fix(sdk): emit spec-compliant key access in experimental/tdf and delegate Writer by dmihalcik-virtru · Pull Request #3944 · opentdf/platform

dmihalcik-virtru · 2026-09-01T02:57:32Z

Part 15 of 20 in the DSPX-2604 re-cut. Base branch: dspx-2604-14-type-aliases.

This stack replaces #3782 / #3865 / #3921, which stay open and untouched
until it lands. Nothing here is a rebase of those branches — the work was
re-cut from the ticket so each PR stands on its own.

Proposed Changes

The experimental writer built its own key access objects, and for EC KAS
keys it built them wrong in three ways at once. It set keyType
"eccWrapped", but service/kas/access/rewrap.go dispatches on the exact
string "ec-wrapped" and has no case for the other spelling. It derived
the wrapping key with HKDF and then XORed the DEK, where the spec and every
KAS expect AES-GCM under that derived key. And it omitted schemaVersion
from the KAO entirely. Any TDF this package produced against an EC KAS was
undecryptable, and nothing in the repo caught it because the package tested
its own output against its own expectations.

The fix is not a patch to that code but its deletion. key_access.go (-266)
goes away and Writer delegates to sdk.NewChunkedWriter, so key access
objects come from sdk.createKeyAccess -- the same code path
SDK.CreateTDF has always used and that the cross-SDK tests exercise. RSA,
EC, ML-KEM and hybrid wrapping now have exactly one implementation.
key_access_test.go (-652) goes with it; equivalent coverage against the
sdk functions landed earlier in this stack, so nothing is lost.

writer.go drops from 680 lines to ~292: Writer becomes its config plus
an inner sdk.ChunkedWriter and a finalized flag. Manifest assembly,
segment encryption, integrity hashing and assertion signing all move to the
one implementation. manifest.go sheds the calculateSignature copy and
the three constants that only its callers needed.

keysplit_adapter.go (+60) is why this is a delegation rather than a
rename. sdk.DefaultKeySplitter is single-KAS and ignores attributes;
keysplit.XORSplitter evaluates the full ABAC boolean expression and
XOR-splits the DEK across every KAS the resulting clauses require. The two
result shapes are field-identical, so the adapter is a straight copy. The
one structural mismatch is where the default KAS enters -- sdk passes it per
Split call, keysplit takes it at construction -- so the splitter is built
inside Split.

API changes callers will notice

Finalize now returns a single *FinalizeResult instead of
(finalBytes, manifest, error). Error values are aliases of their sdk
counterparts rather than copies, so errors.Is matches under either name.

WithSegments no longer requires a contiguous prefix starting at 0.
Indices may be sparse -- a caller mapping fixed index blocks onto S3
multipart uploads writes gaps by construction -- but must still name written
segments in ascending order and may only drop from the end, because that is
the order the payload is laid out in.

WithExcludeVersionFromManifest is deprecated. It was always a no-op: the
manifest builder never read the flag. Omitting schemaVersion is how a
reader is told the TDF predates 4.3.0, and such a reader then expects
hex-then-base64 signatures, which are decided per segment at write time,
long before Finalize sees the option. WithTargetMode sets both together
and is the replacement.

This package's "application/octet-stream" MIME default is preserved
independently of the sdk default. examples/cmd/benchmark_experimental.go,
the only non-test consumer in the repo, compiles unchanged.

Because this changes the KAS wire format for EC keys, it wants a cross-SDK
run before merge:

gh workflow run xtest.yml --repo opentdf/tests --ref main
-f platform-ref= -f otdfctl-ref=main -f java-ref=main -f js-ref=main

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

cd sdk && go test ./... -race
cd examples && go build ./...

This changes the KAS wire format for EC keys, so it wants a cross-SDK run
before merge:

gh workflow run xtest.yml --repo opentdf/tests --ref main \
  -f platform-ref=dspx-2604-15-delegate-writer \
  -f otdfctl-ref=main -f java-ref=main -f js-ref=main

