LAB-275: cross-SDK feature-gap synthesis — code-verified matrix refresh (folds in LAB-272 + LAB-273) by 27Bslash6 · Pull Request #29 · cachekit-io/protocol

27Bslash6 · 2026-07-21T13:36:29Z

LAB-275: cross-SDK feature-gap synthesis — full matrix refresh

Docs-only. Refreshes sdk-feature-matrix.md end-to-end, folding in the two sibling audit branches (includes #24 (LAB-272) and #23 (LAB-273) as merge commits — merge those first and this PR's diff collapses to just the LAB-275 corrections) plus the rows those audits didn't own, each cell code-verified against py/rs/ts main on 2026-07-21.

Trust-bug corrections (cells claiming code that doesn't run)

Cell	Was	Now	Evidence
Key rotation	py ✅ / rs ✅	❌ fleet-wide	core `rotate_key()` = `NotImplemented` stub (`encryption/core.rs:492`); py `KeyRotationState` binding has zero Python callers; ts = nonce monitoring only → LAB-516
Hardware-accel detection	rs ✅, ts N/A	rs ⚠️ core-internal, ts ❌	detection exists in core, never surfaced by rs/ts → LAB-523
TS ArrowSerializer	🔜 Planned	❌	zero code/stubs/tracking repo-wide → LAB-524
TS stampede prevention	✅	⚠️ refresh-path only	cold L1+L2 miss: concurrent callers all execute (`cache.ts:392`); `LockableBackend` unwired → LAB-519
Client SWR (new split row)	ts ❌ (under-claim!)	ts ✅, py ⚠️ L1-only mode	ts `getWithSwr` is live; py's backed-mode SWR stays dead (LAB-388)

New coverage

Observability section: py ✅ live Prometheus + structured logging; rs ⚠️ header telemetry needs a user-wired provider (LAB-521); ts ❌ metrics option accepted and silently ignored, Prometheus module dead (LAB-517); OTel absent everywhere.
Reliability rows added: Retry (ts ✅ / py ⚠️ / rs ❌), Graceful degradation (py+ts ✅ / rs ❌ — LAB-518 bundles the rs tier), Cross-instance invalidation (ts ✅ live pub/sub; py package built but never wired — LAB-520).
Core Features: Orjson row (py-only by design), Rust interop keygen recorded.

Freshness

py 0.13.0 (interop/v1 released), rs#33 merged (interop keygen + vectors in cargo CI), MSRV 1.85, rs→core 0.3, TS Node 22+, and footnote ³ updated: wire-format.json (core#55 / LAB-423) + cache-keys.json (protocol#26 / LAB-425) are now both CI-enforced — every vector file has CI coverage.

Gates

Read-only audit; no crypto/protocol behaviour asserted beyond what LAB-272's panel already verified — cells corrected here (rotation/hw-accel/SWR/stampede/observability) are feature-presence claims with file:line evidence, not normative crypto claims.
Ranked gap register + classification (deliberate-N/A vs real gap) delivered on the Multica issue; 9 backlog tickets filed (LAB-516…LAB-524).

…(LAB-273 audit) Backend-parity audit findings, verified against code (py 0.12.0, rs 0.3.0, ts 0.1.2): - DynamoDB ships in NO SDK. The Python ✅ traced to the custom-backend tutorial (docs/backends/custom.md) — an extension-point example, not shipped support. Row corrected to ❌ across the board. - TS Cloudflare Workers cell N/A → ❌: Workers is a plausible target for TS but blocked by NAPI-native crypto and ioredis; N/A misstates it. - New 'Backend Abstraction' section: required interface per SDK (health required py/rs, absent ts; close()+keyPrefix ts-only), optional capability interfaces, per-backend implementation coverage, and the lock-API shape divergence (py context-manager vs rs/ts lock_id token). - Reliability rows qualified per backend: Python locking is Redis+SaaS (not SaaS-only); rs/ts locking SaaS-only; TS TTL inspection SaaS-only. - Lock-id header migration (CWE-532) recorded complete in all three SDKs: py#131 closed, rs#24 closed, ts ships the header (ts#63 open only for an unrelated NAPI-rebuild item). - Backend-selection note: Python is the only SDK with env backend auto-detection; rs/ts env vars are SaaS-credential-only. Recorded as a finding, not a prescription. - py version 0.11.1 → 0.12.0 (v0.12.0 tag exists). Co-authored-by: multica-agent <github@multica.ai>

