feat(sdk): graduate the chunked writer to stable API by dmihalcik-virtru · Pull Request #3949 · opentdf/platform

dmihalcik-virtru · 2026-09-01T02:57:42Z

Part 20 of 20 in the DSPX-2604 re-cut. Base branch: dspx-2604-19-drop-encrypt-spool.

This stack replaces #3782 / #3865 / #3921, which stay open and untouched
until it lands. Nothing here is a rebase of those branches — the work was
re-cut from the ticket so each PR stands on its own.

Proposed Changes

The chunked writer has been the sole implementation of TDF construction since
CreateTDF was rewritten on top of it. Every TDF the SDK produces already goes
through this code; the "Experimental: not part of the stable SDK API; may
change or be removed" markers on it stopped being true at that point. Drop
them, and give the writer the constructor it was missing.

SDK.NewChunkedWriter resolves key access against the platform the SDK is
connected to, running attributes through the same autoconfigure path
CreateTDF uses. Until now a chunked caller who wanted multi-KAS attribute
grants had to implement a KeySplitter to get them, reimplementing
autoconfigure by hand; DefaultKeySplitter is single-KAS and attribute-blind.
The TDFOptions that shape key access -- WithDataAttributes,
WithKasInformation, WithWrappingKeyAlg -- go in through
WithChunkedTDFOptions.

Resolution happens at Finalize, not at construction. That is the difference
from CreateTDF and the reason this is a distinct resolver rather than a shared
one: a chunked caller may still be adding attributes while segments are in
flight, so the attribute set is not known until Finalize is called. The cost
is that an unreachable KAS surfaces at Finalize, after segments have already
been handed back. Passing WithChunkedKeySplitter opts out entirely and the
given splitter is used as-is -- the config tracks whether the option was
supplied so that "left at the default" and "deliberately overridden" are
distinguishable.

The test seams -- archiveFactory, cipherFactory, clock -- stay unexported.
archiveFactory returns a zipstream.SegmentWriter, and zipstream lives under
internal/, so there is no form of these that could be exported and supported.
Graduating the package does not graduate them.

sdk/experimental/tdf is deprecated at the package level rather than deleted.
It has forwarded to this implementation since the Writer delegation commit and
its manifest and assertion types are already aliases of the sdk types, so
values move across the boundary without conversion and callers can migrate a
call site at a time. The package doc carries the full option-by-option
mapping. Two entries in it are a note rather than a row:
WithIntegrityAlgorithm and WithSegmentIntegrityAlgorithm have no stable
counterpart, because #3940 (revised) fixed the writer at an HS256 root over
GMAC segments and removed the knobs -- which was the only combination either
option accepted anyway.

The experimental-writer benchmark example moves with it:
benchmark-experimental-writer becomes benchmark-chunked-writer and builds on
the package-level NewChunkedWriter, since it talks to one KAS whose key it has
already fetched and has no reason to pay for platform resolution inside the
timed section. Two bugs in it are fixed in passing: the segment goroutines
read the loop variable to compute their own offsets, and shared a single err.

Testing: the chunked suite and the classic TDFSuite round trips both pass
unchanged. Two new cases cover the constructor -- one asserting that
attributes resolve through the platform to the right KAS URL and KID and that
the result round-trips through LoadTDF, one asserting that an explicit
splitter is honored, using a KAS URL that would fail loudly if platform
resolution ran anyway. The fake KAS gained a PublicKey handler so the first
exercises the real key fetch rather than being handed a PEM. Also verified
against cross-module builds of examples, otdfctl, service, and tests-bdd.

Graduating also settles what a nil default KAS means, which the experimental
options never did. WithChunkedDefaultKAS and WithChunkedDefaultKASForFinalize
now reject nil, like every other option in the file that takes a pointer or an
interface. Storing a nil is not recoverable later -- the field is
indistinguishable from "not set" -- and for this particular field the failure
is silent rather than a panic: resolution falls through to the platform base
key, and the caller finds out their data went somewhere they never named only
when a reader cannot unwrap it. That is the shape of the base-key contention
that broke the streaming e2e file. SDK.NewChunkedWriter's doc comment now
spells the fallback out, including that WithKasInformation does not suppress
it, since it fills kasInfoList without clearing autoconfigure.

sdk/experimental/tdf keeps taking nil as "unset" -- WithDefaultKAS and
WithDefaultKASForWriter ship on main and are not this stack's to tighten -- so
the delegation appends the stable option only when a KAS is actually set. A
nil there still surfaces as the splitter's ErrNoDefaultKAS at Finalize, which
is what callers already handle, and a test pins that so a future change cannot
leak the option error through.

TestChunkedOptionsRejectNil covers both new guards and
TestSDKChunkedWriterFallsBackToBaseKey pins the fallback itself, so the
behavior the doc comment describes is asserted rather than just written down.
Both were mutation-checked: removing either guard fails them.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

cd sdk && go test ./... -race
cd examples && go build ./...

TestSDKChunkedWriterResolvesKeyAccess and
TestSDKChunkedWriterKeepsAnExplicitSplitter are the new coverage for the
constructor. The first goes through the fake KAS's new PublicKey handler, so
it exercises the real key fetch rather than being handed a PEM.

For the nil-KAS half, the cases to look at are
TestChunkedOptionsRejectNil/default_KAS{,_for_finalize},
TestSDKChunkedWriterFallsBackToBaseKey, and
TestWriterEndToEnd/ErrorConditions/ExplicitNilKASStaysUnset. Both directions
were mutation-checked: dropping either guard in chunked_options.go fails the
first two, and forwarding the KAS unconditionally from
experimental/tdf/writer.go again makes plain NewWriter(ctx) fail with
chunked: default KAS must not be nil — which is the coupling between the two
changes.

The full DSPX-2604 stack — 20 PRs

#	PR	Based on
01	#3930 chore: bump go.work toolchain to go1.25.12 and simplify an rt_test condition	`main`
02	#3931 feat(sdk): make the zipstream clock injectable for deterministic ZIP output	`main`
03	#3932 fix(sdk): reject a zipstream write set that omits segment 0	#3931
04	#3933 fix(sdk): map ReadAt plaintext offsets from cumulative segment sizes	`main`
05	#3934 chore(sdk): extract integrityAlgorithmString, createPolicyBinding, signAssertions	`main`
06	#3935 chore(sdk): add direct tests for createKeyAccess, encryptMetadata and tdfSalt	`main`
07	#3936 fix(sdk): fill each segment with io.ReadFull and size the buffer to the input	`main`
08	#3937 chore(cli): move streaming IO helpers into pkg	`main`
09	#3938 fix(cli): stream encrypt instead of buffering the whole payload	#3937
10	#3939 fix(cli): stream decrypt and inspect instead of buffering	#3938
11	#3940 feat(sdk): add a chunked segment writer (experimental)	`dspx-2604-base-11` = #3932 + #3934 + #3935
12	#3941 fix(sdk): stop GetManifest from splitting the key under the lock	#3940
13	#3942 fix(sdk): reject a chunked split naming a KAS with no resolved public key	#3941
14	#3943 chore(sdk): alias experimental/tdf manifest and assertion types	#3942
15	#3944 fix(sdk): emit spec-compliant key access in experimental/tdf and delegate Writer	#3943
16	#3945 feat(sdk): accept io.Reader in CreateTDF and drop the 64 GB payload cap	#3936
17	#3946 chore(sdk): rewrite CreateTDF on top of the chunked writer	`dspx-2604-base-17` = #3944 + #3945
18	#3947 chore(sdk): drop dead TDFConfig fields and deprecate the TDFFormat enum	#3946
19	#3948 fix(cli): drop the encrypt-side stdin spool	`dspx-2604-base-19` = #3947 + #3939
20	#3949 feat(sdk): graduate the chunked writer to stable API	#3948

Reviewable in parallel right now, since they sit directly on main and depend on
nothing else: 01, 02, 04, 05, 06, 07, 08.

Why three PRs have a dspx-2604-base-* base. A GitHub PR takes one base branch,
but 11, 17 and 19 each build on more than one parent. The base-* branches are empty
merge commits that exist only to join those parents so the PR diff shows exactly its
own change and nothing else. They contain no code, have no PR of their own, and go
away once their parents land — retarget the child onto main at that point.

Wants a cross-SDK xtest run before merge: 15, 17 (and therefore 20). They touch
the KAS wire format. Dispatch it against 17 or 20, never 15 on its own: xtest drives
the Go side through otdfctl -> SDK.CreateTDF, and 17 is the first commit where
that call reaches the rewritten writer. Set otdfctl-ref to the same branch as
platform-ref -- it defaults to main, which builds the CLI against main's sdk/
and makes the run vacuous.

Red checks you may see are network flakes, not this stack. Four distinct ones hit
this batch and all clear on re-run: golangci-lint config verify timing out on
https://golangci-lint.run/.../golangci.v2.8.jsonschema.json (fails the whole go (<module>) job and fail-fast cancels its siblings), the bats installer getting a 403,
Docker Hub timing out on keycloak/keycloak:26.4, and buf reporting "the server
hosted at that remote is unavailable" while the Java SDK generates sources. The
govulncheck step also emits ##[error] annotations against the go1.25.11 stdlib, but
it is continue-on-error: true and never fails a job — 01 bumps the toolchain and
clears those annotations.

coderabbitai · 2026-09-01T02:57:50Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b5ff18a9-7b85-46ab-935d-bc574d88abf5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-01T03:02:41Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	186.881136ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.207624ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	345.156513ms
Throughput	289.72 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	35.134085364s
Average Latency	350.739721ms
Throughput	142.31 requests/second

github-actions · 2026-09-01T03:12:28Z

github-actions · 2026-09-16T00:20:58Z

X-Test Failure Report

github-actions · 2026-09-16T00:25:20Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	133.238387ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	67.930161ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	258.362734ms
Throughput	387.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.477587818s
Average Latency	363.899691ms
Throughput	137.07 requests/second

github-actions · 2026-09-16T00:26:52Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	243.047215ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	135.397931ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	425.179942ms
Throughput	235.19 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	58.984062024s
Average Latency	588.283532ms
Throughput	84.77 requests/second

github-actions · 2026-09-16T00:35:06Z

X-Test Results

✅ java@main-pull-3949
✅ java@main-main
✅ go@main-pull-3949
cukes-report
✅ go@pull-3949-v0.9.0
✅ java@main-v0.9.0
✅ go@pull-3949-main
✅ js@main-pull-3949
✅ go@main-v0.9.0
✅ js@main-main
govulncheck-failure-1
govulncheck-failure-3
✅ go@main-main
✅ go@pull-3949-pull-3949
✅ js@main-v0.9.0
opentdf~~platform~~X3DYB9.dockerbuild
govulncheck-failure-8

github-actions · 2026-09-16T15:06:07Z

X-Test Failure Report

github-actions · 2026-09-16T15:12:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	238.954398ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	116.814335ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.577336ms
Throughput	242.97 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	57.09774678s
Average Latency	569.420926ms
Throughput	87.57 requests/second

github-actions · 2026-09-16T15:12:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	233.122463ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	129.008206ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	465.194469ms
Throughput	214.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m1.982982761s
Average Latency	618.39527ms
Throughput	80.67 requests/second

github-actions · 2026-09-16T15:22:10Z

X-Test Results

✅ go@main-pull-3949
✅ go@pull-3949-pull-3949
✅ go@main-main
✅ java@main-pull-3949
✅ js@main-v0.9.0
cukes-report
✅ java@main-v0.9.0
✅ js@main-main
govulncheck-failure-3
bats-test-results
govulncheck-failure-8
✅ go@pull-3949-v0.9.0
✅ java@main-main
✅ go@main-v0.9.0
✅ go@pull-3949-main
govulncheck-failure-1
✅ js@main-pull-3949
opentdf~~platform~~T27VQ0.dockerbuild

github-actions · 2026-09-16T16:03:52Z

X-Test Failure Report

github-actions · 2026-09-16T16:08:05Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	114.405674ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	63.560464ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	238.370513ms
Throughput	419.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.753455694s
Average Latency	326.694346ms
Throughput	152.66 requests/second

github-actions · 2026-09-16T16:09:47Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	241.596896ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	136.022045ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	412.210059ms
Throughput	242.59 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.904055337s
Average Latency	597.798561ms
Throughput	83.47 requests/second

github-actions · 2026-09-16T16:18:51Z

X-Test Results

✅ go@main-pull-3949
✅ go@pull-3949-main
✅ go@pull-3949-pull-3949
cukes-report
bats-test-results
govulncheck-failure-3
opentdf~~platform~~2A23PQ.dockerbuild
✅ go@pull-3949-v0.9.0
✅ js@main-v0.9.0
govulncheck-failure-1
✅ js@main-main
✅ js@main-pull-3949
✅ go@main-v0.9.0
✅ java@main-main
✅ java@main-v0.9.0
✅ java@main-pull-3949
✅ go@main-main
govulncheck-failure-8

github-actions · 2026-09-17T16:47:18Z

X-Test Failure Report

github-actions · 2026-09-17T16:51:44Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	154.221743ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.653986ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	323.484748ms
Throughput	309.13 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.386633274s
Average Latency	413.089937ms
Throughput	120.81 requests/second

github-actions · 2026-09-17T16:52:05Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	223.72205ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.482564ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	445.680549ms
Throughput	224.38 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	57.264438648s
Average Latency	571.261275ms
Throughput	87.31 requests/second

github-actions · 2026-09-17T17:02:15Z

X-Test Failure Report

opentdf~~platform~~V6H3CD.dockerbuild
✅ java@main-main
govulncheck-failure-8
✅ go@pull-3949-v0.9.0
server-logs-js@main-pull-3949
cukes-report
✅ js@main-v0.9.0
✅ go@pull-3949-pull-3949
govulncheck-failure-3
✅ js@main-main
✅ java@main-v0.9.0
✅ go@main-pull-3949
✅ go@pull-3949-main
✅ java@main-pull-3949
bats-test-results
✅ go@main-v0.9.0
✅ go@main-main
govulncheck-failure-1

The chunked writer has been the sole implementation of TDF construction since CreateTDF was rewritten on top of it. Every TDF the SDK produces already goes through this code; the "Experimental: not part of the stable SDK API; may change or be removed" markers on it stopped being true at that point. Drop them, and give the writer the constructor it was missing. SDK.NewChunkedWriter resolves key access against the platform the SDK is connected to, running attributes through the same autoconfigure path CreateTDF uses. Until now a chunked caller who wanted multi-KAS attribute grants had to implement a KeySplitter to get them, reimplementing autoconfigure by hand; DefaultKeySplitter is single-KAS and attribute-blind. The TDFOptions that shape key access -- WithDataAttributes, WithKasInformation, WithWrappingKeyAlg -- go in through WithChunkedTDFOptions. Resolution happens at Finalize, not at construction. That is the difference from CreateTDF and the reason this is a distinct resolver rather than a shared one: a chunked caller may still be adding attributes while segments are in flight, so the attribute set is not known until Finalize is called. The cost is that an unreachable KAS surfaces at Finalize, after segments have already been handed back. Passing WithChunkedKeySplitter opts out entirely and the given splitter is used as-is -- the config tracks whether the option was supplied so that "left at the default" and "deliberately overridden" are distinguishable. The test seams -- archiveFactory, cipherFactory, clock -- stay unexported. archiveFactory returns a zipstream.SegmentWriter, and zipstream lives under internal/, so there is no form of these that could be exported and supported. Graduating the package does not graduate them. sdk/experimental/tdf is deprecated at the package level rather than deleted. It has forwarded to this implementation since the Writer delegation commit and its manifest and assertion types are already aliases of the sdk types, so values move across the boundary without conversion and callers can migrate a call site at a time. The package doc carries the full option-by-option mapping. The experimental-writer benchmark example moves with it: benchmark-experimental-writer becomes benchmark-chunked-writer and builds on the package-level NewChunkedWriter, since it talks to one KAS whose key it has already fetched and has no reason to pay for platform resolution inside the timed section. Two bugs in it are fixed in passing: the segment goroutines read the loop variable to compute their own offsets, and shared a single err. Testing: the chunked suite and the classic TDFSuite round trips both pass unchanged. Two new cases cover the constructor -- one asserting that attributes resolve through the platform to the right KAS URL and KID and that the result round-trips through LoadTDF, one asserting that an explicit splitter is honored, using a KAS URL that would fail loudly if platform resolution ran anyway. The fake KAS gained a PublicKey handler so the first exercises the real key fetch rather than being handed a PEM. Also verified against cross-module builds of examples, otdfctl, service, and tests-bdd. Graduating also settles what a nil default KAS means, which the experimental options never did. WithChunkedDefaultKAS and WithChunkedDefaultKASForFinalize now reject nil, like every other option in the file that takes a pointer or an interface. Storing a nil is not recoverable later -- the field is indistinguishable from "not set" -- and for this particular field the failure is silent rather than a panic: resolution falls through to the platform base key, and the caller finds out their data went somewhere they never named only when a reader cannot unwrap it. That is the shape of the base-key contention that broke the streaming e2e file. SDK.NewChunkedWriter's doc comment now spells the fallback out, including that WithKasInformation does not suppress it, since it fills kasInfoList without clearing autoconfigure. sdk/experimental/tdf keeps taking nil as "unset" -- WithDefaultKAS and WithDefaultKASForWriter ship on main and are not this stack's to tighten -- so the delegation appends the stable option only when a KAS is actually set. A nil there still surfaces as the splitter's ErrNoDefaultKAS at Finalize, which is what callers already handle, and a test pins that so a future change cannot leak the option error through. TestChunkedOptionsRejectNil covers both new guards and TestSDKChunkedWriterFallsBackToBaseKey pins the fallback itself, so the behavior the doc comment describes is asserted rather than just written down. Both were mutation-checked: removing either guard fails them. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-09-18T18:28:58Z

X-Test Failure Report

github-actions · 2026-09-18T18:33:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	153.300228ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	80.718682ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	304.431252ms
Throughput	328.48 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.471356116s
Average Latency	373.900764ms
Throughput	133.44 requests/second

github-actions · 2026-09-18T18:34:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	254.174205ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	141.751502ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	431.221388ms
Throughput	231.90 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m1.962679725s
Average Latency	618.35678ms
Throughput	80.69 requests/second

github-actions · 2026-09-18T18:36:30Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-09-18T18:45:12Z

X-Test Results

✅ js@main-pull-3949
✅ js@main-v0.9.0
✅ java@main-main
✅ go@main-pull-3949
✅ go@main-main
✅ java@main-v0.9.0
✅ java@main-pull-3949
bats-test-results
✅ go@pull-3949-pull-3949
✅ go@main-v0.9.0
✅ go@pull-3949-main
cukes-report
✅ go@pull-3949-v0.9.0
✅ js@main-main
govulncheck-failure-8
govulncheck-failure-3
opentdf~~platform~~98TLF7.dockerbuild
govulncheck-failure-1

dmihalcik-virtru requested review from a team as code owners September 1, 2026 02:57

github-actions Bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati comp:examples size/m labels Sep 1, 2026

dmihalcik-virtru force-pushed the dspx-2604-19-drop-encrypt-spool branch from 35ef284 to 1491fb8 Compare September 1, 2026 03:28

dmihalcik-virtru force-pushed the dspx-2604-20-graduate-chunked-writer branch from 601fc87 to 36d4547 Compare September 1, 2026 03:28

dmihalcik-virtru force-pushed the dspx-2604-19-drop-encrypt-spool branch from 7a01a64 to ff16b52 Compare September 16, 2026 15:05

dmihalcik-virtru force-pushed the dspx-2604-20-graduate-chunked-writer branch from a93cd3d to a3e25be Compare September 16, 2026 15:05

dmihalcik-virtru force-pushed the dspx-2604-20-graduate-chunked-writer branch from a3e25be to a75f185 Compare September 16, 2026 16:03

dmihalcik-virtru force-pushed the dspx-2604-19-drop-encrypt-spool branch from ff16b52 to 0cc7dba Compare September 16, 2026 16:03

dmihalcik-virtru force-pushed the dspx-2604-19-drop-encrypt-spool branch from 0cc7dba to 9c8ce6e Compare September 17, 2026 16:47

dmihalcik-virtru force-pushed the dspx-2604-20-graduate-chunked-writer branch from a75f185 to 626da32 Compare September 17, 2026 16:47

dmihalcik-virtru force-pushed the dspx-2604-19-drop-encrypt-spool branch from 9c8ce6e to 3cb79ff Compare September 18, 2026 18:28

dmihalcik-virtru force-pushed the dspx-2604-20-graduate-chunked-writer branch from 626da32 to 1e22cbb Compare September 18, 2026 18:28

Conversation

dmihalcik-virtru commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

dmihalcik-virtru commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading