Skip to content

[DAP-18] TaskConf AAD Part 3: Get all the bits and bobs in place for the TaskConfiguration at all endpoints#4698

Open
jcjones wants to merge 7 commits into
jcj/dap-17-taskconf-aad-test-harnessesfrom
jcj/dap-17-taskconf-aad-part-3
Open

[DAP-18] TaskConf AAD Part 3: Get all the bits and bobs in place for the TaskConfiguration at all endpoints#4698
jcjones wants to merge 7 commits into
jcj/dap-17-taskconf-aad-test-harnessesfrom
jcj/dap-17-taskconf-aad-part-3

Conversation

@jcjones

@jcjones jcjones commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

DAP-18 binds the task's TaskConfiguration -- both aggregator endpoints, task_info, the VDAF/batch config, and the validity interval -- into the HPKE AADs for input and aggregate shares, which requires every party (leader, helper, client, collector, candlestick maker) to independently reconstruct identical TaskConfiguration bytes.

This PR builds the machinery to do that, without yet touching the wire format, building atop #4707.

AggregatorTask gains an own_aggregator_endpoint beside the existing peer endpoint, stamped at creation from the configured public_dap_url for API tasks, and from the received config for taskprov tasks (which taskprov_opt_in previously discarded, can't save that memory now!)

It also gains a task_configuration() adapter that synthesizes the config for API tasks and returns the received wire bytes verbatim for taskprov.

Endpoints move to janus_messages::Url so nothing is re-encoded.

The Client and Collector builders grow the parameters needed to construct a matching config (the collector previously had no helper endpoint at all), validated fail-fast at build(), and the integration-test harness threads the real task_info/interval through so client- and collector-built configs match those at the aggregators.

Nothing is bound into an AAD yet: these values are threaded but not load-bearing, so the change is behavior-preserving. So, uh, the tests still pass.

The actual AAD turn-on -- the InputShareAad / AggregateShareAad / AggregateShareReq struct changes -- is in another castle, and I have to admit I am not sure I have all the byte-identical test changes in here yet, because that changeset still doesn't pass. But look, this one passes, and it is going in the right direction while only being +800/-100.

I just mean to say, while the AAD turn-on is theoretically ~150 lines, it might be ... more... still.

@jcjones jcjones force-pushed the jcj/dap-17-taskconf-aad-part-3 branch from 6ba01cf to 366760a Compare July 8, 2026 21:59
@jcjones jcjones changed the title [DAP-17] TaskConf AAD Part 3: make AggregatorTask self-sufficient [DAP-19] TaskConf AAD Part 3: make AggregatorTask self-sufficient Jul 8, 2026
@jcjones jcjones changed the title [DAP-19] TaskConf AAD Part 3: make AggregatorTask self-sufficient [DAP-18] TaskConf AAD Part 3: make AggregatorTask self-sufficient Jul 8, 2026
@jcjones jcjones force-pushed the jcj/dap-17-taskconf-aad-part-3 branch from 366760a to 9791414 Compare July 8, 2026 22:59
@jcjones jcjones added the allow-changed-migrations Override the ci-migrations check to allow migrations that have changed. label Jul 8, 2026
@jcjones jcjones force-pushed the jcj/dap-17-taskconf-aad-part-3 branch 3 times, most recently from 0f66551 to ecc6608 Compare July 9, 2026 03:07
@jcjones jcjones changed the title [DAP-18] TaskConf AAD Part 3: make AggregatorTask self-sufficient [DAP-18] TaskConf AAD Part 3: Put TaskConf into the AADs Jul 10, 2026
@jcjones jcjones changed the base branch from main to jcj/dap-17-taskconf-aad-test-harnesses July 10, 2026 23:24
@jcjones jcjones force-pushed the jcj/dap-17-taskconf-aad-part-3 branch from ecc6608 to 3cca08a Compare July 10, 2026 23:29
@jcjones jcjones changed the title [DAP-18] TaskConf AAD Part 3: Put TaskConf into the AADs [DAP-18] TaskConf AAD Part 3: Get all the bits and bobs in place for the TaskConfiguration at all endpoints Jul 10, 2026
jcjones added 7 commits July 10, 2026 16:46
…r startup

Restructure JanusInProcess to provision its task via a new provision_task() method once its
ephemeral port is known, so JanusInProcessPair builds one task with consistent real endpoints
and provisions both aggregator views.

Doesn't do anything else.
DAP-18 binds the task's TaskConfiguration -- which contains both the leader
and helper endpoints -- into the HPKE AADs for input and aggregate shares.
AggregatorTask previously stored only peer_aggregator_endpoint, so a party
could not reconstruct both endpoints from the task alone.

Add an own_aggregator_endpoint field (and DB column) alongside the peer
endpoint:

- API-provisioned tasks stamp it at creation from the aggregator's configured
  public_dap_url.
- taskprov tasks populate it from the received TaskConfiguration's endpoint for
  this aggregator's role, which taskprov_opt_in previously discarded.

In the process, we move to the janus_messages::Url.
Add the adapter that yields the canonical TaskConfiguration bound into HPKE
AADs, so the upcoming AAD sites can obtain it from the task alone.

For API-provisioned tasks it is synthesized via build_task_configuration,
pairing the task's own and peer endpoints into leader/helper by role.

For taskprov tasks it is the received wire configuration verbatim. Store that
configuration on the task (new nullable taskprov_task_config column, populated
in taskprov_opt_in). Re-synthesizing it from the stored parameters is not
byte-safe: the VdafConfig<->VdafInstance round trip drops DP strategies and
unknown task extensions would be lost, and any divergence breaks decryption.
…rams

Add builder setters (with_task_info, with_min_batch_size, with_batch_config,
with_vdaf_config, with_task_interval) supplying the parameters the client needs
to reconstruct the task's canonical TaskConfiguration for HPKE AADs. The four
non-optional parameters are validated at build(), which fails fast rather than
deferring to the first upload's AAD construction.

ClientParameters::task_configuration() is the single construction path; it is
not yet AAD-load-bearing (wired in the flag day). In-tree builder callers
(tests, integration harness, interop client) are updated to supply the fields.
… params

Add builder setters (with_helper_endpoint, with_task_info, with_min_batch_size,
with_batch_config, with_vdaf_config, with_task_interval) supplying the parameters
the collector needs to reconstruct the task's canonical TaskConfiguration for
aggregate-share AADs. The collector had no helper endpoint before. Required fields
are validated at build(), which also fails fast on invalid endpoint bytes rather
than deferring to the first collection's AAD construction.

Collector::task_configuration() is the single construction path; it is not yet
AAD-load-bearing (wired in the flag day). Collector::new is removed (it bypassed
the setters and so could no longer build). In-tree callers (tests, integration
harness, interop collector, collect tool) are updated to supply the fields.
Source task_info and the task interval from the provisioned task and thread
them into the client (and TaskParameters) so tests build a TaskConfiguration
that matches the aggregators'. Add TaskBuilder task_info()/task_interval()
getters. Values are threaded but not yet cryptographically bound (the AAD
struct changes land separately), so this is behavior-preserving.

Also fix the get_config expectation to the byte-preserving dap_url (no
trailing slash), which follows from persisting the own endpoint verbatim.
@jcjones jcjones force-pushed the jcj/dap-17-taskconf-aad-part-3 branch from 3cca08a to b72429c Compare July 10, 2026 23:47
@jcjones jcjones marked this pull request as ready for review July 10, 2026 23:47
@jcjones jcjones requested a review from a team as a code owner July 10, 2026 23:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

allow-changed-migrations Override the ci-migrations check to allow migrations that have changed.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant