An automated review of #1189 flagged a one-sided check in the external review recovery decoder. decode_external_review_recovery in crates/registry-breg-client/src/lifecycle.rs rejects a code on state: none but accepts state: operatorAttention with no code, even though the runtime only ever constructs that state from a present last_error_code.
Failure scenario: a proxy or nonconforming deployment returns recovery.state: operatorAttention without code. The Rust, Node.js and Python clients report that operator action is required but cannot say which recovery procedure applies, because the code callers key that decision on is absent.
Suggested fix:
- Require
code when the state is operatorAttention, mirroring the existing absence check for none.
- Add decoder unit tests for both directions.
Filed from the review of #1189; not merge-blocking.
An automated review of #1189 flagged a one-sided check in the external review recovery decoder.
decode_external_review_recoveryincrates/registry-breg-client/src/lifecycle.rsrejects acodeonstate: nonebut acceptsstate: operatorAttentionwith nocode, even though the runtime only ever constructs that state from a presentlast_error_code.Failure scenario: a proxy or nonconforming deployment returns
recovery.state: operatorAttentionwithoutcode. The Rust, Node.js and Python clients report that operator action is required but cannot say which recovery procedure applies, because the code callers key that decision on is absent.Suggested fix:
codewhen the state isoperatorAttention, mirroring the existing absence check fornone.Filed from the review of #1189; not merge-blocking.