kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/tests/linux_baseline/permissions.rs

@@ -0,0 +1,236 @@
+//! Holds what a caller is refused to the Linux that refuses it: a Policy to the
+//! same rules under Landlock, and a Bind to a process of another user.
+
+use std::collections::BTreeMap;
+use std::ffi::CString;
+use std::fs;
+use std::io;
+use std::os::unix::fs::PermissionsExt;
+use std::sync::{Arc, PoisonError};
+use std::thread;
+
+use kobako_runtime::filesystem::Filesystem;
+use kobako_runtime::mount::{Access, Policy};
+
+use crate::calls::{Call, Rng};
+use crate::kobako::Kobako;
+use crate::linux::Linux;
+use crate::{assert_named, bind, class, note, seed_directory, Difference, Setup, BASE, SERIAL};
+
+/// Landlock's right to read a file and to list a directory.
+const LANDLOCK_READ: u64 = (1 << 2) | (1 << 3);
+/// Every right Landlock's filesystem rules name.
+const LANDLOCK_ALL: u64 = (1 << 16) - 1;
+
+const SYS_LANDLOCK_CREATE_RULESET: libc::c_long = 444;
+const SYS_LANDLOCK_ADD_RULE: libc::c_long = 445;
+const SYS_LANDLOCK_RESTRICT_SELF: libc::c_long = 446;
+const LANDLOCK_RULE_PATH_BENEATH: libc::c_long = 1;
+
+#[repr(C)]
+struct RulesetAttr {
+    handled_access_fs: u64,
+    handled_access_net: u64,
+    scoped: u64,
+}
+
+#[repr(C, packed)]
+struct PathBeneath {
+    allowed_access: u64,
+    parent_fd: i32,
+}
+
+/// Reads anywhere, and changes only beneath `d`.
+struct WritesBeneathD;
+
+impl Policy for WritesBeneathD {
+    fn allows(&self, path: &str, access: Access) -> bool {
+        access == Access::Read || path.starts_with("/baseline/d/")
+    }
+}
+
+/// Hold this thread to the rule `WritesBeneathD` states, over `root`, and leave it
+/// `unjudged` to do anything, as kobako's own host directory is no guest's.
+fn restrict_as_writes_beneath_d(root: &str, unjudged: &str) {
+    let attr = RulesetAttr {
+        handled_access_fs: LANDLOCK_ALL,
+        handled_access_net: 0,
+        scoped: 0,
+    };
+    // SAFETY: each pointer names a live value of the size its call is told, and
+    // each descriptor is one this call opened.
+    unsafe {
+        assert_eq!(libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0);
+        let size = size_of::<RulesetAttr>();
+        let ruleset = libc::syscall(SYS_LANDLOCK_CREATE_RULESET, &raw const attr, size, 0);
+        assert!(
+            ruleset >= 0,
+            "this kernel must enforce Landlock: {}",
+            io::Error::last_os_error()
+        );
+        let rules = [
+            (root.to_string(), LANDLOCK_READ),
+            (format!("{root}/d"), LANDLOCK_ALL),
+            (unjudged.to_string(), LANDLOCK_ALL),
+        ];
+        for (path, allowed_access) in rules {
+            let path = CString::new(path).expect("no path holds a NUL");
+            let parent_fd = libc::open(path.as_ptr(), libc::O_PATH | libc::O_CLOEXEC);
+            assert!(parent_fd >= 0, "{}", io::Error::last_os_error());
+            let rule = PathBeneath {
+                allowed_access,
+                parent_fd,
+            };
+            let added = libc::syscall(
+                SYS_LANDLOCK_ADD_RULE,
+                ruleset,
+                LANDLOCK_RULE_PATH_BENEATH,
+                &raw const rule,
+                0,
+            );
+            assert_eq!(added, 0, "{}", io::Error::last_os_error());
+            libc::close(parent_fd);
+        }
+        assert_eq!(libc::syscall(SYS_LANDLOCK_RESTRICT_SELF, ruleset, 0), 0);
+        libc::close(ruleset as i32);
+    }
+}
+
+/// Run `sequence` through both sides until they disagree, as `differs` says of
+/// two answers, noting what it does.
+fn compare(
+    sequence: &[Call],
+    mut kobako: Kobako,
+    mut linux: Linux,
+    differs: impl Fn(&str, &str) -> bool,
+    found: &mut BTreeMap<String, Difference>,
+) {
+    for (at, call) in sequence.iter().enumerate() {
+        let (theirs, ours) = (linux.run(call), kobako.run(call));
+        if differs(&ours, &theirs) {
+            let detail = format!("kobako={ours} linux={theirs}");
+            note(found, class(call, &ours, &theirs), &sequence[..=at], detail);
+            return;
+        }
+    }
+}
+
+fn sequence(seed: u64, longest: u64, paths: &[String]) -> Vec<Call> {
+    let mut rng = Rng::new(seed);
+    let length = 1 + rng.random_below(longest);
+    (0..length).map(|_| rng.call(paths)).collect()
+}
+
+#[test]
+#[ignore = "needs root and a mount namespace; run by rake crates:linux_baseline"]
+fn a_policy_answers_as_the_same_rules_under_landlock() {
+    let _serial = SERIAL.lock().unwrap_or_else(PoisonError::into_inner);
+    let setup = Setup::Bind;
