brekkylab/backlot

Found while reviewing an open pull request. Source and commit — jira, main at b4ff262. jira_search (backlot/routers/atlassian.py) never reads failFast on GET, leaves it out of _JIRA_SEARCH_BODY_KEYS on POST, and counts no reconcileIssues. So a failFast real refuses is served on GET, every failFast is refused on POST as a member the bean does not declare, and any number of ids is served on both methods. How you know — measured against Jira Cloud on 2026-10-12 between 04:07 and 04:35 UTC, with an API token and a cache-buster on each request, on /rest/api/3/search/jql unless the row says otherwise: GET ?jql=project%20is%20not%20EMPTY&failFast=… 200 true yes (empty) %01true ye%C5%BF yes&failFast=x 400 Failed to convert x null %20 x&failFast=yes (names the array) POST {"jql": "project is not EMPTY", "failFast": …} 200 true false "true" 1 null 400 invalid payload "x" "yes" [] {} reconcileIssues, 50 ids 200 on GET (repe

Found while reviewing an open pull request. Source and commit — jira, main at b4ff262. Four refusals carry a sentence Backlot wrote rather than real's: errors_atlassian.unbounded_jql, errors_atlassian.max_results_out_of_range and errors_atlassian.bad_page_token for search/jql, and the orderBy refusal in _jira_order_desc (backlot/routers/atlassian.py) for the comment read. Each docstring or comment gives the same reason: real words these in the account's language, and the account they were measured against answered in Korean, so only the status and the envelope were reproduced. The account measured now has the locale en_US (GET /rest/api/3/myself), and real answers all four in English. How you know — measured against Jira Cloud on 2026-10-12 between 04:11 and 04:35 UTC, with an API token and a cache-buster on each request. Each answer is 400 application/json;charset=UTF-8 with {"errorMessages":[<sentence>],"errors":{}}, on /rest/api/3 and /rest/api/2 alike: request

Found while reviewing an open pull request. Source and commit — jira and confluence, main at b4ff262. _int_param (backlot/routers/atlassian.py) reads these parameters with Python's int() after errors_atlassian.strip_java_whitespace. int() refuses 0x2 and #2 and any string past 4300 digits, and reads a digit outside the Basic Multilingual Plane; the strip removes U+0085, which Python counts as whitespace. Real reads the first two kinds and refuses the last two. Every route measured below reads its value through _int_param. Confluence's CQL search reads limit and start through _cql_page_param, a different binding that refuses 0x10 (its docstring, 2026-10-04), and is not part of this. How you know — measured against Jira Cloud and Confluence Cloud on 2026-10-12 between 04:07 and 04:37 UTC, with an API token and a cache-buster on each request. The comment read and both Confluence listings echo the value they read, so those columns show what real read: value search/jql

Found while reviewing a pull request on batch/read. Source and commit — hubspot, main at 38eff04. How you know — measured against api.hubapi.com on 2026-10-12 (04:10 UTC) with a read-only service key on a free portal, one request per body to companies batch/read and companies search, each carrying a cache-busting _ query parameter the API ignores. Real reads the body with Jackson, which refuses the non-standard tokens NaN, Infinity and -Infinity: every body below is a 400 naming the token, with no category, at the column just past the token. Backlot reads every HubSpot POST body through json_body in backlot/routers/__init__.py, which calls Starlette's request.json(), and Python's json.loads reads those tokens as floats. What happens next depends on the member: a float where the route reads a list, a cursor or a limit. route body real batch/read {"inputs":NaN} 400 … column 14: Non-standard token 'NaN': enab

Found while reviewing an open pull request. Source and commit — s3, main at 0c87917, and the same with GET and HEAD at /{bucket}/ routed to the bucket. A POST or PATCH at /s3/{bucket}/ matches the object route /{bucket}/{key:path} in backlot/routers/s3.py with key the empty string, so it is refused as a method on a key. The bucket's own POST and PATCH answers are routed at /{bucket} alone. How you know — measured against s3.amazonaws.com (us-east-1, the region Backlot presents) on 2026-10-12 with an IAM user's SigV4 keys, path-style, on a probe bucket holding one object, created for the measurement and deleted after it. Each request was sent to /{bucket} and to /{bucket}/, and each pair answered the same status, header names and body once the request ids are set aside: request real, /{bucket} and /{bucket}/ Backlot, /{bucket}/ POST 412 PreconditionFailed (Bucket POST must be ... 405 MethodNotAllowed, <ResourceType>OBJECT