unicity-aos/aos-ce · warning

hook-adapter-oracle: dropping mismatched context reply on

Error message

hook-adapter-oracle: dropping mismatched context reply on {reply_topic}

What it means

While collecting context replies, each message is checked against the expected reply topic and verified principal. A reply that doesn't match either is untrusted (wrong requester, spoofed topic, or stale subscriber output), so the adapter logs this warning and skips it via continue rather than incorporating it into the oracle's context.

Solutions

1. Ensure each hook replies on exactly the reply_topic provided in the request (echo it back verbatim).
2. Keep the principal's verified identity stable for the duration of request/reply; re-authenticate before the request if needed.
3. Give each context request a unique reply topic so unrelated traffic cannot collide.
4. Audit publishers writing to the reply topic namespace to eliminate foreign traffic.

Example fix

// before: hook replies on its own static topic
bus.publish("hook.oracle.context", reply);
// after: reply on the topic supplied in the request envelope
bus.publish(&request.reply_topic, reply);

// verify reply topic and principal before consuming
fn reply_ok(m: &Message, reply_topic: &str, principal: &Principal) -> bool {
    m.topic == reply_topic && m.principal.verified() == Some(principal)
}

fn trusted_reply(m: &Message, want_topic: &str, want: &Principal) -> bool {
    m.topic == want_topic && m.principal.verified() == Some(want)
}

When it happens

Trigger: dispatch_oracle_hook -> collect_additional_context receives a message on the fan-out subscription where message.topic != reply_topic OR message.principal.verified() != Some(principal) — i.e. topic mismatch or the reply was not verifiably sent by the expected principal.

Common situations: A shared subscription also receiving other topics' traffic; hooks replying on a stale/wrong reply topic after a retry; principals re-authenticated between request and reply so the verified identity differs; another capsule broadcasting on a colliding topic.

Related errors

• failed to deserialize compaction response payload
• hook-adapter-oracle: incomplete context fan-out on
• Unicity AOS health service must bind to 127.0.0.1
• product manifest path must be a regular file
• temporary product manifest path must be a regular file

AI-assisted analysis of unicity-aos/aos-ce@f6f22024fb (2026-09-13). Data as JSON: /api/errors/6055683759aba0c6. Report an issue: GitHub.

Appendix: source

Thrown at capsules/capsule-hook-adapter-oracle/src/lib.rs:280

        let remaining = if contexts.is_empty() {
            HOST_HOOK_COLLECT_DEADLINE_MS - elapsed_ms
        } else {
            HOOK_QUIESCENCE_MS.min(HOST_HOOK_COLLECT_DEADLINE_MS - elapsed_ms)
        };
        match subscription.recv(remaining) {
            Ok(poll) if poll.messages.is_empty() => break,
            Ok(poll) => {
                if poll.dropped != 0 || poll.lagged != 0 {
                    log::warn(format!(
                        "hook-adapter-oracle: incomplete context fan-out on {reply_topic}; dropping all partial context"
                    ));
                    return Ok(None);
                }
                for message in poll.messages {
                    if message.topic != reply_topic
                        || message.principal.verified() != Some(principal)
                    {
                        log::warn(format!(
                            "hook-adapter-oracle: dropping mismatched context reply on {reply_topic}"
                        ));
                        continue;
                    }
                    match serde_json::from_str::<serde_json::Value>(&message.payload) {
                        Ok(value) => {
                            if let Some(context) = value
                                .get("additional_context")
                                .and_then(serde_json::Value::as_str)
                                .filter(|context| !context.trim().is_empty())
                                && !push_context(&mut contexts, &mut context_bytes, context)
                            {
                                log::warn(format!(
                                    "hook-adapter-oracle: dropping context beyond {MAX_HOST_CONTEXT_BYTES} bytes"
                                ));
                            }
                        }
                        Err(error) => log::warn(format!(

View on GitHub (pinned to f6f22024fb)