oficina / memoria Public

Review 1 on the provider: errors, proxies, ports, and a stricter parse

Reviewed by Codex GPT-6-Astra (dispatched: codex/gpt-6-astra; self-
reported "Codex / GPT-6, exact variant not exposed"). REQUEST CHANGES.
Spec draft 2: seven of Astra's eight earlier findings FIXED, one
PARTIAL (the provider must be named, not only the model — next commit).
The code findings were serious, and each was reproduced before fixing.

**Errors carried provider-controlled bytes.** The transport and read
paths wrapped Go's errors, and url.Error quotes the URL — which after a
redirect is whatever Location the provider sent. A 307 to
"/<canary>" came back in the error; so did a malformed header and a
chunked trailer. My comment said the URL was a constant; after a
redirect it is not. Every such failure is now a fixed sentinel with the
original DISCARDED, not wrapped; context errors stay recognisable.

**The pin let environment proxies through, and ignored the port.**
http.DefaultTransport honours HTTPS_PROXY: a listener set there received
"CONNECT api.tensorx.ai:443" while the host pin passed, because the pin
checks the URL and the URL was still TensorX's. That is decision 13's
objection to a configurable base URL arriving through the environment.
The client now owns a transport with proxies off and TLS verification
default. The pin is host AND port, with the scheme's default made
explicit; another listener on 127.0.0.1 took the body before, and
":8443" in BaseURL left every test green. Userinfo is refused.

**The strict parse was not strict.** Two claims verified before acting,
since both turn on encoding/json internals: the decoder folds "ſ" to
"s" (EqualFold) while my duplicate check used ToLower, so
{"passage":0,"paſſage":1} decoded as passage 1; and dec.More() is not
an end-of-input check, so {"addresses":[]}} was accepted. Duplicates
are now detected with EqualFold, end of input is io.EOF, the model's
content accepts only the exact schema keys, and the ENVELOPE is checked
for duplicates too — "finish_reason":"length","finish_reason":"stop"
decoded as stop and defeated the truncation refusal.

**Fourteen of the review's surviving mutations are now red**, and two of
my own fixes turned out unreachable: through ExtractAddresses the exact-
key check pre-empts the fold-aware duplicate check, and decodeAddresses
has its own EOF check. Both matter for the envelope, so rejectAmbiguous
is now tested directly (AGENTS.md: make it reachable or delete it). The
error test is now an exact whitelist built from the sentinels — the
canary search passed with eight bytes of content leaked. The deadline
is asserted against a literal 800 ms; cancellation is observed at the
listener; the happy path asserts POST, the path and the instructions.

**fact**: "e-mail address" primed [email, address] — an email query
sending passages to a model — because the two-token "e mail" matched
first and left "address" behind. The model-kind allowlist is pinned to
exactly [address], since adding one is Paul's to rule. RecognisedSpans,
LabelAt and WordBounded each gained the fixture a review's mutation got
past.

**And the timing test on main was flaking.** It timed every small run,
then every large one, so load arriving mid-test landed on one side of
the ratio. Now interleaved: pristine 1.90-2.01 idle and at most 2.56
with four CPUs pinned busy; the two quadratic mutants 3.54 and 3.89 at
their lowest. Three separates them with half a point either side.

Config asserts the loaded credential's value, and AI-on without one
fails at boot through provider.New rather than as a 401 on first search.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>