Accept padded audit log row counts

Author: yummybomb

src/kernel/lib/audit_log_download.py

@@ -201,14 +201,12 @@ def _parse_chunk_headers(headers: httpx.Headers, current_cursor: str | None) ->
     has_more = has_more_value == "true"
 
     row_count = headers.get("x-row-count")
-    if (
-        row_count is None
-        or not row_count.isascii()
-        or not row_count.isdecimal()
-        or len(row_count) > len(str(_MAX_CHUNK_ROWS))
-    ):
+    if row_count is None or not row_count.isascii() or not row_count.isdecimal():
         raise AuditLogDownloadError("response missing or invalid X-Row-Count header")
-    rows = int(row_count)
+    normalized_row_count = row_count.lstrip("0") or "0"
+    if len(normalized_row_count) > len(str(_MAX_CHUNK_ROWS)):
+        raise AuditLogDownloadError("response missing or invalid X-Row-Count header")
+    rows = int(normalized_row_count)
     if rows > _MAX_CHUNK_ROWS:
         raise AuditLogDownloadError("response missing or invalid X-Row-Count header")
 

tests/test_audit_log_download.py

@@ -221,6 +221,20 @@ def test_download_rejects_invalid_row_count(row_count: str, client: Kernel, resp
     assert destination.getvalue() == b""
 
 
+def test_download_accepts_zero_padded_row_count(client: Kernel, respx_mock: MockRouter) -> None:
+    response = chunk_response(b"chunk", rows=1, has_more=False)
+    response.headers["x-row-count"] = "0" * 5000 + "1"
+    respx_mock.get("/audit-logs/export/chunk").mock(return_value=response)
+
+    result = client.audit_logs.download(
+        to=BytesIO(),
+        start="2026-06-01T00:00:00Z",
+        end="2026-06-02T00:00:00Z",
+    )
+
+    assert result.rows == 1
+
+
 class InvalidWriteDestination:
     def __init__(self, result: object) -> None:
         self.result = result