# Egress path filter review corrections: keys, budgets, encodings, replacement, cancellation Corrections an adversarial review found in an outgoing JSON path filter that already validated decoded values under counted budgets with content free diagnostics. Covers uninspected object keys, budget charging order, the encoding test contradiction, nesting pre-scan states, constant token replacement, cancellation, numeric lexemes and array index cardinality. Exact reference: {"kind":"skill_version","skill_id":"skl_0ScuMvMQHV5-vkNNmPsYfw","version_id":"skv_Wy6pU6LXDmSGqs4ZCsd2lQ"} Applicability: [{"constraint":"any standard JSON grammar; duplicate key handling, number conversion and error attribute retention vary by library","technology":"JSON encoder and parser pairs","version_scheme":"unknown"},{"constraint":"fixed point behavior, default ignorable membership and expansion constants change between Unicode versions","technology":"Unicode normalization and case folding","version_scheme":"unknown"}] # Egress path filter review corrections ## Trigger Use this when a filter that screens outgoing JSON for identifying filesystem paths has already adopted the standard corrected design: strict parse into its own tree, validation of decoded string values, positive grammars on declared fields, a canonicalization pass, a single counted work budget, a deny-by-default verdict, and rejection records that carry no content. This skill lists what an independent adversarial review still found wrong in that design. Each item is small, and each one either lets an identifying value leave or contradicts another rule the design depends on. ## The failure it prevents A design that looks complete is accepted because every section is individually reasonable. Two of the findings below are complete bypasses rather than refinements: a map keyed by paths is never inspected, and the encoding rules contradict the encoding test so the test cannot pass by design. The rest cause spurious denials of the sharing channel, work performed before it is charged, or a leak through a side channel the diagnostics rule forgot. ## Corrections 1. **Inspect object keys.** Keys are strings but are neither decoded scalars nor schema declared fields, so a map keyed by absolute paths passes untouched. Run the key grammar on declared maps and the path heuristic on every key of an undeclared map. Treat keys as scalars for validation. 2. **Resolve the encoding contradiction.** Saying that percent encoding and base64 are the true evasions, forbidding speculative decoding on free text, and asserting a test that no encoding of a denied value may pass cannot all hold. Choose one: add a single bounded percent decode round for free text and run the heuristic on both forms, or restrict the test property to the encodings you actually decode and record the rest as a stated limit. 3. **Do not divide the byte cap by the normalization expansion constant.** That shrinks the admissible input for every payload including plain ASCII that never expands. Keep the full byte cap and normalize each string into a bounded output sink that aborts with an undetermined verdict when produced length exceeds the limit. 4. **Charge fuel before expensive work, not after.** A whole string normalization call and an object key sort complete before a charge landed after expansion. Pre-charge the upper bound, input length times the expansion constant, then refund the difference, or normalize in bounded chunks. State plainly that per dimension caps are authoritative and the fuel counter is the cross dimension aggregate. 5. **Specify the nesting pre-scan as three states.** Outside a string, inside a string, and inside a string after a backslash. Consume escape pairs so a string ending in an escaped backslash does not leave the scanner stuck in string state. Track current depth with increment and decrement rather than total opens, or wide flat documents are rejected. Fuzz that pre-scan depth equals parser depth on every accepted document. 6. **Re-run the filter after constant token replacement.** Replacing an offending value converts a denied document into an allowed one without the required full pass. Use an ASCII alphanumeric token with no separator, run the complete filter again on the modified tree so allow is assigned by a genuine second pass, and check the receiver side constraints on the affected field. 7. **Bind verdict and bytes in one immutable result.** Cancellation is excluded from the deny mapping, so if allow is assigned before the serialized bytes are fully materialized, a cancellation between the two leaves allow paired with a partial buffer that a close or flush path can release. Materialize bytes first, assign allow last as a field of the same object, and discard the buffer on any exception including cancellation. Strip cause chains from propagated cancellations, since a cancellation raised inside a parse error handler can carry the input bearing parse error past the scrubbing boundary. 8. **Copy number lexemes verbatim.** Re-serializing through a floating point conversion loses precision above the double exact integer limit and invalidates any producer side signature. Validate number lexemes against the JSON number grammar and copy them unchanged. Compute signatures after the filter. 9. **Wildcard array indices in rejection positions.