Skip to content

Implement automatic tag pagination in the library and CLI #69

Closed
#70
Closed
Implement automatic tag pagination in the library and CLI#69
#70
Labels
agent-managedCreated/managed by My Feature EngineerenhancementNew feature or requestfeature:tag-paginationAutomatic tag pagination in the library and CLItype:featureFeature tracking issue (epic)

Description

@toddysm
toddysm
opened on Oct 29, 2026

Summary

Add automatic tag pagination to the Python library and command-line interface (CLI), using the pagination protocol in the Open Container Initiative (OCI) Distribution Specification.

The existing list_tags() operation and regshape tag list expose one-page requests through page_size / --n and last / --last. Add list_tags_all() and an opt-in regshape tag list --all that retrieve and aggregate all remaining pages. Keep the existing single-page behavior unchanged.

Authoritative specification

Implement against the released OCI Distribution Specification v1.1.1, Listing Tags, particularly endpoints end-8a and end-8b. Release reference.

The following are protocol requirements or guidance from that specification, not new RegShape conventions:

  1. Tags are retrieved with GET /v2/<name>/tags/list. A successful response for an existing repository is HTTP 200 with a tag-list object containing the repository name and tags. An empty repository may return an empty list.
  2. The specification requires lexical ordering, described there as case-insensitive alphanumeric ordering. Preserve the received ordering and exact tag spelling when aggregating pages; do not lower-case or independently re-sort tags before selecting a continuation cursor.
  3. n requests a number of tags: /v2/<name>/tags/list?n=<int>. The specification permits fewer than n results when the repository has fewer tags or a Link header is supplied; otherwise it requires n results. A short page alone is therefore not a sufficient end-of-list signal when a continuation link is present.
  4. A registry MAY provide a continuation Link header when more tags are available. When provided, its syntax must follow RFC 5988, Web Linking, with relation next. The header is optional, so absence of Link must not by itself end a full-sized, cursor-paginated response.
  5. last is an exclusive cursor containing a tag value, not a numerical offset: /v2/<name>/tags/list?n=<int>&last=<tagname>. That tag is excluded from the following page. A numeric-looking tag remains a tag value; do not interpret it as an offset.
  6. n is optional when last is supplied.
  7. With n=0, the registry must return an empty tag list and must not include a Link header.
  8. The specification advises clients to prefer a supplied Link header over deriving pagination from last. This matters both for older registries that omit links and newer registries that use links to return shorter pages.

The specification defines the wire protocol. It does not mandate a CLI --all flag, a library helper, or a particular default page size; those are client conveniences.

Required client behavior

  • Add and export list_tags_all() using the existing authenticated RegistryClient and TagList model. Reuse the current tag operation, error handling, and telemetry patterns where appropriate; do not make a breaking change to list_tags().
  • Add --all to regshape tag list. Without it, preserve the current request count, flags, output, and pagination semantics.
  • In all-pages mode, --n controls each requested page, not the total number of returned tags. If omitted, use a documented positive default page size (proposed: 100). This default is a RegShape policy, not an OCI requirement.
  • Support an initial last / --last cursor: in combination with --all, retrieve all tags after that cursor, not the tags preceding it.
  • Prefer a valid rel="next" link on every page, even when the page is shorter than requested or empty. Resolve relative links against the actual response URL, select the correct relation from headers containing multiple links, and preserve the linked path and query rather than rebuilding them from stale parameters.
  • When a next link is absent and a positive page size was used, continue from the last returned tag after a full-sized page. Stop on a short or empty page without a next link. Handle exact multiples of the page size, which may require a final empty request.
  • Use the effective page size of the current request when falling back to cursor pagination; a server-provided link may change it. Cover transitions between linked and cursor-only pages without losing tags or stopping early.
  • As a RegShape input-validation policy, reject zero/negative page sizes for list_tags_all() and --all before network access. Do not remove existing single-page --n 0 support: its OCI-defined empty result is not a request for all tags.
  • Detect repeated continuation URLs, cursor cycles, or lack of pagination progress and report a clear error rather than hanging or returning an apparently complete partial result.
  • Treat continuation links as untrusted input. Reuse transport safeguards where available; do not forward registry credentials to another origin or silently downgrade a secure connection. Reject unsafe links explicitly. These are client safety requirements, not additional OCI pagination clauses.
  • Return one aggregated TagList, preserving the existing {"name": ..., "tags": [...]} shape. Keep --json, --output, authentication, --insecure, and telemetry behavior consistent with other commands.
  • If a later page fails, propagate the repository-standard error. The CLI must exit nonzero without reporting success or emitting/writing an incomplete result as if it were the full list.

