test(protocol): vendor wire-format.json 1.3.0, run constructed and reject vectors (LAB-6506)

[27Bslash6]

Vendors test-vectors/wire-format.json 1.3.0 from cachekit-io/protocol @ efe56e5 (sha256 5d72ca1f…) and runs its two new vector groups through the real ByteStorage.retrieve FFI call. Test-only; nothing under src/ or rust/ changes.

• Fixture: byte-identical copy; FIXTURE_SHA256 and the module docstring updated. The vectors group is unchanged from 1.1.1, so the existing tests and their 7 + 7 counts are untouched.
• Constructed vector: envelope_ratio_product_wraps_32_bits is rebuilt from its {hex, count} segment lists (4,295,001 B envelope, 8,523,079 B input) and must decode to exactly the input with format msgpack. cachekit-py ships 64-bit wheels only, so this is a regression guard, not proof for a 32-bit target; the docstring says so.
• Reject vectors: each of the six is driven through retrieve and must raise the class and message its row names: EnvelopeIntegrityError for over-cap, zero-length, ratio bomb, length mismatch and checksum; a plain ValueError (asserted not to be EnvelopeIntegrityError) for the u32 wrap, which is rejected at the range-checked decode. The six names are pinned as a literal set, so an emptied or renamed group fails. The zero-length case carries the ratio message because cachekit-core uses one error variant for its zero-length and ratio checks; with original_size 0 only the zero-length check can fire.
• Not asserted: the allocation bound the spec asks for on reject_original_size_over_cap and reject_ratio_bomb. An SDK over cachekit-core may rely on core's allocation probe only once it runs in CI on the pinned core version, and no released core has it yet.
• .secrets.baseline: entries for the fixture's new hex strings; the new pin carries an inline # pragma: allowlist secret, so the old pin's entry is removed.

Verified: uv run pytest tests/unit (3818 passed), ruff check, ruff format --check, and every pre-commit hook including detect-secrets. A mutation check (swapping two expected messages, and the u32 case's class) fails the reject test as expected.

No docs needed: test-only.

Closes LAB-6506

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 40 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: cachekit-io/cachekit-py/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b2d0c3b3-4ffa-4bbc-a29e-4424abbb6808

📥 Commits

Reviewing files that changed from the base of the PR and between c3fabda and 816ed87.

📒 Files selected for processing (3)

• .secrets.baseline
• tests/unit/protocol/fixtures/wire-format.json
• tests/unit/protocol/test_envelope_wire_vectors.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.