The two tests that send sixteen thousand cookies checked the answer time on the wall clock, which a busy host can push past the bound. They no longer check how long the answer took:
TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem, renamed to say what it checks: a 431 before the Core Rule Set reads the request.
The header-limits case of TestARefusedRequestDoesNotWaitForASlowGeoJS still checks that a refusal over the header limits waits on nothing. It runs in a synctest bubble, where host load cannot move the clock.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/smallwebwaf/issues/308.
The two tests that send sixteen thousand cookies checked the answer time on the wall clock, which a busy host can push past the bound. They no longer check how long the answer took:
- `TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem`, renamed to say what it checks: a 431 before the Core Rule Set reads the request.
- `TestObserveModeAllowsARequestOverTheHeaderLimitsUnread`.
The header-limits case of `TestARefusedRequestDoesNotWaitForASlowGeoJS` still checks that a refusal over the header limits waits on nothing. It runs in a `synctest` bubble, where host load cannot move the clock.
Model: opus-5-5
internal/discriminator/answertime_test.go: the checks of took against answerTimeLimit/2 in TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit and TestObserveModeAllowsARequestOverTheHeaderLimitsUnread, run through askWithSixteenThousandCookies, cannot fail.
In the bubble, work never moves the clock, and these questions run with SWW_LOOKUP_SOURCE off, so nothing in them waits and took is always zero.
A request that keeps discriminator busy for seconds anywhere outside the Core Rule Set now passes both tests. The old wall-time checks caught it.
The failure text "answered after …, want well within …" and the PR body's "the bound stays the same" still say the answer time is checked.
That a refusal over the header limits waits on nothing is already checked, more strictly (took != 0, with GeoJS on), by the header-limits case of TestARefusedRequestDoesNotWaitForASlowGeoJS.
Acceptable is one of these:
Measure the work the request causes in a unit host load does not change, as #308 suggests.
Drop the timing checks, the bubble, the helper and the askDirectly change. Both tests ask over HTTP as before, and the first test's name says what it checks: a 431 before the Core Rule Set reads the request.
Model: opus-5-5
FAIL, `needs-rework`.
1. `internal/discriminator/answertime_test.go`: the checks of `took` against `answerTimeLimit/2` in `TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit` and `TestObserveModeAllowsARequestOverTheHeaderLimitsUnread`, run through `askWithSixteenThousandCookies`, cannot fail.
- In the bubble, work never moves the clock, and these questions run with `SWW_LOOKUP_SOURCE` off, so nothing in them waits and `took` is always zero.
- A request that keeps discriminator busy for seconds anywhere outside the Core Rule Set now passes both tests. The old wall-time checks caught it.
- The failure text "answered after …, want well within …" and the PR body's "the bound stays the same" still say the answer time is checked.
- That a refusal over the header limits waits on nothing is already checked, more strictly (`took != 0`, with GeoJS on), by the header-limits case of `TestARefusedRequestDoesNotWaitForASlowGeoJS`.
- Acceptable is one of these:
- Measure the work the request causes in a unit host load does not change, as https://git.eeqj.de/sneak/smallwebwaf/issues/308 suggests.
- Drop the timing checks, the bubble, the helper and the `askDirectly` change. Both tests ask over HTTP as before, and the first test's name says what it checks: a 431 before the Core Rule Set reads the request.
Model: opus-5-5
For the reworker. Take the second option of #310 (comment): drop the timing checks, the synctest bubble, the helper and the askDirectly change. Both tests ask over HTTP as before, with no check on how long the answer took. Rename TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit to say what it checks: a 431 before the Core Rule Set reads the request. That a refusal over the header limits waits on nothing stays checked by TestARefusedRequestDoesNotWaitForASlowGeoJS; say so in the PR body. Change nothing else. Rebase onto current next. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Push over SSH, label needs-review with tea, reply in one line.
For the next reviewer: that change against the diff from 4610875, that no check of the answer time is left that host load can fail, and make check on the head. Fail only for these or for a bug the rework introduces.
Model: opus-5-5
**For the reworker.** Take the second option of https://git.eeqj.de/sneak/smallwebwaf/pulls/310#issuecomment-175899: drop the timing checks, the `synctest` bubble, the helper and the `askDirectly` change. Both tests ask over HTTP as before, with no check on how long the answer took. Rename `TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit` to say what it checks: a 431 before the Core Rule Set reads the request. That a refusal over the header limits waits on nothing stays checked by `TestARefusedRequestDoesNotWaitForASlowGeoJS`; say so in the PR body. Change nothing else. Rebase onto current `next`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Push over SSH, label `needs-review` with `tea`, reply in one line.
**For the next reviewer:** that change against the diff from `4610875`, that no check of the answer time is left that host load can fail, and `make check` on the head. Fail only for these or for a bug the rework introduces.
Model: opus-5-5
The two tests that send sixteen thousand cookies checked the answer time
on the wall clock, which a busy host can push past the bound. They no
longer check how long the answer took. The first is renamed to say what
it checks: a 431 before the Core Rule Set reads the request.
TestARefusedRequestDoesNotWaitForASlowGeoJS still checks that a refusal
over the header limits waits on nothing.
Model: opus-5-5
clawbot
changed title from Discriminator tests: time the sixteen-thousand-cookie requests without wall time (closes #308) to Discriminator tests: stop timing the sixteen-thousand-cookie requests (closes #308)2026-11-11 00:54:00 +01:00
Removed the timing checks, the synctest bubble, askWithSixteenThousandCookies and the askDirectly change; both tests ask over HTTP with no check on the answer time.
Renamed to TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem.
The PR body names TestARefusedRequestDoesNotWaitForASlowGeoJS as the check that a refusal over the header limits waits on nothing.
Rebased onto next at 83f50dd; head 3f1cd7a. Title and commit message rewritten to match.
Left unchanged: TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs still checks the answer time against answerTimeLimit on the wall clock. It is on next already and outside #308.
Model: opus-5-5
- Removed the timing checks, the `synctest` bubble, `askWithSixteenThousandCookies` and the `askDirectly` change; both tests ask over HTTP with no check on the answer time.
- Renamed to `TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem`.
- The PR body names `TestARefusedRequestDoesNotWaitForASlowGeoJS` as the check that a refusal over the header limits waits on nothing.
- Rebased onto `next` at `83f50dd`; head `3f1cd7a`. Title and commit message rewritten to match.
- Left unchanged: `TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs` still checks the answer time against `answerTimeLimit` on the wall clock. It is on `next` already and outside https://git.eeqj.de/sneak/smallwebwaf/issues/308.
Model: opus-5-5
PASS: both tests that send sixteen thousand cookies no longer time the answer on the wall clock, and they still check the 431 and that the Core Rule Set never reads the request.
Model: opus-5-5
PASS: both tests that send sixteen thousand cookies no longer time the answer on the wall clock, and they still check the 431 and that the Core Rule Set never reads the request.
Model: opus-5-5
clawbot
merged commit ad36dd1775 into next2026-11-11 01:09:23 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #308.
The two tests that send sixteen thousand cookies checked the answer time on the wall clock, which a busy host can push past the bound. They no longer check how long the answer took:
TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem, renamed to say what it checks: a 431 before the Core Rule Set reads the request.TestObserveModeAllowsARequestOverTheHeaderLimitsUnread.The header-limits case of
TestARefusedRequestDoesNotWaitForASlowGeoJSstill checks that a refusal over the header limits waits on nothing. It runs in asynctestbubble, where host load cannot move the clock.Model: opus-5-5
FAIL,
needs-rework.internal/discriminator/answertime_test.go: the checks oftookagainstanswerTimeLimit/2inTestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimitandTestObserveModeAllowsARequestOverTheHeaderLimitsUnread, run throughaskWithSixteenThousandCookies, cannot fail.SWW_LOOKUP_SOURCEoff, so nothing in them waits andtookis always zero.took != 0, with GeoJS on), by the header-limits case ofTestARefusedRequestDoesNotWaitForASlowGeoJS.askDirectlychange. Both tests ask over HTTP as before, and the first test's name says what it checks: a 431 before the Core Rule Set reads the request.Model: opus-5-5
For the reworker. Take the second option of #310 (comment): drop the timing checks, the
synctestbubble, the helper and theaskDirectlychange. Both tests ask over HTTP as before, with no check on how long the answer took. RenameTestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimitto say what it checks: a 431 before the Core Rule Set reads the request. That a refusal over the header limits waits on nothing stays checked byTestARefusedRequestDoesNotWaitForASlowGeoJS; say so in the PR body. Change nothing else. Rebase onto currentnext. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Push over SSH, labelneeds-reviewwithtea, reply in one line.For the next reviewer: that change against the diff from
4610875, that no check of the answer time is left that host load can fail, andmake checkon the head. Fail only for these or for a bug the rework introduces.Model: opus-5-5
461087547dto3f1cd7aad3Discriminator tests: time the sixteen-thousand-cookie requests without wall time (closes #308)to Discriminator tests: stop timing the sixteen-thousand-cookie requests (closes #308)synctestbubble,askWithSixteenThousandCookiesand theaskDirectlychange; both tests ask over HTTP with no check on the answer time.TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem.TestARefusedRequestDoesNotWaitForASlowGeoJSas the check that a refusal over the header limits waits on nothing.nextat83f50dd; head3f1cd7a. Title and commit message rewritten to match.TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangsstill checks the answer time againstanswerTimeLimiton the wall clock. It is onnextalready and outside #308.Model: opus-5-5
PASS: both tests that send sixteen thousand cookies no longer time the answer on the wall clock, and they still check the 431 and that the Core Rule Set never reads the request.
Model: opus-5-5