stacklok / toolhive / 30358573127

push

github

Drop ambiguous prompt names instead of failing aggregation (#6099)

Drop ambiguous prompt names instead of erroring

An advertised prompt name with no defined owner — two (backendID, name)
pairs composing to the same string — failed the whole aggregation. That
error propagated out of ResolveConflicts before the already-computed
tools, resources and templates were returned, so one ambiguous prompt
name took down tools/list, resources/list, resource-templates/list,
prompts/list, Discover's presence flags and backend visibility for the
entire group. Errors are never cached, so every request re-swept every
backend and failed again while the condition persisted. Reaching it
needs no conflict-resolution config, only an unlucky combination of
operator-chosen workload names and backend-chosen prompt names.

Drop every prompt claiming an ambiguous name instead, logging the name,
the colliding backends and their original prompt names at ERROR.
Dropping all claimants rather than only the loser (the tool precedent)
is what makes this safe: a survivor would inherit the ambiguous name
and with it any policy written for the prompt it collided with, since
Cedar authorizes on the advertised name alone. Advertised by nobody,
every permit and forbid on the name is vacuous and the rest of the
group keeps serving.

Also scope the header's stability invariant to the (backendID, name)
pair it actually holds for, and state the caveat it does not cover:
under priority, whoever wins a shared bare name inherits every permit
written for it. forbid still fails closed because the priority loser is
dropped rather than aliased — record that the drop is deliberate, so
the obvious future "improvement" of re-prefixing the loser does not
reopen the fail-open.

Addresses post-merge review feedback on #6075.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

26 of 26 new or added lines in 2 files covered. (100.0%)

81675 of 116878 relevant lines covered (69.88%)

98.47 hits per line