Repository navigation
lab-ops-hub: container validator codec path (IDNA2003 nameprep) returns differ from Worker for ß, final sigma, post-3.2 codepoints #4019
Description
Found during the task 4848 differential for #659 (PR #3781, 2026-11-01): three accepted IDN spellings where the container validator's returned host still differs from the Worker's WHATWG return, all on the stdlib-IDNA-codec path in pkgs/lab-ops-hub/container/app.py (_return_label: candidate.encode("idna") — IDNA2003 nameprep, Unicode 3.2 tables), not the punycode fallback fixed in PR #3781.
Reproduction (container return vs new URL().href):
| Spelling | Container | Worker (WHATWG/UTS-46) |
|---|---|---|
http://ß.com/ |
http://ss.com/ |
http://xn--zca.com/ |
http://ς.com/ |
http://xn--4xa.com/ (σ) |
http://xn--3xa.com/ (ς) |
http://ꭰ.com/ (U+AB30) |
http://xn--kz9a.com/ |
http://xn--58d.com/ |
Causes: nameprep maps ß→ss (UTS-46 nontransitional keeps ß) and final sigma ς→σ (UTS-46 keeps ς; only U+03F2 maps to σ), and the codec's Unicode 3.2 tables encode newer/changed codepoints differently from current UTS-46.
These change the domain the fetcher resolves versus the one the Worker certified — the same defect class as #659/#665, different mechanism.
Acceptance:
- A Python↔WHATWG differential over these spellings (and neighbours: ß in multi-label hosts, ς/σ/ϲ family, post-3.2 codepoints) shows no returned-host differences.
- All existing pinned returns stay green (
test_container_validate.py, including the lab-ops-hub: container validator returns the raw U-label host for IDN targets — Worker returns the punycode A-label form it judged #659 A-label tests and the lab-ops-hub: container validator returns UTS-46 ignored codepoints in the host it judged without them — returned URL differs from the Worker, and U+180E cannot be IDNA-encoded at fetch time #652/lab-ops-hub: literal U+3002/U+FF0E/U+FF61 root-dot spellings still return the fullwidth form from the container validator (PR #657 remainder) #660/lab-ops-hub: container validator returns the raw Kelvin-sign (U+212A) host spelling — extraction folds it to 'k' before the #666 mapped-host check can see it #667 families) — in particular ϲ.com must keep returning xn--4xa.com. - Judging (accept/refuse) is unchanged; only the returned form moves.
Acceptance criteria
- For the three filed spellings, the container validator returns the same host as the Worker (WHATWG/UTS-46):
ß.com→xn--zca.com,ς.com→xn--3xa.com,ꭰ.com(U+AB30) → the current UTS-46 punycode, verified by a differential test againstnew URL().href. - The fix replaces or corrects the stdlib IDNA2003 nameprep path in
pkgs/lab-ops-hub/container/app.py(_return_label) rather than special-casing the three filed inputs. - Existing lab-ops-hub container validator tests pass, and the PR fix(lab-ops-hub): return IDN hosts in A-label form from container validator (#659) #3781 punycode-fallback behavior is unchanged.
- A regression differential (container vs Worker) over the filed cases is added to the test suite.
Activity
fix(lab-ops-hub): apply compatibility mappings in A-label fallback (#659
dezren39 commentedon Nov 1, 2026
Intake review
idnacodec is IDNA2003 with Unicode 3.2 nameprep tables, while the Worker implements UTS-46 nontransitional processing. The three cases are three distinct symptoms of that one root cause (ß mapping, final-sigma mapping, stale codepoint tables), so a fix that only patches the examples would leave the class open — the acceptance criteria require replacing/correcting the path.idnapackage's UTS-46 mode) changes returns for other spellings too; the differential test corpus from the lab-ops-hub: container validator returns the raw U-label host for IDN targets — Worker returns the punycode A-label form it judged #659 work should be re-run to catch regressions in previously-matching cases._return_label, route through UTS-46 nontransitional processing (the third-partyidnapackage exposesuts46=True; the stdlib codec cannot do this), keep the existing fallback order, and extend the lab-ops-hub: container validator returns the raw U-label host for IDN targets — Worker returns the punycode A-label form it judged #659 differential fixtures with these three spellings.developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · handed off
45 remaining items
dezren39 commentedon Nov 4, 2026
agent-note:v1
fix(lab-ops-hub): align IDN returns with WHATWG (#5231)
dezren39 commentedon Nov 4, 2026
🤖 Agent note · done