glm-5.3-flash
12b35e2c5f
21 review-001 tasks across server/adapters/client/gateway/websocket/infra, chunked from the 7-unit remediation plan in docs/reviews/001-initial-implementation-review.md. - Scope split by mechanism, not one-per-finding: 15 tasks in generation 1 (parallelizable), 6 sequenced after their file-sharing precursors - Deliberately deferred until dependent fixes land: projection/doc fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills (COV-01..07 via in-task acceptance for forward.rs), and per-finding minors (OAI-06/07, HY-02/04/06/10/11, CON-08) - Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing in alkcall, not here taskgraph: validate clean, no cycles, 6 generations
56 lines
2.3 KiB
Markdown
56 lines
2.3 KiB
Markdown
---
|
|
id: review-001-ref-cycle-guard
|
|
name: Bounded, cycle-safe $ref resolution (OAI-01, OAI-08)
|
|
status: pending
|
|
depends_on: []
|
|
scope: narrow
|
|
risk: high
|
|
impact: component
|
|
level: implementation
|
|
tags: [adapters, review-001, from-openapi]
|
|
---
|
|
|
|
## Description
|
|
|
|
Review 001 finding OAI-01 — the single highest-severity finding in the
|
|
review (borderline critical, empirically verified):
|
|
`resolve_refs_recursive` (`src/adapters/openapi_spec.rs:199-221`) recurses
|
|
with no cycle detection and no depth budget. A self-referential component
|
|
(`{"$ref":"#/components/schemas/Node"}` inside Node — trees, linked
|
|
lists, cursor pagination: common and *valid* OpenAPI) recurses until the
|
|
stack is exhausted: `thread has overflowed its stack; fatal runtime
|
|
error` → **process abort**. Not a catchable panic; `import()` kills the
|
|
whole process — startup crash-loop, or remote DoS if specs are ever
|
|
runtime-refreshed/peer-supplied.
|
|
|
|
Fix: depth budget + visited set keyed on the JSON-pointer path, returning
|
|
a clean `CallError`/import error on cycles and over-deep specs. **Do not**
|
|
try to preserve full recursive expansion of recursive schemas — the goal
|
|
is a clean, loud error (or a depth-limited expansion where the adapter can
|
|
safely represent it), not unbounded expansion.
|
|
|
|
Ride-along: **OAI-08** — guarded `expect`s in `openapi_spec.rs:144,170`
|
|
(the "no `expect` outside tests" convention; `if let` costs nothing).
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Import of a self-referential spec returns an error — the process does not abort (the review's named acceptance gate: a test importing a self-referential spec would have caught the abort immediately)
|
|
- [ ] Deeply-nested non-circular spec beyond the budget errors cleanly at import (test)
|
|
- [ ] A non-recursive spec with `$ref` sharing (refs to a common schema) still imports identically — no false cycle positives (existing suite green)
|
|
- [ ] OAI-08 `expect`s replaced
|
|
- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
|
|
|
|
## References
|
|
|
|
- docs/reviews/001-initial-implementation-review.md (Part E, OAI-01, OAI-08)
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation. Do before anything
|
|
> deployment-facing. Deliberately split from the parameter/requestBody
|
|
> work (review-001-openapi-import-integrity) so the delicate
|
|
> cycle-detection change lands alone.
|
|
|
|
## Summary
|
|
|
|
> Filled on completion. |