Acceptance criteria and regression tests

  • list_tags_all() is available from the tags package and returns every page in one TagList.
  • regshape tag list --all -i registry/repo retrieves all tags; omitting --all remains a single-page operation.
  • Tests cover empty repositories, one page, multiple pages, exact page-size multiples, and an initial exclusive cursor.
  • Link tests cover absolute same-origin links, relative links, multiple relations, linked query preservation, and short/empty pages that still provide a next link.
  • Compatibility tests cover registries omitting Link, full-page cursor continuation, final short/empty pages, and transitions where linked requests change the effective page size.
  • Tests preserve server ordering and tag case, use tag values rather than offsets, and verify exact request paths/parameters and bounded request counts.
  • --all --n 0 and negative all-pages sizes fail clearly before requests; existing single-page --n 0 behavior is preserved.
  • Repeated links/cursors, unsafe continuation origins, malformed responses, authentication failures, and later-page transport/registry failures have explicit error tests.
  • CLI tests cover text/JSON output, file output, --n, --last, and failure without successful-looking partial output.
  • Include CLI-to-library/transport regression coverage, not only mocked return-value tests, and wire it into hosted test validation. Reuse a test workflow when available rather than invoking or changing release automation.
  • Update library/CLI help, the operations and CLI specifications, and user-facing examples. Cite the pinned OCI section and distinguish its requirements from RegShape-specific defaults and safety policies.

Examples

# Fetch every tag, using the all-pages default
regshape tag list -i registry.example.com/team/image --all

# Fetch every remaining tag after v1.0, requesting 100 per page
regshape tag list -i registry.example.com/team/image --all --n 100 --last v1.0

# Save the aggregated response
regshape tag list -i registry.example.com/team/image --all --json -o tags.json

Successful JSON retains the existing shape, for example {"name":"team/image","tags":["v1.0","v1.1","v2.0"]}. Invalid all-pages page sizes should produce a usage error; later-page failures should produce the normal tag-operation error and a nonzero exit.

Relevant implementation surfaces

Scope boundary

This is a new, opt-in client convenience over the existing tag-list endpoint. It does not add a registry API, change tag deletion, promise a consistent snapshot while tags are concurrently modified, or authorize unrelated catalog/referrer changes.

Captured as backlog work only; implementation has not started. Tracking is issues-only because Project access is currently unavailable.

Activity

  1. toddysm
    added
    enhancementNew feature or request
    agent-managedCreated/managed by My Feature Engineer
    feature:tag-paginationAutomatic tag pagination in the library and CLI
    type:featureFeature tracking issue (epic)
    on Oct 29, 2026

  2. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Capture checkpoint

    Status: planned/backlog; implementation has not started. The issue records the released OCI Distribution Specification v1.1.1 rules, separates them from proposed client defaults and safety policies, and includes library/CLI acceptance criteria and regression scenarios.

    This is a standalone capability work item, not a child of the Homebrew or referrer-tag work. No implementation branch, pull request, or repository edit was created for it. Tracking is issues-only because Project access is unavailable. Next step: schedule the work and confirm any proposed client-policy defaults before implementation.

  3. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Implementation checkpoint — in progress

    The issue scope is authorized for implementation. Testing mode: hosted, continuing the session choice. The all-pages default is 100; this remains a RegShape policy rather than an OCI requirement.

    Owner: fd2ca782-7ed9-4986-98b4-1168ece9ee3d.
    Branch: feature/tag-pagination/issue-69-fd2ca782.
    Owned worktree: /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags.
    Base: 024c15bc7da136448a3856de59fe30deea0a49a5.