+    setup.prepare();
+    let paths = setup.paths();
+    let mut found = BTreeMap::new();
+    for seed in 1..=15_000 {
+        let (root, kobako_dir) = (setup.dir("linux"), setup.dir("kobako"));
+        seed_directory(&kobako_dir);
+        seed_directory(&root);
+        let filesystem =
+            Filesystem::new(Arc::new(bind(&kobako_dir))).expect("the instance must stand");
+        let kobako = Kobako::with_policy(filesystem, Arc::new(WritesBeneathD));
+        let linux = Linux::new(&root, false);
+        let calls = sequence(seed, 30, &paths);
+        let found = &mut found;
+        thread::scope(|scope| {
+            scope
+                .spawn(|| {
+                    restrict_as_writes_beneath_d(&root, &kobako_dir);
+                    compare(&calls, kobako, linux, |ours, theirs| ours != theirs, found);
+                })
+                .join()
+                .expect("a sequence must not panic");
+        });
+    }
+    assert_named("policy", &found);
+}
+
+/// A tree another user meets refused in each way a mode refuses: a directory it
+/// may only read, search, or not reach, and files it may only read, only write,
+/// or not open.
+fn seed_permissions(dir: &str) {
+    let mode = |path: String, mode| {
+        fs::set_permissions(path, fs::Permissions::from_mode(mode)).expect("the mode must be set");
+    };
+    let _ = fs::remove_dir_all(dir);
+    fs::create_dir_all(dir).expect("the host directory");
+    mode(dir.to_string(), 0o777);
+    for (name, bits) in [
+        ("ro", 0o755),
+        ("nox", 0o704),
+        ("nor", 0o701),
+        ("no", 0o700),
+        ("w", 0o777),
+    ] {
+        let sub = format!("{dir}/{name}");
+        fs::create_dir(&sub).expect("the host directory");
+        fs::write(format!("{sub}/f"), "x").expect("the host file");
+        mode(format!("{sub}/f"), 0o666);
+        mode(sub, bits);
+    }
+    for (name, bits) in [("fro", 0o644), ("fwo", 0o602), ("fno", 0o600)] {
+        fs::write(format!("{dir}/{name}"), "x").expect("the host file");
+        mode(format!("{dir}/{name}"), bits);
+    }
+}
+
+const PERMISSION_PATHS: [&str; 22] = [
+    ".", "x", "ro", "ro/", "ro/f", "ro/x", "nox", "nox/", "nox/f", "nox/x", "nor", "nor/", "nor/f",
+    "nor/x", "no", "no/", "no/f", "fro", "fwo", "fno", "w/f", "w/x",
+];
+
+/// Whether one side succeeded where the other was refused. kobako has no layer
+/// of permissions, so which refusal answers first is the host's to reach, and two
+/// refusals of one call agree whatever each names.
+fn one_succeeded(ours: &str, theirs: &str) -> bool {
+    let refused = |answer: &str| answer.starts_with('E');
+    refused(ours) != refused(theirs)
+}
+
+#[test]
+#[ignore = "needs root and a mount namespace; run by rake crates:linux_baseline"]
+fn a_bind_refuses_another_user_as_its_host_does() {
+    let _serial = SERIAL.lock().unwrap_or_else(PoisonError::into_inner);
+    let setup = Setup::Bind;
+    setup.prepare();
+    fs::set_permissions(BASE, fs::Permissions::from_mode(0o755)).expect("the mode must be set");
+    let paths = PERMISSION_PATHS.map(str::to_string);
+    let mut found = BTreeMap::new();
+    for seed in 1..=12_000 {
+        let (root, kobako_dir) = (setup.dir("linux"), setup.dir("kobako"));
+        seed_permissions(&kobako_dir);
+        seed_permissions(&root);
+        let filesystem =
+            Filesystem::new(Arc::new(bind(&kobako_dir))).expect("the instance must stand");
+        let calls = sequence(seed, 20, &paths);
+        let found = &mut found;
+        thread::scope(|scope| {
+            scope
+                .spawn(|| {
+                    // SAFETY: these change only this thread's credentials, as raw
+                    // syscalls do where libc's wrappers would change every thread's.
+                    unsafe {
+                        assert_eq!(
+                            libc::syscall(libc::SYS_setgroups, 0, std::ptr::null::<u32>()),
+                            0
+                        );
+                        assert_eq!(libc::syscall(libc::SYS_setresgid, 1000, 1000, 1000), 0);
+                        assert_eq!(libc::syscall(libc::SYS_setresuid, 1000, 1000, 1000), 0);
+                    }
+                    let kobako = Kobako::new(filesystem, Access::ReadWrite, false);
+                    let linux = Linux::new(&root, false);
+                    compare(&calls, kobako, linux, one_succeeded, found);
+                })
+                .join()
+                .expect("a sequence must not panic");
+        });
+    }
+    assert_named("another-user", &found);
+}

