Remove unsafe ad hoc STAR URI implementation from runtime modernization #2

Open
opened 2026-09-06 19:12:31 +00:00 by nsaspy · 0 comments
Owner

Confirmed defects at PR #1 head e3d5646

bbp/star_uri.py:197-218 documents that callers must supply a canonical authority, but parse_legacy_star_uri(value) accepts no target authority, discards the legacy address, and invents legacy.<domain>. This contradicts STAR-RESEARCH-041, which requires an explicit migration target because the tuple cannot determine canonical identity.

_normalize_segment checks ./.. before percent normalization (:100-111), so star://a/actor/%2E%2E is accepted and serializes as star://a/actor/... Other accepted strings such as %61 also serialize differently while is_canonical_star_uri returns true. A local exact-head probe reproduced all three outcomes.

Config.DEFAULT_STAR_AUTHORITY = "bbpd.starintel.actor" treats an illustrative research namespace as an owned deployment default; no ownership decision was established.

Impact

The PR would emit invented/noncanonical identities and create migration behavior outside this debugging task. Forgejo exact-head CI was also failure, so the branch was not merge eligible.

Expected resolution

Remove the parser, authority default, and startup STAR manifest from this runtime debugging PR. Implement STAR URI only through the shared conformance/migration work tracked by starintel-server issue #1, with explicit migration targets and authority ownership. Keep dual Rabbit target bindings and actor-event fields as independent wire fixes.

Regression criteria

  • Runtime modernization contains no new star:// implementation or default authority.
  • %2E/%2E%2E and noncanonical spellings are covered by the eventual shared conformance suite.
  • Legacy migration requires a caller-supplied canonical target.

Research

Corrected STAR-RESEARCH-060 on research/star-bbpd-runtime-modernization explicitly withdraws its prior recommendation.

## Confirmed defects at PR #1 head `e3d5646` `bbp/star_uri.py:197-218` documents that callers must supply a canonical authority, but `parse_legacy_star_uri(value)` accepts no target authority, discards the legacy address, and invents `legacy.<domain>`. This contradicts STAR-RESEARCH-041, which requires an explicit migration target because the tuple cannot determine canonical identity. `_normalize_segment` checks `.`/`..` before percent normalization (`:100-111`), so `star://a/actor/%2E%2E` is accepted and serializes as `star://a/actor/..`. Other accepted strings such as `%61` also serialize differently while `is_canonical_star_uri` returns true. A local exact-head probe reproduced all three outcomes. `Config.DEFAULT_STAR_AUTHORITY = "bbpd.starintel.actor"` treats an illustrative research namespace as an owned deployment default; no ownership decision was established. ## Impact The PR would emit invented/noncanonical identities and create migration behavior outside this debugging task. Forgejo exact-head CI was also failure, so the branch was not merge eligible. ## Expected resolution Remove the parser, authority default, and startup STAR manifest from this runtime debugging PR. Implement STAR URI only through the shared conformance/migration work tracked by starintel-server issue #1, with explicit migration targets and authority ownership. Keep dual Rabbit target bindings and actor-event fields as independent wire fixes. ## Regression criteria - Runtime modernization contains no new `star://` implementation or default authority. - `%2E`/`%2E%2E` and noncanonical spellings are covered by the eventual shared conformance suite. - Legacy migration requires a caller-supplied canonical target. ## Research Corrected STAR-RESEARCH-060 on `research/star-bbpd-runtime-modernization` explicitly withdraws its prior recommendation.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/star-bbpd#2
No description provided.