Repository navigation
test(compat): sdk compat parity tripwire and proxy-swap 101 note (D-0705, D-0769) - #1012
Merged
Merged
Conversation
…e 101 header rule in proxy-swap matrix (D-0705, D-0769)
…ratchet internal/compat is L0 and may not import the SDK module (sdk/go/v2/compat is unclassified). Moving TestSDKCopyAgreesInCLIProcess to test/e2e (L3) resolves the D1 violation without loosening the ratchet.
acamarata
force-pushed
the
dw10-cli-10
branch
from
October 28, 2026 21:47
8f4c5d1 to
607f6f3
Compare
Collaborator
Author
|
Fixed nself-ci layering ratchet failure: moved |
Chromium learns HSTS from secure WebSocket handshakes and enforces it on subsequent requests. Document the missing HSTS header on 101 responses as an unresolved difference instead of claiming it has no browser effect.
Collaborator
Author
|
Fixed CHANGES-1: corrected the claim that WebSocket handshake HSTS headers have no browser effect. Chromium learns HSTS from secure WebSocket handshakes (regression test linked in code); documented the missing HSTS header on 101 responses as an unresolved difference. Commit 9192533. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
D-0705 (partial hardening, row stays latent)
The sdk copy of the ADR 0021 rule (
sdk/go/compat) still reads onlyNSELF_V15. Today both copies agree, so no behaviour changes. Addedinternal/compat/sdk_parity_test.go: in the CLI process it assertsinternal/compat.V15()equalssdk/go/compat.V15()for every rule value. If P7-SHIP flips the internal default without the sdk copy following (or the CLI exporting its resolved mode), this test fails and names D-0705 and the pin store gate, so the flip must handle the sdk in the same change. Mutation check: making an emptyNSELF_V15true ininternal/compatfails the new test (<unset>and empty subtests); reverted. I did not flip the default or delete the v1.4 branch inknownhosts_compat.go: that is the P7-SHIP release step (version-lock territory) andcompat-markers.shalready lists the file (D-0484).D-0769 (partial, doc only)
Added the comment in
scripts/e2e/proxy-swap.shthat browsers do not apply CSP/HSTS/X-Frame-Options from a websocket 101 handshake, so the missing 101 headers have no browser effect. TheVarydecision needs a Traefik renderer change in the plugins repo; tightening the matrix first would turn the e2e red, so the matrix is unchanged.Not in this PR
executor.gobranch).nodes testAcceptEnv warning, node setup page) is in the plugins repo (free/ci); the CLI-side behaviour is already documented insdk/go/remote/exec.go(EnvAllowlist). A generated-Ffile would drop the operator's User/IdentityFile/ProxyJump settings, so I did not choose it.Checks
go test ./internal/compat/...okgo vet ./internal/compat/okbash scripts/ci/compat-markers.sh --checkokbash -n scripts/e2e/proxy-swap.shok (shellcheck not installed locally)