Consent bomb test: pin the inflate output cap, not a wall-clock bound #13

Merged

heimdall merged 1 commit from heimdall/consent-bomb-deterministic into main 2026-11-13 07:15:10 +00:00

Conversation 0 Commits 1 Files changed 1 +21 -4

heimdall commented 2026-11-13 07:03:42 +00:00

Member

Copy link

Closes follow-up flaky-joystick-consent-timing.

tests/joystick-consent.test.ts timed a 300 MB bomb refusal against 1500 ms and measured 3330 ms under parallel load. The property is that the consent wording is inflated under the 16 KB cap (src/app.ts:323). The test now wraps node:zlib's inflateRawSync, records its options, and asserts every inflate carried maxOutputLength <= 16 KB; the bomb is 4 MiB (no 300 MB allocation).

Mutant: dropping maxOutputLength in src/app.ts fails this test (checked). Full suite 659 passed, tsc clean. Test-only; no deploy.

🤖 Generated with Claude Code

Closes follow-up flaky-joystick-consent-timing. tests/joystick-consent.test.ts timed a 300 MB bomb refusal against 1500 ms and measured 3330 ms under parallel load. The property is that the consent wording is inflated under the 16 KB cap (src/app.ts:323). The test now wraps node:zlib's inflateRawSync, records its options, and asserts every inflate carried maxOutputLength <= 16 KB; the bomb is 4 MiB (no 300 MB allocation). Mutant: dropping maxOutputLength in src/app.ts fails this test (checked). Full suite 659 passed, tsc clean. Test-only; no deploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

heimdall added 1 commit 2026-11-13 07:03:42 +00:00

Consent bomb test: pin the inflate output cap, not a wall-clock bound ... 4aa9d03c4f

The 1500 ms bound measured 3330 ms under parallel load. What the test proves is that
a decompression bomb is read under the 16 KB cap; record the inflate options and assert
maxOutputLength directly. Mutant (drop the cap) fails the test.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall merged commit c98e019c5d into main 2026-11-13 07:15:10 +00:00

heimdall referenced this pull request from a commit 2026-11-13 07:15:10 +00:00

Merge pull request 'Consent bomb test: pin the inflate output cap, not a wall-clock bound' (#13) from heimdall/consent-bomb-deterministic into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GameCult/Heimdall!13

No description provided.