The fixture covers 8 of 13 frame types

Type: Debt
Found while: SAPE-13
Triage: Defer
Status: Open
Severity: Medium — the uncovered five include the whole handshake

Description

fixtures/frames.json is what a third-party client builds against. It holds 10 cases covering 8 distinct frame types out of the 13 the protocol defines. Five types have no case at all.

Evidence

Counted from the two files themselves, not from either one's prose.

The 13 types, internal/protocol/frame.go:37-57:

#	Type	In the fixture?
1	hello	no
2	welcome	no
3	ping	yes — "ping, no payload"
4	pong	no
5	invoke	yes — "invoke with JSON"
6	result	yes — "largest id", "payload with every byte value"
7	failure	yes — "utf-8 in JSON"
8	subscribe	no
9	event	yes — "event, id 0 — nobody asked for it"
10	goodbye	no
11	elevate	yes — the proof answering the welcome's challenge
12	explore	yes — two cases, a typed get and a catalogue
13	declare	yes — an operation stored on a running server

8 of 13, from 10 cases. Note what the five missing ones are: hello and welcome are the whole handshake, goodbye is how a connection ends cleanly, and subscribe is the entry to the only asynchronous part of the protocol — whose answering frame, event, is covered.

The suites are honest about the number without stating it. The TypeScript guard asserts fixture.cases.length >= 8 (tests/frames.test.mjs:41) — a floor, not a coverage claim — while asserting that the fixture's types table matches FrameType exactly. So the table of 13 is pinned and the cases are not.

Triage

Does it lose data, break a promise on a public surface, or stop somebody installing and running? No. The frame numbers 1…13 are frozen by the types table, which is pinned on both sides, and the types with no case are all exercised by real tests in both repositories — a handshake that did not work would fail every live test there is. What is missing is a byte-level example a stranger can build against without running either implementation.

So this blocks nobody from installing or running, and it breaks no promise that was made: the fixture never claimed to be complete. It is a gap in what the specification teaches, which is real and is not a release gate. Defer.

If deferred, what it costs to wait

The cost is paid by the next client author in a fourth language. They get no worked example of the handshake — the one part of the protocol where getting the bytes wrong means nothing works at all and there is no error frame to read, because the error frame comes after the handshake.
The welcome gap is now slightly worse than when this was filed: SAPE-1 added productVersion to that frame, so the one frame with no worked example is also the one that just grew a field — see ISS-16 for what two of three clients do with it.
Frame numbers freeze at 1.0.0 either way, so adding cases later is purely additive and costs nothing in compatibility. This is one of the few issues here that is genuinely no more expensive tomorrow.
The compounding part is ISS-2: every case added is one more thing kept in sync by hand across two repositories. Fixing the single-source problem first makes this cheaper, not the other way round.