[Networking] Report message decode failures on staked channels to ALSP

[zhangchiqing]

Messages received on staked channels that fail to decode, or that fail structural validation in ToInternal, were not being reported to the application-layer spam prevention manager because the violation carried a nil Identity.

Changes:

• In processAuthenticatedMessage, populate Violation.Identity for all four decode/validation failure branches (unknown message code, unmarshal/invalid encoding, unexpected decode error, and ToInternal failure).
• The identity lookup is done lazily via a closure so it only runs on violation paths, not on the hot path for well-formed messages.
• Public channels keep the nil Identity, preserving the existing exemption where the slashing consumer skips reporting.

Tests added to network/underlay/network_test.go covering:

• Undecodable payload on a staked channel is reported to ALSP.
• Well-formed CBOR that fails ToInternal structural validation on a staked channel is reported to ALSP.
• Decode failure on a public channel is skipped (not reported).

The related nil-identity sites on the unicast path (handleIncomingStream no-subscription and max-size branches) are left for a follow-up.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Improved security violation reporting for invalid or undecodable messages on staked channels by including the peer’s identity.
  • Public-channel decode failures continue to be excluded from security violation reporting while still being recorded in security metrics.

• Tests

  • Added coverage for invalid payloads, structural validation failures, and public-channel behavior.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a80af5e0-4642-4666-bb2b-cda32e1ba432

📥 Commits

Reviewing files that changed from the base of the PR and between 8c18ee2 and c6f3bf0.

📒 Files selected for processing (2)

• network/underlay/network.go
• network/underlay/network_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• network/underlay/network.go

Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds lazy peer identity resolution to authenticated message violations. Staked-channel decode and validation failures now reach ALSP with the peer identity. Public-channel failures remain excluded from ALSP reporting.

Changes

Authenticated violation reporting

Layer / File(s)	Summary
Identity propagation for violations network/underlay/network.go	Message violations resolve peer identity for staked channels and attach it to ALSP reports. Public-channel violations keep a nil identity.
ALSP reporting tests network/underlay/network_test.go	Tests verify reporting for staked-channel decode and structural validation failures. Tests also verify skipped reporting and metrics for public-channel decode failures.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to c6f3b

Staked-channel decode and validation violations now include sender identity for ALSP reporting, while public-channel violations remain excluded. The covered behaviors preserve the intended reporting boundary and no merge-blocking risk remains.

Suggested reviewers: peterargue

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: reporting message decode failures on staked channels to ALSP. It is concise and specific.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch leo/alsp-report-decode-failures

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!