    Plan: implement the library traversal and safety guards, add the opt-in CLI flag, tests and documentation, then open one unmerged pull request. Link handling must prefer actual continuation URLs and support cursor fallback when links are absent, without copying the incomplete termination assumptions of other domains. Single-page behavior, including n=0, stays unchanged.

    The five pre-existing catalog/transport test failures documented in #68 remain outside this issue scope. No merge, release, or changes to the parked #46 worktree are authorized. Tracking remains issues-only.

  4. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Implementation checkpoint — in review

    Opened #70, targeting main. Initial pushed head: 2044b11. The branch is independent of the parked #46 work.

    The library helper, CLI flag, exports, safety/progress guards, documentation, and regression tests are implemented. The implementation prefers next links, falls back to exclusive tag cursors, tracks effective page sizes, and preserves single-page n=0 behavior. Both middleware and legacy transport paths are exercised.

    Testing mode: hosted. Local validation: 173 focused tag/model/CLI/transport tests passed on Python 3.12.4, along with scoped Ruff, Bandit, mypy (isolated request stubs), actionlint, whitespace, and documentation-link checks. Self-review found no blocking issues. Hosted full-suite results and automated review are being monitored; no green full-suite result is claimed yet. Known baseline failures remain outside the scope and are not disabled.

    Owner: fd2ca782-7ed9-4986-98b4-1168ece9ee3d.
    Branch: feature/tag-pagination/issue-69-fd2ca782.
    Owned worktree: /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags.
    Working tree clean; all implementation changes committed and pushed. No merge or release is authorized. Tracking remains issues-only.

  5. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Review-fix checkpoint

    Current pushed head for #70: 980a478b4e70c484057fd4c35a6dde68968e06cc.

    Copilot identified a genuine opaque-query preservation problem. Two focused regressions reproduced it before the fix: binary cursor values were rewritten during fallback, and distinct binary values could collapse to the same page identity. The fix preserves raw non-pagination query fields and decodes only n/last for validation. The fix confirmation was posted in the original review thread with its commit SHA before resolving it, and review of the new head was requested.

    All 177 focused tag tests and scoped Ruff, Bandit, mypy, workflow, and whitespace checks pass. The first hosted run reported 1127 passing tests and exactly the same five known catalog/transport failures on each Python version; no new failures were present. New-head hosted results are pending and the full validation gate remains blocked until those results and the existing baseline issues are reconciled.

    Testing mode: hosted. Owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. No merge, release, or unrelated baseline fixes were performed.

  6. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    URI-resolution review checkpoint

    Current pushed head for #70: db57174954aa8605202f8947adcd14478b6ff43c.

    The second review summary identified another genuine continuation issue: standard-library URL joining collapsed empty path segments in relative links. Seven regression cases reproduced the problem (including dot-segment interaction, empty segments in the response base, and explicit empty-query handling). The fix uses RFC 3986 reference/dot-segment resolution while preserving opaque path segments and the existing same-origin guards. The earlier opaque-query correction is retained.

    All 205 focused tag/CLI/transport tests now pass, as do scoped Ruff, Bandit, mypy, actionlint, and whitespace checks. Review of the new head has been requested. The preceding head reported 1131 passing tests and exactly the same five pre-existing catalog/transport failures on each hosted Python version; no tests were skipped or disabled. Current-head hosted results remain to be recorded.

    Testing mode: hosted. Owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Changes are committed and pushed. No merge, release, or unrelated baseline fix was performed.

  7. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Security-review checkpoint

    Current pushed head for #70: 7e749d54689f22df5aa1153e0c2595c6ed305aa5.

    Addressed both security findings from the latest review summary. Pagination now disables automatic redirects before authentication, propagates that policy through middleware/legacy authentication probes and retries, separates cache variants by redirect policy, and follows only validated same-origin redirects with a 30-hop bound. Ordinary request defaults remain unchanged. URL-parser failures now have sanitized diagnostics and suppressed raw exception context so malformed credential-bearing authorities cannot leak into CLI stderr or tracebacks.

