test(storyboard-drift): drop stale idempotency.supported skip#633
Merged
Conversation
The `isPathReachable` `union` branch already returns true when any union option has the segment, so `adcp.idempotency.supported` resolves through `z.union([IdempotencySupported, IdempotencyUnsupported])` without any extra unwrapping. Skip entry was stale; removing it turns the check on. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…docs Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
, adcp#2468) Unblocks the signed-requests synthesis cascade on main: - Vector loader accepts jwks_override (inline malformed JWK) as an alternative to jwks_ref. Vector 025 ships such an override; without this, synthesis throws and every downstream signed_requests step reports `synthesis_error`. - @target-uri canonicalization decodes percent-encoded unreserved bytes per RFC 3986 §6.2.2.2 (fixes vector 009 positive byte-identity). - Step 1 now rejects duplicate Signature-Input dictionary keys (021), multi-valued Content-Type (022), multi-valued Content-Digest (023), and non-ASCII URL authority (026) — each is a parser-differential attack surface left open by silent last-value deduplication. - Step 8 enforces JWK alg/kty/crv consistency (RFC 8037 / 7518) so an `alg=EdDSA` JWK with `kty=EC` is rejected with request_signature_key_purpose_invalid (025). - Builder adds passthrough mutators for 021-026 (prebaked malformed requests — re-signing would repair the anomaly). Grader marks 025 and 026 `transport_ungradable` because a live HTTP probe can't surface either edge (fetch punycodes U-labels; the reference agent exposes its own JWKS, not the vector's). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… library Follow-up to expert review of bc7db86: - validateJwkParameterConsistency now requires jwk.alg, binds it to sig-params alg (ed25519↔EdDSA, ecdsa-p256-sha256↔ES256), and runs the kty/crv check unconditionally. Prevents a JWKS entry with no alg from smuggling a sig-params alg-downgrade past step 8. - canonicalAuthority rejects userinfo in the same way canonicalTargetUri does. Covers the case where a signer covers @authority but not @target-uri. - rejectNonAsciiHost accepts scheme-relative URLs (//host/...) so a raw U-label can't enter through a non-absolute URL shape. - Grader routes jwks_override vectors (currently only 025) through the library verifier directly with StaticJwksResolver(vector.jwks_override.keys). Black-box HTTP probing can't mutate a target agent's JWKS per-vector, so the only path that exercises what 025 tests is the in-process verifier. 026 remains transport_ungradable (fetch punycodes U-labels). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…achable # Conflicts: # src/lib/signing/canonicalize.ts # src/lib/testing/storyboard/request-signing/builder.ts # src/lib/testing/storyboard/request-signing/types.ts # src/lib/testing/storyboard/request-signing/vector-loader.ts # src/lib/types/core.generated.ts # src/lib/types/schemas.generated.ts # test/request-signing-grader-e2e.test.js # test/request-signing-grader-mcp.test.js # test/request-signing-grader-vectors.test.js # test/request-signing-runner-integration.test.js
adcp#2468 is in the latest tarball — the webhook_emission storyboard now asserts `field_present: supported_protocols`, so the allowlist entry for `operations` never matches any collected validation. Remove the stale entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
isPathReachablealready resolvesadcp.idempotency.supportedvia the existingunionbranch — bothIdempotencySupportedSchemaandIdempotencyUnsupportedSchemaare plain objects with asupportedfield, andunionreturns true when any option has the segment.VERIFIER_UNREACHABLEentry predicted a codegen shape that doesn't actually materialize here (no intersection, no wrapper), so the skip was stale.isPathReachableitself.Test plan
node --test test/lib/storyboard-drift.test.js— 368 pass, 4 skipped (remaining upstream-drift entries), 0 failidempotency/get_capabilities: adcp.idempotency.supported exists in get_adcp_capabilities schemasubtest now runs and passesNo library code touched → no changeset.
🤖 Generated with Claude Code