WS-A3 pre-freeze hardening: Audit reserve, cross-list token tag, boundary tests #351

New Issue

2026-07-31T21:42:43Z

KofTwentyTwo commented

2026-07-31 21:42:43 +00:00

(Migrated from github.com)

Non-blocking follow-ups from the WS-A3 (#275) review, to land BEFORE the M7 freeze:

Audit.ListRecordsRequest field 2 was retyped (offset uint32 -> page_token string) at the same field number — authorized pre-freeze, but add reserve 2; (+ move page_token to a fresh number) before freezing so the old wire slot is never reused.
Cross-list page_token acceptance is only partial: messages/rules/events share the [I,S] cursor layout, so parse_token matches on shape not list identity — a token from one list is silently accepted by another (non-corrupting: yields an empty/wrong page, never a dup/gap in correct single-list paging). Add a list-identity tag to the opaque cursor (private encoding, no contract break) and reject mismatches; correct the report's over-claim.
Add across-a-boundary multi-page no-dupes/no-gaps tests for the 4 lists that only have single-page round-trips (folders/rules/events/contacts). All were hand-verified correct in review, but contacts has the trickiest ordering (interaction_count DESC, display_name ASC, id ASC) and deserves an explicit multi-page test. Minor: encode_cursor unwrap_or_default on a non-finite bm25 rank. Source: PR #350 review.

Non-blocking follow-ups from the WS-A3 (#275) review, to land BEFORE the M7 freeze: 1. Audit.ListRecordsRequest field 2 was retyped (offset uint32 -> page_token string) at the same field number — authorized pre-freeze, but add `reserve 2;` (+ move page_token to a fresh number) before freezing so the old wire slot is never reused. 2. Cross-list page_token acceptance is only partial: messages/rules/events share the [I,S] cursor layout, so parse_token matches on shape not list identity — a token from one list is silently accepted by another (non-corrupting: yields an empty/wrong page, never a dup/gap in correct single-list paging). Add a list-identity tag to the opaque cursor (private encoding, no contract break) and reject mismatches; correct the report's over-claim. 3. Add across-a-boundary multi-page no-dupes/no-gaps tests for the 4 lists that only have single-page round-trips (folders/rules/events/contacts). All were hand-verified correct in review, but contacts has the trickiest ordering (interaction_count DESC, display_name ASC, id ASC) and deserves an explicit multi-page test. Minor: encode_cursor unwrap_or_default on a non-finite bm25 rank. Source: PR #350 review.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#351