derive_signature()/signature() panic on malformed composite indices where compile() returns a typed CompileError #24

New Issue

2026-06-05T14:05:45+02:00

Brummel commented

2026-06-05 14:05:45 +02:00

From the 0012 cycle-close audit (commit a4fb5d7). Composite::schema() (crates/aura-engine/src/blueprint.rs) indexes nodes[..]/inputs[..]/output[..] raw, so a malformed composite makes it panic — whereas compile() returns a typed CompileError (BadInteriorIndex / RoleKindMismatch / OutputPortOutOfRange) for the same malformations. Two validity surfaces with divergent failure modes (panic vs Result). The doc-comment acknowledges it ('assumes well-formed indices; compile() is the validator'), so it is a known, named gap, not silent drift. Low priority: schema() is the derived authoring interface and is only reached on already-validated composites in the current code path. Consider making schema() total (Result or best-effort) when the C20 named-handle authoring surface lands and schema() gets called pre-compile.

From the 0012 cycle-close audit (commit a4fb5d7). `Composite::schema()` (crates/aura-engine/src/blueprint.rs) indexes `nodes[..]`/`inputs[..]`/`output[..]` raw, so a malformed composite makes it panic — whereas `compile()` returns a typed `CompileError` (BadInteriorIndex / RoleKindMismatch / OutputPortOutOfRange) for the same malformations. Two validity surfaces with divergent failure modes (panic vs Result). The doc-comment acknowledges it ('assumes well-formed indices; compile() is the validator'), so it is a known, named gap, not silent drift. Low priority: schema() is the derived authoring interface and is only reached on already-validated composites in the current code path. Consider making schema() total (Result or best-effort) when the C20 named-handle authoring surface lands and schema() gets called pre-compile.

Brummel added the idea label 2026-06-05 14:05:45 +02:00

Brummel referenced this issue

2026-06-05 19:18:55 +02:00

Implement composite nodes (C9): a Node wiring a sub-graph with one output #12

Brummel referenced this issue from a commit

2026-06-05 23:01:24 +02:00

audit: cycle 0012 tidy (clean)

Brummel changed title from ~~Composite::schema() panics on malformed indices where compile() returns a typed CompileError~~ to derive_signature()/signature() panic on malformed composite indices where compile() returns a typed CompileError

2026-06-09 16:15:57 +02:00

Brummel commented

2026-06-09 16:15:57 +02:00

Still open after cycle 0024 (1b39093), under renamed symbols. Composite::schema() is gone; the same raw-indexing now lives in derive_signature() / interior_slot_kind() / BlueprintNode::signature() (blueprint.rs:83 c.nodes()[of.node].signature().output[of.field], :96 nodes[t.node].signature().inputs[t.slot]). These index nodes[..]/inputs[..]/output[..] raw and panic on a malformed composite, whereas compile_with_params returns a typed CompileError (BadInteriorIndex / OutputPortOutOfRange / kind mismatch) for the same malformations. The panic-vs-Result divergence this issue named persists verbatim; only the function names changed. Title updated accordingly.

Still open after cycle 0024 (1b39093), under renamed symbols. Composite::schema() is gone; the same raw-indexing now lives in derive_signature() / interior_slot_kind() / BlueprintNode::signature() (blueprint.rs:83 c.nodes()[of.node].signature().output[of.field], :96 nodes[t.node].signature().inputs[t.slot]). These index nodes[..]/inputs[..]/output[..] raw and panic on a malformed composite, whereas compile_with_params returns a typed CompileError (BadInteriorIndex / OutputPortOutOfRange / kind mismatch) for the same malformations. The panic-vs-Result divergence this issue named persists verbatim; only the function names changed. Title updated accordingly.

Brummel referenced this issue from a commit

2026-06-10 16:27:46 +02:00

audit: cycle 0025 (#49) — drift-clean; root renders like any composite

Brummel commented

2026-06-14 22:23:28 +02:00

Resolved by cycle 0040 (commits 227d004 / 8b330e3). The raw indexing this issue named — derive_signature / interior_slot_kind / signature() indexing nodes[..]/inputs[..]/output[..] and panicking on a malformed composite — is gone: both paths are now bounds-total (.get().and_then(...).unwrap_or(F64), blueprint.rs:98-120), yielding a placeholder kind instead of a panic, with the real fault reported by validate_wiring's guarded checks (BadInteriorIndex / OutputPortOutOfRange). The panic-vs-Result divergence no longer exists. Closing.

Resolved by cycle 0040 (commits 227d004 / 8b330e3). The raw indexing this issue named — `derive_signature` / `interior_slot_kind` / `signature()` indexing `nodes[..]`/`inputs[..]`/`output[..]` and panicking on a malformed composite — is gone: both paths are now bounds-total (`.get().and_then(...).unwrap_or(F64)`, blueprint.rs:98-120), yielding a placeholder kind instead of a panic, with the real fault reported by `validate_wiring`'s guarded checks (`BadInteriorIndex` / `OutputPortOutOfRange`). The panic-vs-Result divergence no longer exists. Closing.

Brummel closed this issue

2026-06-14 22:23:35 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Brummel/Aura#24