The full DSPX-2604 stack — 20 PRs

#	PR	Based on
01	#3930 chore: bump go.work toolchain to go1.25.12 and simplify an rt_test condition	`main`
02	#3931 feat(sdk): make the zipstream clock injectable for deterministic ZIP output	`main`
03	#3932 fix(sdk): reject a zipstream write set that omits segment 0	#3931
04	#3933 fix(sdk): map ReadAt plaintext offsets from cumulative segment sizes	`main`
05	#3934 chore(sdk): extract integrityAlgorithmString, createPolicyBinding, signAssertions	`main`
06	#3935 chore(sdk): add direct tests for createKeyAccess, encryptMetadata and tdfSalt	`main`
07	#3936 fix(sdk): fill each segment with io.ReadFull and size the buffer to the input	`main`
08	#3937 chore(cli): move streaming IO helpers into pkg	`main`
09	#3938 fix(cli): stream encrypt instead of buffering the whole payload	#3937
10	#3939 fix(cli): stream decrypt and inspect instead of buffering	#3938
11	#3940 feat(sdk): add a chunked segment writer (experimental)	`dspx-2604-base-11` = #3932 + #3934 + #3935
12	#3941 fix(sdk): stop GetManifest from splitting the key under the lock	#3940
13	#3942 fix(sdk): reject a chunked split naming a KAS with no resolved public key	#3941
14	#3943 chore(sdk): alias experimental/tdf manifest and assertion types	#3942
15	#3944 fix(sdk): emit spec-compliant key access in experimental/tdf and delegate Writer	#3943
16	#3945 feat(sdk): accept io.Reader in CreateTDF and drop the 64 GB payload cap	#3936
17	#3946 chore(sdk): rewrite CreateTDF on top of the chunked writer	`dspx-2604-base-17` = #3944 + #3945
18	#3947 chore(sdk): drop dead TDFConfig fields and deprecate the TDFFormat enum	#3946
19	#3948 fix(cli): drop the encrypt-side stdin spool	`dspx-2604-base-19` = #3947 + #3939
20	#3949 feat(sdk): graduate the chunked writer to stable API	#3948

Reviewable in parallel right now, since they sit directly on main and depend on
nothing else: 01, 02, 04, 05, 06, 07, 08.

Why three PRs have a dspx-2604-base-* base. A GitHub PR takes one base branch,
but 11, 17 and 19 each build on more than one parent. The base-* branches are empty
merge commits that exist only to join those parents so the PR diff shows exactly its
own change and nothing else. They contain no code, have no PR of their own, and go
away once their parents land — retarget the child onto main at that point.

Wants a cross-SDK xtest run before merge: 15, 17 (and therefore 20). They touch
the KAS wire format.

Red checks you may see are network flakes, not this stack. Four distinct ones hit
this batch and all clear on re-run: golangci-lint config verify timing out on
https://golangci-lint.run/.../golangci.v2.8.jsonschema.json (fails the whole go (<module>) job and fail-fast cancels its siblings), the bats installer getting a 403,
Docker Hub timing out on keycloak/keycloak:26.4, and buf reporting "the server
hosted at that remote is unavailable" while the Java SDK generates sources. The
govulncheck step also emits ##[error] annotations against the go1.25.11 stdlib, but
it is continue-on-error: true and never fails a job — 01 bumps the toolchain and
clears those annotations.

coderabbitai · 2026-09-01T02:57:41Z

Warning

Review limit reached

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b087a53f-d0f5-48a0-8a6b-6c41d364204e

📥 Commits

Reviewing files that changed from the base of the PR and between 80607e5 and 853c55a.

📒 Files selected for processing (8)

sdk/experimental/tdf/doc.go
sdk/experimental/tdf/key_access.go
sdk/experimental/tdf/key_access_test.go
sdk/experimental/tdf/keysplit_adapter.go
sdk/experimental/tdf/manifest.go
sdk/experimental/tdf/options.go
sdk/experimental/tdf/writer.go
sdk/experimental/tdf/writer_test.go

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-01T03:02:30Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	246.07499ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	128.704592ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.416813ms
Throughput	236.73 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.067918623s
Average Latency	449.885817ms
Throughput	110.94 requests/second

github-actions · 2026-09-01T03:11:35Z

github-actions · 2026-09-01T03:30:51Z

X-Test Failure Report

github-actions · 2026-09-01T15:09:16Z

X-Test Failure Report

github-actions · 2026-09-01T15:12:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	123.138316ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	59.1676ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	237.679741ms
Throughput	420.73 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	24.257021763s
Average Latency	242.114685ms
Throughput	206.13 requests/second

github-actions · 2026-09-01T15:13:57Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.18589ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.630564ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	345.04431ms
Throughput	289.82 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.950022894s
Average Latency	328.866109ms
Throughput	151.74 requests/second

