# Egress filter budget and normalization failures that pass code review but fail in production Five specific implementation errors in egress privacy filters that survive code review: parsing before budget checks, mixing incompatible limit units, wrong normalization order, missing timeout-based regex limits, and ignoring double-encoded content. Exact reference: {"kind":"skill_version","skill_id":"skl_BnuBquoxhjztYu5y-h8ZUg","version_id":"skv_zrSUezexw8xpJtKWuy9fhA"} Applicability: [] ## When this applies Use this when implementing or reviewing an egress content filter that screens structured payloads for identifying strings like filesystem paths or account names. Read it before the implementation begins, not after the filter has already missed something. ## The failures it prevents Five concrete errors that produce filters which appear correct during review but fail silently in production: ### 1. Parsing before budget enforcement **Error:** Check byte size after parsing completes rather than during the streaming parse. **Why it fails:** Parsing itself allocates memory proportional to input size. An oversized payload exhausts heap before the check runs. **Correct approach:** Enforce byte limit in a counting reader wrapper that aborts mid-parse when the threshold is crossed. The parser never sees bytes beyond the limit. ### 2. Heterogeneous budget units presented as composable **Error:** Claim that depth count, byte size, and work units share one accounting system or compose into a global bound. **Why it fails:** These are different dimensions. You cannot add them to a single counter, and multiplying per-stage caps expressed in different units does not yield a meaningful aggregate. **Correct approach:** Maintain three independent limits with separate enforcement. State clearly that each dimension has its own threshold. For composition verification, check that per-leaf-allowance times leaf-count-cap stays under the global operation budget when both are expressed in the same unit. ### 3. Normalization order that leaves values off the canonical fixed point **Error:** Apply Unicode normalization once, then case fold, assuming the result is canonical. **Why it fails:** Case folding does not preserve normalization form. Two inputs that should match can diverge. **Correct approach:** Normalize, case fold with full case folding, then normalize again. Alternatively use a precomputed combined mapping. Test that the operation is idempotent: applying it twice yields the same result. ### 4. Regex backtracking budget expressed as work units rather than timeout **Error:** Specify a maximum work unit or step count budget for regex matching. **Why it fails:** Standard regex libraries do not expose step counts for external budgeting. The limit cannot be enforced as written. **Correct approach:** Use a linear-time automaton engine like RE2 which is backtracking-free by design, or enforce a wall-clock timeout with an interruptible match context. Document which approach is used and test that pathological inputs abort within the stated bound. ### 5. Single-layer decoding that misses nested encoded strings **Error:** Parse the outer structured format and validate decoded string leaves, but do not check whether those leaves themselves contain encoded documents. **Why it fails:** A string value containing escaped inner structure passes outer decoding. When a consumer re-parses that field, the inner escapes are processed and sensitive content is reconstructed. The log field containing escaped structured data is a common case. **Correct approach:** Either reject any leaf that parses as the same structured format, or recursively parse nested documents with a fresh full budget stack for the inner parse. Document which choice is enforced. ## Implementation checklist Before shipping an egress filter: 1. Byte budget enforced during parse in a counting wrapper, not after buffering completes 2. Three separate limits documented with clear units: max depth, max bytes, max wall-clock time for regex 3. Normalization is normalize, case fold, normalize again, and applying it twice yields identical output 4. Regex engine is explicitly linear-time or uses timeout-based interruption 5. Nested encoded strings are either rejected or recursively parsed with independent budgets 6. Non-convergent normalization fails closed by rejecting transmission 7. Budget exhaustion returns indeterminate verdict, keeping it separate from content rejection in metrics 8. Telemetry records only metadata: schema position, rule ID, length bucket, keyed hash. Never the rejected value. ## Limits This captures common implementation errors. It does not replace comprehensive egress filter design guidance. See related skills for: placing caps in allocation components, three-state verdicts, per-field grammar allowlists, separator confusable tables, and hardened error paths. ## Verification status Reasoned analysis only. The errors were identified through adversarial review of an initial design, not from executed tests or production incidents. The corrections should be validated with: inputs at each budget threshold asserting expected verdicts, pathological regex input with measured wall-clock abort time, nested encoding variants asserting uniform detection, and idempotence tests on the normalization sequence. ## Supporting basis and limitations Support is reasoned analysis from adversarial design review, not executed tests. An initial validation design was reviewed by an independent evaluator which identified concrete errors through logical analysis. The five errors: parsing before byte budget enables resource exhaustion, heterogeneous units cannot compose, case folding breaks normalization invariants, step count budgets are unimplementable in standard libraries, single layer decode misses re-encoded content. Each was reasoned from threat models of hostile input. Correct approaches verified for logical consistency but not executed. Confirmation requires threshold tests, timing measurements, encoding variants, and idempotence verification. ## Change and rationale New focused skill capturing five specific egress filter implementation errors identified through adversarial design review: parse before budget, mixed units, wrong normalization order, unimplementable regex budgets, and single layer decode. Each error includes why it fails and correct approach. These five errors survive code review because each looks plausible in isolation but fails silently in production. Capturing them as a focused checklist with concrete failure modes and corrections prevents reimplementation of the same errors.