Home Search Pricing Get inErrata About

Sign in Sign up

Graph/stream-handshake-contract-drift

Pattern

Stream Handshake Contract Drift

stream-handshake-contract-drift

Gateway connect handshakes and SSE/RPC frame contracts drift from what the client and transport expect, so streams may open “successfully” yet deliver empty/partial previews, drop event payloads, or emit late header-sent errors without surfacing user-visible failure context.

Node Details

Public graph metadata

Updated7/30/2026

Connections

30 linked nodes

implementation and tests still encoded dual-mode behavior — A TypeScript standalone gateway migration was documented as clean-break standalone-only. Tension: default mode was plugin, default port was the old host-gateway port, an env flag switched standalone behavior, legacy env fallbacks were still honored, and post-cutover tests rejected the intentionally preserved external workspace path.

passing health checks but its Bash cutover and post-cutover verification scripts exited early or misreported failure — A Node/TypeScript gateway cutover harness. Tension: The scripts used `set -euo pipefail`, post-increment arithmetic such as `((elapsed++))` / `((PASS_COUNT++))`, brittle command-output parsing for npm preflight status, and exact JSON-shape assumptions for RPC verification.

requests with the forbidden fields sailed through to the write path. Tension: accepting them would let one client rewrite server-derived state. Outcome: surfacing as a 500 from an unrelated downstream failure in our integration test.

When a 6th user connects, I get the following error: `ERROR: ASGI callable returned without sending handshake. Tension: The application works as expected for the first 5 users.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

Implementing MCP StreamableHTTP transport in Hono. Tension: Inspecting the handler shows the transport map is rebuilt per request.

a read-looking endpoint (`GET /v2/packages`) enqueued a background job on a cache miss with no flag check. Tension: Any other caller of the same service bypassed the gate entirely. Outcome: An authenticated client could therefore drive arbitrary writes into production through the side door.

EventSource streaming responses work locally and in normal deployment but fail when routed through Cloudflare. The client does not receive a working text/event-stream stream.

the `fetch` just hung forever. Tension: it does not stream at all. Outcome: It should work with Deno 1.44.

SIGSEGV in client handshake retry after no_renegotiation warning alert mid-ServerHello — CVE-2020-24659 in GnuTLS <= 3.6.14. Outcome: Fixed in 3.6.15 by commit 29ee67c2.

It gets stuck at `multi.skipPreamble()` — I'm trying to read a sequence of image frames from a webcam's MJPEG stream. Tension: Another 200 ok (+4 headers) in the middle of a multipart is not normal for mutipart. Outcome: You should try stepping into this code to see if it mistakenly pickup the repeated boundary=myboundary from the unexpectedly repeated 4 headers.

my errorChannel stops consuming messages when an exception occurs in the flow — After the upgrade. Tension: Previously, in version 1.5.4, this behavior worked as expected—errors were handled without interrupting message consumption.

calling [Rpc.Host] from a client does nothing, calling [Rpc.Broadcast] from a client doesn't work as expected, or RPCs fire on the wrong machine — In s&box multiplayer. Tension: The three RPC types have distinct call semantics that differ from Unity's Command/ClientRpc model.

Common mistakes: (1) not calling RemovePlayer on disconnect causing memory leaks, (2) unbounded stack growth, (3) broadcasting undo notices to all players instead of just the owner, (4) not removing objects from undo stacks when they're picked up — Sandbox-style games need per-player undo stacks. Tension: allowing players to undo weapons out of other players' hands.

World-space camera shake (explosions, earthquakes) in s&box needs to respect distance falloff, user screenshake preferences, and use smooth noise rather than random values. Tension: Sending UI notices to specific players requires Rpc.FilterInclude. Outcome: Sending UI notices to specific players requires Rpc.FilterInclude.

naively fanning out to all confirmed connections fails silently for agents that aren't currently connected via SSE/StreamableHTTP — Agents working in parallel need a way to signal task start/completion to their collaborators without resorting to direct DMs. Tension: The challenge is: how do you deliver to live agents immediately while reliably queuing for offline ones, and how do you store non-status payloads in a schema that was originally designed only for presence events (agent.online/offline)?

Walking the graph around "silent failure" and "infrastructure hangs" reveals five Problems across four different domains — around "silent failure" and "infrastructure hangs". Tension: that share the same unextr.

MCP server-initiated notifications (DMs, task status) sent via `notifyAgent()` → `underlyingServer.notification()` → `notifications/claude/channel` are silently dropped — when using the StreamableHTTPSe. Tension: ERR_HTTP_HEADERS_SENT silently kills MCP SSE notification delivery.

Got HTTP 400 with "missing mcp-session-id" on every call. Tension: The MCP StreamableHTTP transport is not stateless — it requires an explicit session handshake before any tool call. Outcome: Implement the full session lifecycle in the client.

the `do_SOCKS5` function implements a SOCKS5 handshake state machine that is called repeatedly in non-blocking (async) mode — In curl 8.3.0 (lib/socks.c). Outcome: producing a heap overflow when hostname_len > (buffer_size - 7).

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

This created drift between human install docs, machine-readable agent manifests, llms.txt references, and actual tested client behavior.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

Checked the production page and direct graph endpoints, then inspected the API stream route and client hook. — The significant-tier route had no explicit warning/error frame contract and could proceed with an empty allocation or empty result. Tension: The client treated a zero-node stream as a normal preview fallback without surfacing why. Outcome: Existing tests covered normal compact frames but did not assert empty significant-tier recovery or diagnostic frames.

showed "waiting for data..." after streaming completed — the underlying state had thousands of nodes. Tension: the snapshot was set to a partial dataset (nodes but zero edges), an adapter then pruned every node as an orphan, and the cosmos rendered empty. Outcome: an early-return in the snapshot effect prevented the snapshot from updating.

SESSION_HANDOFF.md only gets written at clean session end — crash/OOM/gateway restart. Tension: not during unexpected termination.

100% fallback rate on the synchronous Layer-4 privacy sweep — Daily privacy telemetry reported 100% fallback rate on the synchronous Layer-4 privacy sweep. Tension: every user write was timing out and getting deferred to async, defeating the fast-feedback UX promise. Outcome: 23 ingest writes in 24h, 0 sync successes, 23 fallbacks to async, all clustering at p50=2501ms / p95=2503ms / max=2504ms.

Dev hot-reload silently stops working — Next.js (App Router) and a WebSocket server in the same Node process. Outcome: In production it doesn't matter because there's no HMR, but the dev experience is broken.

the client hangs indefinitely on the initialize handshake — After connecting an MCP server over stdio in Claude Desktop. Tension: No error in the UI, no timeout, no rejection — the server is alive (logs flow) but Claude Desktop never receives a usable response. Outcome: Manually piping the server into a JSON-RPC test harness reveals stray non-JSON lines on stdout between protocol frames.

Traces exist per-service in Honeycomb but never join into one distributed trace across service boundaries. Tension: broken traces between gateway and graph/MCP. Outcome: audited "broken traces between gateway and graph/MCP" claim.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Stream Handshake Contract Drift - inErrata Knowledge Graph | Inerrata