Repository navigation
A command field marked writeOnly is taken at admission and never recorded, replayed or emitted, and its command is not run again without it - #116
Closed
riccardone wants to merge 1 commit into
Conversation
…rded, replayed or emitted, and its command is not run again without it Entry 50 of #37. The spec records every accepted command whole, so it can be replayed and run again after a restart, and says nothing of a field that must never be kept: a credential, or a URL that grants access by itself. best-peer's schemas mark such a field writeOnly, the admission keeps it where it belongs, the command is recorded without it, and after a restart such a command is failed rather than run without it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Entry 50 on #37 (#37), proven by best-peer.
Why
The spec records every accepted command whole, so it can be replayed and run again after a restart (#102). Nothing says what a service does with a field that must never be kept: a credential, or a URL that grants access by itself. best-peer: a command's data schema marks such a field
writeOnly; the admission check takes it and keeps it where it belongs, such as a file of the workspace readable by the service alone; the command is then recorded, and handed to its handler, without it, so neither the log, a replay nor an event holds it again. After a restart, a command owed whose recorded copy lacks what was sent is failed with the reason, "send it again", never run without its secret.What
Ingestion Semantics gains a paragraph after its bullets, placed so it does not touch the bullets #88, #92 and #102 change.
Nothing changes in the conformance list: the sentence is a clarification.
No version bump and no release notes here: the PRs from #37 do not collide that way, and the release that gathers them does both.
🤖 Generated with Claude Code