    The new security tests reproduced 17 failures before the fix and now pass, covering foreign redirected challenges without credential exchange, probe/retry policy propagation, safe redirects, redirect bounds, cache isolation, default compatibility, and malformed-URL redaction. The expanded affected tag/transport suite reports 351 passed and one failure, which is the already-known transport 401 request-count baseline failure. Mypy passes in seven affected source/test files; scoped new-code lint, transport correctness checks, Bandit, actionlint and whitespace checks pass. Six unrelated middleware lint findings were confirmed unchanged on main and were not swept into this change.

    Review of the new head was requested. No full-suite success is claimed: the known five catalog/transport baseline failures remain outside scope and are not disabled. Owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Changes committed and pushed; no merge or release authorized.

  8. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Redirect-state review checkpoint

    Current pushed head for #70: 02fd38dc81c318f4359ab23749a3e21b0589c894.

    Addressed the canonicalizing-redirect finding: exact redirect-hop URLs are now tracked separately from completed pagination pages, so a safe redirect that reorders n/last can be fetched while actual redirect cycles and the 30-hop limit remain enforced. Both the positive canonicalization case and the bounded cycle regression failed before the fix and now pass. The original thread received a fix-confirmation reply naming this commit before resolution.

    The expanded affected suite reports 353 passed, 1 known baseline failure. Mypy passes in seven affected source/test files; scoped lint, security, workflow, and whitespace checks pass. The preceding security head reported 1180 passing tests and exactly the five existing catalog/transport baseline failures on all three hosted Python versions. No unrelated fixes or test skips were introduced. New-head hosted validation and review were requested.

    Testing mode: hosted. Owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Changes committed and pushed; no merge or release authorized.

  9. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Final implementation checkpoint — baseline validation blocked

    Implementation pull request: #70.
    Current tested/pushed/reviewed head: 02fd38dc81c318f4359ab23749a3e21b0589c894.
    Testing mode: hosted.

    The library helper, opt-in CLI flag, OCI-grounded traversal, output compatibility, documentation, and regression coverage are implemented. Review findings were corrected with reproducing tests: opaque query preservation, relative path resolution, redirect/authentication safety, sanitized URL errors, and separate redirect/page cycle state. Both inline review threads received fix-confirmation replies with pushed SHAs before resolution. The final Copilot review recommends approval with no active review issues, and CodeQL checks pass.

    Validation evidence:

    • Expanded affected local suite: 353 passed, 1 pre-existing transport test failure on Python 3.12.4.
    • Current-head hosted run 40933034038: 1182 passed, 5 failed on each of Python 3.10/3.11/3.12. The five failures exactly match the catalog/transport baseline already reproduced on unchanged main (024c15bc7da136448a3856de59fe30deea0a49a5); exact selectors and commands are in the pull request.
    • Mypy passes in seven affected source/test files; scoped new-code lint, transport correctness checks, Bandit, actionlint, whitespace and changed documentation links pass. Six unrelated legacy middleware style/import findings were confirmed pre-existing and left unchanged.

    No failing tests were skipped or disabled. The full validation gate is not green; this issue and the pull request remain open and unmerged. Next step: authorize separate work on the existing baseline failures before merging. No release, inventory close-out, branch deletion, or unrelated baseline fix was performed.

    Resume state: owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags; clean, zero unpushed commits. The branch/worktree/claim are retained. The isolated temporary type-checking environment and cache can be removed after this checkpoint. Project updates remain unavailable with current permissions.

  10. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Baseline repair checkpoint

    The user authorized the test-only baseline fixes. A separate repair pull request #71 is open at 51a8b97cc1587265414862ae3c6af2c8d02af62f.

    Catalog mocks now publish response metadata like the real client; the original pagination assertions remain, with additional real-client/mocked-network contract cases. The authentication test checks the exact resource request and /v2/ probe before failure and asserts no credential exchange. Production code is unchanged. Locally, all 1047 baseline tests pass; hosted checks and automated review are pending.

    The #70 feature branch has not been modified or merged. After the repair is merged with authorization, update the feature branch from main and rerun its checks.

