Clawpatch finding
- Severity: medium
- Category: api-contract
- Confidence: high
- Feature:
feat_custom_apis_openai_responses_retrieval_proxy
- Finding ID:
fnd_sig-feat-custom-apis-openai-resp_1a18c232a8
- Run ID:
20260831T084145-e3344c
- Reviewer model:
gpt-5.6-sol via the local Codex provider at xhigh
- Prior overlap: No matching GitHub issue or prior-run finding was found. The current OpenAI API reference documents a minimum of 1000.
Evidence
apis/src/openai/responses/compact/mod.rs:352-382 (extract_compaction_config)apis/src/openai/responses/compact/tests.rs:145-148 (extract_compaction_config_zero_threshold_compacts_immediately)
Description
The pinned OpenAI Responses schema defines compact_threshold as an integer with a minimum of 1000. This filter consumes the field itself rather than forwarding it for backend validation, yet accepts zero through 999. Such requests behave differently through Praxis and can force a summarization call on every eligible continuation, increasing cost and violating client expectations for OpenAI-compatible validation.
Reproduction
Send a rehydrated Responses request with context_management set to [{"type":"compaction","compact_threshold":0}]. Praxis accepts the value and invokes summarization whenever the conversation has any tokens, although an OpenAI-compatible request should reject the threshold.
Recommendation
Validate compact_threshold as at least 1000 when parsing the compaction entry. Invalid proxy-consumed values should produce a normal invalid_request_error rather than silently skipping or executing compaction.
Reported from a Clawpatch review of apis/src at commit 543259683b9ff9a3f42772703a6d9ca134948475.
Clawpatch finding
feat_custom_apis_openai_responses_retrieval_proxyfnd_sig-feat-custom-apis-openai-resp_1a18c232a820260831T084145-e3344cgpt-5.6-solvia the local Codex provider atxhighEvidence
apis/src/openai/responses/compact/mod.rs:352-382(extract_compaction_config)apis/src/openai/responses/compact/tests.rs:145-148(extract_compaction_config_zero_threshold_compacts_immediately)Description
The pinned OpenAI Responses schema defines compact_threshold as an integer with a minimum of 1000. This filter consumes the field itself rather than forwarding it for backend validation, yet accepts zero through 999. Such requests behave differently through Praxis and can force a summarization call on every eligible continuation, increasing cost and violating client expectations for OpenAI-compatible validation.
Reproduction
Send a rehydrated Responses request with context_management set to [{"type":"compaction","compact_threshold":0}]. Praxis accepts the value and invokes summarization whenever the conversation has any tokens, although an OpenAI-compatible request should reject the threshold.
Recommendation
Validate compact_threshold as at least 1000 when parsing the compaction entry. Invalid proxy-consumed values should produce a normal invalid_request_error rather than silently skipping or executing compaction.
Reported from a Clawpatch review of
apis/srcat commit543259683b9ff9a3f42772703a6d9ca134948475.