fix(webconsole): three PHI routes now charge the per-actor read budget (BACKLOG #1025) - #247
Open
wshallwshall wants to merge 2 commits into
Open
fix(webconsole): three PHI routes now charge the per-actor read budget (BACKLOG #1025)#247wshallwshall wants to merge 2 commits into
wshallwshall wants to merge 2 commits into
Conversation
…KLOG #1025)
`GET /ui/messages/search` and `GET /ui/messages/search/layered` reach the reused
engine handlers (`search_messages` / `layered_search`) only on their criteria/preset
path; those handlers already charge the per-actor PHI-read budget in their own body
(`enforce_phi_read_pacing`). The only genuinely-unpaced path was each route's
SHORT-CIRCUIT render -- the bare-form and no-preset re-renders that return before the
handler runs -- which on first deployment would skip the read budget entirely.
A gate-level `phi=` on `require_ui_step_up` (the filing's proposed fix) is wrong for
these mixed routes: a FastAPI dependency runs on EVERY request, so it would charge the
criteria/preset path a SECOND time on top of the handler -- the exact double-count that
already excludes the uploaded-logs route. Instead each search route now charges
`enforce_phi_read_pacing` INLINE on its short-circuit branch only, so the render spends
one token while a real search still charges exactly once. `GET /ui/uploaded-logs/file/{file_id}`
keeps no console-side charge: its handler paces every call and it has no short-circuit,
so any second charge would double-count (its scope-guard test is added here).
Scope note: the filing named three routes and a `phi=` on all three; verified against
the code, only the two search renders were the real gap and the naive `phi=` would have
double-charged. Two routes changed, uploaded-logs deliberately unchanged.
Tests: two short-circuit tests (bare-form / no-preset -> 429 when over budget), two
double-charge guards (a criteria search and a preset-bearing layered run each stay 200
at a tight budget -- they red if a gate-level `phi=` is reintroduced), and the
uploaded-logs scope guard. Each falsified by mutation (remove the inline charge -> the
short-circuit test reds; reintroduce gate `phi=` -> the criteria guards red).
Docs: the `require_ui_step_up` docstring, `docs/SECURITY.md` and the webconsole CHANGELOG
now describe the inline-charge mechanism. The edit pair (BACKLOG #324) still uses gate
`phi=` because `get_message` does not self-pace on a direct console call.
NOT-DEPLOYED beta: written in the conditional ("would skip the budget on first
deployment"), not a live exposure.
Flip the #1025 banner from filed to shipped and correct its mechanism note from the gate-level `phi=` the earlier draft described to the inline short-circuit charge that actually shipped (a gate `phi=` would have double-charged the criteria path). Banner line only. The census distribution lines were NOT recomputed; this commit touches only the #1025 banner. The item's Severity/Mechanism body paragraphs still describe the pre-amendment three-route premise and need a follow-up reconciliation not bound by the banner-only rule (flagged for the owner).
wshallwshall
enabled auto-merge (squash)
August 6, 2026 14:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes BACKLOG #1025. webconsole; the #324 seam.
Three PHI console routes served payload data without charging the per-actor read budget, so the
budget under-counted exactly the accesses it exists to bound. All three now pass phi=True.
Verified in-lane: plan -> build -> 3-lens adversarial verify -> remediate. Banner gate OK.