Conformance & interop scorecard

Target: near grpc-go / official interop parity (Phases 1–9 hard; ALTS allowlisted).

Overall estimates (judgment, not a formal audit)

Remaining risk is mostly peer lifecycle edges (half-close, compress+stream, cancel timing) and cloud-live paths (ADC/ALTS/xDS against real infra), not missing basic RPCs. Stress demos found two such bugs (gzip stream decode; bidi empty END_STREAM); FramingMatrix + run-stress-demos.sh now hard-gate those classes.

Scorecard by area

Mock vs live

Interop case checklist

Notes: - cacheable_unary here checks the GET-verb wire mechanism (safe/idempotent calls use :method: GET) against EmptyCall in Lean↔︎Lean CI, rather than replicating the official CacheableUnaryCall + caching-proxy + timestamp-equality assertions (infrastructure outside this repo). It is not run against recent grpc-go interop servers (GET EmptyCall → INTERNAL) or Python C-core (rejects GET). - cancel_after_begin / cancel_after_first_response now assert CANCELLED (grpc-status 1) after the client-initiated RST, using the same RST→trailers mapping (H2.Client.rstToTrailers) applied locally as soon as the client sends the reset. - Compression negotiation preference order is gzip > deflate > snappy > identity (Grpc.Compression.negotiate); deflate uses a zlib (RFC 1950) container, snappy uses literal-only (uncompressed) block framing that any conformant Snappy reader can decode. - mTLS: Grpc.Tls.Config.certPath/keyPath present a client certificate on dial; Grpc.Tls.Config.clientCaPath makes serveTls/Grpc.Tls.serveH2 require and verify a client certificate. Covered end-to-end by tlsLoopback (plain TLS, mTLS-reject-without-cert, mTLS-accept-with-cert), skipped only if openssl is unavailable in the environment. - ADC composition: Grpc.Adc.dialOptions builds Credentials.DialOptions combining TLS channel credentials with an ADC-derived per-RPC Bearer token, for calling real Google APIs. - xDS ADS now resolves the full chain a real xDS-enabled client would: Grpc.XdsAds.resolveChain does LDS(listener) → RDS(route config) → CDS(cluster) → EDS(endpoints) over one ADS session, with real ACK/NACK (Grpc.Xds.Discovery.Request.ack/.nack) on each hop; fakeAdsServer serves all five resource types (LDS/RDS/CDS/EDS/SDS) plus a deliberate nack-test resource whose inner Any.type_url is wrong, to exercise the NACK path end-to-end. - Observability additions: Grpc.Health.registerWithWatch adds a Watch (server-streaming) handler alongside Check; Grpc.Reflection decodes real ServerReflectionRequests and answers list_services/file_by_filename/file_containing_symbol against a small registry for both v1 and v1alpha; Grpc.Channelz.GetTopChannels/GetServers return real call counters keyed off a shared IO.Ref Counters; Grpc.Orca reports use IEEE-754 double utilization fields and support both per-call and out-of-band (orca_oob) streaming reports; Grpc.BinaryLog captures header/message/trailer events to an in-memory sink; Grpc.Stats exposes call counters via a Prometheus-style exposition and a stdout/OTel-stub exporter. - Codegen: the lightweight .proto-text path (LEAN_GRPC_PROTO, used by the Lake CI smoke test) is unchanged and still emits ByteArray-typed RPC stubs (it has no field-level info). The real protoc-plugin path (stdin/stdout, invoked as protoc --plugin=... --lean4_out=...) now decodes a minimal but real subset of google.protobuf.compiler.CodeGeneratorRequest (messages, fields, services, methods) and emits real message structs with encode/decode plus correctly-typed unary/client-streaming/server-streaming/bidi client stubs and a typed unary server-registration helper per RPC. scripts/run-codegen-fixture.sh hand-builds a request for a small helloworld-shaped service (no protoc binary needed) and checks the emitted code for the expected struct/stub/handler names. - grpclb: Grpc.Grpclb is a thin client-side shim for the legacy grpc.lb.v1.LoadBalancer/ BalanceLoad protocol — one-shot connect, InitialLoadBalanceRequest, decode the first ServerList response, and filter out drop entries. xDS ADS (Grpc.XdsAds) remains the preferred/primary discovery+LB path in this library; grpclb exists for interop with older balancers that only speak the plain server-list protocol. - Interceptors: Grpc.Interceptor provides composable client/server unary interceptor chains (applyClient/applyServer, callUnary/registerUnary) plus ready-made logging interceptors; additional cross-cutting concerns (auth, metrics, retries) compose the same way by adding more ClientUnary/ServerUnary elements to the chain array. - Soak: Bench/Soak.lean (benchSoak) now understands the standard --soak_* flags used by grpc’s rpc_soak/channel_soak tools (soak_iterations, soak_max_failures, soak_per_iteration_max_acceptable_latency_ms, soak_min_time_ms_between_rpcs, soak_overall_timeout_seconds, soak_request_size, soak_num_channels, soak_reset_channel_per_iteration), while remaining back-compatible with the original benchSoak host port N positional-iterations form. See scripts/run-soak.sh.

Commands

./scripts/run-go-to-lean.sh
GRPC_PORT=10001 ./scripts/interop-go-lean.sh
./scripts/run-python-to-lean.sh
GRPC_PORT=10001 ./scripts/interop-lean-python.sh
./scripts/run-rust-to-lean.sh
GRPC_PORT=10001 ./scripts/interop-lean-rust.sh
./scripts/interop-compress-go-lean.sh
./scripts/interop-tls-go-lean.sh
./scripts/run-adc-smoke.sh
./scripts/run-xds-ads-smoke.sh       # full LDS/RDS/CDS/EDS/SDS chain + NACK path
./scripts/run-codegen-fixture.sh     # real protoc-plugin descriptor decode + typed emit
./scripts/run-soak.sh                # rpc_soak + channel_soak flag surface
./scripts/h2spec.sh
./scripts/run-stress-demos.sh        # VaultGauntlet + MirrorForge + SignalWeave + FramingMatrix
./scripts/run-framing-matrix.sh      # peer framing only (Lean↔Lean + Go→Lean)
lake build tlsLoopback && ./.lake/build/bin/tlsLoopback   # mTLS loopback (needs `openssl` CLI)

# Manual / nightly only — needs live Google credentials + network egress:
GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json ./scripts/run-adc-live.sh

Source: docs/conformance.md in RileyBetts/lean-grpc. Hosted docs may lag the repository slightly.