data/crates/kobako-transport/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.20.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.19.0...kobako-transport-v0.20.0) (2026-11-07)
+
+
+### Bug Fixes
+
+* **transport:** call the Envelope by its name when one fails to decode ([411c8d5](https://github.com/elct9620/kobako/commit/411c8d505e2d939b8014b5406b1a9625b865f02b))
+
+## [0.19.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.18.0...kobako-transport-v0.19.0) (2026-10-26)
+
+
+### ⚠ BREAKING CHANGES
+
+* the Guest ABI is version 5, so a Guest Binary built against version 4 is refused at Sandbox construction until rebuilt. In kobako-transport, Reply gains a Break arm and YieldReply::Break carries no payload. The Yielder trait of kobako-runtime gains frame and takes the frame in yield_to_block; the Guest trait of kobako-core and the MrbGuest trait of kobako-mruby take the frame in yield_to_block; Downcall::Yield carries frame and args.
+
+### Features
+
+* let a block's break or return unwind a Service as a plain method ([4e9eca0](https://github.com/elct9620/kobako/commit/4e9eca05f1647c8b6409fc00d08317b431c0c648))
+
+
+### Bug Fixes
+
+* run a stored block as the block of the Call that carried it ([bf33dc1](https://github.com/elct9620/kobako/commit/bf33dc1fd40c83498c6c12b0be52b3a835a144cf))
+
 ## [0.18.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.17.0...kobako-transport-v0.18.0) (2026-10-13)
 
 

data/crates/kobako-transport/Cargo.toml

@@ -1,6 +1,6 @@
 # kobako-transport — the fixed tier of the kobako wire.
 #
-# The core envelope: the outer frame every host↔guest message rides in,
+# The Envelope: the outer frame every host↔guest message rides in,
 # carrying routing and outcome attribution and handing the payload
 # through untouched. A host, a payload codec, and a guest are chosen
 # independently only because this layer is the same in every assembly,
@@ -12,9 +12,9 @@
 
 [package]
 name = "kobako-transport"
-version = "0.18.0"
+version = "0.20.0"
 edition = "2021"
-description = "The kobako core envelope — the fixed host↔guest wire frame every assembly shares."
+description = "The kobako Envelope —the fixed host↔guest wire frame every assembly shares."
 license = "Apache-2.0"
 repository = "https://github.com/elct9620/kobako"
 readme = "README.md"

data/crates/kobako-transport/README.md

@@ -9,7 +9,7 @@ same in every assembly. This crate is both of them, and nothing else.
 
 | Module | What it fixes |
 |---|---|
-| `envelope` | the **core envelope**, the outer frame each message rides in |
+| `envelope` | the **Envelope**, the outer frame each message rides in |
 | `abi` | the values both sides agree on before exchanging a byte |
 
 The envelope covers the downcall's and the upcall's requests under one
@@ -28,7 +28,7 @@ so that payload reaches its reader as a view rather than a copy.
 
 ```text
 Call { method, payload }
-                  └── opaque here; read by whoever owns the schema
+                  +-- opaque here; read by whoever owns the schema
 ```
 
 ## Dependency Position
@@ -37,8 +37,9 @@ This crate depends on no other, and every kobako tier depends on it —
 including any third-party engine, codec, or guest composing against them.
 
 ```text
-host   kobako-runtime · kobako-wasmtime ──┐
-guest  kobako-core · kobako-mruby ────────┴──> kobako-transport
+host   kobako-runtime, kobako-wasmtime --+
+                                         +--> kobako-transport
+guest  kobako-core, kobako-mruby --------+
 ```
 
 The golden vectors in this crate are derived from the kobako repository's
@@ -51,7 +52,7 @@ reaches the same types through `kobako-core`.
 
 ```toml
 [dependencies]
-kobako-transport = "0.18.0" # x-release-please-version
+kobako-transport = "0.20.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-transport/src/abi.rs

@@ -10,7 +10,7 @@
 /// version it reports equals this one, so a framing or symbol change is
 /// an increment rather than a negotiation. A new request tag needs
 /// neither, but a new answer arm is an increment.
-pub const ABI_VERSION: u32 = 4;
+pub const ABI_VERSION: u32 = 5;
 
 /// Width in bytes of the length prefix that frames a message on WASI
 /// stdin, such as the Preamble.

data/crates/kobako-transport/src/envelope/bytes.rs

@@ -1,4 +1,4 @@
-//! Byte primitives for the core envelope: unsigned big-endian integers,
+//! Byte primitives for the Envelope: unsigned big-endian integers,
 //! length-prefixed byte strings, counted lists, and the trailing remainder.
 //!
 //! `Reader` borrows rather than copies, so a decoded envelope's payload is
@@ -7,7 +7,7 @@
 
 use super::DecodeError;
 
-const MALFORMED: DecodeError = DecodeError::new("core envelope ended before its declared length");
+const MALFORMED: DecodeError = DecodeError::new("Envelope ended before its declared length");
 
 /// Cursor over one message. Every read either advances past a complete
 /// field or fails, so a truncated message can never be mistaken for a
@@ -22,13 +22,13 @@ impl<'a> Reader<'a> {
         Reader { bytes, pos: 0 }
     }
 
-    pub(crate) fn u8(&mut self) -> Result<u8, DecodeError> {
+    pub(crate) fn read_u8(&mut self) -> Result<u8, DecodeError> {
         let byte = *self.bytes.get(self.pos).ok_or(MALFORMED)?;
         self.pos += 1;
         Ok(byte)
     }
 
-    pub(crate) fn u32(&mut self) -> Result<u32, DecodeError> {
+    pub(crate) fn read_u32(&mut self) -> Result<u32, DecodeError> {
         let end = self.pos.checked_add(4).ok_or(MALFORMED)?;
         let slice = self.bytes.get(self.pos..end).ok_or(MALFORMED)?;
         self.pos = end;
@@ -37,8 +37,8 @@ impl<'a> Reader<'a> {
     }
 
     /// A `u32` length followed by that many bytes.
-    pub(crate) fn bytes(&mut self) -> Result<&'a [u8], DecodeError> {
-        let len = self.u32()? as usize;
+    pub(crate) fn read_bytes(&mut self) -> Result<&'a [u8], DecodeError> {
+        let len = self.read_u32()? as usize;
         let end = self.pos.checked_add(len).ok_or(MALFORMED)?;
         let slice = self.bytes.get(self.pos..end).ok_or(MALFORMED)?;
         self.pos = end;
@@ -48,9 +48,9 @@ impl<'a> Reader<'a> {
     /// A byte string carrying UTF-8. Every text field in the envelope is
     /// validated at decode so a frontend receives `&str` without repeating
     /// the check.
-    pub(crate) fn text(&mut self) -> Result<&'a str, DecodeError> {
-        core::str::from_utf8(self.bytes()?)
-            .map_err(|_| DecodeError::new("core envelope text field is not valid UTF-8"))
+    pub(crate) fn read_text(&mut self) -> Result<&'a str, DecodeError> {
+        core::str::from_utf8(self.read_bytes()?)
+            .map_err(|_| DecodeError::new("Envelope text field is not valid UTF-8"))
     }
 
     /// A `u32` count followed by that many byte strings, each carrying
@@ -58,21 +58,21 @@ impl<'a> Reader<'a> {
     ///
     /// The elements are copied rather than borrowed: a binding's path and
     /// a panic's `available` names outlive the frame buffer they arrive in.
-    pub(crate) fn text_list(&mut self) -> Result<Vec<String>, DecodeError> {
-        self.list(|reader| Ok(reader.text()?.to_owned()))
+    pub(crate) fn read_text_list(&mut self) -> Result<Vec<String>, DecodeError> {
+        self.read_list(|reader| Ok(reader.read_text()?.to_owned()))
     }
 
     /// A `u32` count followed by that many byte strings of any content,
-    /// copied for the same reason as `text_list`.
-    pub(crate) fn bytes_list(&mut self) -> Result<Vec<Vec<u8>>, DecodeError> {
-        self.list(|reader| Ok(reader.bytes()?.to_vec()))
+    /// copied for the same reason as `read_text_list`.
+    pub(crate) fn read_bytes_list(&mut self) -> Result<Vec<Vec<u8>>, DecodeError> {
+        self.read_list(|reader| Ok(reader.read_bytes()?.to_vec()))
     }
 
-    fn list<T>(
+    fn read_list<T>(
         &mut self,
         mut element: impl FnMut(&mut Self) -> Result<T, DecodeError>,
     ) -> Result<Vec<T>, DecodeError> {
-        let count = self.u32()? as usize;
+        let count = self.read_u32()? as usize;
         // Every element opens with a `u32` length, so a count past what the
         // bytes left can hold is refused before it sizes the allocation.
         if count > self.remaining().len() / size_of::<u32>() {
@@ -106,7 +106,7 @@ impl<'a> Reader<'a> {
             Ok(())
         } else {
             Err(DecodeError::new(
-                "core envelope carries bytes past its last field",
+                "Envelope carries bytes past its last field",
             ))
         }
     }
@@ -175,15 +175,23 @@ mod tests {
         let encoded = w.into_bytes();
 
         let mut r = Reader::new(&encoded);
-        assert_eq!(r.u8(), Ok(7), "a u8 must round-trip through the writer");
-        assert_eq!(r.u32(), Ok(0xdead_beef), "a u32 must round-trip big-endian");
         assert_eq!(
-            r.bytes(),
+            r.read_u8(),
+            Ok(7),
+            "a u8 must round-trip through the writer"
+        );
+        assert_eq!(
+            r.read_u32(),
+            Ok(0xdead_beef),
+            "a u32 must round-trip big-endian"
+        );
+        assert_eq!(
+            r.read_bytes(),
             Ok(&b"kv"[..]),
             "a length-prefixed byte string must round-trip"
         );
         assert_eq!(
-            r.text_list(),
+            r.read_text_list(),
             Ok(vec!["a".to_owned(), "bc".to_owned()]),
             "a counted list must round-trip element for element"
         );
@@ -213,7 +221,7 @@ mod tests {
         let bytes = [0, 0, 0, 8, b'h', b'i'];
         let mut r = Reader::new(&bytes);
         assert!(
-            r.bytes().is_err(),
+            r.read_bytes().is_err(),
             "a byte string whose length overruns the message must be rejected, not truncated"
         );
     }
@@ -225,7 +233,7 @@ mod tests {
         let bytes = [0xff, 0xff, 0xff, 0xff];
         let mut r = Reader::new(&bytes);
         assert!(
-            r.text_list().is_err(),
+            r.read_text_list().is_err(),
             "a list count the message cannot satisfy must be rejected before any allocation"
         );
     }
@@ -238,7 +246,7 @@ mod tests {
         let encoded = w.into_bytes();
         let mut r = Reader::new(&encoded);
         assert!(
-            r.text().is_err(),
+            r.read_text().is_err(),
             "a text field carrying non-UTF-8 bytes must be rejected at decode"
         );
     }
@@ -250,7 +258,7 @@ mod tests {
         w.bytes(b"ok").remainder(b"!");
         let encoded = w.into_bytes();
         let mut r = Reader::new(&encoded);
-        r.bytes().unwrap();
+        r.read_bytes().unwrap();
         assert!(
             r.finish().is_err(),
             "bytes past an envelope's last field must fail loudly as a framing desync"

data/crates/kobako-transport/src/envelope/call.rs

@@ -36,9 +36,9 @@ pub struct Call<'a> {
 impl<'a> Call<'a> {
     pub fn decode(bytes: &'a [u8]) -> Result<Self, DecodeError> {
         let mut reader = Reader::new(bytes);
-        let target = match reader.u8()? {
-            KIND_PATH => Target::Path(reader.text()?),
-            KIND_HANDLE => Target::Handle(reader.u32()?),
+        let target = match reader.read_u8()? {
+            KIND_PATH => Target::Path(reader.read_text()?),
+            KIND_HANDLE => Target::Handle(reader.read_u32()?),
             _ => return Err(DecodeError::new("Call kind must be 0 (path) or 1 (handle)")),
         };
         if let Target::Handle(0) = target {
@@ -46,8 +46,8 @@ impl<'a> Call<'a> {
                 "Call target Handle id 0 is the invalid sentinel",
             ));
         }
-        let method = reader.text()?;
-        let block_given = match reader.u8()? {
+        let method = reader.read_text()?;
+        let block_given = match reader.read_u8()? {
             0 => false,
             1 => true,
             _ => return Err(DecodeError::new("Call block_given must be 0 or 1")),

data/crates/kobako-transport/src/envelope/compile_reply.rs

@@ -20,9 +20,9 @@ pub enum CompileReply {
 impl CompileReply {
     pub fn decode(bytes: &[u8]) -> Result<Self, DecodeError> {
         let mut reader = Reader::new(bytes);
-        match reader.u8()? {
+        match reader.read_u8()? {
             tag::OK => {
-                let bytecodes = reader.bytes_list()?;
+                let bytecodes = reader.read_bytes_list()?;
                 reader.finish()?;
                 Ok(CompileReply::Ok(bytecodes))
             }

data/crates/kobako-transport/src/envelope/error_record.rs

@@ -21,9 +21,9 @@ pub struct ErrorRecord {
 impl ErrorRecord {
     pub(crate) fn read(reader: &mut Reader<'_>) -> Result<Self, DecodeError> {
         Ok(ErrorRecord {
-            name: reader.text()?.to_owned(),
-            message: reader.text()?.to_owned(),
-            backtrace: reader.text_list()?,
+            name: reader.read_text()?.to_owned(),
+            message: reader.read_text()?.to_owned(),
+            backtrace: reader.read_text_list()?,
         })
     }
 

data/crates/kobako-transport/src/envelope/fault.rs

@@ -32,7 +32,8 @@ const KIND_BLOCK: u8 = 4;
 pub enum FaultKind {
     /// A Ruby exception raised inside the Service method.
     Runtime,
-    /// The call shape did not fit the method.
+    /// The Service method refused its arguments, whether the call would
+    /// not bind or the method rejected what it was given.
     Argument,
     /// No such member or method.
     Undefined,
@@ -115,8 +116,8 @@ impl Fault {
     }
 
     pub(crate) fn read(reader: &mut Reader<'_>) -> Result<Self, DecodeError> {
-        let kind = FaultKind::from_tag(reader.u8()?);
-        let message = reader.text()?.to_owned();
+        let kind = FaultKind::from_tag(reader.read_u8()?);
+        let message = reader.read_text()?.to_owned();
         // A Fault gains fields as the contract does, and it is the last
         // thing a Reply carries, so whatever follows the fields this
         // reader knows belongs to a later version of them.

data/crates/kobako-transport/src/envelope/outcome.rs

@@ -66,12 +66,12 @@ pub struct Panic {
 impl Outcome {
     pub fn decode(bytes: &[u8]) -> Result<Self, DecodeError> {
         let mut reader = Reader::new(bytes);
-        match reader.u8()? {
+        match reader.read_u8()? {
             tag::OK => Ok(Outcome::Ok(reader.remaining().to_vec())),
             tag::PANIC => {
-                let origin = Origin::from_name(reader.text()?);
+                let origin = Origin::from_name(reader.read_text()?);
                 let error = ErrorRecord::read(&mut reader)?;
-                let available = reader.text_list()?;
+                let available = reader.read_text_list()?;
                 reader.finish()?;
                 Ok(Outcome::Panic(Panic {
                     origin,