This is the issue's explicit requirement that a detached resolver thread is not cancellation.
• tcp.rs — TransportStream now stores the rustls connection and socket separately, so rustls::Stream::new(conn, &mut DeadlineSocket) routes every handshake and record syscall through the deadline. Connect, TLS connect, accept, accept-TLS, send (partial writes plus flush), recv and wait all start one deadline and propagate what is left. net_wait's program timeout is a cap, never a licence to exceed it. settle() also settles the resolver, so a timeout leaves no unmanaged resolver task.
• Native C11 — monotonic clock (clock_gettime / GetTickCount64), spx_network_deadline_* helpers, remaining-budget propagation across candidate addresses, partial writes, EINTR-retried reads and poll.

Coordinator-verified

cargo test --locked -p semaprax --lib -- network_provider:: https_client:: wasm::http_io:: → 35 passed, 0 failed, in 0.21 s — re-run by me after rebasing onto current main and hand-resolving a Rust conflict. The sub-second total is the point: a_bounded_accept_stops_waiting_at_the_deadline, a_silent_peer_bounds_a_read_by_the_operation_deadline, a_peer_that_never_reads_bounds_a_partial_write_in_aggregate and a_wait_never_outlasts_the_operation_deadline reach their budget boundaries by advancing an injected clock or selecting a short budget over real loopback sockets, satisfying the criterion that these be covered without waiting 30 seconds each. 16 tests were added across deadline.rs (4), resolver.rs (4) and tcp/deadline_tests.rs (8).

Acceptance criteria NOT satisfied

• Native-C11 getaddrinfo remains unbounded. There is no owned resolver worker in the C11 lane, so resolution there is not covered by the aggregate deadline. Stated in docs/BOUNDED-LANGUAGE-NETWORK-IO-V1.md and the completion matrix; no native/Rust parity on resolution is claimed, per the issue's warning not to infer parity from the Rust seam alone. Tracked in [P2] Bound native C11 name resolution by the aggregate deadline #79.
• "Interrupted system calls preserve the same deadline" is enforced structurally — every EINTR arm re-slices the same Deadline — but is not covered by an executed test, as no portable way to inject EINTR was found.
• Native evidence was executed on macOS/clang through the POSIX branch only; the _WIN32 branch was not compiled.