    Repair owner: fd2ca782-7ed9-4986-98b4-1168ece9ee3d; branch feature/test-baseline/repair-mocks-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-baseline. Testing mode: hosted. The repair is committed and pushed; no merge or release is authorized.

  11. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Baseline repair checkpoint — validated, awaiting merge

    The test-only repair pull request #71 is validated at 51a8b97cc1587265414862ae3c6af2c8d02af62f. Hosted run 40948711011 passed all 1047 tests on each of Python 3.10, 3.11, and 3.12. CodeQL passed; Copilot review recommends approval with no findings or unresolved threads. The full local suite also passed. Production code is unchanged.

    #71 remains open and unmerged. The #70 feature branch has not been changed; its existing failed checks are not being represented as green. Next step: authorize merging #71, then integrate main into #70 and rerun its checks.

    Repair resume state: owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; testing mode hosted; branch feature/test-baseline/repair-mocks-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-baseline. Clean and fully pushed, zero unpushed commits. Branch/worktree/claim retained; temporary type-checking artifacts can be removed. No merge, release, feature-branch update, or Project change was performed.

  12. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Baseline repair merge checkpoint

    User-authorized merge completed: #71 was squash-merged into main as 6d2c188b07e6211263b6ba3518eeee97bd2bae20. The GitHub commit signature is verified. Copilot and Codex both completed review of the tested head without findings; no review threads or requests were outstanding. All pre-merge checks passed.

    The merged tree exactly matches tested head 51a8b97cc1587265414862ae3c6af2c8d02af62f. Post-merge test run 40952280635 passed all 1047 tests on each of Python 3.10, 3.11, and 3.12. The additional main-branch analysis run was still in progress at verification; no completed result is claimed for it.

    The repair is now available on main. #70 remains open and its branch has not been updated or merged. Next step: authorize integrating main into the feature branch, rerun its checks, and recheck review feedback before any feature merge.

    Repair owner: fd2ca782-7ed9-4986-98b4-1168ece9ee3d; testing mode hosted; branch feature/test-baseline/repair-mocks-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-baseline. Clean and fully pushed; branch/worktree retained because deletion was not requested. No release, inventory close-out, original-checkout update, or feature-branch mutation was performed.

  13. 1 remaining item

  14. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Refreshed-review checkpoint

    The repaired main is integrated and the current hosted suite is green (1191 tests per Python version), but refreshed review identified three feature-specific issues to address before merge readiness: safely follow same-origin authentication-probe redirects, reject partially overlapping/duplicate tag pages, and sanitize Requests redirect-parser failures that can occur before a response is returned.

    These will be addressed with reproducing tests, including an adapter-level test that exercises real Requests redirect parsing without network access. The existing all-pages policy will reject overlap explicitly rather than silently deduplicating results; single-page behavior remains unchanged. Shared URL validation will be reused for pagination and authentication probes.

    Owner and worktree remain unchanged: fd2ca782-7ed9-4986-98b4-1168ece9ee3d, /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags, branch feature/tag-pagination/issue-69-fd2ca782. Testing mode: hosted. #68 is separately validated and ready for merge approval; no pull request will be merged in this step.

  15. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Refreshed-review fixes checkpoint

    Current pushed head for #70: 5d9be0ac6a71745712066e533a9be4c41185520f.

    Addressed all three refreshed findings: bounded same-origin authentication-probe redirects now work in both transport modes; repeated/partially overlapping tags are rejected without partial output; and low-level Requests parser failures are sanitized before logging. Shared URI validation is reused by pagination and auth probes. Twenty reproducing cases failed before these fixes; adapter-level tests exercise real Requests redirect parsing without network access.

    Full local suite: 1212 passed; focused affected suite: 414 passed. Scoped new-code lint, Bandit, actionlint, and whitespace checks pass. Core type checks pass; expanding mypy to the request-wrapper file exposes two existing JSON-renderer diagnostics at line 231, verified identical against the pre-change file and left outside this fix.

    Each review thread received a fix-confirmation reply with the pushed commit before resolution. Copilot and Codex re-review and hosted checks are requested for this new head. Owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; testing mode hosted; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Changes committed and pushed; no merge or release authorized.

  16. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Origin-safety review checkpoint

    Current pushed head for #70: 35a19a2f0c7d7e03941b8188816dc0414a353a2a.

    Addressed the additional Unicode-host normalization finding. Validated authorities now require ASCII spelling, with punycode supported for international names; the validator no longer mixes its built-in IDNA mapping with Requests behavior. Regressions verified the differing destination mapping and rejection before dispatch in both auth-probe modes. Three cases failed before the fix and now pass; the ASCII-punycode compatibility case remains supported.

    Full local suite: 1216 passed. Core type, lint, security, workflow, and whitespace checks pass; the two previously identified JSON-renderer mypy diagnostics remain unchanged and outside this fix. The inline thread received a fix-confirmation SHA reply before resolution. Hosted checks and Copilot/Codex review are requested for this new head.

    Owner/worktree unchanged: fd2ca782-7ed9-4986-98b4-1168ece9ee3d, /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags, feature/tag-pagination/issue-69-fd2ca782. Testing mode: hosted. #68 remains independently green; neither pull request has been merged.

  17. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Exclusive-cursor review checkpoint

    Current pushed head for #70: b3319b66590e7d0bef1f2cc15d82e099a8479a1b.

    Addressed the remaining cursor-exclusivity finding: every page is checked against requested initial/linked cursors before aggregation, even for short pages and when redirects remove a cursor parameter. Four new regressions failed before the fix and now pass; duplicate/no-progress diagnostics remain intact.

    Full local suite: 1220 passed. Core type, lint, security, workflow, and whitespace checks pass; the two unchanged JSON-renderer type diagnostics remain documented. The thread received a fix-confirmation SHA reply before resolution, and current-head Copilot/Codex review and hosted checks were requested.

    Owner/worktree unchanged: fd2ca782-7ed9-4986-98b4-1168ece9ee3d, /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags, feature/tag-pagination/issue-69-fd2ca782. Testing mode: hosted. #68 remains validated at e5d1ada; neither pull request has been merged.

  18. toddysm
    added
    needs-humanNeeds a human decision before proceeding
    on Oct 29, 2026

  19. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Refresh checkpoint — green tests, policy decision needed

    #70 is updated to head b3319b66590e7d0bef1f2cc15d82e099a8479a1b and includes repaired main. Full local suite and hosted run 40962398506 pass 1220 tests, including all three hosted Python versions. CodeQL passes. All inline review findings have been fixed with reproducing tests and SHA replies before thread resolution; Codex reports no current findings.

    Copilot has no open inline issues but asks for human assessment of cursor/non-progress behavior when opaque links keep changing. A bounded mocked probe confirmed that eight empty pages with alternating cursor values and unique nonce parameters still led to a ninth fetch. No live registry was contacted. Repeating last alone cannot reliably identify a cycle when opaque link parameters may encode valid progress.

    Recommendation requiring owner confirmation: impose a client safety limit of 30 consecutive empty linked pages, failing without partial output and resetting on received tags. This is not an OCI requirement, so it has not been silently added. The issue and pull request are marked needs-human for that decision.

    #68 is independently green and ready for merge approval. Neither pull request was merged. Owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d; testing mode hosted; branch feature/tag-pagination/issue-69-fd2ca782; worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Clean, fully pushed, and retained; next step is the policy decision, not an automatic merge.

  20. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Policy approved — implementation resumed

    The owner approved a limit of 10 consecutive empty linked pages. Traversal will fail explicitly on the tenth consecutive empty page carrying a next link, without issuing an eleventh continuation request or returning partial results. A page containing tags resets the counter; an empty page without a next link still completes normally. This is a documented client safety policy, not an Open Container Initiative specification requirement.

    Resuming the existing owned worktree and branch at b3319b66590e7d0bef1f2cc15d82e099a8479a1b: instance fd2ca782-7ed9-4986-98b4-1168ece9ee3d, branch feature/tag-pagination/issue-69-fd2ca782, worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Testing mode remains hosted; code, boundary/reset/output regression tests, documentation, and refreshed reviews will be pushed to #70. Neither #68 nor #70 is authorized for merge in this step.

