base-layer/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Record authentication response budget decision

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-05 04:06:23 +00:00
parent c542b81666
commit 95730a3c11
1 changed files with 36 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
docs/roadmap/audit/catalog.md
View File

@@ -30,9 +30,11 @@ Sources: [Security 1](07-security.md#1-the-audited-go-toolchain-predates-applica
**Confirmed resource/security defect.** Authentication diagnostics read a
successful upstream body with unbounded `io.ReadAll`. A deadline does not bound
the bytes a fast server can supply. Introduce finite response consumption and
clean closure, with an explicit choice of byte budget and overflow reporting.
Overflow should not be interpreted as proof of rejected authentication.
the bytes a fast server can supply.
[Decision 3](#decision-3-authentication-response-budget-and-overflow-outcome)
selects a fixed 1 MiB internal constant and explicit overflow diagnostics, with
credential acceptance unknown. Implementation remains pending. Overflow should
not be interpreted as proof of rejected authentication.
Relocating the provider adapter in entry 26 would not itself fix this defect.
Sources: [Resources 1](05-resources.md#1-authentication-diagnostics-read-an-unbounded-upstream-body),
@@ -515,6 +517,37 @@ in-document references, including recursion where otherwise supported. Update
schema documentation and release notes, and simplify the shared compilation
work in finding 21 accordingly. This record does not itself implement the change.
### Decision 3: Authentication Response Budget And Overflow Outcome
**Related findings:** [2](#2-bound-authentication-probe-response-consumption)
and [26](#26-move-openrouter-authentication-protocol-details-into-its-adapter).
**Status:** Accepted; implementation pending.
**Decision:** Bound the authentication protocol's response body to 1 MiB
(1,048,576 bytes), defined as a named internal constant. This is a generous
practical processing allowance, not an upstream protocol limit. Do not add a
public configuration option now; keep the value centralized so a future option
can be introduced if needed. This limit does not apply to inference responses
or establish an application deadline.
Enforce the budget against bytes actually read, regardless of declared content
length. Detect overflow, stop reading, and close without unbounded draining.
Report an explicit response-limit diagnostic with credential acceptance unknown,
retaining independently collected HTTP status and timing information. Overflow
is neither evidence of rejected credentials nor proof of malformed JSON. The
consuming application decides what to do with the diagnostic.
**Alternative considered:** A caller-configurable budget with a finite default
would accommodate unusual deployments, but adds public configuration without a
current demonstrated need. Reconsider if such a need arises.
**Remediation follow-through:** Add focused boundary and overflow coverage,
including missing or inaccurate content lengths. Represent overflow explicitly
in the diagnostic report and update its owning documentation. Keep this fix
independent of adapter relocation so architectural cleanup does not delay the
resource remedy. This record does not itself implement the change.
## Open Decisions
Work through the remaining decisions below in order, retaining their original
@@ -524,31 +557,6 @@ unrelated fixes. In particular, updating the maintainer toolchain need not wait
for the consumer-minimum decision. Implementation details and optional cleanup
do not become release gates merely by appearing in this catalog.
### Decision 3: Authentication Response Budget And Overflow Outcome
**Related findings:** [2](#2-bound-authentication-probe-response-consumption)
and [26](#26-move-openrouter-authentication-protocol-details-into-its-adapter).
**Question:** What finite response budget should the authentication adapter
apply, and how should a probe report exceeding it?
**Recommendation:** Select a conservative fixed budget for this small protocol,
check actual streamed bytes regardless of declared length, and close on overflow
without unbounded draining. Report the diagnostic failure with acceptance
unknown, retaining any independently observed HTTP facts. Agree the exact byte
count and its representation in the existing diagnostic report before coding;
the catalog does not select either implicitly.
**Alternative:** Expose a caller-configurable budget with a finite default.
This accommodates unusual legitimate responses but expands configuration and
validation surface. It is worthwhile if a concrete consumer requirement cannot
be served by an appropriately chosen fixed budget; it is not necessary merely
to address the demonstrated unbounded read.
**Resolve before implementation:** Choose the size, overflow classification,
and whether configurability is warranted. Keep this fix independent of adapter
relocation so architectural cleanup does not delay the resource remedy.
### Decision 4: Exact Numbers And The Source-Conversion Boundary
**Related findings:** [3](#3-avoid-exponential-expansion-during-convenience-source-conversion),