github-actions · 2026-09-01T15:23:36Z

github-actions · 2026-09-03T14:13:24Z

X-Test Failure Report

github-actions · 2026-09-03T14:18:05Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.441711ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	110.022494ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	409.769607ms
Throughput	244.04 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.247158206s
Average Latency	531.214096ms
Throughput	93.90 requests/second

github-actions · 2026-09-03T14:18:15Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	208.139612ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	118.848688ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	359.403075ms
Throughput	278.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.083358536s
Average Latency	529.624452ms
Throughput	94.19 requests/second

github-actions · 2026-09-03T14:28:43Z

X-Test Results

✅ go@main-main
✅ go@pull-3944-main
✅ go@main-pull-3944
✅ go@pull-3944-pull-3944
bats-test-results
✅ go@main-v0.9.0
✅ java@main-pull-3944
✅ go@pull-3944-v0.9.0
cukes-report
✅ js@main-main
✅ js@main-pull-3944
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-v0.9.0
opentdf~~platform~~TB5EH5.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1

github-actions · 2026-09-03T14:39:21Z

X-Test Failure Report

github-actions · 2026-09-03T14:45:24Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	235.797461ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	137.523017ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	409.81011ms
Throughput	244.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	57.637992774s
Average Latency	574.373669ms
Throughput	86.75 requests/second

github-actions · 2026-09-03T14:45:28Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	238.848868ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	132.806587ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	424.6364ms
Throughput	235.50 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	58.595231193s
Average Latency	583.896875ms
Throughput	85.33 requests/second

github-actions · 2026-09-03T14:54:58Z

X-Test Results

bats-test-results
✅ go@main-main
✅ go@pull-3944-pull-3944
✅ go@main-pull-3944
✅ java@main-main
✅ go@pull-3944-v0.9.0
✅ go@pull-3944-main
✅ java@main-pull-3944
✅ java@main-v0.9.0
✅ go@main-v0.9.0
✅ js@main-main
cukes-report
✅ js@main-v0.9.0
✅ js@main-pull-3944
opentdf~~platform~~9ICNRG.dockerbuild
govulncheck-failure-1
govulncheck-failure-3
govulncheck-failure-8

github-actions · 2026-09-08T17:15:38Z

X-Test Failure Report

github-actions · 2026-09-08T17:21:43Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	223.341922ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	139.524197ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.116255ms
Throughput	243.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.127661028s
Average Latency	589.709918ms
Throughput	84.56 requests/second

github-actions · 2026-09-08T17:21:50Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	226.623177ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	140.245352ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	436.906171ms
Throughput	228.88 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.415110287s
Average Latency	592.831391ms
Throughput	84.15 requests/second

…gate Writer The experimental writer built its own key access objects, and for EC KAS keys it built them wrong in three ways at once. It set keyType `"eccWrapped"`, but `service/kas/access/rewrap.go` dispatches on the exact string `"ec-wrapped"` and has no case for the other spelling. It derived the wrapping key with HKDF and then XORed the DEK, where the spec and every KAS expect AES-GCM under that derived key. And it omitted `schemaVersion` from the KAO entirely. Any TDF this package produced against an EC KAS was undecryptable, and nothing in the repo caught it because the package tested its own output against its own expectations. The fix is not a patch to that code but its deletion. `key_access.go` (-266) goes away and `Writer` delegates to `sdk.NewChunkedWriter`, so key access objects come from `sdk.createKeyAccess` -- the same code path `SDK.CreateTDF` has always used and that the cross-SDK tests exercise. RSA, EC, ML-KEM and hybrid wrapping now have exactly one implementation. `key_access_test.go` (-652) goes with it; equivalent coverage against the sdk functions landed earlier in this stack, so nothing is lost. `writer.go` drops from 680 lines to ~292: `Writer` becomes its config plus an inner `sdk.ChunkedWriter` and a `finalized` flag. Manifest assembly, segment encryption, integrity hashing and assertion signing all move to the one implementation. `manifest.go` sheds the `calculateSignature` copy and the three constants that only its callers needed. `keysplit_adapter.go` (+60) is why this is a delegation rather than a rename. `sdk.DefaultKeySplitter` is single-KAS and ignores attributes; `keysplit.XORSplitter` evaluates the full ABAC boolean expression and XOR-splits the DEK across every KAS the resulting clauses require. The two result shapes are field-identical, so the adapter is a straight copy. The one structural mismatch is where the default KAS enters -- sdk passes it per `Split` call, keysplit takes it at construction -- so the splitter is built inside `Split`. API changes callers will notice `Finalize` now returns a single `*FinalizeResult` instead of `(finalBytes, manifest, error)`. Error values are aliases of their sdk counterparts rather than copies, so `errors.Is` matches under either name. `WithSegments` no longer requires a contiguous prefix starting at 0. Indices may be sparse -- a caller mapping fixed index blocks onto S3 multipart uploads writes gaps by construction -- but must still name written segments in ascending order and may only drop from the end, because that is the order the payload is laid out in. `WithExcludeVersionFromManifest` is deprecated. It was always a no-op: the manifest builder never read the flag. Omitting `schemaVersion` is how a reader is told the TDF predates 4.3.0, and such a reader then expects hex-then-base64 signatures, which are decided per segment at write time, long before Finalize sees the option. `WithTargetMode` sets both together and is the replacement. This package's `"application/octet-stream"` MIME default is preserved independently of the sdk default. `examples/cmd/benchmark_experimental.go`, the only non-test consumer in the repo, compiles unchanged. Because this changes the KAS wire format for EC keys, it wants a cross-SDK run before merge: gh workflow run xtest.yml --repo opentdf/tests --ref main \ -f platform-ref=<branch> -f otdfctl-ref=main -f java-ref=main -f js-ref=main Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-09-08T17:31:36Z