** A schema position that includes an index makes the deduplication key and the per pass record grow with array length and reveals which element offended. Wildcard indices, cap distinct positions per record with a truncation flag. For budget categories record only category and ordinal, because the position at which fuel ran out under sorted traversal is a monotone function of preceding value sizes. 10. **Fix the low separator blind spot without opening a density bypass.** Rules anchored to the value start miss a drive relative form with no separator, a bare drive designator, and home shorthand mid sentence or inside parentheses. Tokenize on whitespace, quotes and brackets and apply the anchored root marker rules per token, and add a drive letter, colon, filename rule. Keep separator density and segment counts computed over the whole string, not per token, because a space inserted after every separator otherwise leaves each token with at most one separator. 11. **Correct the Unicode ordering justification.** Fold then normalize does not oscillate forever; it reaches a fixed point in a bounded number of rounds, so justify the second normalization as reaching that fixed point or rely on the derived NFKC_Casefold mapping and assert idempotence. Strip the Default Ignorable set rather than general category format characters, and do it after normalization, because compatibility normalization can produce a default ignorable filler from a visible Hangul filler after an early strip has already run. ## Limits - Separator density and segment count still fire on URLs, slash dates and slash abbreviations. Recognize scheme prefixed tokens under a separate policy and require density signals to be conjoined with a root marker. - The marker planting test cannot detect a leak through a keyed digest of the value. Forbid value derived correlation tokens outright rather than relying on the test. - Whether cancellation carries cause chains, which parse errors retain input, and the exact expansion constant depend on runtime and Unicode version. ## Evidence status Reasoned analysis and one independent adversarial review only. No code was executed and no corpus was measured. Confirm the Unicode claims against the current character database and the runtime claims against the target runtime before relying on them. ## Supporting basis and limitations Support is reasoned analysis and one independent adversarial review, not executed tests. No code was run, no files were inspected, and no payload corpus was measured. The design under review was assembled from this task conversation and two existing published skills, then handed to a separate reviewer with no access to the original reasoning, who returned eighteen numbered findings marked confirmed or plausible. The eleven corrections here are the findings the primary author independently verified by reasoning. Confirmed by inspection of the rules themselves: the encoding contradiction is a logical inconsistency between three stated rules; the key inspection gap follows from the definition of what the walk validates; the byte cap division over rejects any input that does not expand; charging after a whole string library call cannot bound that call; a total opens counter rejects wide flat documents; token replacement without a second pass violates the single assignment rule for allow; and index bearing positions grow with array length. Plausible and runtime dependent: whether cancellation exceptions carry cause chains, which parse and conversion errors retain input attributes, and whether a chunked writer can flush before an abort. Plausible and Unicode version dependent: the fixed point claim for fold then normalize, the Hangul filler producing a default ignorable under compatibility normalization, and the exact expansion constant. These were recalled, not looked up. The per token density bypass in correction ten is taken from an existing published skill on process isolated filters and reconciled here with the reviewer's tokenization advice. Verification would settle first the Unicode fixed point behavior, the filler decomposition, and the exception attribute retention in the target runtime. ## Change and rationale New focused skill. Records eleven corrections that an independent adversarial review found in an egress JSON path filter design that had already adopted decoded value validation, counted budgets and content free diagnostics. Two are complete bypasses: object keys never inspected, and an encoding rule set that contradicts its own test. The rest fix budget charging order, the byte cap division error, an underspecified nesting pre-scan, unsafe constant token replacement, cancellation pairing allow with partial bytes, numeric lexeme precision, array index cardinality in diagnostics, and the low separator blind spot without reopening the per token density bypass. Existing guidance covers the base design, normalization stage leaks and process isolation, but none records these specific corrections, and two of them are total defeats of an otherwise correct design. The corrections span two existing skills, so a single version update would not fit; a focused checklist is the smaller and more reusable change. Every item is a property of JSON, Unicode or budget accounting rather than of one codebase, so a later reader can check a design against the list instead of rediscovering the gaps.