duckbrain-api-keys-tree-capped-listing-phantom-hole
Done. Deliverables written to /workspace:
/workspace/solution.md — full solution (title, root-cause analysis, exact fix code, verification section)./workspace/evidence.md — observed command transcripts./workspace/signatures.json — structured root cause/pattern/fix metadata./workspace/repro/ — runnable reproduction: mock DuckBrain that reproduces the silent tree cap, buggy and fixed checkers, and an 8-case selftest.GET /api/keys?namespace=<ns>&tree silently caps the listing (default 100) when no limit is passed, and total counts returned nodes, not namespace size — so truncation is invisible in the body. A guard that treats "absent from this listing" as "key is a hole" turns cap truncation into false positives (e.g. /tick/418).
In h3 scripts/check-duckbrain-tick-chain.sh:
1. Always fetch with &limit=${H3_TICK_CHAIN_LIMIT:-5000}.
2. If total >= limit, print UNVERIFIED and exit 0 (never a PASS/FAIL claim) — absence from a possibly-capped listing is not a gap.
3. Defence in depth: cross-check suspected holes against the namespace JSONL; a key present on disk is a phantom.
A reusable form is provided for any listing consumer (pass explicit large limit + UNVERIFIED degrade).
Reproduced the contract and ran the harness: 8/8 cases pass, including the falsification proof that a genuine absence of 418 still produces FAIL: 1 hole(s): 418, while the capped-listing phantom becomes PASS (with limit 5000) or UNVERIFIED (when the limit is reached).
# Evidence - Problem class: duckbrain-api-keys-tree-capped-listing-phantom-hole - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-21T09:37:10.245Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Guard scripts that census a DuckBrain namespace via GET /api/keys?namespace=<ns>&tree can report keys as MISSING that actually exist. The endpoint silently caps the listing when no limit is given (measured 2026-09-21 on localhost:3000: default response total:100 / 121 tree paths while the namespace held ~1958 items), and the response's total field counts the RETURNED nodes, not the namespace, so the cap is invisible in the body. A tick-chain checker then reported bare /tick/418 as a hole although the key existed on disk (fs JSONL), in the flat /api/keys listing, and in the tree fetched with &limit=5000 (total:1204). Diagnosis recipe: (1) fs-grep the namespace JSONL for the exact key - if present, the 'hole' is phantom; (2) fetch the same listing with a large explicit limit and compare totals; (3) never conclude a key is absent from a capped listing (same class as the /api/memories pagination cap: absence from a capped listing is NOT a gap). Fix shape for any consumer of a potentially-capped listing: pass an explicit large limit (e.g. limit=5000) AND degrade to UNVERIFIED (exit 0, never a pass claim) when the answer's total >= the limit, instead of judging over a possibly-truncated tree. Implemented in h3 scripts/check-duckbrain-tick-chain.sh (H3_TICK_CHAIN_LIMIT env, default 5000) with 2 new selftest cases (13/13) and a falsification proof.", "environment": "linux, DuckBrain HTTP API on localhost:3000, jq/curl consumers", "language": "sh", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "duckbrain-api-keys-tree-capped-listing-phantom-hole", "provider": "openrouter", "solved_at": "2026-09-21T09:37:10.245Z", "version": ""}Done. Deliverables written to /workspace:
/workspace/solution.md — full solution (title, root-cause analysis, exact fix code, verification section)./workspace/evidence.md — observed command transcripts./workspace/signatures.json — structured root cause/pattern/fix metadata./workspace/repro/ — runnable reproduction: mock DuckBrain that reproduces the silent tree cap, buggy and fixed checkers, and an 8-case selftest.GET /api/keys?namespace=<ns>&tree silently caps the listing (default 100) when no limit is passed, and total counts returned nodes, not namespace size — so truncation is invisible in the body. A guard that treats "absent from this listing" as "key is a hole" turns cap truncation into false positives (e.g. /tick/418).
In h3 scripts/check-duckbrain-tick-chain.sh:
1. Always fetch with &limit=${H3_TICK_CHAIN_LIMIT:-5000}.
2. If total >= limit, print UNVERIFIED and exit 0 (never a PASS/FAIL claim) — absence from a possibly-capped listing is not a gap.
3. Defence in depth: cross-check suspected holes against the namespace JSONL; a key present on disk is a phantom.
A reusable form is provided for any listing consumer (pass explicit large limit + UNVERIFIED degrade).
Reproduced the contract and ran the harness: 8/8 cases pass, including the falsification proof that a genuine absence of 418 still produces FAIL: 1 hole(s): 418, while the capped-listing phantom becomes PASS (with limit 5000) or UNVERIFIED (when the limit is reached).
# Evidence - Problem class: duckbrain-api-keys-tree-capped-listing-phantom-hole - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-21T09:37:10.245Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Guard scripts that census a DuckBrain namespace via GET /api/keys?namespace=<ns>&tree can report keys as MISSING that actually exist. The endpoint silently caps the listing when no limit is given (measured 2026-09-21 on localhost:3000: default response total:100 / 121 tree paths while the namespace held ~1958 items), and the response's total field counts the RETURNED nodes, not the namespace, so the cap is invisible in the body. A tick-chain checker then reported bare /tick/418 as a hole although the key existed on disk (fs JSONL), in the flat /api/keys listing, and in the tree fetched with &limit=5000 (total:1204). Diagnosis recipe: (1) fs-grep the namespace JSONL for the exact key - if present, the 'hole' is phantom; (2) fetch the same listing with a large explicit limit and compare totals; (3) never conclude a key is absent from a capped listing (same class as the /api/memories pagination cap: absence from a capped listing is NOT a gap). Fix shape for any consumer of a potentially-capped listing: pass an explicit large limit (e.g. limit=5000) AND degrade to UNVERIFIED (exit 0, never a pass claim) when the answer's total >= the limit, instead of judging over a possibly-truncated tree. Implemented in h3 scripts/check-duckbrain-tick-chain.sh (H3_TICK_CHAIN_LIMIT env, default 5000) with 2 new selftest cases (13/13) and a falsification proof.", "environment": "linux, DuckBrain HTTP API on localhost:3000, jq/curl consumers", "language": "sh", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "duckbrain-api-keys-tree-capped-listing-phantom-hole", "provider": "openrouter", "solved_at": "2026-09-21T09:37:10.245Z", "version": ""}