widen the write-guard parity test to the full-URL mode and the normalized path #789

New issue

Open

opened 2026-10-16 02:09:28 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-16 02:09:28 +00:00

Owner

The write-guard parity test from #785 proves a passthrough write calls the guard, but only for the relative and absolute raw modes, and it never checks the path the guard receives. Two gaps remain.

Gap 1: no case asserts a full-URL-mode write calls the guard. The guard call runs for every raw mode, so a full-URL write is guarded in the code today, but nothing locks it. A later change could drop the full-URL mode out of the guarded path and the gate would stay green.

Gap 2: no case asserts the endpoint the guard receives. The absolute-mode case checks only that the guard was called once, not that the /api/v1 prefix was stripped. The effect matcher classifies a write by this path, so a wrong path changes the decision. rawGuardPath normalizes the path for all three modes and no assertion covers its output.

Safety note: the guard refuses any endpoint it cannot match, so a normalization bug over-refuses a valid write rather than letting a write through. These gaps are test coverage, not an open hole.

Fix:

Add a full-URL-mode write case that asserts the guard is called.
Assert the exact endpoint value the guard receives in each raw mode, so a broken rawGuardPath fails the test.

Acceptance:

The test fails if a full-URL-mode write skips the guard.
The test fails if rawGuardPath returns the wrong path for any mode.

Refines #785. Part of the write-guard work (#670).

The write-guard parity test from #785 proves a passthrough write calls the guard, but only for the relative and absolute raw modes, and it never checks the path the guard receives. Two gaps remain. Gap 1: no case asserts a full-URL-mode write calls the guard. The guard call runs for every raw mode, so a full-URL write is guarded in the code today, but nothing locks it. A later change could drop the full-URL mode out of the guarded path and the gate would stay green. Gap 2: no case asserts the endpoint the guard receives. The absolute-mode case checks only that the guard was called once, not that the `/api/v1` prefix was stripped. The effect matcher classifies a write by this path, so a wrong path changes the decision. `rawGuardPath` normalizes the path for all three modes and no assertion covers its output. Safety note: the guard refuses any endpoint it cannot match, so a normalization bug over-refuses a valid write rather than letting a write through. These gaps are test coverage, not an open hole. Fix: - Add a full-URL-mode write case that asserts the guard is called. - Assert the exact endpoint value the guard receives in each raw mode, so a broken `rawGuardPath` fails the test. Acceptance: - The test fails if a full-URL-mode write skips the guard. - The test fails if `rawGuardPath` returns the wrong path for any mode. Refines #785. Part of the write-guard work (#670).

hexajon referenced this issue

2026-10-16 02:41:35 +00:00

feat(guard): enforce the ADR 0046 write guard on every forge write surface #790

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#789

No description provided.

Rows
Columns