X-Test Failure Report

bats-test-results
✅ go@main-main
✅ go@pull-3944-pull-3944
✅ go@pull-3944-main
✅ go@pull-3944-v0.9.0
✅ go@main-v0.9.0
✅ java@main-main
✅ java@main-pull-3944
✅ go@main-pull-3944
✅ java@main-v0.9.0
✅ js@main-main
✅ js@main-v0.9.0
cukes-report
server-logs-js@main-pull-3944
opentdf~~platform~~PXZL7Z.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

github-actions · 2026-09-08T17:37:10Z

X-Test Failure Report

github-actions · 2026-09-08T17:42:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	163.95769ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	85.025238ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	295.618297ms
Throughput	338.27 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.235287663s
Average Latency	421.420568ms
Throughput	118.38 requests/second

github-actions · 2026-09-08T17:43:30Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	259.748497ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	150.387761ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	432.717597ms
Throughput	231.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m2.54592112s
Average Latency	623.95551ms
Throughput	79.94 requests/second

github-actions · 2026-09-08T17:45:42Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-09-08T17:54:05Z

X-Test Results

✅ go@main-main
✅ go@pull-3944-main
✅ go@pull-3944-pull-3944
✅ go@main-v0.9.0
✅ java@main-pull-3944
✅ go@main-pull-3944
cukes-report
✅ java@main-main
bats-test-results
✅ java@main-v0.9.0
✅ go@pull-3944-v0.9.0
✅ js@main-main
✅ js@main-pull-3944
✅ js@main-v0.9.0
govulncheck-failure-3
opentdf~~platform~~ET5NZ2.dockerbuild
govulncheck-failure-1
govulncheck-failure-8

dmihalcik-virtru requested review from a team as code owners September 1, 2026 02:57

github-actions Bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati size/xl labels Sep 1, 2026

dmihalcik-virtru force-pushed the dspx-2604-15-delegate-writer branch from 7971d6c to daa07d2 Compare September 1, 2026 03:30

dmihalcik-virtru changed the title ~~fix(sdk/experimental/tdf): emit spec-compliant key access and delegate Writer~~ fix(sdk): emit spec-compliant key access in experimental/tdf and delegate Writer Sep 1, 2026

dmihalcik-virtru force-pushed the dspx-2604-15-delegate-writer branch from 95ae918 to 903f660 Compare September 3, 2026 14:13

dmihalcik-virtru force-pushed the dspx-2604-15-delegate-writer branch from 903f660 to 1273c11 Compare September 3, 2026 14:39

dmihalcik-virtru force-pushed the dspx-2604-15-delegate-writer branch from 1273c11 to 2f5a2d8 Compare September 8, 2026 17:15

dmihalcik-virtru force-pushed the dspx-2604-15-delegate-writer branch from 2f5a2d8 to 853c55a Compare September 8, 2026 17:36

Uh oh!

Conversation

dmihalcik-virtru commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 3, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 3, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 3, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

dmihalcik-virtru commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading