mikebrandon/here-telemetry-rnd
1
0
Fork 0
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

Send a frame across the pipe as a PNG, not as six mebibytes of base64 #16

Merged
LNK merged 1 commit from claude/png-over-the-pipe into main 2026-09-04 21:19:20 +00:00
Conversation 0 Commits 1 Files changed 11 +236 -67
LNK commented 2026-09-04 21:19:19 +00:00
Contributor
Copy link

The review's C4. A frame crossed the pipe as 6.4 MiB of base64 RGBA inside the record's JSON, through a 64 KiB pipe buffer, and the gate encoded the PNG afterwards.

What changes. The collector encodes the PNG with the gate's settings and sends it as the next frame on the pipe after the record, which states how many bytes follow. The gate reads exactly those bytes, drops the connection on a mismatch rather than storing a record with someone else's pixels, decodes to RGBA, and redacts as before. A window of text is a few hundred kilobytes. The backlog budget is unchanged in bytes and now holds a hundred frames where it held five.

Proof. A synthetic full-size window of text crosses in well under a mebibyte; a frame record is followed by its pixels and then answered; what the collector encodes the gate decodes to the same pixels, and a wrong size, a truncated file or a non-PNG is refused, which fails against a decoder that skips the size check. Linux verifier green on the pinned toolchain; the Windows crates cross-check clean. Not run here: the macOS body, the Windows body, and the end-to-end suite.

The review's C4. A frame crossed the pipe as 6.4 MiB of base64 RGBA inside the record's JSON, through a 64 KiB pipe buffer, and the gate encoded the PNG afterwards. **What changes.** The collector encodes the PNG with the gate's settings and sends it as the next frame on the pipe after the record, which states how many bytes follow. The gate reads exactly those bytes, drops the connection on a mismatch rather than storing a record with someone else's pixels, decodes to RGBA, and redacts as before. A window of text is a few hundred kilobytes. The backlog budget is unchanged in bytes and now holds a hundred frames where it held five. **Proof.** A synthetic full-size window of text crosses in well under a mebibyte; a frame record is followed by its pixels and then answered; what the collector encodes the gate decodes to the same pixels, and a wrong size, a truncated file or a non-PNG is refused, which fails against a decoder that skips the size check. Linux verifier green on the pinned toolchain; the Windows crates cross-check clean. Not run here: the macOS body, the Windows body, and the end-to-end suite. 
A frame crossed from the collector to the gate inside the record's JSON as base64 RGBA: a
1280-wide window is 4.8 MiB of pixels, 6.4 MiB once base64'd, through a 64 KiB pipe buffer,
and then the gate encoded the PNG it was going to store. The pixels existed three times on
the way — raw in the collector, as a string in the record, decoded in the gate — and the
queue in front of the gate was sized in frames because of it.

The collector encodes the PNG now, with the gate's own settings, and the pixels cross as the
next frame on the pipe after the record, which says how many bytes follow. A window of text
is a few hundred kilobytes. The gate reads exactly the promised bytes — a sidecar of another
size means the pipe is out of step, and the connection is dropped rather than a record
stored with someone else's pixels — decodes them back to RGBA, and redacts on those before
anything is written. Encoding before the hop changed what the pipe carries, not what the
store may keep: the secure rectangles still travel with the record and are still painted
out in the only process that writes. The backlog budget is unchanged in bytes and now holds
a hundred frames where it held five, which is what it was for.

Tests: a full-size synthetic window of text crosses in well under a mebibyte and at a
quarter of the RGBA it replaces; a buffer that does not match its size is refused; a frame
record is followed by its pixels and then answered, and the record says how many bytes
follow while carrying none itself; what the collector encodes the gate decodes to the same
pixels, and a wrong size, a truncated file or a non-PNG is refused — which fails against a
decoder that does not check the size, checked by removing the check.

Both collector bodies changed the same way; the macOS one is compiled only on a Mac and the
Windows one is reviewed, not run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
LNK merged commit 729f40503e into main 2026-09-04 21:19:20 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
mikebrandon/here-telemetry-rnd!16
No description provided.