feat(conformance): wave 14 — VM sweep of ten more boot-tier adapters - #90
Merged
Conversation
Engine-level suites for printful, photos, braze, apple-searchads, helius, netsuite, x-articles, workday, whatsapp, threads: 264 behavior markers (844 VM behaviors total). VM tier 28 -> 38, boot 44 -> 24. ~21 fidelity fixes plus an OAuth standardization. The standouts: - photos: any authenticated user could read AND delete another user's album; upload tokens were infinitely reusable; refresh-issued access tokens never expired despite the advertised expires_in - netsuite: the TBA gate probed the substring oauth_signature (matching oauth_signature_method) — a signature-less header passed; SuiteQL envelope lacked the hasMore/offset/totalResults clients page off - threads: float timestamps rendered "2025.0-06.0-15.0T..."; inbox oldest-first; ?metric= projection ignored - whatsapp: sends without a usable recipient were silently accepted (real API 400s with code 131026) - printful: v1 creates stored an internal wrapper doc that leaked into the v2 list, defeated the status filter, and served stale reads - apple-searchads: money formatted two ways in one response - braze: invalid cursor bypassed the fatal envelope - x-articles: publish lacked concurrency_key - helius + workday: zero fixes needed OAuth standardization: authorization codes now survive a failed client-mismatch exchange across ALL adapters (instagram, photos, threads, x-articles) — an attacker's failed attempt can no longer deny the legitimate client its code. Both updated suites assert survival. ~26 new sidecar bullets (reviewer-verified); one duplicate threads bullet and two stale burn-semantics comments removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ten engine-level VM suites (printful, photos, braze, apple-searchads, helius, netsuite, x-articles, workday, whatsapp, threads) — 264 new behavior markers, 844 VM behaviors total. VM tier 28 → 38, boot 44 → 24.
~21 adapter fidelity fixes, the standouts:
expires_inoauth_signature(matchingoauth_signature_method) — a signature-less header passed; the SuiteQL envelope lacked thehasMore/offset/totalResultsfields clients page off"2025.0-06.0-15.0T…"; inbox listed oldest-first;?metric=projection ignoredconcurrency_keyOAuth standardization: authorization codes now survive a failed client-mismatch exchange across all OAuth adapters (instagram, photos, threads, x-articles) — an attacker's failed attempt can no longer deny the legitimate client its code. Found as a recurring pattern (instagram wave 13, photos wave 14), swept via cross-adapter grep, both remaining instances fixed, all four suites assert the safer semantics.
Reviewed by code-reviewer agent: no functional defects; three hygiene findings (stale docstring, stale engine-test comment, duplicate sidecar bullet) fixed pre-merge.