Egress path filter review corrections

Trigger

Use this when a filter that screens outgoing JSON for identifying filesystem paths has already adopted the standard corrected design: strict parse into its own tree, validation of decoded string values, positive grammars on declared fields, a canonicalization pass, a single counted work budget, a deny-by-default verdict, and rejection records that carry no content. This skill lists what an independent adversarial review still found wrong in that design. Each item is small, and each one either lets an identifying value leave or contradicts another rule the design depends on.

The failure it prevents

A design that looks complete is accepted because every section is individually reasonable. Two of the findings below are complete bypasses rather than refinements: a map keyed by paths is never inspected, and the encoding rules contradict the encoding test so the test cannot pass by design. The rest cause spurious denials of the sharing channel, work performed before it is charged, or a leak through a side channel the diagnostics rule forgot.

Corrections

1. Inspect object keys. Keys are strings but are neither decoded scalars nor schema declared fields, so a map keyed by absolute paths passes untouched. Run the key grammar on declared maps and the path heuristic on every key of an undeclared map. Treat keys as scalars for validation.

1. Resolve the encoding contradiction. Saying that percent encoding and base64 are the true evasions, forbidding speculative decoding on free text, and asserting a test that no encoding of a denied value may pass cannot all hold. Choose one: add a single bounded percent decode round for free text and run the heuristic on both forms, or restrict the test property to the encodings you actually decode and record the rest as a stated limit.

1. Do not divide the byte cap by the normalization expansion constant. That shrinks the admissible input for every payload including plain ASCII that never expands. Keep the full byte cap and normalize each string into a bounded output sink that aborts with an undetermined verdict when produced length exceeds the limit.

1. Charge fuel before expensive work, not after. A whole string normalization call and an object key sort complete before a charge landed after expansion. Pre-charge the upper bound, input length times the expansion constant, then refund the difference, or normalize in bounded chunks. State plainly that per dimension caps are authoritative and the fuel counter is the cross dimension aggregate.

1. Specify the nesting pre-scan as three states. Outside a string, inside a string, and inside a string after a backslash. Consume escape pairs so a string ending in an escaped backslash does not leave the scanner stuck in string state. Track current depth with increment and decrement rather than total opens, or wide flat documents are rejected. Fuzz that pre-scan depth equals parser depth on every accepted document.

1. Re-run the filter after constant token replacement. Replacing an offending value converts a denied document into an allowed one without the required full pass. Use an ASCII alphanumeric token with no separator, run the complete filter again on the modified tree so allow is assigned by a genuine second pass, and check the receiver side constraints on the affected field.

1. Bind verdict and bytes in one immutable result. Cancellation is excluded from the deny mapping, so if allow is assigned before the serialized bytes are fully materialized, a cancellation between the two leaves allow paired with a partial buffer that a close or flush path can release. Materialize bytes first, assign allow last as a field of the same object, and discard the buffer on any exception including cancellation. Strip cause chains from propagated cancellations, since a cancellation raised inside a parse error handler can carry the input bearing parse error past the scrubbing boundary.

1. Copy number lexemes verbatim. Re-serializing through a floating point conversion loses precision above the double exact integer limit and invalidates any producer side signature. Validate number lexemes against the JSON number grammar and copy them unchanged. Compute signatures after the filter.

1. Wildcard array indices in rejection positions. A schema position that includes an index makes the deduplication key and the per pass record grow with array length and reveals which element offended. Wildcard indices, cap distinct positions per record with a truncation flag. For budget categories record only category and ordinal, because the position at which fuel ran out under sorted traversal is a monotone function of preceding value sizes.

1. Fix the low separator blind spot without opening a density bypass. Rules anchored to the value start miss a drive relative form with no separator, a bare drive designator, and home shorthand mid sentence or inside parentheses. Tokenize on whitespace, quotes and brackets and apply the anchored root marker rules per token, and add a drive letter, colon, filename rule. Keep separator density and segment counts computed over the whole string, not per token, because a space inserted after every separator otherwise leaves each token with at most one separator.

1. Correct the Unicode ordering justification. Fold then normalize does not oscillate forever; it reaches a fixed point in a bounded number of rounds, so justify the second normalization as reaching that fixed point or rely on the derived NFKC_Casefold mapping and assert idempotence. Strip the Default Ignorable set rather than general category format characters, and do it after normalization, because compatibility normalization can produce a default ignorable filler from a visible Hangul filler after an early strip has already run.

Limits

• Separator density and segment count still fire on URLs, slash dates and slash abbreviations. Recognize scheme prefixed tokens under a separate policy and require density signals to be conjoined with a root marker.
• The marker planting test cannot detect a leak through a keyed digest of the value. Forbid value derived correlation tokens outright rather than relying on the test.
• Whether cancellation carries cause chains, which parse errors retain input, and the exact expansion constant depend on runtime and Unicode version.

Evidence status

Reasoned analysis and one independent adversarial review only. No code was executed and no corpus was measured. Confirm the Unicode claims against the current character database and the runtime claims against the target runtime before relying on them.