docs(entitlements): document the digest the billing service actually computes - #100
Open
pythonlearner1025 wants to merge 1 commit into
Open
docs(entitlements): document the digest the billing service actually computes#100pythonlearner1025 wants to merge 1 commit into
pythonlearner1025 wants to merge 1 commit into
Conversation
…computes The README recipe and the only code that verifies corpus.sha256 were two different algorithms over two different file sets, and each was self- consistent, so neither looked wrong. The recipe hashed the .json fixtures with no separator between the parts. The billing service's test/billing.test.ts hashes EVERY file in the directory except corpus.sha256 -- README.md included -- as name\0bytes, joined by \0. The billing test is the only reader, so its algorithm is the definition and the recipe was the thing that was wrong. The recipe is now a transcription of that test, and says so, including that nothing in this repository verifies the file. Including README.md is what lets both copies hold the same digest when they are byte-identical, which is what the billing test claims to check. corpus.sha256 is regenerated under the documented algorithm: ca619ff2ba7597717cfb235effa5014e280e96f020c2bec064eb5a5a1b8fdca6 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J6fUBY1B27EzvDwbhfBf52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The README recipe and the only code that verifies
corpus.sha256were two different algorithms over two different file sets. Each was self-consistent, so neither looked wrong.blitzos-billingtest/billing.test.ts*.jsononlycorpus.sha256, soREADME.mdtoo\0between every partname₁‖bytes₁‖name₂‖…name₁‖NUL‖bytes₁‖NUL‖name₂‖…Both reproduced their own repository's checked-in value, which is exactly why the drift was invisible.
Which one is right
The billing test is the only thing that reads this file — nothing in this repository verifies it. So its algorithm is the definition, and the recipe was the part that was wrong. The README now carries a transcription of that test and says outright that it is one, so the next person knows which side to fix if they disagree.
Why README.md belongs in the digest
Because it makes the check mean what it claims. The billing test is titled "keeps the copied entitlement fixtures byte-identical to core", and the copy includes the README. With every file in the digest, two byte-identical directories hold the same value — so the digest is now a cross-repository identity, not a per-repository self-check.
corpus.sha256is regenerated under the documented algorithm:blitzdotdev/blitzos-billing#4syncs the copies so its digest lands on the same value.Verification
The recipe in the README reproduces the checked-in file.
test/entitlements-fixtures.test.tspasses (16), and the.jsonfixtures themselves are untouched here — onlyREADME.mdandcorpus.sha256change.Still open: nothing in this repository verifies
corpus.sha256, which is why it drifted in the first place. That gap is unchanged by this PR.🤖 Generated with Claude Code
https://claude.ai/code/session_01J6fUBY1B27EzvDwbhfBf52