new-adapter-next: credential-redaction rule + slicer cfg-gate reuse (Wave 2 learnings) - #541
Merged
Merged
Conversation
…Wave 2 learnings) Two additions distilled from the Wave 2 ports (postgres/zmq): - Credential-redaction invariant in the fallibility section: never embed a password/token/DSN in error context; give the connection config a redacted() method and use it at every connect() error site, with a no-service test that the raw secret never leaks. Generalizes the classic postgres fix (#433) to every networked adapter. - Time-slicer cfg-gate reuse: the second time-partitioned adapter must WIDEN the shared slicer's #[cfg(any(feature = ...))] gate rather than duplicate it (postgres left compute_validated_time_slices gated postgres-only because a kdb cfg didn't exist yet), and postgres's query-at-wiring -> WindowFilter -> replay_results reader is named as the template. Directly unblocks the kdb port. Docs-only change to .claude/commands/new-adapter-next.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SEQvysabaSKTnYyQDgPDTt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two skill additions distilled from the Wave 2 ports (postgres #539, zmq #540).
Changes to
new-adapter-nextCredential-redaction invariant (fallibility section). A connection string / DSN / URL often embeds a password or token, and
.context("connecting to {conn}")would spill it into logs and the graph-abort error. The skill now requires aredacted()method on the connection config, used at everyconnect()error site, with a no-service test asserting the raw secret never appears. This generalizes the classic postgres password-redaction fix (Redact password from postgres connection errors #433) to every networked adapter (redis, kafka, zmq, kdb, …) so it isn't rediscovered per port.Time-slicer cfg-gate reuse (the "caller-parameterised time range" invariant). postgres ported
compute_validated_time_slicesintocommon.rsbut had to gate it#[cfg(feature = "postgres")](an unknownkdbcfg would tripunexpected_cfgs). The reusing adapter must widen that gate to#[cfg(any(feature = "postgres", feature = "$ARGUMENTS"))], not duplicate the slicer — and postgres's reader (query each slice at wiring → clamp viaWindowFilter→ feedreplay_results) is named as the template. This directly unblocks the kdb port (Wave 3).Docs-only change to
.claude/commands/new-adapter-next.md.🤖 Generated with Claude Code
Generated by Claude Code