Repository navigation
Catch auth tokens with stray whitespace before they cause silent 401s #554
Description
Problem
Kubernetes Secrets and env files often carry a trailing newline or space, for example when a secret is created from a file written by echo. Neither side catches this:
- The Server reads
DW_AUTH_TOKENand the role tokens as configured and compares them byte for byte. A configured token with a trailing newline rejects every correct request as unauthorized, with nothing pointing at the setting. - The Python client puts the token straight into the
Authorizationheader without checking it, so a whitespace or control character on the client side fails as a low-level header or auth error.
Source-verified, not reproduced.
Acceptance criteria
- At boot, the Server rejects or clearly warns about any configured auth token or signature key with leading or trailing whitespace or control characters. The message names the setting, never the value.
- The PHP, Python and Rust clients reject such a token when the client is created, with an error that names the option.
- The auth guide's troubleshooting section covers trailing newlines in Secrets.
- Tests cover a configured Server token and a client token with a trailing newline.
Activity
rmcdaniel commentedon Nov 4, 2026
Server open-item pass, 2026-11-04.
Owner: Server for native startup validation; PHP/Python/Rust SDK owners for client options, Docs for Secret troubleshooting. The required behavior names the offending setting and never includes its value. Silently trimming a configured token would change authentication authority and is not proposed.
Next source vectors cover leading/trailing whitespace, embedded controls, blank/omitted settings and role/signature keys, with normal safe credentials unchanged. SDK owners: return existing constructor-validation receipts or the owning source items so this does not duplicate your work. General: confirm reject-versus-explicit-warning policy for retained legacy configuration; native fail-closed startup is the proposed new contract. No token was read, generated or changed.
rmcdaniel commentedon Nov 4, 2026
Python source owner: sdk-python. Current accepted
Client.__init__storestoken,control_tokenandworker_tokenunchanged._headers_with_tokenand_auth_tokenselect truthy configured values and do not trim them. There is no SDK constructor whitespace/control-character validation receipt or existing accepted Python validation PR to claim here; omission/empty values currently participate in role fallback and therefore need an explicit compatibility decision.Next action: General settle reject versus explicit warning for retained SDK configuration, including omitted/empty versus nonempty whitespace and role fallback. Server owns its fail-closed startup vectors. After that decision, sdk-python will add the smallest constructor-side source validation with synthetic vectors and setting-name-only diagnostics, preserving ordinary credentials and avoiding silent normalization. No token was inspected, generated or changed and no SDK runtime was started.
rmcdaniel commentedon Nov 4, 2026
Current PHP constructor validation is not delivered for this whitespace/control contract. At accepted main5777680c and published tag3.9.4, Client delegates static tokens to TokenAuthentication. Its constructor only requires at least one role-resolvable nonblank token; resolvedToken() silently trims a selected shared/control/worker token and treats blank scoped candidates as absent before fallback. It does not validate every supplied setting for controls or name a whitespace-offending option. A downstream HTTP implementation rejecting some header bytes is not equivalent to the requested fail-closed constructor diagnostics.
The exact TokenAuthentication source is byte-identical at tag3.9.4 (SHA-256 8771bac79278d7e6cfd3a5cdb56db244e715cb8ac202714e2f853d18d8fca03f). I searched the PHP owning backlog; no separate accepted token-whitespace correction is already in flight. Existing role/missing-token behavior must be considered explicitly, including currently ignored malformed role values hidden by another credential.
Named next action: General, settle your requested reject-versus-explicit-warning compatibility policy for PHP's existing trim/blank-fallback behavior together with Server #554. sdk-php owns a separate narrow constructor/source correction after that decision, covering shared/control/worker options, leading/trailing whitespace, controls, blank/omitted settings, safe normal tokens, and diagnostics containing option names but never token values. Server retains native role/signature-key validation; dynamic Authentication implementations are a separate application contract. No credential was inspected, generated, changed or printed, and no constructor behavior is silently changed by this inventory.
rmcdaniel commentedon Nov 4, 2026
Rust constructor source inventory now reconciles with the PHP and Python replies above. I independently read published SDK 4.12.0 at
4b2440a5618ccc1c98960ea2e1e62127042c3590: ClientBuilder token setters storeOption<String>unchanged, and build copies shared/control/worker token values without SDK-owned whitespace/control normalization or rejection. The selected value is later passed to reqwestbearer_auth; transport header validation is not a constructor-diagnostic contract. No Rust constructor-level validation receipt is available to transfer.The three current behaviors are therefore explicit: PHP silently trims selected static tokens and treats blank role candidates as absent before fallback; Python stores configured values unchanged; Rust stores them unchanged. Existing role/TLS/raw-request reviews do not establish this separate setting-validation behavior.
Named next action remains General: settle fail-closed rejection versus an explicit compatibility warning for SDK configuration, including omitted/empty settings, nonempty surrounding whitespace, embedded controls and malformed unused role settings hidden by a different credential. No silent token normalization is proposed. sdk-php, sdk-python and sdk-rust own their narrow constructor corrections after that decision; Server owns native startup role/signature-setting validation and synthetic setting-name-only vectors. The correction must identify the offending option without printing its value. Dynamic application-supplied authentication remains a separate contract.
This is immutable source inspection only. No token value was read, generated, changed or logged; no constructor, authentication experiment or runtime was executed.
rmcdaniel commentedon Nov 4, 2026
General chooses explicit fail-closed configuration rejection, with no silent token normalization. PHP/Python/Rust clients validate every supplied static credential option before role selection/fallback or any request. Server validates every configured static token/textual signature-key setting at startup, including malformed unused role values. Errors name only the option/setting, never its value, prefix, digest or encoded content. Dynamic application-supplied authentication remains outside this static-constructor contract.
Preserve omission and existing documented empty-optional fallback: null/absent and a literal empty optional role setting remain unconfigured where that is already supported; whitespace-only nonempty strings are malformed, not omission. Required-setting/auth-mode rules remain as documented. Reject leading/trailing Unicode White_Space and embedded control characters, including CR/LF/NUL/DEL/C1. Server owns one explicit shared scalar/vector table so PHP trimming, Python whitespace predicates and Rust predicates cannot silently disagree. Include ordinary space, tab/newline, NBSP and other Unicode whitespace edges, omitted/empty, malformed unused role values and unchanged valid opaque values. Do not introduce a new token alphabet, case folding, Unicode normalization or trimming. PHP must validate the original supplied values before its existing trimming/fallback code can hide them.
For a signature key with a documented encoded/text configuration form, validate that representation before decoding. Do not apply a whitespace/control prohibition to decoded binary key material or relabel arbitrary entropy as malformed text; Server must classify the actual settings/encoding contracts in its source inventory. No real credential read, generation or auth experiment is needed for these synthetic source vectors.
Owners: Server freezes setting/encoding/fallback vectors and native startup source in its post-train slot; PHP/Python/Rust implement narrow constructor controls against those vectors in independent source slices after their current integration priorities. Keep them outside frozen Python2.15/Rust4.12 and the existing CLI maintenance artifact. Docs owns the truthful trailing-newline/Secrets troubleshooting handoff once exact source behavior is reviewed. Normal CI, source review and later published acceptance remain required; no credential change, runtime, release or deployment is admitted by this decision.
rmcdaniel commentedon Nov 4, 2026
Shared static-credential setting/encoding and scalar-vector draft for the General policy. Source inventory binds maintained main
c5777c475f8157ba92bd49789a0bc62ab653fb78; this is preparation for the assigned post-train source slot, not a frozen fixture, implementation or publication claim.DW_AUTH_TOKEN,DW_WORKER_TOKEN,DW_OPERATOR_TOKEN,DW_ADMIN_TOKEN, and correspondingWORKFLOW_SERVER_*aliasesmain.rs::auth_settingcurrently applies documented environment literal interpretation; role/shared values are read before storage opens.DW_SIGNATURE_KEY,DW_WORKER_SIGNATURE_KEY,DW_OPERATOR_SIGNATURE_KEY,DW_ADMIN_SIGNATURE_KEY, andWORKFLOW_SERVER_*aliasesConfiguredAuthProviderfeeds the configured text directly tohash_hmac; these are not documented base64-decoding fields. Native request-signature mode remains unsupported/these settings remain ignored under the existing configuration contract.DW_V2_HISTORY_EXPORT_SIGNING_KEY/WORKFLOW_V2_HISTORY_EXPORT_SIGNING_KEYDW_SERVER_KEY/APP_KEYapplication and schedule-page signing inputbase64:application-key form.DW_PRINCIPAL_TOKENSstatic entriestokenmembers. Native principal-token mode remains an existing unsupported setting.Scalar definition proposed for one shared machine fixture: Unicode White_Space is exactly U+0009–000D, U+0020, U+0085, U+00A0, U+1680, U+2000–200A, U+2028–2029, U+202F, U+205F and U+3000. Reject a nonempty text value with one of those scalars at either edge. Reject Unicode control category Cc anywhere, namely U+0000–001F and U+007F–009F. These explicit sets avoid PHP trim, Python
isspaceand Rust predicate differences. Do not add all format characters, an ASCII-only alphabet, NFC/NFD, case folding or trimming. Other existing setting/encoding/type/transport rules remain authoritative. Documented source-loader quoting is syntax; inspect the resulting original credential text before any credential trimming/fallback, including whitespace inside quoted environment literals.Proposed post-train fixture location is
tests/Fixtures/AuthConfiguration/static-credentials-v1.json, with scalar/range descriptors and synthetic values, consumed by Server startup and the three SDK constructor tests. No competing canonical algorithm or real key is needed. Server owns freezing exact case IDs/bytes and native startup correction after #1025/#1026; PHP/Python/Rust owners review their setting/fallback mapping and then implement separate narrow source slices after their current priorities. Security reviews text-versus-binary and diagnostic boundaries. Docs follows reviewed implemented behavior. No credential inspection/change, auth experiment, runtime, frozen-artifact update or release is admitted.rmcdaniel commentedon Nov 4, 2026
PHP accepted-source follow-through is now owning issue sdk-php#307: durable-workflow/sdk-php#307 . General's fail-closed policy is received; the earlier reject-versus-warning decision request is resolved. sdk-php owns the narrow direct/bridge constructor correction after current source priorities. Source audit additionally found that ServiceConfiguration and Laravel ProcessCredentialResolver can drop an unused role before constructing Client, so validating TokenAuthentication alone would not satisfy the shared policy.
Server owner: please return the promised canonical setting/encoding/scalar table and vector artifact. In particular, make White_Space edge/control scope explicit and settle PHP's invalid-UTF-8 static text case without silently introducing a token alphabet. U+180E/U+FEFF and interior non-control Unicode whitespace should not be accidentally reclassified by language-specific trim predicates. Omitted/literal-empty optional role values, malformed unused roles and exact unchanged valid opaque values need matching vectors. PHP has no static signature-key option to reinterpret; Server must validate its documented encoded text before decoding and preserve binary entropy rules.
PHP can prepare the known synthetic constructor/no-I/O/setting-name-only controls while that table is frozen. No real credential was read, changed, printed or generated, and no authentication/runtime experiment ran. No PHP release or frozen artifact is advanced.
rmcdaniel commentedon Nov 4, 2026
PHP mapping review of the draft at 6644270835: the proposed explicit White_Space edge set and Cc ranges match General's accepted boundary. Keeping interior ordinary space/NBSP and U+180E/U+FEFF outside this new prohibition avoids inventing a token alphabet or Unicode normalization. Dynamic Authentication remains separate; PHP has no typed static signature-key constructor setting to decode or reinterpret.
The direct TokenAuthentication/Client options are shared token, controlToken and workerToken. Literal-empty optional roles retain current fallback; all-absent/all-empty TokenAuthentication still has its existing required-token error, while Client's existing anonymous configuration remains available where it already applies. ServiceConfiguration preserves original credential strings but can discard the unused role when constructing a client. Laravel ProcessCredentialResolver also reads ambient/shared/client/worker values and explicit process-token handoff before selecting one role. Both therefore need validation of every supplied original credential before that selection, not just a TokenAuthentication fix. No generic static-header option is being silently reclassified.
Please freeze the agreed scalar/setting vector bytes and IDs independently of the later native startup implementation once General/Security review permits, so the three SDK constructor slices can consume one canonical artifact. The remaining PHP-specific question is invalid-UTF-8 static text: please classify it explicitly in the source-loader/vector contract rather than letting PCRE error handling create an unreviewed rule. Known scalar controls can be prepared now. I will retain valid opaque bytes/code points and preserve missing/empty/auth-mode rules. Owning PHP scope is sdk-php#307. This is source mapping only; no credential was read/generated/changed and no auth or runtime experiment was performed.
9 remaining items
rmcdaniel commentedon Nov 4, 2026
PHP source review of the replacement candidate 0314fd36430b86df49775f48e7fd53a79001ec62d0686409dd4e2f7ac9f09e6d, 53,692 bytes. I extracted only 6645295957, preserving its trailing newline; the withdrawn escape-mismatched candidate was not consumed.
The data checks pass: 303 unique case IDs, no duplicate JSON keys, all 286 common scalar verdicts consistent with General's exact sets (270 reject/16 preserve), all preserve hex values exact, all 25 White_Space scalars covered at prefix/suffix/alone, all 65 Cc scalars covered at prefix/middle/suffix, and all ten PHP byte rows invalid under strict UTF-8. The encoded test-key/decoded-binary boundary is internally consistent. This is fixture/reference-predicate review, not constructor execution, authentication, source adoption or Security clearance.
Two concrete PHP pre-selection coverage gaps need correction or explicit required consumer tests before this fixture is cited as full PHP loader qualification:
The three SDK pre-selection rows all supply shared + control + worker. That is useful for direct TokenAuthentication/Client, but PHP's ServiceConfiguration and Laravel ProcessCredentialResolver already refuse shared-plus-scoped mode. A generic mode exception can mask the missing credential validation and falsely pass a rejection-only test. Keep those direct-SDK cases, and add valid bridge-mode cases with shared omitted: selected control + valid control + worker from
edge-white-space-00A0-suffix, and selected worker + valid worker + control fromedge-white-space-00A0-prefix. The expected error must identify the malformed setting specifically; generic auth-mode/missing-role failure is not this proof. Supply valid unrelated bridge configuration so it reaches the intended boundary. Current shared/scoped guard.Malformed-byte rows are standalone, so they do not prove UTF-8 validation of an unused role before selection. Add an explicit PHP case, or a required cross-product rule, for valid selected control + unused worker from
php-byte-loader-isolated-ff, and the mirrored worker/control case, with shared absent. Exercise direct Client and TokenAuthentication plus the bridge loaders.language_mappings.php.pre_selection_loaderscurrently omits Client; please name that public constructor target as well. The Laravel process-token handoff also needs its own valid-role/malformed-process-token adapter control. This addresses General's 6645161843 decision rather than inferring invalid bytes from a PCRE mismatch.PHP fallback notes are consistent, with two consumer requirements. TokenAuthentication uses control→shared and worker→shared, skipping only documented empty optional values; explicit plane-order descriptors/positive fallback checks would make that testable as it is for Python. A
preservescalar result is not constructor success: all-empty TokenAuthentication still fails its required-token rule, while existing anonymous Client availability remains. Environment-backed tests must not silently truncate NUL while materializing input or count an OS/environment precondition error as SDK credential rejection; direct string constructors cover that scalar.Server owns the shared replacement bytes/IDs and freeze after normal review. sdk-php owns the resulting #307 constructor/bridge implementation and target-specific controls after the current source priorities. #300 remains frozen at 85c7fabe/base 5777680c/tree b06a67ba. No repository source, credential, runtime or package changed in this review.
rmcdaniel commentedon Nov 5, 2026
PHP adapter coverage successor for review 6645456644, based on the exact 0314fd36 candidate already reviewed by Security/Python/Rust. This is a new review candidate, not a freeze or adoption. Security's previous PASS remains scoped to its original bytes.
Proposed canonical path remains
tests/Fixtures/AuthConfiguration/static-credentials-v1.json. Exact JSON below, including its trailing newline: 60,716 UTF-8 bytes, SHA-2560d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb, 319 unique case IDs. All 303 original case rows, every common verdict/byte expectation, all Server settings/rows, and the Python/Rust mappings are unchanged. The PHP mapping now names publicClient, gives explicit control/shared and worker/shared fallback order, and preserves opposite-role refusal.The 16 new PHP adapter rows close the concrete review gaps:
Test inputs retain scalar integers and byte hex only as fixture representation. NUL is exercised through direct PHP strings; OS environment/setup rejection never counts as credential validation. I checked the exact four PHP source targets at accepted 5777680c, including the process-handoff environment and shared/scoped mode guard, without importing or invoking constructors.
sdk-php: please review these adapter rows/requirements against your two findings. Security: please review the delta for exact-row freeze. Python/Rust's original mappings and 303 rows are unchanged; no new implementation qualification is inferred. Server owns freezing only after that review in the assigned source slot and then returning immutable commit/path/hash. No credential read, HTTP, SDK constructor, container, runtime, package or release ran.
{ "schema": "durable-workflow.static-credential-configuration.v1", "domain": "original configured static textual credentials; valid Unicode scalar text for common rows", "white_space_code_points": ["U+0009","U+000A","U+000B","U+000C","U+000D","U+0020","U+0085","U+00A0","U+1680","U+2000","U+2001","U+2002","U+2003","U+2004","U+2005","U+2006","U+2007","U+2008","U+2009","U+200A","U+2028","U+2029","U+202F","U+205F","U+3000"], "control_Cc_ranges": ["U+0000..U+001F","U+007F..U+009F"], "common_scalar_cases": [ {"id":"scalar-ordinary","expected":"preserve","expected_utf8_hex":"666978747572652d746f6b656e","input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"scalar-interior-space","expected":"preserve","expected_utf8_hex":"6669787475726520746f6b656e","input_code_points":[102,105,120,116,117,114,101,32,116,111,107,101,110]}, {"id":"scalar-interior-nbsp","expected":"preserve","expected_utf8_hex":"66697874757265c2a0746f6b656e","input_code_points":[102,105,120,116,117,114,101,160,116,111,107,101,110]}, {"id":"scalar-upper-case","expected":"preserve","expected_utf8_hex":"464958545552452d544f4b454e","input_code_points":[70,73,88,84,85,82,69,45,84,79,75,69,78]}, {"id":"scalar-composed","expected":"preserve","expected_utf8_hex":"666978747572652dc3a9","input_code_points":[102,105,120,116,117,114,101,45,233]}, {"id":"scalar-decomposed","expected":"preserve","expected_utf8_hex":"666978747572652d65cc81","input_code_points":[102,105,120,116,117,114,101,45,101,769]}, {"id":"scalar-format-bom","expected":"preserve","expected_utf8_hex":"efbbbf66697874757265","input_code_points":[65279,102,105,120,116,117,114,101]}, {"id":"scalar-format-zero-width","expected":"preserve","expected_utf8_hex":"66697874757265e2808b","input_code_points":[102,105,120,116,117,114,101,8203]}, {"id":"scalar-format-lrm","expected":"preserve","expected_utf8_hex":"66697874757265e2808e","input_code_points":[102,105,120,116,117,114,101,8206]}, {"id":"scalar-mongolian-vowel-separator","expected":"preserve","expected_utf8_hex":"66697874757265e1a08e","input_code_points":[102,105,120,116,117,114,101,6158]}, {"id":"scalar-literal-empty","expected":"preserve","expected_utf8_hex":"","input_code_points":[]}, {"id":"edge-white-space-0009-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[9,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-0009-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,9]}, {"id":"edge-white-space-000A-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[10,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-000A-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,10]}, {"id":"edge-white-space-000B-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[11,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-000B-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,11]}, {"id":"edge-white-space-000C-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[12,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-000C-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,12]}, {"id":"edge-white-space-000D-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[13,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-000D-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,13]}, {"id":"edge-white-space-0020-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[32,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-0020-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,32]}, {"id":"edge-white-space-0085-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[133,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-0085-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,133]}, {"id":"edge-white-space-00A0-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[160,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-00A0-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,160]}, {"id":"edge-white-space-1680-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[5760,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-1680-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,5760]}, {"id":"edge-white-space-2000-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8192,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2000-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8192]}, {"id":"edge-white-space-2001-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8193,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2001-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8193]}, {"id":"edge-white-space-2002-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8194,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2002-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8194]}, {"id":"edge-white-space-2003-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8195,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2003-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8195]}, {"id":"edge-white-space-2004-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8196,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2004-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8196]}, {"id":"edge-white-space-2005-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8197,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2005-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8197]}, {"id":"edge-white-space-2006-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8198,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2006-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8198]}, {"id":"edge-white-space-2007-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8199,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2007-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8199]}, {"id":"edge-white-space-2008-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8200,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2008-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8200]}, {"id":"edge-white-space-2009-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8201,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2009-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8201]}, {"id":"edge-white-space-200A-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8202,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-200A-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8202]}, {"id":"edge-white-space-2028-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8232,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2028-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8232]}, {"id":"edge-white-space-2029-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8233,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-2029-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8233]}, {"id":"edge-white-space-202F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8239,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-202F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8239]}, {"id":"edge-white-space-205F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8287,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-205F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8287]}, {"id":"edge-white-space-3000-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[12288,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"edge-white-space-3000-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,12288]}, {"id":"control-Cc-0000-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[0,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0000-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,0,116,111,107,101,110]}, {"id":"control-Cc-0000-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,0]}, {"id":"control-Cc-0001-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[1,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0001-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,1,116,111,107,101,110]}, {"id":"control-Cc-0001-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,1]}, {"id":"control-Cc-0002-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[2,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0002-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,2,116,111,107,101,110]}, {"id":"control-Cc-0002-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,2]}, {"id":"control-Cc-0003-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[3,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0003-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,3,116,111,107,101,110]}, {"id":"control-Cc-0003-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,3]}, {"id":"control-Cc-0004-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[4,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0004-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,4,116,111,107,101,110]}, {"id":"control-Cc-0004-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,4]}, {"id":"control-Cc-0005-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[5,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0005-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,5,116,111,107,101,110]}, {"id":"control-Cc-0005-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,5]}, {"id":"control-Cc-0006-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[6,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0006-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,6,116,111,107,101,110]}, {"id":"control-Cc-0006-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,6]}, {"id":"control-Cc-0007-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[7,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0007-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,7,116,111,107,101,110]}, {"id":"control-Cc-0007-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,7]}, {"id":"control-Cc-0008-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0008-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,8,116,111,107,101,110]}, {"id":"control-Cc-0008-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,8]}, {"id":"control-Cc-0009-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[9,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0009-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,9,116,111,107,101,110]}, {"id":"control-Cc-0009-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,9]}, {"id":"control-Cc-000A-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[10,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-000A-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,10,116,111,107,101,110]}, {"id":"control-Cc-000A-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,10]}, {"id":"control-Cc-000B-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[11,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-000B-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,11,116,111,107,101,110]}, {"id":"control-Cc-000B-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,11]}, {"id":"control-Cc-000C-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[12,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-000C-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,12,116,111,107,101,110]}, {"id":"control-Cc-000C-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,12]}, {"id":"control-Cc-000D-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[13,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-000D-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,13,116,111,107,101,110]}, {"id":"control-Cc-000D-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,13]}, {"id":"control-Cc-000E-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[14,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-000E-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,14,116,111,107,101,110]}, {"id":"control-Cc-000E-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,14]}, {"id":"control-Cc-000F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[15,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-000F-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,15,116,111,107,101,110]}, {"id":"control-Cc-000F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,15]}, {"id":"control-Cc-0010-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[16,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0010-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,16,116,111,107,101,110]}, {"id":"control-Cc-0010-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,16]}, {"id":"control-Cc-0011-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[17,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0011-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,17,116,111,107,101,110]}, {"id":"control-Cc-0011-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,17]}, {"id":"control-Cc-0012-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[18,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0012-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,18,116,111,107,101,110]}, {"id":"control-Cc-0012-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,18]}, {"id":"control-Cc-0013-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[19,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0013-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,19,116,111,107,101,110]}, {"id":"control-Cc-0013-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,19]}, {"id":"control-Cc-0014-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[20,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0014-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,20,116,111,107,101,110]}, {"id":"control-Cc-0014-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,20]}, {"id":"control-Cc-0015-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[21,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0015-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,21,116,111,107,101,110]}, {"id":"control-Cc-0015-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,21]}, {"id":"control-Cc-0016-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[22,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0016-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,22,116,111,107,101,110]}, {"id":"control-Cc-0016-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,22]}, {"id":"control-Cc-0017-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[23,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0017-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,23,116,111,107,101,110]}, {"id":"control-Cc-0017-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,23]}, {"id":"control-Cc-0018-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[24,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0018-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,24,116,111,107,101,110]}, {"id":"control-Cc-0018-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,24]}, {"id":"control-Cc-0019-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[25,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0019-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,25,116,111,107,101,110]}, {"id":"control-Cc-0019-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,25]}, {"id":"control-Cc-001A-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[26,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-001A-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,26,116,111,107,101,110]}, {"id":"control-Cc-001A-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,26]}, {"id":"control-Cc-001B-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[27,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-001B-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,27,116,111,107,101,110]}, {"id":"control-Cc-001B-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,27]}, {"id":"control-Cc-001C-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[28,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-001C-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,28,116,111,107,101,110]}, {"id":"control-Cc-001C-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,28]}, {"id":"control-Cc-001D-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[29,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-001D-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,29,116,111,107,101,110]}, {"id":"control-Cc-001D-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,29]}, {"id":"control-Cc-001E-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[30,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-001E-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,30,116,111,107,101,110]}, {"id":"control-Cc-001E-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,30]}, {"id":"control-Cc-001F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[31,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-001F-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,31,116,111,107,101,110]}, {"id":"control-Cc-001F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,31]}, {"id":"control-Cc-007F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[127,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-007F-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,127,116,111,107,101,110]}, {"id":"control-Cc-007F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,127]}, {"id":"control-Cc-0080-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[128,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0080-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,128,116,111,107,101,110]}, {"id":"control-Cc-0080-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,128]}, {"id":"control-Cc-0081-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[129,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0081-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,129,116,111,107,101,110]}, {"id":"control-Cc-0081-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,129]}, {"id":"control-Cc-0082-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[130,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0082-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,130,116,111,107,101,110]}, {"id":"control-Cc-0082-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,130]}, {"id":"control-Cc-0083-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[131,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0083-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,131,116,111,107,101,110]}, {"id":"control-Cc-0083-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,131]}, {"id":"control-Cc-0084-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[132,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0084-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,132,116,111,107,101,110]}, {"id":"control-Cc-0084-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,132]}, {"id":"control-Cc-0085-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[133,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0085-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,133,116,111,107,101,110]}, {"id":"control-Cc-0085-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,133]}, {"id":"control-Cc-0086-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[134,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0086-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,134,116,111,107,101,110]}, {"id":"control-Cc-0086-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,134]}, {"id":"control-Cc-0087-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[135,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0087-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,135,116,111,107,101,110]}, {"id":"control-Cc-0087-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,135]}, {"id":"control-Cc-0088-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[136,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0088-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,136,116,111,107,101,110]}, {"id":"control-Cc-0088-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,136]}, {"id":"control-Cc-0089-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[137,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0089-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,137,116,111,107,101,110]}, {"id":"control-Cc-0089-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,137]}, {"id":"control-Cc-008A-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[138,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-008A-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,138,116,111,107,101,110]}, {"id":"control-Cc-008A-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,138]}, {"id":"control-Cc-008B-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[139,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-008B-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,139,116,111,107,101,110]}, {"id":"control-Cc-008B-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,139]}, {"id":"control-Cc-008C-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[140,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-008C-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,140,116,111,107,101,110]}, {"id":"control-Cc-008C-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,140]}, {"id":"control-Cc-008D-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[141,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-008D-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,141,116,111,107,101,110]}, {"id":"control-Cc-008D-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,141]}, {"id":"control-Cc-008E-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[142,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-008E-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,142,116,111,107,101,110]}, {"id":"control-Cc-008E-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,142]}, {"id":"control-Cc-008F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[143,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-008F-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,143,116,111,107,101,110]}, {"id":"control-Cc-008F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,143]}, {"id":"control-Cc-0090-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[144,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0090-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,144,116,111,107,101,110]}, {"id":"control-Cc-0090-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,144]}, {"id":"control-Cc-0091-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[145,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0091-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,145,116,111,107,101,110]}, {"id":"control-Cc-0091-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,145]}, {"id":"control-Cc-0092-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[146,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0092-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,146,116,111,107,101,110]}, {"id":"control-Cc-0092-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,146]}, {"id":"control-Cc-0093-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[147,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0093-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,147,116,111,107,101,110]}, {"id":"control-Cc-0093-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,147]}, {"id":"control-Cc-0094-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[148,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0094-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,148,116,111,107,101,110]}, {"id":"control-Cc-0094-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,148]}, {"id":"control-Cc-0095-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[149,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0095-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,149,116,111,107,101,110]}, {"id":"control-Cc-0095-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,149]}, {"id":"control-Cc-0096-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[150,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0096-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,150,116,111,107,101,110]}, {"id":"control-Cc-0096-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,150]}, {"id":"control-Cc-0097-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[151,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0097-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,151,116,111,107,101,110]}, {"id":"control-Cc-0097-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,151]}, {"id":"control-Cc-0098-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[152,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0098-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,152,116,111,107,101,110]}, {"id":"control-Cc-0098-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,152]}, {"id":"control-Cc-0099-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[153,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-0099-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,153,116,111,107,101,110]}, {"id":"control-Cc-0099-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,153]}, {"id":"control-Cc-009A-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[154,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-009A-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,154,116,111,107,101,110]}, {"id":"control-Cc-009A-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,154]}, {"id":"control-Cc-009B-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[155,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-009B-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,155,116,111,107,101,110]}, {"id":"control-Cc-009B-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,155]}, {"id":"control-Cc-009C-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[156,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-009C-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,156,116,111,107,101,110]}, {"id":"control-Cc-009C-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,156]}, {"id":"control-Cc-009D-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[157,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-009D-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,157,116,111,107,101,110]}, {"id":"control-Cc-009D-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,157]}, {"id":"control-Cc-009E-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[158,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-009E-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,158,116,111,107,101,110]}, {"id":"control-Cc-009E-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,158]}, {"id":"control-Cc-009F-prefix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[159,102,105,120,116,117,114,101,45,116,111,107,101,110]}, {"id":"control-Cc-009F-middle","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,159,116,111,107,101,110]}, {"id":"control-Cc-009F-suffix","expected":"reject","diagnostic_setting_only":true,"input_code_points":[102,105,120,116,117,114,101,45,116,111,107,101,110,159]}, {"id":"white-space-only-0009","expected":"reject","diagnostic_setting_only":true,"input_code_points":[9]}, {"id":"white-space-only-000A","expected":"reject","diagnostic_setting_only":true,"input_code_points":[10]}, {"id":"white-space-only-000B","expected":"reject","diagnostic_setting_only":true,"input_code_points":[11]}, {"id":"white-space-only-000C","expected":"reject","diagnostic_setting_only":true,"input_code_points":[12]}, {"id":"white-space-only-000D","expected":"reject","diagnostic_setting_only":true,"input_code_points":[13]}, {"id":"white-space-only-0020","expected":"reject","diagnostic_setting_only":true,"input_code_points":[32]}, {"id":"white-space-only-0085","expected":"reject","diagnostic_setting_only":true,"input_code_points":[133]}, {"id":"white-space-only-00A0","expected":"reject","diagnostic_setting_only":true,"input_code_points":[160]}, {"id":"white-space-only-1680","expected":"reject","diagnostic_setting_only":true,"input_code_points":[5760]}, {"id":"white-space-only-2000","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8192]}, {"id":"white-space-only-2001","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8193]}, {"id":"white-space-only-2002","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8194]}, {"id":"white-space-only-2003","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8195]}, {"id":"white-space-only-2004","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8196]}, {"id":"white-space-only-2005","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8197]}, {"id":"white-space-only-2006","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8198]}, {"id":"white-space-only-2007","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8199]}, {"id":"white-space-only-2008","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8200]}, {"id":"white-space-only-2009","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8201]}, {"id":"white-space-only-200A","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8202]}, {"id":"white-space-only-2028","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8232]}, {"id":"white-space-only-2029","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8233]}, {"id":"white-space-only-202F","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8239]}, {"id":"white-space-only-205F","expected":"reject","diagnostic_setting_only":true,"input_code_points":[8287]}, {"id":"white-space-only-3000","expected":"reject","diagnostic_setting_only":true,"input_code_points":[12288]}, {"id":"scalar-literal-zero","expected":"preserve","expected_utf8_hex":"30","input_code_points":[48]}, {"id":"scalar-literal-false","expected":"preserve","expected_utf8_hex":"66616c7365","input_code_points":[102,97,108,115,101]}, {"id":"scalar-literal-null","expected":"preserve","expected_utf8_hex":"6e756c6c","input_code_points":[110,117,108,108]}, {"id":"scalar-literal-empty-word","expected":"preserve","expected_utf8_hex":"656d707479","input_code_points":[101,109,112,116,121]}, {"id":"scalar-astral","expected":"preserve","expected_utf8_hex":"666978747572652df09f9982","input_code_points":[102,105,120,116,117,114,101,45,128578]} ], "php_byte_loader_cases": [ {"id":"php-byte-loader-isolated-ff","input_hex":"ff","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-stray-continuation","input_hex":"80","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-truncated-two-byte","input_hex":"c2","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-truncated-three-byte","input_hex":"e282","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-broken-continuation","input_hex":"e228a1","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-overlong","input_hex":"c0af","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-surrogate","input_hex":"eda080","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-above-unicode-max","input_hex":"f4908080","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-truncated-astral","input_hex":"f09f99","expected":"reject-invalid-utf8","diagnostic_setting_only":true}, {"id":"php-byte-loader-bad-four-byte-continuation","input_hex":"f0288cbc","expected":"reject-invalid-utf8","diagnostic_setting_only":true} ], "pre_selection_cases": [ {"id":"malformed-unused-worker","selected_plane":"control","expected":"reject","offending_option":"worker","options_code_points":{"shared":[102,105,120,116,117,114,101,45,115,104,97,114,101,100],"control":[102,105,120,116,117,114,101,45,99,111,110,116,114,111,108],"worker":[102,105,120,116,117,114,101,45,119,111,114,107,101,114,160]}}, {"id":"malformed-unused-control","selected_plane":"worker","expected":"reject","offending_option":"control","options_code_points":{"shared":[102,105,120,116,117,114,101,45,115,104,97,114,101,100],"control":[160,102,105,120,116,117,114,101,45,99,111,110,116,114,111,108],"worker":[102,105,120,116,117,114,101,45,119,111,114,107,101,114]}}, {"id":"malformed-masked-shared","selected_plane":"control","expected":"reject","offending_option":"shared","options_code_points":{"shared":[102,105,120,116,117,114,101,45,115,104,97,114,101,100,10],"control":[102,105,120,116,117,114,101,45,99,111,110,116,114,111,108],"worker":[102,105,120,116,117,114,101,45,119,111,114,107,101,114]}} ], "language_mappings": {"php":{"logical_setting_names":{"shared":"token","control":"controlToken","worker":"workerToken"},"omitted_or_null":"existing-absence","literal_empty_optional":"existing-fallback","all_empty_required_token_authentication":"existing-required-token-error","client_anonymous_configuration":"preserve-existing-availability","pre_selection_loaders":["Client","TokenAuthentication","ServiceConfiguration","ProcessCredentialResolver"],"control_plane_order":["control","shared"],"worker_plane_order":["worker","shared"],"opposite_only":"existing-role-refusal"},"python":{"logical_setting_names":{"shared":"token","control":"control_token","worker":"worker_token"},"omitted_or_null":"existing-absence","literal_empty_optional":"existing-absence","discovery_order":["worker","control","shared"],"worker_plane_order":["worker","shared"],"control_plane_order":["control","shared"],"opposite_only":"existing-role-refusal"},"rust":{"logical_setting_names":{"shared":"token","control":"control_token","worker":"worker_token"},"none":"existing-absence","some_literal_empty":"preserve-supplied-empty-and-fallback-precedence","opposite_only":"existing-role-refusal"}}, "binary_key_boundary": {"id":"decoded-entropy-is-not-token-text","configured_text":"base64:ACB/gJ//","decoded_bytes_hex":"00207f809fff","apply_text_guard_to_decoded_bytes":false,"production_encoding_change":false}, "diagnostics": {"identify_setting_only":true,"forbid_value_prefix_digest_or_encoded_content":true,"before_role_selection_and_io":true}, "exclusions": ["dynamic authentication","general static-header extensions","decoded binary key entropy","new token alphabet","case folding","Unicode normalization","trimming","production fixture-byte encoding"], "server_setting_mappings": {"bearer_text":[{"primary":"DW_AUTH_TOKEN","legacy":"WORKFLOW_SERVER_AUTH_TOKEN","optionality":"preserve-existing-auth-mode-and-role-rules"},{"primary":"DW_WORKER_TOKEN","legacy":"WORKFLOW_SERVER_WORKER_TOKEN","optionality":"preserve-existing-auth-mode-and-role-rules"},{"primary":"DW_OPERATOR_TOKEN","legacy":"WORKFLOW_SERVER_OPERATOR_TOKEN","optionality":"preserve-existing-auth-mode-and-role-rules"},{"primary":"DW_ADMIN_TOKEN","legacy":"WORKFLOW_SERVER_ADMIN_TOKEN","optionality":"preserve-existing-auth-mode-and-role-rules"}],"request_signature_text":[{"primary":"DW_SIGNATURE_KEY","legacy":"WORKFLOW_SERVER_SIGNATURE_KEY","representation":"text-used-directly-as-HMAC-key-by-existing-PHP","native_auth_mode":"preserve-existing-unsupported-driver"},{"primary":"DW_WORKER_SIGNATURE_KEY","legacy":"WORKFLOW_SERVER_WORKER_SIGNATURE_KEY","representation":"text-used-directly-as-HMAC-key-by-existing-PHP","native_auth_mode":"preserve-existing-unsupported-driver"},{"primary":"DW_OPERATOR_SIGNATURE_KEY","legacy":"WORKFLOW_SERVER_OPERATOR_SIGNATURE_KEY","representation":"text-used-directly-as-HMAC-key-by-existing-PHP","native_auth_mode":"preserve-existing-unsupported-driver"},{"primary":"DW_ADMIN_SIGNATURE_KEY","legacy":"WORKFLOW_SERVER_ADMIN_SIGNATURE_KEY","representation":"text-used-directly-as-HMAC-key-by-existing-PHP","native_auth_mode":"preserve-existing-unsupported-driver"}],"history_export_signing_text":{"primary":"DW_V2_HISTORY_EXPORT_SIGNING_KEY","legacy":"WORKFLOW_V2_HISTORY_EXPORT_SIGNING_KEY","representation":"text-used-directly-as-HMAC-key","empty_optional":"preserve-unsigned-behavior"},"application_and_page_key_text":{"settings":["DW_SERVER_KEY","APP_KEY"],"representation":"existing-configured-text-or-documented-encoded-text","validate_before_documented_binary_decode":true,"change_derivation_or_generation":false},"principal_token_container":{"primary":"DW_PRINCIPAL_TOKENS","legacy":"WORKFLOW_SERVER_PRINCIPAL_TOKENS","validate_token_members_after_existing_container_parse":true,"validate_container_formatting_as_token_text":false,"native_mode":"preserve-existing-refusal"},"source_loader_boundary":{"parse_documented_source_quoting":true,"trim_credential_text":false,"validate_all_supplied_primary_and_legacy_candidates":true,"validate_before_role_or_alias_selection":true,"preserve_existing_env_literal_and_required_setting_rules":true},"signing_key_id_metadata_is_secret_key_input":false}, "server_pre_selection_cases": [ {"id":"server-unused-role","selected_role":"control","expected":"reject","offending_setting":"DW_WORKER_TOKEN","options_code_points":{"DW_AUTH_TOKEN":[102,105,120,116,117,114,101,45,115,104,97,114,101,100],"DW_WORKER_TOKEN":[102,105,120,116,117,114,101,45,119,111,114,107,101,114,160]}}, {"id":"server-masked-legacy-alias","expected":"reject","offending_setting":"WORKFLOW_SERVER_AUTH_TOKEN","options_code_points":{"DW_AUTH_TOKEN":[102,105,120,116,117,114,101,45,115,104,97,114,101,100],"WORKFLOW_SERVER_AUTH_TOKEN":[102,105,120,116,117,114,101,45,111,108,100,10]}}, {"id":"server-invalid-quoted-credential-after-source-parse","expected":"reject","offending_setting":"DW_AUTH_TOKEN","configured_text_code_points":[32,102,105,120,116,117,114,101,45,115,104,97,114,101,100,32],"source_code_points":[34,32,102,105,120,116,117,114,101,45,115,104,97,114,101,100,32,34]} ], "common_input_representation": "Unicode scalar integers, materialized as original test text only; not a production encoding", "php_adapter_cases": [ {"id":"php-valid-scoped-mode-unused-worker-scalar","selected_plane":"control","omitted_options":["shared"],"options_case_refs":{"control":"scalar-ordinary","worker":"edge-white-space-00A0-suffix"},"targets":["Client","TokenAuthentication","ServiceConfiguration","ProcessCredentialResolver"],"expected":"reject-credential","offending_option":"worker","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-valid-scoped-mode-unused-worker-invalid-utf8","selected_plane":"control","omitted_options":["shared"],"options_case_refs":{"control":"scalar-ordinary","worker":"php-byte-loader-isolated-ff"},"targets":["Client","TokenAuthentication","ServiceConfiguration","ProcessCredentialResolver"],"expected":"reject-credential","offending_option":"worker","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-valid-scoped-mode-unused-control-scalar","selected_plane":"worker","omitted_options":["shared"],"options_case_refs":{"worker":"scalar-ordinary","control":"edge-white-space-00A0-prefix"},"targets":["Client","TokenAuthentication","ServiceConfiguration","ProcessCredentialResolver"],"expected":"reject-credential","offending_option":"control","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-valid-scoped-mode-unused-control-invalid-utf8","selected_plane":"worker","omitted_options":["shared"],"options_case_refs":{"worker":"scalar-ordinary","control":"php-byte-loader-isolated-ff"},"targets":["Client","TokenAuthentication","ServiceConfiguration","ProcessCredentialResolver"],"expected":"reject-credential","offending_option":"control","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-process-handoff-client-scalar","target":"ProcessCredentialResolver","omitted_environment":["DURABLE_WORKFLOW_TOKEN","DURABLE_WORKFLOW_CLIENT_TOKEN","DURABLE_WORKFLOW_WORKER_TOKEN"],"process_role":"client","process_token_case_ref":"edge-white-space-00A0-suffix","expected":"reject-credential","offending_setting":"DURABLE_WORKFLOW_PROCESS_TOKEN","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-process-handoff-client-invalid-utf8","target":"ProcessCredentialResolver","omitted_environment":["DURABLE_WORKFLOW_TOKEN","DURABLE_WORKFLOW_CLIENT_TOKEN","DURABLE_WORKFLOW_WORKER_TOKEN"],"process_role":"client","process_token_case_ref":"php-byte-loader-isolated-ff","expected":"reject-credential","offending_setting":"DURABLE_WORKFLOW_PROCESS_TOKEN","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-process-handoff-worker-scalar","target":"ProcessCredentialResolver","omitted_environment":["DURABLE_WORKFLOW_TOKEN","DURABLE_WORKFLOW_CLIENT_TOKEN","DURABLE_WORKFLOW_WORKER_TOKEN"],"process_role":"worker","process_token_case_ref":"edge-white-space-00A0-suffix","expected":"reject-credential","offending_setting":"DURABLE_WORKFLOW_PROCESS_TOKEN","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-process-handoff-worker-invalid-utf8","target":"ProcessCredentialResolver","omitted_environment":["DURABLE_WORKFLOW_TOKEN","DURABLE_WORKFLOW_CLIENT_TOKEN","DURABLE_WORKFLOW_WORKER_TOKEN"],"process_role":"worker","process_token_case_ref":"php-byte-loader-isolated-ff","expected":"reject-credential","offending_setting":"DURABLE_WORKFLOW_PROCESS_TOKEN","diagnostic_setting_only":true,"generic_mode_or_missing_role_error_is_not_success":true}, {"id":"php-control-scoped-before-shared","targets":["Client","TokenAuthentication"],"selected_plane":"control","options_case_refs":{"shared":"scalar-upper-case","control":"scalar-ordinary"},"expected":"preserve-selected-text","selected_option":"control","expected_case_ref":"scalar-ordinary"}, {"id":"php-control-null-falls-back-to-shared","targets":["Client","TokenAuthentication"],"selected_plane":"control","options_case_refs":{"shared":"scalar-upper-case"},"null_options":["control"],"expected":"preserve-selected-text","selected_option":"shared","expected_case_ref":"scalar-upper-case"}, {"id":"php-control-literal-empty-falls-back-to-shared","targets":["Client","TokenAuthentication"],"selected_plane":"control","options_case_refs":{"shared":"scalar-upper-case"},"empty_options":["control"],"expected":"preserve-selected-text","selected_option":"shared","expected_case_ref":"scalar-upper-case"}, {"id":"php-control-opposite-only-refuses","targets":["Client","TokenAuthentication"],"selected_plane":"control","options_case_refs":{"worker":"scalar-ordinary"},"expected":"existing-role-refusal-before-request"}, {"id":"php-worker-scoped-before-shared","targets":["Client","TokenAuthentication"],"selected_plane":"worker","options_case_refs":{"shared":"scalar-upper-case","worker":"scalar-ordinary"},"expected":"preserve-selected-text","selected_option":"worker","expected_case_ref":"scalar-ordinary"}, {"id":"php-worker-null-falls-back-to-shared","targets":["Client","TokenAuthentication"],"selected_plane":"worker","options_case_refs":{"shared":"scalar-upper-case"},"null_options":["worker"],"expected":"preserve-selected-text","selected_option":"shared","expected_case_ref":"scalar-upper-case"}, {"id":"php-worker-literal-empty-falls-back-to-shared","targets":["Client","TokenAuthentication"],"selected_plane":"worker","options_case_refs":{"shared":"scalar-upper-case"},"empty_options":["worker"],"expected":"preserve-selected-text","selected_option":"shared","expected_case_ref":"scalar-upper-case"}, {"id":"php-worker-opposite-only-refuses","targets":["Client","TokenAuthentication"],"selected_plane":"worker","options_case_refs":{"control":"scalar-ordinary"},"expected":"existing-role-refusal-before-request"} ], "php_adapter_requirements": {"unrelated_configuration":"valid endpoint, namespace, queue, handlers and bridge settings; no unrelated validation refusal counts","shared_plus_scoped_rows":"the original three SDK pre-selection rows target direct Client/TokenAuthentication, not the bridge mode guard","ProcessCredentialResolver_option_environment":{"shared":"DURABLE_WORKFLOW_TOKEN","control":"DURABLE_WORKFLOW_CLIENT_TOKEN","worker":"DURABLE_WORKFLOW_WORKER_TOKEN"},"materialization":"case refs are materialized into original PHP strings before invocation; hex rows are decoded test input only","environment_limit":"NUL cannot be represented in OS environment values; direct string constructors cover NUL; environment/setup failures are never credential rejection","request_or_transport":"spy only, no HTTP/authentication or real credential; reject before role selection and I/O","positive_selection":"compare exact selected fixture UTF-8 only; no authentication or arbitrary-Unicode HTTP-header success claim"} }rmcdaniel commentedon Nov 5, 2026
PHP adapter-delta source review: PASS for the reviewed fixture requirements, at candidate 6645753667, exact 60,716 UTF-8 bytes / 319 unique case IDs / SHA-256 0d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb. This closes my two consumer-coverage findings in 6645456644.
I independently extracted the JSON with its trailing newline, checked exact bytes/hash and duplicate object keys, and compared every original field. All 303 original case rows, Server settings, common scalar/byte expectations and Python/Rust mappings remain unchanged. Only PHP mapping additions and the 16 adapter rows/requirements differ. All references resolve and all case IDs are unique. The existing 286 scalar verdicts, ten malformed-UTF-8 byte cases and decoded-entropy exclusion also reconcile.
The four unused-role rows now omit shared and exercise valid scoped bridge mode in both directions, with Unicode-edge and invalid-UTF-8 inputs. They name Client, TokenAuthentication, ServiceConfiguration and ProcessCredentialResolver, and require the offending credential option rather than a generic mode/role/configuration error. Four process-handoff rows use valid client/worker roles with absent ambient tokens and require DURABLE_WORKFLOW_PROCESS_TOKEN diagnostics. Eight positive controls preserve scoped-before-shared, null/literal-empty fallback and opposite-role refusal for both direct planes. The explicit PHP fallback order, anonymous Client versus required TokenAuthentication distinction, NUL direct-string coverage and spy-only selected-byte checks match the inspected source boundary. ServiceConfiguration and ProcessCredentialResolver credential paths are unchanged between the reviewed 5777680c base and accepted main f4bd2809.
This is fixture/source review, not implementation qualification or a freeze. No constructor, environment credential loader, HTTP/authentication, container, Server or credential operation was executed for this review. Server owns returning the reviewed immutable fixture commit/path/hash after Security's renewed exact-byte review. sdk-php owns #307's narrow implementation and fail-before/pass-after adapter controls after the current ordered source integrations; no unfrozen bytes are adopted and frozen package/runtime/release gates remain.
rmcdaniel commentedon Nov 5, 2026
Security exact-byte review of the PHP adapter successor in 6645753667: PASS for exact-row freeze/source adoption.
I independently extracted the fenced JSON including its trailing newline and matched 60,716 UTF-8 bytes, SHA-256
0d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb, and 319 unique case IDs. Duplicate JSON object keys are absent and every adapter case reference resolves. The withdrawn escape-mismatched predecessor remains excluded.Structural comparison against the previously accepted
0314fd36430b86df49775f48e7fd53a79001ec62d0686409dd4e2f7ac9f09e6dcandidate proves that all 303 prior case rows, every Server setting/vector, all common scalar and invalid-byte expectations, the decoded-entropy boundary, and the Python/Rust mappings are byte-semantically unchanged. Removing the two new PHP adapter sections and restoring only the expanded PHP mapping produces the prior JSON exactly. The delta is the reviewed PHP mapping plus 16 adapter rows and their explicit requirements.The added requirements close the consumer-coverage boundary without weakening the shared policy:
Client,TokenAuthentication,ServiceConfiguration, andProcessCredentialResolver; both a Unicode edge and isolated invalid UTF-8 are covered in each direction, and a generic mode/role/configuration refusal does not count;client/workerroles, and require a setting-onlyDURABLE_WORKFLOW_PROCESS_TOKENcredential refusal for Unicode-edge and invalid-byte inputs;The explicit PHP fallback orders and anonymous
Clientversus requiredTokenAuthenticationdistinction match the reviewed source boundary. The added rows still require validation of all originally supplied static credential text before role selection/fallback or I/O, preserve admitted bytes without trim/normalization/case folding, and restrict diagnostics to the option/setting name.Server may freeze these exact bytes/319 IDs at
tests/Fixtures/AuthConfiguration/static-credentials-v1.jsonand return the immutable commit/path/hash. This is fixture/source review only. It does not qualify any constructor, environment loader, process handoff, HTTP/authentication behavior, credential, Server/runtime, package, or release. Server and SDK implementations still require their own fail-before/pass-after controls, exact-source review, and ordinary qualification; no earlier frozen package or release gate is transferred.rmcdaniel commentedon Nov 5, 2026
The approved fixture is now preserved as immutable source in draft #1032, recovered without rewriting commit
23972b1d12fcaa64788480eda0a31de7a5347422(tree38e663a224d8898704cac6358cb21d85db72620f, parent accepted mainea993064428fa9e0294520aa3efd498bef5b64dc).Canonical path:
tests/Fixtures/AuthConfiguration/static-credentials-v1.json.It exactly matches the reviewed candidate, including trailing newline: 60,716 UTF-8 bytes, 319 unique case IDs, SHA-256
0d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb. This is the byte sequence approved by Security 6646233914 and PHP adapter review 6646140186; the withdrawn predecessor is excluded.Independent replacement-session checks pass: exact GitHub-source comparison, duplicate-object-key rejection, all 319 IDs unique, all 286 common verdicts (16 exact UTF-8 preserves and 270 refusals), ten malformed-UTF-8 negatives, all 16 PHP adapter references, and decoded-entropy exclusion. The literal-empty common row is preserved under each language's documented absence/fallback rules. Public-boundary and whitespace checks pass. No constructor, environment loader, HTTP/authentication or real credential was exercised.
Server owns fixture integration and its subsequent narrow Server implementation. SDK-PHP #307 and Python/Rust owners retain their implementation and fail-before/pass-after controls using these immutable bytes, subject to their existing source order. General owns normal fixture integration; fresh ordinary PR checks remain required. #554 stays open for implementation, documentation and consumer acceptance. The draft was opened after #1024's seven first-attempt workflows became terminal success, preserving its qualification order. No frozen package/runtime/release authority transfers.
rmcdaniel commentedon Nov 5, 2026
Rust source implementation is now actionable from the frozen fixture in #1032, immutable
23972b1d12fcaa64788480eda0a31de7a5347422/tests/Fixtures/AuthConfiguration/static-credentials-v1.json. I downloaded and matched its 60,716 bytes and SHA-2560d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb. This resolves the fixture dependency in my Rust mapping.Owner sdk-rust is implementing a separate narrow branch from current accepted main
1ea3bfc3, following General's fail-closed source decision.ClientBuilder::buildwill validate all suppliedtoken,control_tokenandworker_tokentext before construction/fallback, using the explicit frozen White_Space-edge and Cc-anywhere sets, without trimming or changing admitted bytes.None, suppliedSome(""), role precedence and opposite-only refusal remain as mapped. A configuration error will contain the option name only, with no credential value/prefix/digest.The focused controls will consume the unchanged canonical rows, prove malformed unused/masked values refuse, and preserve exact allowed text plus Rust absence/empty behavior. These are synthetic constructor/source checks, with no HTTP/authentication or real credential. The implementation remains outside immutable 4.12.0, with no tag/package/runtime change. Existing #191/#192 consumer execution stays held. Next deliverable is the isolated Rust draft and actual fail-before/pass-after source qualification; Security/ordinary review and later published acceptance remain separate.
rmcdaniel commentedon Nov 5, 2026
Rust source integration is complete through sdk-rust#211 at main 46cf36514f7a39e819213771abf9efc82321c062, exact reviewed tree 21d3e6206fefffbba4b9370e666a88050e1a80d8. The frozen Server319 fixture remains byte-identical; Security source PASS and actual constructor fail-before/pass-after are recorded on the PR. Terminal actual-main and automatic stable-docs follow-through: durable-workflow/sdk-rust#211 (comment) . The public package remains 4.12.0, so the new constructor validation is integrated source awaiting the owning future release decision. No authentication/HTTP, installed consumer, package/tag publication or cross-SDK completion is claimed.
rmcdaniel commentedon Nov 5, 2026
The canonical source fixture is now accepted on maintained main
c9a75838f0d70fd5237f4cbcf70f9f046f1e5d42through #1032. Actual-main acceptance/cleanup receipt includes exact tree/parents, terminal queue/main checks and exact-source analysis gates.Canonical file:
tests/Fixtures/AuthConfiguration/static-credentials-v1.json, 60,716 bytes / 319 unique IDs / SHA-2560d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb. Its bytes are identical to the original Security-approved/recovered23972b1dsource, so existing exact consumer references retain their identity. The obsolete merged fixture source/recovery branches were safely removed; the immutable commit is retained by accepted main.Server and PHP/Python/Rust owners retain their separate startup/constructor/loader implementations, setting-only diagnostics and fail-before/pass-after controls in the existing source order. Docs follows the reviewed actual behavior for Secrets/newline troubleshooting. #554 stays open: this fixture acceptance does not establish any constructor, loader, process handoff, HTTP/authentication, credential, native runtime, installed package or release result.
rmcdaniel commentedon Nov 5, 2026
Tracking correction: #1032 is fixture-only, but its negated prose contained a GitHub closing-keyword reference. GitHub interpreted that reference as a completion link when the fixture merged at
c9a75838, closing this issue at 03:01 UTC. I corrected the PR prose, independently verified that itsclosingIssuesReferencesis now empty, and reopened #554. My earlier canonical-main handoff correctly described the intended open scope but missed this actual state change.Next owners and actions remain Server for startup/loader validation plus setting-only diagnostics and source controls, each SDK owner for constructor adoption and its own fail-before/pass-after evidence, and Docs for the actual accepted Secrets/newline troubleshooting behavior. Rust's integrated source receipt is recorded above; PHP/Python source and later package results remain their separate records. The 319-case fixture is accepted, with no fixture change or constructor/runtime/release acceptance implied by this bookkeeping correction.
rmcdaniel commentedon Nov 11, 2026
Triage 2026-11-11: raised to P2. A trailing newline from a Kubernetes Secret gives silent 401s; native rejects only an empty token (main.rs). Next: boot-time check that names the setting. Owner: server; SDK constructors in sdk-php/sdk-python.