Skip to content

Refuse malformed keyed saved receipts - #871

Closed
NewWorldVenture wants to merge 1 commit into
codex/reminder-member-family-20261003from
codex/idempotency-keyed-receipts-20261003
Closed

NewWorldVenture wants to merge 1 commit into
codex/reminder-member-family-20261003from
codex/idempotency-keyed-receipts-20261003

Conversation

@NewWorldVenture

Copy link
Copy Markdown
Owner

Successful keyed duplicate probes could accept a malformed saved receipt or a receipt for another family/key. Validate the successful non-null result as an object with a nonempty string ID, the queried family (case-insensitive), and the exact idempotency key before returning it. Null absence and existing SDK error precedence remain intact; recovery keeps the original create refusal when the saved receipt is invalid.

Adds 20 synthetic installed-SDK boundary cases and supplies family/key metadata to one existing healthy reminder retry fixture. The original 19-case block remains byte-exact; all 16 reminder cases retain their names and assertions. Same-family legacy foreign-member outcomes and opaque extra fields remain admitted.

Validation: candidate and normal-config 20/20 passed; safe frozen parent produced the expected nine causal failures and eleven passing controls. Related reminder 16/16 passed. Full strict TypeScript (--noEmit --incremental false, 8192MB) and scoped three-file lint passed under the network seal. Each SDK boundary run recorded 25 GETs, at most two per case, seven pure modeled create callbacks, and zero POST, forbidden operations, or transport errors. Nine failures demonstrate one receipt contract gap, including the empty-ID refinement.

Stacked draft on codex/reminder-member-family-20261003 (#867). Evidence is limited to malformed successful HTTP JSON modeling and actual helper behavior; it does not prove PostgreSQL/RLS, provider, privacy, backend, or full workflow behavior. No schema/configuration changes or backend operations. Complete author evidence: 2574585f01bf3dd44f4a5eabe888948882c7584acbaecb49b0d5073b6b33e405.

@vercel

vercel Bot commented Oct 3, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
bubaly Ignored Ignored Oct 3, 2026 11:07am UTC

Request Review

@NewWorldVenture

Copy link
Copy Markdown
Owner Author

Independent read-only review traced the sole hosted Main unit failure on head bc55f74a72febc0dc5a722fb2d8ea029020cdf3d to the repeated-calendar-key fixture returning EVENT_ROW without the now-required matching idempotency_key. This is fixture drift; the product check is family-and-key scoped, and the authored receipt tests pass.

A local fixture-only candidate based on this exact head adds idempotency_key: 'retry-1' to that saved receipt: commit 0b06cf63f0b6461fa6faae486ec5ad64413c98a6. Validation: formerly failing case 1/1, full service-calendar 19/19, combined receipt/calendar/reminder 55/55, scoped ESLint and diff check pass. It is isolated and unpushed; exact-head hosted CI must still rerun. No product source changed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant