mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-04 08:13:37 +08:00
Martin Vogel
2dd296bab4
An image-verification rejection logged daemon.client_image_rejected and finished the worker WITHOUT sending a hello response - the only admission-failure path that never answered the peer. The client reported status "pending" indefinitely, indistinguishable from a slow cold start, with the reason visible only in the daemon log. The rejection now sends a CONNECT_REJECTED hello response carrying the reason (fingerprint_mismatch / image_unverifiable) and an actionable message, matching the version-conflict and capacity paths. The version-conflict path already responds to unverified peers, so this discloses nothing new to a same-uid local peer; admission stays rejected either way. Adds a CBM_ENABLE_TEST_SEAMS-only seam forcing peer-image verification to fail, since the in-process harness's peer pid is OS-authenticated socket credentials and always verifies against the service's own active image. Test: daemon_runtime_image_rejection_reaches_client_issue1383 - the client receives CONNECT_REJECTED with the reason in the message. RED without the response block (client times out), GREEN with it. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>