  21. toddysm
    removed
    needs-humanNeeds a human decision before proceeding
    on Oct 29, 2026

  22. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Pushed checkpoint — ten-page policy tested

    The approved policy is implemented and pushed in a8519be92c6a996161e7f316632f79dc52fd5cdf on #70. The tenth consecutive empty linked page raises a clear TagError before following another link; tags reset the counter, terminal empty pages complete normally, and redirects neither increment nor reset it.

    Validation: full local suite 1233 passed; focused pagination suite 186 passed; hosted run 40965753727 confirms 1233 passed on each of Python 3.10, 3.11, and 3.12. Scoped mypy and Bandit pass. Ruff diagnostics match the pre-change baseline (14 unrelated style findings); no extra findings. Thirteen new cases verify boundaries, reset paths, redirects, and no partial text/JSON output or new/existing-file changes. Source and user-facing contracts are updated; local self-review found no new issues.

    Copilot and Codex reviews have been requested for this head; waiting for them to settle. No merges or releases. Instance fd2ca782-7ed9-4986-98b4-1168ece9ee3d retains the clean, fully pushed worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags, branch feature/tag-pagination/issue-69-fd2ca782. Next step: finish current-head review and checkpoint readiness for explicit merge approval.

  23. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Review checkpoint — limit approved, malformed-tag regression reproduced

    At a8519be92c6a996161e7f316632f79dc52fd5cdf, hosted tests and CodeQL pass, Codex is clear, and no inline threads remain. The refreshed Copilot summary raised a separate malformed-tag concern. A bounded mocked probe reproduced both behaviors: a tag containing a newline was returned unchanged, and an unpaired surrogate caused an unhandled UnicodeEncodeError when promoted to the next cursor.

    This falls under the existing #69 requirement to reject malformed responses and cursors. The released OCI specification defines tags as at most 128 ASCII characters matching [a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}. I am adding scoped all-pages validation for returned tags and initial/linked tag cursors, with error/output and valid-boundary regressions. Single-page behavior, opaque continuation fields, and the approved ten-empty-page policy will remain unchanged. No merge is authorized; the same instance and owned worktree remain active.

  24. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Pushed checkpoint — malformed tags handled explicitly

    Pushed e53b4fd0eeadb9b15a0684cf9729312e285ed2d3 to #70, with the approved ten-empty-linked-page policy unchanged. Returned tags and initial/linked cursors now satisfy the official OCI tag grammar before rendering or encoding. No changes to the existing one-page API or opaque continuation fields.

    Exact local validation: PYTHONDONTWRITEBYTECODE=1 python3 -B -m pytest -q -p no:cacheprovider — 1276 passed; the same runner scoped to the pagination suite — 229 passed. Scoped mypy, Bandit, and whitespace checks pass; Ruff retains its 14 pre-existing style findings and no new ones. Local self-review covers changed source/contracts and the 43 added grammar/error/output cases, with no remaining findings in this scope.

    Hosted checks and Copilot/Codex have been refreshed for this head. Same instance fd2ca782-7ed9-4986-98b4-1168ece9ee3d, branch feature/tag-pagination/issue-69-fd2ca782, clean/fully pushed worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Waiting for review settlement; neither feature pull request has been merged.

  25. toddysm commented on Oct 29, 2026

    @toddysm
    toddysm
    on Oct 29, 2026
    OwnerAuthor

    Ready for merge approval — ten-page policy complete

    #70 is clean and fully pushed at e53b4fd0eeadb9b15a0684cf9729312e285ed2d3. The approved safety policy fails on the tenth consecutive empty linked page, resets when tags arrive, and permits normal terminal-empty completion. Redirects do not count as pages or reset the counter. No partial results or output-file changes occur on failure. The follow-up malformed-tag review finding is also fixed using the official OCI tag grammar, without changing single-page behavior or opaque continuation fields.