…reality (LAB-272) Audit of py/rs/ts main branches against the four protocol requirements: - Interop mode: merged in cachekit-py (#220) and cachekit-ts (#71), in review for cachekit-rs (#33) — the '❌ Not implemented' row was stale. - Test vectors row now states what each SDK's CI actually executes; wire-format.json and cache-keys.json are verified by no CI anywhere (LAB-423, LAB-425). - Rust keygen cell: caller-supplied keys remain N/A, but the crate exports an unused legacy generate_cache_key matching no protocol format (LAB-424); conformant keygen arrives with cachekit-rs#33. - AAD v0x03 cells record component arity per SDK (py auto serializers emit the optional fifth original_type component; rs/ts/interop are four-component) — byte-identity code-verified per protocol#12. - cachekit-py fleet version 0.11.1 -> 0.12.0. Co-authored-by: multica-agent <github@multica.ai>

…aram and generate_cache_key is not unused [LAB-424] The footnote claimed cachekit-rs delegates key construction via a 'key' parameter on #[cachekit] (no such parameter exists) and called key::generate_cache_key 'unused' (it is called at runtime by every #[cachekit] expansion — proc-macro call sites are invisible to grep). Rewritten to the verified posture: get/set caller-supplied; macro derives an SDK-internal legacy RFC-shape key, made private in cachekit-rs#35 (LAB-424); conformant keygen arrives with #33. Co-authored-by: multica-agent <github@multica.ai>

…on accuracy - Correct future-dated audit stamps (2026-07-21 → 2026-07-20) in the Last-updated banner, Backend Abstraction audit note, and lock-id migration note. - Fix Redis optional-capability summary to match the capability table: Python has both locking + TTL inspection, Rust Redis has TTL inspection only, TS Redis neither. - Restore the documented Python backend-selection fallbacks (REDIS_URL/localhost, ConfigurationError on ambiguous selectors) in the SDK summary bullet. CodeRabbit-Resolved: sdk-feature-matrix.md:9:Remove future-dated completion claims CodeRabbit-Resolved: sdk-feature-matrix.md:115:Correct the Redis capability summary CodeRabbit-Resolved: sdk-feature-matrix.md:194:Preserve backend-selection fallbacks

…order, TS vector wording [LAB-445] Four clarity nits flagged by the LAB-272 expert-panel review of #24; no factual claim changes (verdicts, marks, versions, byte constants preserved): - Python AAD cell: 5-component is the Python norm (every auto serializer appends original_type); interop mode is the sole 4-component path — matches the line-65 callout framing instead of reading like an edge case. - Footnotes renumbered so first appearance runs 1, 2, 3 in reading order (keygen note was 2 but appeared before 1); note blocks reordered to match. - TS test-vectors cell: 'key/AAD' disambiguated to what CI actually runs — inline Python-generated AAD-construction + encryption (decrypt-Python- ciphertext) vectors. 'key' dropped: key-generation.protocol.test.ts holds property checks only, no Python-generated key values; key-vector coverage is the interop/v1 set (33 key vectors), now credited explicitly. - AAD byte-layout detail deduped out of the matrix callout: layout, frozen True/False tokens, and the protocol#12 decision are already normative in spec/encryption.md, which stays linked — matrix keeps parity altitude. Co-authored-by: multica-agent <github@multica.ai>

…' into lab-275-feature-gap-synthesis

…nto lab-275-feature-gap-synthesis # Conflicts: # sdk-feature-matrix.md

… [LAB-275] Folds in the LAB-272 (protocol adherence) and LAB-273 (backend parity) audit branches and corrects every remaining capability row against py/rs/ts main as of 2026-07-21. Trust-bug corrections (cells that claimed code that doesn't run): - Key rotation: was py/rs ✅ — ships in NO SDK. core rotate_key() is a NotImplemented stub; py's KeyRotationState PyO3 binding has zero Python callers (detection-only); ts monitors nonce exhaustion only. Now ❌ fleet-wide with evidence footnote (LAB-516). - Hardware-accel detection: rs ✅ → ⚠️ core-internal (never surfaced); ts N/A → ❌ (same Rust core, nothing exposed) (LAB-523). - TS Arrow: 🔜 Planned → ❌ — zero code/stubs/tracking behind the claim (LAB-524). - TS stampede: ✅ → ⚠️ refresh-path only; no cold-miss single-flight, LockableBackend unwired (LAB-519). - Py client SWR: live in L1-only mode (ObjectCache) — backed-mode SWR stays dead code (LAB-388); split client/server SWR rows (ts client SWR was under-claimed as ❌, it is live). New coverage: Orjson serializer row, Retry / Graceful degradation / Cross-instance invalidation rows (py invalidation package is built but never wired — LAB-520), and an Observability section (ts metrics option silently ignored — LAB-517; rs has no logging/tracing and telemetry headers report disabled by default — LAB-521). Freshness: py 0.13.0 (interop released), rs#33 merged (interop keygen + vectors in cargo CI), MSRV 1.85, core dep 0.3, Node 22+, wire-format + cache-keys vector CI holes recorded closed (core#55 / protocol#26). Co-authored-by: multica-agent <github@multica.ai>

coderabbitai · 2026-07-21T13:36:38Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7c561de2-8048-4f2d-99a1-8fcc9d535457

📥 Commits

Reviewing files that changed from the base of the PR and between 442cb44 and c8824b1.

📒 Files selected for processing (1)

sdk-feature-matrix.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch lab-275-feature-gap-synthesis

_{Comment @coderabbitai help to get the list of available commands.}

27Bslash6 · 2026-07-21T14:13:11Z

@coderabbitai review

coderabbitai · 2026-07-21T14:18:15Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

27Bslash6 · 2026-07-21T14:27:25Z

@coderabbitai review

coderabbitai · 2026-07-21T14:27:30Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

27Bslash6 · 2026-07-23T13:33:36Z

Heads-up from LAB-517 (cachekit-io/cachekit-ts#75): the three TypeScript Observability cells this PR adds are now stale once that PR merges.

Metrics / TypeScript: ❌ dead (LAB-517) → ✅ live Prometheus counters/gauges/histograms via optional prom-client peer dep (metrics: boolean | MetricsConfig, custom registry supported; loud once + no-op when prom-client missing). Footnote ¹ can drop.
Structured logging / TypeScript: ❌ ad-hoc console.error only (LAB-517) → ⚠️ pluggable error-logger hook (setLogger), default console.error — still not a structured logger (that stays a gap vs. Python's ring-buffer logger).
SaaS telemetry headers / TypeScript: ⚠️ user-supplied metricsProvider, never auto-wired → ✅ auto-wired from live L1/L2 hit/miss counters (user override still wins).

Whoever lands last should reconcile — happy to push the flip commit here once ts#75 merges.

27Bslash6 · 2026-07-25T01:48:19Z

Conflict in sdk-feature-matrix.md (the "Last updated" summary line — same recurring pattern as the other protocol PRs in this sweep: both this branch and main wrote a different narrative summary onto the same line). Picking one drops the other's content, so this needs a human call.

27Bslash6 · 2026-07-25T05:06:03Z

Auto-rebase attempted: merging origin/main produced 9 separate conflict hunks in sdk-feature-matrix.md — extensive overlapping edits to the same table/sections on both sides. Far beyond a safe auto-union — needs a human call. Left the branch untouched.

27Bslash6 · 2026-07-25T11:11:42Z

Auto-rebase attempted a merge of main but hit 12 conflict hunks across sdk-feature-matrix.md -- this branch's cross-SDK synthesis rewrite collides extensively with independent doc updates that landed on main since this branch was cut. Far beyond a mechanical union; needs a human to reconcile which content wins where.

27Bslash6 · 2026-07-26T02:04:46Z

Auto-rebase attempt: merged origin/main and hit 11 separate conflict hunks in sdk-feature-matrix.md — both this branch's cross-SDK feature-gap synthesis and main's intervening updates (LAB-430/446/519/595/272 etc.) rewrote overlapping rows/sections of the same shared doc. Too many competing edits to the same table to call this a safe non-overlapping union; resolving would mean picking one side's audit findings over the other's in multiple places. Needs a human to reconcile. Merge aborted, branch untouched.

