Repository navigation
Feat/manifest event catalog - #138
Merged
Merged
Conversation
Filtering was `event_types` glob only, and `subscription.request.json` permits `*` solely in the final segment. A subscriber interested in one field of one object still received every event of that type and discarded the rest — after paying full delivery cost. For an LLM agent that cost is tokens, which is precisely the "context bloat" `docs/strategy/unmet-needs-map.md` claims EEP answers with "subscribers choose what and when". The mechanism was thinner than the claim. New §5.1.3 and an optional `filter` on the subscription request: a flat list of comparisons over dotted paths into the envelope, combined with `all` or `any`. Operators are `eq`, `ne`, `in`, `nin`, `prefix`, `exists`, `gt`, `lt`. Three design decisions worth stating: - **No regex operator, and not Turing-complete.** The filter is evaluated by the publisher, on the delivery hot path, against every candidate event. A richer language would let a subscriber hand the publisher a catastrophically backtracking pattern to run at the publisher's expense. Conditions (20) and path depth (8) are bounded for the same reason. `ROADMAP.md` already plans ReDoS fuzzing on gate-config patterns; this avoids opening a second such surface. - **A malformed filter is rejected with 400, not ignored.** A subscriber that believes it is filtering but is not receives traffic it thought it had asked to be spared, and cannot detect the difference from its own side. - **Filters narrow, never widen**, and are not access control. Gates are applied before filters, and a filter cannot reach anything the subscriber's tier does not already grant. An event that fails the filter is not delivered and does not count toward the subscription's failure counter — it was never a candidate, so treating it as a failed delivery would eventually pause a healthy subscription. Path traversal into `__proto__` / `constructor` / `prototype` is rejected at validation, and the reader ignores inherited properties, so a subscriber-supplied path can never reach a prototype lookup. Webhook batching, the other half of audit finding O4, is deliberately left to a separate change: it alters the delivery envelope and the signing unit, which deserves its own review. Refs: EEP audit 2026-08 finding O4 (filters) Signed-off-by: Ugur Cekmez <ucekmez@gmail.com>
feat(spec,middleware): publisher-side subscription filters
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scope
Checklist
npm test/pytestin affected packages).Notes for reviewers