feat(flamingo)!: match over the verifier WebSocket session - #562
Conversation
Flamingo replaces the HTTP assignment and match routes with a single GET /v1/matches WebSocket (worldcoin/flamingo#125). Each match now opens a session that verifies the assignment delivered on it and sends the sealed inputs over the same socket; a reassignment opens a fresh session. Configured headers are sent on the upgrade request. Headers the handshake sets itself (Host, Connection, Upgrade, Sec-WebSocket-*) are rejected alongside Cookie, which no longer carries ALB affinity. The flamingo crates are pinned to the unreleased PR commit until a release is published. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Risk agent: Pre-filter typesafe/jev-1.13-20260917 scored this 0.57 on the skip-review question, so the detailed review was skipped. The agent transcript is in the run log. |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Takaros999
left a comment
Takaros999
left a comment
There was a problem hiding this comment.
Reviewed bdc7e1d. The update only replaces the tested Git dependencies with published 0.6.0 crates; published source matches the tested revision. All 21 focused tests and a fresh public-dev WebSocket matrix passed with the registry dependencies. Roll out compatible WebSocket servers/proxy before applications adopt this client; live tests used synthetic inputs and dev debug measurements.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It introduces a breaking identity-matching protocol change while authenticated proxy and stage/production validation remain outstanding.
Review effort: Balanced
Findings: None
What changed in this PR
Migrates Flamingo matching from HTTP requests to the v0.6.0 attested WebSocket session protocol.
Changes:
- Opens one verified WebSocket session per match, with one reassignment retry.
- Applies validated custom headers during WebSocket upgrades.
- Adds WebSocket test infrastructure and updates Flamingo dependencies.
No critical code issues found. Residual risk remains because authenticated proxy and stage/production rollout validation are outstanding.
| File | Description |
|---|---|
crates/walletkit-core/src/flamingo/mod.rs |
Implements session matching, header validation, retry logic, and tests. |
crates/walletkit-core/Cargo.toml |
Adds WebSocket test dependencies. |
Cargo.toml |
Upgrades Flamingo crates and adds workspace dependencies. |
Cargo.lock |
Locks the updated WebSocket dependency graph. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This PR moves Flamingo matching to the released 0.6.0 WebSocket API.
reassign_required.Rollout
This is a breaking wire-protocol change with no HTTP fallback. The target Flamingo server and any app-backend proxy must support WebSockets before applications adopt this WalletKit version. Flamingo #125 and app-backend-rest #1442 are merged; dev was verified. Stage/prod rollout and authenticated proxy E2E are separate.
Validation
bdc7e1d, including Swift/Kotlin builds and foreign-binding tests, WASM, Rust tests, Clippy and security checks.bdc7e1dwith registry 0.6.0: two DeepFace signed matches through the same matcher, one GrayBadge signed match, expectedThumbnailHashMismatch, and strict/wrong-PCR rejection controls.Live tests use synthetic inputs and dev's explicit debug measurement bypass; attestation signatures/key binding and successful token signatures still verify. They do not validate real enrollment, phone capture or production PCR trust. The earlier test also covered both dev replicas.
Note
High Risk
Breaking wire-protocol change on the identity-matching path with no HTTP fallback; deployments need WebSocket-capable verifier/proxy infrastructure before adopting this WalletKit version.
Overview
Flamingo matching now uses the 0.6.0 verifier WebSocket API instead of separate HTTP assignment and match calls. Each
perform_matchopens one attested session (assignment on the socket, then sealed inputs and result on the same connection), with a single retry that opens a fresh session when the client returnsReassignRequired.Integration changes in
FlamingoMatcher: the verifier client is built without a customreqwestclient or affinity cookies; caller headers are applied on the WebSocket upgrade (with URL prefix preserved).with_headersnow rejectsCookieand handshake headers (Host,Upgrade,Sec-WebSocket-*, etc.). The public UniFFI surface is unchanged.Workspace deps add
futures-utilandtokio-tungstenite0.29; lockfile reflects the verifier client’s move off HTTP toward WebSockets. Tests drop mockito HTTP route checks in favor of local WebSocket stubs that assert upgrade path, headers, assignment protocol, and that bad attestation fails before binary image frames are sent.Reviewed by Cursor Bugbot for commit bdc7e1d. Bugbot is set up for automated code reviews on this repo. Configure here.