Migration 0099 matched inside words and mangled rows it rewrote #153

Merged

bvandeusen merged 1 commits from dev into main 2026-09-11 20:18:02 -04:00

Conversation 0 Commits 1 Files Changed 2

+61 -2

bvandeusen commented 2026-09-11 20:17:57 -04:00

Owner

Copy Link

Copy Source

One commit, found post-deploy by reading the telemetry that migration 0099 had just rewritten.

What happened

The credential it was written for is gone — where a token sat, the row now reads TOK=[redacted:token]. But <task-notification> came back as <ta[redacted:token]>, across rows, because sk- matched inside the word: sk- followed by notification is a vendor prefix plus twelve word characters.

Two porting mistakes, compounding

The live scrubber's pattern begins with \b. The migration's inlined copy had no boundary at all — dropped in the port to SQL. And \b would not have saved it either: in Postgres ARE \b is a backspace, not a word boundary. \m (start of word) is the spelling that means what Python's \b means.

Two things that look interchangeable, are not, and fail in the same direction.

The evidence separates them cleanly: rows written after the deploy carry <task-notification> intact, while migration-rewritten ones are mangled. The live scrubber was never affected — only the frozen copy was wrong.

Scope

The damage on the install that ran it is permanent. The UPDATE overwrote the only copy of that text. What this fixes is every other install: 0099 has run exactly once, and leaving a known evidence-destroying migration in the chain for everyone else would be the worse half of the mistake. The docstring records what it cost rather than tidying it away.

Impact is degraded query text in some telemetry rows — no data loss beyond that, no security consequence.

Guard

Pins the property no reader can eyeball: \m present and \b absent in both patterns, falsified against the shape that actually shipped.

Worth noting plainly: this is the third time this scrubber has eaten evidence it should not have (--author=, then task-notification). The shape is consistent — the redaction half is easy to verify, and the survival half only fails on inputs that were not imagined. Real sampled rows, not invented examples, are what a future change to it needs.

All six CI jobs green on fe2f88c.

🤖 Generated with Claude Code

https://claude.ai/code/session_011cPyzNnegXHr5iRMzzy5KJ

One commit, found post-deploy by reading the telemetry that migration `0099` had just rewritten. ## What happened The credential it was written for is gone — where a token sat, the row now reads `TOK=[redacted:token]`. But `<task-notification>` came back as `<ta[redacted:token]>`, across rows, because `sk-` matched **inside the word**: `sk-` followed by `notification` is a vendor prefix plus twelve word characters. ## Two porting mistakes, compounding The live scrubber's pattern begins with `\b`. The migration's inlined copy had **no boundary at all** — dropped in the port to SQL. And `\b` would not have saved it either: in Postgres ARE `\b` is a **backspace**, not a word boundary. `\m` (start of word) is the spelling that means what Python's `\b` means. Two things that look interchangeable, are not, and fail in the same direction. The evidence separates them cleanly: rows written after the deploy carry `<task-notification>` intact, while migration-rewritten ones are mangled. The live scrubber was never affected — only the frozen copy was wrong. ## Scope **The damage on the install that ran it is permanent.** The `UPDATE` overwrote the only copy of that text. What this fixes is every *other* install: `0099` has run exactly once, and leaving a known evidence-destroying migration in the chain for everyone else would be the worse half of the mistake. The docstring records what it cost rather than tidying it away. Impact is degraded query text in some telemetry rows — no data loss beyond that, no security consequence. ## Guard Pins the property no reader can eyeball: `\m` present and `\b` absent in both patterns, falsified against the shape that actually shipped. Worth noting plainly: this is the third time this scrubber has eaten evidence it should not have (`--author=`, then `task-notification`). The shape is consistent — the redaction half is easy to verify, and the survival half only fails on inputs that were not imagined. Real sampled rows, not invented examples, are what a future change to it needs. All six CI jobs green on `fe2f88c`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_011cPyzNnegXHr5iRMzzy5KJ

bvandeusen added 1 commit 2026-09-11 20:17:57 -04:00

fix(telemetry): migration 0099 matched inside words and mangled rows (#3925) ... fe2f88cdb6

Found post-deploy, by reading the telemetry it had just rewritten.

The token it was written for IS gone — `TOK=[redacted:token]` where a
credential used to be. But `<task-notification>` came back as
`<ta[redacted:token]>`, across rows, because `sk-` matched INSIDE the word:
`sk-` + `notification` is a vendor prefix followed by twelve word characters.

TWO PORTING MISTAKES, COMPOUNDED. The live scrubber's pattern begins with
`\b`; the migration's inlined copy had no boundary at all, dropped when I
ported it to SQL. And `\b` would not have saved it either — in Postgres ARE
`\b` is a BACKSPACE, not a word boundary. `\m` (start of word) is the
spelling that means what Python's `\b` means. Two things that look
interchangeable, are not, and fail in the same direction.

The live scrubber was never affected, and the evidence says so cleanly: rows
written after the deploy carry `<task-notification>` intact, while
migration-rewritten ones are mangled. Only the frozen copy was wrong.

THE DAMAGE HERE IS PERMANENT. The UPDATE overwrote the only copy of that
text, so those rows cannot be restored. What this fixes is every OTHER
install: 0099 has run exactly once, on one instance, and shipping a known
evidence-destroying migration in the chain for everyone else would be the
worse half of the mistake. The docstring records what it cost rather than
tidying it away.

The guard pins the property no reader can eyeball — `\m` present, `\b`
absent, in both patterns — and is falsified against the shape that shipped.

This is the third time this scrubber has eaten evidence it should not have
(`--author=`, then `task-notification`), and the pattern is consistent: the
redaction half is easy to verify and the SURVIVAL half only fails on inputs
I did not think to include. The evidence set is where the work is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011cPyzNnegXHr5iRMzzy5KJ

bvandeusen merged commit de9431ec39 into main 2026-09-11 20:18:02 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate-bot bvandeusen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bvandeusen/FabledScribe#153