Clawpatch finding
- Severity: medium
- Category: api-contract
- Confidence: high
- Feature:
feat_custom_apis_openai_responses_state_store_stream
- Finding ID:
fnd_sig-feat-custom-apis-openai-resp_79525b1400
- Run ID:
20260831T084818-f6ae5e
- Reviewer model:
gpt-5.6-sol via the local Codex provider at xhigh
- Prior overlap: No matching GitHub issue or prior-run finding was found. The OpenAI Responses contract states that
previous_response_id cannot be used with conversation.
Evidence
apis/src/openai/responses/rehydrate/mod.rs:97-115 (RehydrateFilter::rehydrate)apis/src/openai/responses/rehydrate/tests.rs:1424-1473 (previous_response_id_takes_precedence_over_conversation)
Description
The current Open Responses request schema states that previous_response_id cannot be used with conversation. Instead of preserving that invalid combination for backend validation or rejecting it because the proxy must choose a local state source, rehydration silently selects the previous response. This changes an invalid client request into locally defined behavior and can combine history from a response with a different requested conversation.
Reproduction
Store resp_win and conv_lose with different histories, then POST /v1/responses with both previous_response_id":"resp_win" and conversation":"conv_lose". The filter releases the request with state populated from resp_win rather than returning an invalid-request error.
Recommendation
When both non-null selectors are present, return an OpenAI-compatible 400 rejection before fetching either record. Alternatively, leave both completely untouched and avoid local rehydration so the provider can enforce the contract, but do not apply precedence.
Reported from a Clawpatch review of apis/src at commit 543259683b9ff9a3f42772703a6d9ca134948475.
Clawpatch finding
feat_custom_apis_openai_responses_state_store_streamfnd_sig-feat-custom-apis-openai-resp_79525b140020260831T084818-f6ae5egpt-5.6-solvia the local Codex provider atxhighprevious_response_idcannot be used withconversation.Evidence
apis/src/openai/responses/rehydrate/mod.rs:97-115(RehydrateFilter::rehydrate)apis/src/openai/responses/rehydrate/tests.rs:1424-1473(previous_response_id_takes_precedence_over_conversation)Description
The current Open Responses request schema states that
previous_response_idcannot be used withconversation. Instead of preserving that invalid combination for backend validation or rejecting it because the proxy must choose a local state source, rehydration silently selects the previous response. This changes an invalid client request into locally defined behavior and can combine history from a response with a different requested conversation.Reproduction
Store
resp_winandconv_losewith different histories, then POST/v1/responseswith bothprevious_response_id":"resp_win"andconversation":"conv_lose". The filter releases the request with state populated fromresp_winrather than returning an invalid-request error.Recommendation
When both non-null selectors are present, return an OpenAI-compatible 400 rejection before fetching either record. Alternatively, leave both completely untouched and avoid local rehydration so the provider can enforce the contract, but do not apply precedence.
Reported from a Clawpatch review of
apis/srcat commit543259683b9ff9a3f42772703a6d9ca134948475.