cues.fire: auto_verify + sha256 constant-cost path (Phase 2 follow-on B + bonus)#41
Merged
Merged
Conversation
… B + bonus)
Mike body-verify directive 2026-05-11. cue-pm unblocked these
follow-ons at ~23:48Z after primary's substrate-fix (body_received
flat-string + body_received_sha256 hashing body field bytes) verified
on prod.
Changes:
cueapi/resources/cues.py:
- New ``auto_verify=True`` kwarg on ``CuesResource.fire``. Default
verify-on (symmetric with MessagesResource.send). When set:
- sends X-CueAPI-Verify-Echo: true request header
- pre-computes sha256(canonical-JSON-of-body) client-side
- on response: extracts body_received (defensive isinstance for
both string post-fix shape AND dict pre-fix shape — sibling of
PR #40 hotfix pattern)
- if body_received_sha256 present: constant-cost hex compare first,
fall back to string compare on sha drift (JSON-canonicalization
differences could cause spurious sha mismatch)
- on confirmed drift: raises BodyVerifyMismatchError with
sent_body, received_body, first_divergence_byte, message_id
(= execution_id for fire) attributes.
tests/test_cues_resource.py:
- Existing 3 TestFire tests updated to expect the new headers kwarg
in the post call (X-CueAPI-Verify-Echo: true is now default-on).
- New TestFireAutoVerify class with 5 tests pinning:
- Default adds verify-echo header
- --auto_verify=False omits header
- Byte-identical sha256 match passes
- No-op when substrate omits echo fields (pre-Layer-1 backward-compat)
- Opt-out skips verify even if substrate echoes
All 39 tests (messages + cues resource units) pass.
CHANGELOG entry under [Unreleased].
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ics locked
CI revealed: substrate's /v1/cues/{id}/fire echoes a pydantic-after-parse
body that includes server-side default-population (e.g. empty {} request
gets echoed as 16-byte populated-defaults JSON). Client's canonical-JSON
serialization diverges from substrate's defaulted echo → spurious
BodyVerifyMismatchError on integration tests.
Mitigation: default auto_verify=False on CuesResource.fire. Callers opt-
in via auto_verify=True when their serialization aligns with substrate's
echo semantic. Once cueapi-primary locks per-field echo semantics for
fire (sibling to the body_received semantic locked for /v1/messages),
flip default to True.
Existing fire tests reverted to expect headers={} (no auto-verify).
TestFireAutoVerify class tests updated to explicitly pass auto_verify=True.
39 of 39 messages + cues resource tests pass. Integration tests in
test_cues.py no longer raise spurious BodyVerifyMismatchError.
This was referenced May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-on B (CuesResource.fire auto_verify) + bonus (sha256 constant-cost path) of body-verify defense-in-depth. cue-pm unblocked at ~23:48Z after primary's substrate-fix verified on prod.
Mirror of
MessagesResource.sendauto_verify pattern, applied toclient.cues.fire()for symmetric coverage of /v1/cues/{cue_id}/fire endpoint.What
auto_verify=Truekwarg onCuesResource.fire. Default on.sha256(canonical-JSON(body)).hexdigest()client-side.body_received_sha256(constant cost) first; falls back to string compare on hash mismatch.BodyVerifyMismatchErroron confirmed drift;message_idfield carries the execution_id.Test plan
Defense-in-depth status post-merge
🤖 Generated with Claude Code