test(protocol): correct the decode-bounds header on where the envelope is verified (LAB-3479)

[27Bslash6]

Summary

This PR corrects a documentation comment in the header of packages/cachekit/test/protocol/decode-bounds.protocol.test.ts. There are no code, test logic, or public API changes.

What changed

The old header said the ByteStorage envelope "is verified against the same vectors" in cachekit-core. That was inaccurate. The new header states:

• Where decoding happens: The ByteStorage envelope is decoded in Rust (cachekit-core), reached through the NAPI unpack binding or wasm. It is not decoded in this package.
• Where verification is added: fix(byte-storage): pre-scan envelope bytes before decoding them (LAB-3479) cachekit-core#80 adds the envelope pre-scan to ByteStorage::retrieve and runs the decode-bounds vectors through it in core CI.
• Current state of this repo: The pinned cachekit-core 0.6.0 has no envelope pre-scan. unpack gets the guard only when the pin moves to a core release that includes it.

Scope and impact

• Public APIs: None modified. unpack (NAPI) and the wasm path are named in the comment only as references.
• Test coverage: Unchanged. The test still covers the three decoders that live in this package:
  • the auto-mode serializer
  • the interop/v1 value decoder
  • the invalidation-event decoder
• Provenance note: Unchanged (feat(interop): pin untrusted-decode bounds as a cross-SDK invariant (LAB-2503) protocol#59 @ b75adac4).

Note on wording

The existing PR description says both unpack (NAPI) and the wasm path gain the guard after the pin update. The updated comment only says unpack gains the guard; it mentions wasm only as a way to reach the Rust decoder. Aligning the two may be worthwhile if the wasm path is also expected to pick up the pre-scan.

Related

• fix(byte-storage): pre-scan envelope bytes before decoding them (LAB-3479) cachekit-core#80: envelope pre-scan in ByteStorage::retrieve
• docs(matrix): cachekit-core envelope pre-scan on main, unreleased (LAB-3479) protocol#82: matching matrix update
• Tracking: LAB-3479

---

This PR corrects a single header comment in packages/cachekit/test/protocol/decode-bounds.protocol.test.ts. There are no functional, test-logic, or public API changes.

The comment previously said that cachekit-core#80 runs "these vectors" through the envelope pre-scan in core CI. That implied core CI uses the same decode-bounds vectors vendored in this repository.

The revised wording says core CI instead runs the protocol's decode-bounds.json version 1.1.0 through ByteStorage::retrieve. That version is newer than the copy vendored here.

The rest of the header is unchanged:

• The ByteStorage envelope is decoded in Rust (cachekit-core, via NAPI unpack / wasm).
• The pinned cachekit-core 0.6.0 lacks the envelope pre-scan.
• unpack gains the guard only when the pin moves to a core release that includes it.

Summary by CodeRabbit

• Documentation
  • Clarified that the currently pinned release does not include envelope pre-scanning protection for unpack. This protection will be available when the dependency is updated to a release that contains it. No behavior changes are included in this update.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: cachekit-io/cachekit-ts/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2f6965a8-af94-4a15-826b-583e05d3bbc6

📥 Commits

Reviewing files that changed from the base of the PR and between 80912c3 and 222afe1.

📒 Files selected for processing (1)

• packages/cachekit/test/protocol/decode-bounds.protocol.test.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: cachekit-io/cachekit-ts/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b5c6c141-1f4d-418e-a13f-51c9054a2bf9

📥 Commits

Reviewing files that changed from the base of the PR and between eed8a79 and 80912c3.

📒 Files selected for processing (1)

• packages/cachekit/test/protocol/decode-bounds.protocol.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The test documentation now states that the pinned cachekit-core 0.6.0 lacks the ByteStorage envelope pre-scan. It notes that unpack receives the guard when the dependency pin moves to a release that includes the pre-scan.

Changes

Test documentation

Layer / File(s)	Summary
Document dependency pre-scan status packages/cachekit/test/protocol/decode-bounds.protocol.test.ts	The documentation distinguishes the core implementation of the envelope pre-scan from its absence in the pinned cachekit-core 0.6.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 80912

This PR only clarifies test documentation and does not change runtime behavior or dependency versions, so it is ready to merge.

Architecture Summary

Architecture risk: 🔵 Low · up to 80912

The change affects 1 system.

Changed systems: packages/cachekit

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — packages/cachekit (library) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in packages/cachekit/test/protocol/decode-bounds.protocol.test.ts: The documentation now distinguishes the core implementation of the ByteStorage envelope pre-scan from the package’s pinned cachekit-core 0.6.0, which lacks it; it states that unpack receives the guard only with a later pin that includes the pre-scan. This replaces the prior claim that the envelope was verified against the same vectors in Rust.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the comment-only change to the decode-bounds header and identifies the relevant protocol test.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.