    Final evidence for this exact head:

    • Local full command: PYTHONDONTWRITEBYTECODE=1 python3 -B -m pytest -q -p no:cacheprovider — 1276 passed on Python 3.12.4.
    • Same runner scoped to the pagination suite — 229 passed, including 13 empty-page and 43 tag-grammar regression cases added during this continuation.
    • Hosted run 40966730097: 1276 passed on each of Python 3.10, 3.11, and 3.12, verified in job logs.
    • CodeQL and Python/Actions analysis checks pass. Scoped mypy and Bandit pass; Ruff has no additional diagnostics compared with the pre-change baseline (14 unchanged style findings).
    • Local self-review and source/user documentation checks are complete. Current-head Copilot recommends approval with no active issues; Codex completed with no findings; there are no unresolved inline threads.

    Testing mode remains hosted; tests use mocked responses, not a live registry. Instance fd2ca782-7ed9-4986-98b4-1168ece9ee3d retains branch feature/tag-pagination/issue-69-fd2ca782 and clean worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags, with no unpushed commits. Temporary validation environments were cleaned. #68 remains open and unchanged at e5d1adad3be0efb4bd1dc32cd17135f4e7634507. Neither pull request was merged or released; next step is explicit merge authorization, then one-at-a-time integration and validation.

  26. toddysm commented on Oct 30, 2026

    @toddysm
    toddysm
    on Oct 30, 2026
    OwnerAuthor

    Authorized merge checkpoint — combined features under validation

    The owner authorized merging #68 and #70. #68 is now merged as 5fdd598a3233d5cb53b4380c22f104e4a91bf439. Its signed merge tree exactly matches its tested head. Latest main was integrated into this owned branch with a normal merge, producing f0166d0bd0d317f00a38ecd73aa7a9d46221e9b4. Only the three previously reviewed referrer source/test/specification files were brought in, with no conflicts or manual source changes.

    The full combined local command PYTHONDONTWRITEBYTECODE=1 python3 -B -m pytest -q -p no:cacheprovider passes 1300 tests. The ten-empty-linked-page policy and malformed-tag protections are unchanged. Integration self-review confirms the expected incoming file scope and unchanged public call contracts; hosted checks and both reviews must refresh for this new head before merge.

    Same owner fd2ca782-7ed9-4986-98b4-1168ece9ee3d, branch feature/tag-pagination/issue-69-fd2ca782, worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags. Pushed without history rewriting. No release or branch/worktree cleanup is authorized.

  27. toddysm
    closed this as completedin #70on Oct 30, 2026

  28. toddysm commented on Oct 30, 2026

    @toddysm
    toddysm
    on Oct 30, 2026
    OwnerAuthor

    Merged checkpoint

    With owner authorization, #70 was squash-merged into main as ed17d2eef64da73528998e5c0917dff4e91820c5. Issue #69 is closed. #68 had already merged as 5fdd598a3233d5cb53b4380c22f104e4a91bf439; both features were integrated and revalidated together before this merge.

    The tested/reviewed combined head was f0166d0bd0d317f00a38ecd73aa7a9d46221e9b4: 1300 tests passed locally and on each hosted Python version, scoped mypy passed both feature surfaces, CodeQL succeeded, Copilot recommended approval, Codex had no findings, and no review threads remained unresolved. Main was freshly checked immediately before the normal protected merge; no bypass was used.

    Instance fd2ca782-7ed9-4986-98b4-1168ece9ee3d retains clean branch feature/tag-pagination/issue-69-fd2ca782 and worktree /Users/toddysm/Documents/Development/regshape-fe-fd2ca782-tags; no unpushed commits remain. No release or branch/worktree cleanup was authorized or performed. Final verification is complete: the GitHub merge signature is valid, its parent is the #68 merge, and its tree exactly matches the tested combined head. Post-merge main run 40982870365 passed 1300 tests on each of Python 3.10, 3.11, and 3.12, verified in job logs. Both feature branches remain on the remote, both owned worktrees are clean, and temporary type-checking artifacts were removed. Both requested merges are complete; no further merge action is pending.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent-managedCreated/managed by My Feature EngineerenhancementNew feature or requestfeature:tag-paginationAutomatic tag pagination in the library and CLItype:featureFeature tracking issue (epic)

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions