Repository navigation
docs(spec): mark the Rust default tenant conformant from cachekit-rs 0.8.0 (LAB-4667) - #206
Conversation
…0.8.0 The Rust cell said from_env() derived under a deployment namespace. No published release does: CacheKit::from_env() falls back to "default" because CachekitConfig::from_env() never sets the namespace it reads, and both secure presets read the default_tenant_interop vector in the SDK's own tests. Checked against every published .crate from 0.8.0 to 0.11.1.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 16 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary by CodeRabbit
WalkthroughThe Rust SDK conformance entry now reports default ChangesRust default tenant conformance
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Suggested reviewers: Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title names the change: the Rust default tenant conformance row in the intent-presets spec is marked conformant from cachekit-rs 0.8.0, with a Jira-style ticket reference. It matches the changeset… |
| Description check | |
The description is specific and on-topic. It names the exact spec cell changed (Rust cell of the SDK Conformance row in spec/intent-presets.md), the version floor (cachekit-rs 0.8.0+), and the added c… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title names the change: the Rust default tenant conformance row in the intent-presets spec is marked conformant from cachekit-rs 0.8.0, with a Jira-style ticket reference. It matches the changeset, which flips the Rust cell from ❌ to ✅ and adds a changelog fragment. The title uses the conventional docs(spec) prefix and is 85 characters, within normal length for a commit title.
Full details: Description check
-
Explanation
The description is specific and on-topic. It names the exact spec cell changed (Rust cell of the SDK Conformance row in spec/intent-presets.md), the version floor (cachekit-rs 0.8.0+), and the added changelog.d/ fragment. It also explains the evidence (crates.io release checks, sha256 matches, and the preset and from_env() tenant tracing) and lists the checks run. It fully matches the raw summary and objectives.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@kody start-review |
Code Review Completed! 🔥The code review was successfully completed based on your current configurations. Kody Guide: Usage and ConfigurationInteracting with Kody
Providing Context (Files & MCPs)Add these hints in your PR description (or a comment) to unlock deeper checks:
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
The claim that every other encryption entry point takes the tenant as an argument sat under an open 0.8.0+ floor, and an unreleased builder method that reads the key from the environment encrypts with no tenant argument. Bound it to 0.11.x like the from_env() clause, and name config.namespace so the fallback does not read as a namespace tenant.
b818eec
Code Review Completed! 🔥The code review was successfully completed based on your current configurations. Kody Guide: Usage and ConfigurationInteracting with Kody
Providing Context (Files & MCPs)Add these hints in your PR description (or a comment) to unlock deeper checks:
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
Flips the Rust cell of the
spec/intent-presets.md§ SDK Conformance row "Defaulttenant_idis"default", identical for HKDF and AAD" from ❌ to ✅, with the floorcachekit-rs0.8.0+, and adds achangelog.d/fragment. Docs only.The old cell said
from_env()derived under the deployment namespace, "inconsistent by constructor". No published release does that. The new cell states what each Rust path that encrypts with no caller-supplied tenant resolves, and names no API that a published release does not ship.Evidence
Per
decisions/matrix-version-verification.md, against the published artifacts, notmain. I downloaded everycachekit-rsrelease from 0.8.0 up from crates.io on 2026-10-23. Each sha256 matches the registry checksum:.cratesha256src/intents.rs)from_env()tenant (src/client.rs)986848f4…d941:63"default":241792ee2d3…775e:67"default":2596f97c303…5d49:67"default":28578b6c477…f086:87"default":28723db3fd7…7733:87"default":287Presets (rule 6: executed tests).
CacheKit::secureandCacheKit::secure_from_envshare one private helper that passes the literal"default". Each.crateabove ships the crate-internal testshex_path_decrypts_default_tenant_vectorandenv_path_decrypts_default_tenant_vectorinsrc/intents.rs. They build each preset path with no tenant, asserttenant_id() == "default", and decrypttest-vectors/encryption.jsondefault_tenant.vectors[0](default_tenant_interop) to itsplaintext_hex. 0.8.0 is the first release that carries them.CacheKit::from_env()through 0.11.x (rule 6: no test asserts it, so the whole path is traced). Layer checked: the publishedsrc/of each.crate.CacheKit::from_env()builds its config only fromCachekitConfig::from_env(). WithCACHEKIT_MASTER_KEYset it encrypts with tenantconfig.namespace.as_deref().unwrap_or("default")(line in the table).CachekitConfig::from_env()starts fromSelf::default(), wherenamespaceisNone. It assigns onlyapi_key,api_url,master_key,previous_master_keysand, through 0.11.x,default_ttl. No release assignsconfig.namespaceinsrc/config.rs, and nosrc/file reads a namespace environment variable.CachekitConfigBuilder::namespace, fills aCachekitConfigthat no client constructor accepts. Outsideconfig.rsand thelib.rsre-export, the onlyCachekitConfiguse isfrom_env()'s ownCachekitConfig::from_env()call.?on the path returns an error rather than falling through to another tenant. Building the encryption layer is the last step beforeOk(builder), so a.namespace(…)chained on the returned builder changes key prefixes only, never the layer's tenant.So
from_env()derived the key and built the AAD under"default"in every release, and no ciphertext was ever derived under a namespace tenant.No other tenant-less path. In each
.crate, the non-test calls that build an encryption layer are the preset helper,from_env(), and builder methods (.encryption(),.encryption_from_bytes(),.encryption_from_bytes_with_previous(), and from 0.11.0.encryption_with_previous()) plusEncryptionLayer::new/with_previous_keys. All of these take the tenant as an argument.Checks
python3 tools/test_conformance.py: 284 cases pass.python3 tools/conformance.py check --base origin/main: OK, andconformance/coverage.mdis current.CHANGELOG.mdis untouched.