LAB-272: correct SDK feature matrix to code-verified protocol-adherence reality - #24
Conversation
…reality (LAB-272) Audit of py/rs/ts main branches against the four protocol requirements: - Interop mode: merged in cachekit-py (#220) and cachekit-ts (#71), in review for cachekit-rs (#33) — the '❌ Not implemented' row was stale. - Test vectors row now states what each SDK's CI actually executes; wire-format.json and cache-keys.json are verified by no CI anywhere (LAB-423, LAB-425). - Rust keygen cell: caller-supplied keys remain N/A, but the crate exports an unused legacy generate_cache_key matching no protocol format (LAB-424); conformant keygen arrives with cachekit-rs#33. - AAD v0x03 cells record component arity per SDK (py auto serializers emit the optional fifth original_type component; rs/ts/interop are four-component) — byte-identity code-verified per protocol#12. - cachekit-py fleet version 0.11.1 -> 0.12.0. Co-authored-by: multica-agent <github@multica.ai>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 44 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughUpdates ChangesSDK feature matrix documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…aram and generate_cache_key is not unused [LAB-424] The footnote claimed cachekit-rs delegates key construction via a 'key' parameter on #[cachekit] (no such parameter exists) and called key::generate_cache_key 'unused' (it is called at runtime by every #[cachekit] expansion — proc-macro call sites are invisible to grep). Rewritten to the verified posture: get/set caller-supplied; macro derives an SDK-internal legacy RFC-shape key, made private in cachekit-rs#35 (LAB-424); conformant keygen arrives with #33. Co-authored-by: multica-agent <github@multica.ai>
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai full review |
✅ Action performedFull review finished. You're currently rate limited under our Fair Usage Limits Policy. Your recent PR review activity is in the 95th percentile or higher among CodeRabbit users, so adaptive limits apply. Your next review will be available in 42 minutes. |
|
Mandatory crypto/protocol expert panel (high stakes) is clean — no factual findings. bug-hunter + security independently cross-verified every AAD/keygen/wire claim against the actual SDK code: Python AAD = 5 components (all auto-mode serializers emit |
|
@coderabbitai review |
✅ Action performedReview finished.
|
…order, TS vector wording [LAB-445] Four clarity nits flagged by the LAB-272 expert-panel review of #24; no factual claim changes (verdicts, marks, versions, byte constants preserved): - Python AAD cell: 5-component is the Python norm (every auto serializer appends original_type); interop mode is the sole 4-component path — matches the line-65 callout framing instead of reading like an edge case. - Footnotes renumbered so first appearance runs 1, 2, 3 in reading order (keygen note was 2 but appeared before 1); note blocks reordered to match. - TS test-vectors cell: 'key/AAD' disambiguated to what CI actually runs — inline Python-generated AAD-construction + encryption (decrypt-Python- ciphertext) vectors. 'key' dropped: key-generation.protocol.test.ts holds property checks only, no Python-generated key values; key-vector coverage is the interop/v1 set (33 key vectors), now credited explicitly. - AAD byte-layout detail deduped out of the matrix callout: layout, frozen True/False tokens, and the protocol#12 decision are already normative in spec/encryption.md, which stays linked — matrix keeps parity altitude. Co-authored-by: multica-agent <github@multica.ai>
|
@coderabbitai review |
✅ Action performedReview finished.
|
…[LAB-424] cachekit-rs#35 pivoted from hiding the legacy keygen to deleting it: the macro now delegates to interop_key with required explicit interop/namespace attributes (owner call — greenfield, no byte-stability constraint). Interop row: rs #33 merged (unreleased), matching py/ts. Footnote ¹ rewritten to the shipped posture and notes the upgrade is a full cache invalidation for #[cachekit] users. Co-authored-by: multica-agent <github@multica.ai>
…merged [LAB-424] Co-authored-by: multica-agent <github@multica.ai>
…d line Co-authored-by: multica-agent <github@multica.ai>
|
Conflict in |
|
Auto-rebase attempted: merging origin/main produced a conflict in |
# Conflicts: # sdk-feature-matrix.md
This comment has been minimized.
This comment has been minimized.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@sdk-feature-matrix.md`:
- Around line 198-205: Remove the unprefixed blank lines between the three >
[!NOTE] paragraphs in the documented blockquote, or prefix those blank lines
with > so all note content remains inside the callout and satisfies markdownlint
MD028.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 478f17a1-a076-4aa4-9a05-1ebacb99b341
📒 Files selected for processing (1)
sdk-feature-matrix.md
…h vector-CI footnote to post-LAB-423/425 reality CodeRabbit r3650057657: blank lines between the three consecutive '> [!NOTE]' blockquotes trip markdownlint MD028 and can render note content outside the callout. Merged into a single callout with '>'-separated paragraphs; footnote markers unchanged. While in the block: footnote 3 still claimed wire-format.json and cache-keys.json were verified by no CI — both stale since LAB-423 (tools/wire-format-reference.py in verify.yml) and LAB-425 (cache-keys vendored + CI-verified in cachekit-py#229, regenerated at v0.12.0 byte-identical to the v0.5.0 originals) closed. Co-authored-by: multica-agent <github@multica.ai>
Kody Review CompleteGreat news! 🎉 Keep up the excellent work! 🚀 Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
1 participant
LAB-272 — read-only cross-SDK protocol-adherence audit. This PR is the matrix correction; findings that need code changes are filed as LAB-423 / LAB-424 / LAB-425 (plus the already-tracked rs interop PR cachekit-rs#33).
What was verified (against
mainof each repo, 2026-07-21)Key generation — py ✅
key_generator.py:114-140(Blake2b-256 overmsgpack.packb([normalized_args, sorted_kwargs]), 7-segment key). ts ✅key-generator.ts:34-45(@noble/hashes blake2b dkLen=32; language-specific{namespace}:{hash}prefix, per spec). rs: auto-mode keys are caller-supplied (N/A) — but the crate publicly exports an unusedkey::generate_cache_keythat matches no protocol format → LAB-424.Wire format — py ✅ ByteStorage via cachekit-core FFI inside its CK v3 frame (
standard_serializer.py:28; python-frame.json generated from the real wheel, CI-verified here). rs ✅ plainrmp_serde::to_vec_named, no envelope (serializer/mod.rs:7) — exactly the ratified protocol#11 container. ts ✅ bare ByteStorage envelope via NAPI (round-trip tested inwire-format.protocol.test.ts).Encryption / AAD v0x03 — byte-identical layout across py (
encryption_wrapper.py:403-417), rs (encryption.rs:115-149), ts (encryption/manager.ts):[0x03][4B BE len][tenant][len][cache_key][len][format][len][compressed], frozenTrue/Falsetokens (protocol#12). py auto serializers append the optionaloriginal_typefifth component (spec'd); rs/ts/interop always emit exactly four. py's fail-closed plaintext-claim read path is on main (cachekit-py#215).SaaS API — all three hit
/v1/cache/{key}(+/lock,/ttl,/health) and carry the lock capability token inX-CacheKit-Lock-Id(pycachekitio/backend.py:35, rscachekitio_lock.rs:14, tscachekitio-lockable.ts:12).Test vectors in CI — py: full interop/v1 set (33 key / 4 value / 9 error / 1 AAD via the real
_create_aad/ 1 encryption through the production stack) intests/unit/protocol/. ts: full interop/v1 set + inline Python-generated key/AAD vectors, all in defaultpnpm test. rs: none on main — the first-ever Rust execution of the interop vectors lives in cachekit-rs#33 (all pass, CI green on the PR). Org-wide gaps:wire-format.jsonis verified by no CI anywhere and cachekit-core's only compat test is#[ignore]d + stale (LAB-423);cache-keys.jsonwas generated by cachekit-py v0.5.0 and has no consumer (LAB-425).Rust trailing-bytes hazard (protocol#11) — rs main has no cross-SDK read path, so the lenient
rmp_serde::from_sliceinserializer/mod.rs:12only ever reads its own writes (spec-acceptable). The spec-mandated strict end-of-input check +0x43 0x4BCK-frame diagnostic exist in cachekit-rs#33'sinterop::deserializewith dedicated tests — verified in the PR diff; lands on merge.Matrix changes
generate_cache_key.No spec files touched; docs-only.
Fold-in (LAB-445): presentation-clarity fixes from the expert-panel review — Python AAD cell reframed around the 5-component norm, footnote markers renumbered to reading order, TS test-vectors cell disambiguated to the vector sets CI actually runs, and the AAD byte-layout detail deduped into spec/encryption.md. No factual claims changed.
Summary by CodeRabbit