connect: put a size ceiling on ClusterActivation.tensor_data #1078

Follow-up from #1063 by @Adityakk9031 — thanks again for that PR!

What

ClusterActivation.tensor_data is an unbounded bytes field (idl/connect.proto:276). Every parse path in core/src/connect/rac_connect.cpp runs through parse_message (:148-166), whose only pre-parse check is rac_proto_bytes_validate — data == nullptr && size != 0, plus size > INT_MAX (core/src/foundation/rac_proto_buffer.cpp:30-38). There is no SetTotalBytesLimit and no message-size constant anywhere under core/src or core/include, and the activation validator enforces only a floor (min_bytes = seq_len * hidden_size * 2, rac_connect.cpp:986-991). The declared seq_len/hidden_size cannot bound it either — they are read from the same untrusted message — so an oversized activation is allocated in full by ParseFromArray before any validation sees it.

Why it matters

A coordinator or peer that advertises a large tensor, maliciously or by accident, makes the receiving device allocate it before the cluster can reject it, up to protobuf's ~2 GB ceiling. Nothing reaches these entry points over a transport yet, which is exactly why the ceiling belongs in place first: the receive path and decoder are being written in #1071, and a boundary check added after the wire shape is in use is one a peer can skip. (That PR's exact byte-count check — tensor_data().size() == seq_len * hidden_size * element_size — is not a ceiling, since the dimensions come from the same message.) Sanchit raised this on #723 on 2026-10-14 and left it open for a follow-up.

Suggested approach

Pick a protocol maximum (a few hundred MB, or a bound derived from the declared layer geometry) and enforce it in parse_message — or a cluster-specific parse helper — before ParseFromArray, returning a typed rejection the way the other cluster paths do; state the ceiling in the idl/connect.proto comment next to the field. If #1071 lands first, its transport receive path is the natural place to enforce it.

Done when

• A cluster message whose tensor_data exceeds the documented ceiling is rejected before the payload is allocated.
• The ceiling is stated in the idl/connect.proto contract and covered by a test.

Not blocking #1063. @Adityakk9031, you're welcome to take this one if you're interested.

Opened with help from Claude Code and Codex.

Reviewed with help from Claude Code and Codex.