27Bslash6 · 2026-07-27T03:36:09Z

Merge conflict against main in sdk-feature-matrix.md — 12 separate conflict blocks across the doc (SDK overview, backends, backend abstraction, reliability, developer experience, protocol compliance, architecture notes). This is the same shared-file conflict pattern as the sibling protocol matrix-update PRs stacked on main right now; resolving it correctly means reconciling a dozen concurrently-edited table sections, several with directly conflicting factual claims (not just additive rows). Not a safe automated call — needs a human to merge these matrix-update branches in sequence.

27Bslash6 · 2026-07-27T07:35:50Z

Auto-rebase sweep: merging main into this branch conflicts in sdk-feature-matrix.md. Both this branch (LAB-275 feature-gap synthesis) and main made extensive, overlapping edits to the same table rows and changelog blurb with contradictory content — not a non-overlapping union. Needs a human call on which edits win/how to fold the two synthesis passes together.

27Bslash6 · 2026-07-27T16:17:27Z

Auto-rebase check: base main has moved (main HEAD 936f22f) and this branch now conflicts in sdk-feature-matrix.md — 8+ separate hunks across the capability matrix disagree with main's newer content (main has since had LAB-595/LAB-519/LAB-272/etc. land on the same rows). Reconciling requires picking/merging matrix cells by hand — needs a human call, not safe to auto-resolve.

27Bslash6 · 2026-07-28T00:03:44Z

Auto-rebase attempted: merging main into this branch produces 12 conflict hunks across sdk-feature-matrix.md — overlapping table-cell edits and banner-text edits with different facts on each side (this branch's synthesis vs. main's independent updates, e.g. LAB-729/LAB-430/LAB-446/LAB-595/LAB-519/LAB-272 entries). Not a safe non-overlapping union; resolving would mean picking one side's content over the other's in several places. Left for a human call.

27Bslash6 · 2026-07-29T01:08:06Z

Auto-rebase attempted a merge from main but hit heavy content conflict in sdk-feature-matrix.md (12 separate hunks) — same shared table this branch and several siblings both edit with differing factual claims per cell. Not a non-overlapping union; resolving means picking one side's data over the other's across many rows. Needs a human call. Left branch untouched (no push).

27Bslash6 and others added 8 commits July 21, 2026 01:05

Merge remote-tracking branch 'origin/lab-272-protocol-adherence-audit…

b1adb6d

…' into lab-275-feature-gap-synthesis

Merge remote-tracking branch 'origin/lab-273-backend-parity-matrix' i…

c115379

…nto lab-275-feature-gap-synthesis # Conflicts: # sdk-feature-matrix.md

27Bslash6 mentioned this pull request Jul 23, 2026

LAB-516: master-key rotation — client-side keyring with grace window (decision + normative spec) #34

Merged

This was referenced Jul 29, 2026

LAB-520: feature-matrix row for cross-instance L1 invalidation #31

Open

docs(matrix): flip rs Redis-lock + Workers lock/TTL cells (LAB-426) #32

Open

Uh oh!

Conversation

27Bslash6 commented Jul 21, 2026

LAB-275: cross-SDK feature-gap synthesis — full matrix refresh

Trust-bug corrections (cells claiming code that doesn't run)

New coverage

Freshness

Gates

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

27Bslash6 commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

27Bslash6 commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

27Bslash6 commented Jul 23, 2026

Uh oh!

27Bslash6 commented Jul 25, 2026

Uh oh!

27Bslash6 commented Jul 25, 2026

Uh oh!

27Bslash6 commented Jul 25, 2026

Uh oh!

27Bslash6 commented Jul 26, 2026

Uh oh!

27Bslash6 commented Jul 27, 2026

Uh oh!

27Bslash6 commented Jul 27, 2026

Uh oh!

27Bslash6 commented Jul 27, 2026

Uh oh!

27Bslash6 commented Jul 28, 2026

Uh oh!

27Bslash6 commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading