[AdaWorldAPI]

What

#321 was merged while its review fixes were being pushed, so ace0918 reached the branch but not main. This PR carries only that commit. Codex and CodeRabbit raised six findings on #321; each was reproduced by a failing test first.

• Bag members are matched by exact name (Codex P2, CodeRabbit). The old check parsed the suffix, so extensionAttribute01 counted as member 1 and was neither stored nor reported as ignored. It also sliced by byte length and could panic on a multi-byte name.
  • New ogar_dir_core::schema::bag_member_of accepts only the canonical spelling: the bag name in any ASCII case, then 1..=15 with no leading zero, sign or space. It uses a checked split.
  • ogar-ad now reports extensionAttribute01 as ignored.
• SID representation (Codex P1). objectSid is binary in AD, and onPremisesSecurityIdentifier is the S-1-… string in Graph.
  • New SyncTransform::SecurityIdentifier and ogar_dir_core::sid::sid_to_string, per [MS-DTYP] 2.4.2: big-endian 48-bit authority, little-endian sub-authorities, and a length that must match the sub-authority count.
• cloud_of resolves a numbered extension attribute to the bag entry. Only the canonical spelling counts: extensionAttribute7 resolves, extensionAttribute07 and extensionAttribute16 do not.
• routing_parts requires the tenant to be a DNS label: letters, digits and hyphens, no leading or trailing hyphen.
• Doc: the bag's zero-based entry offset and bag_member's 1-based index are stated separately.

Tests

The workspace passes 1008 tests; fmt and clippy -D warnings are clean. New tests:

• bag_members_are_named_exactly;
• a_binary_sid_renders_as_its_string_form, against an independently computed vector (S-1-5-21-1004336348-1177238915-682003330-512) plus S-1-1-0, with malformed lengths refused;
• extended extension_attributes_are_one_bag, every_synced_attribute_exists_on_both_sides_once and the routing-template test.

Disable runs, each red on a named test:

• leading zero accepted;
• unchecked split (panics);
• member range not checked;
• SID length not checked;
• SID sub-authorities read big-endian;
• the SID pair set back to OnPremisesEvidence;
• cloud_of without the bag fallback;
• cloud_of with a prefix match instead of the exact name;
• tenant check back to "no @ or .";
• leading hyphen allowed.

Merge order

This does not break lance-graph: nothing there uses SyncTransform or the bag helpers, and lance-graph #1392's lance-graph-dir-sim suite passes against this head.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

---

Generated by Claude Code

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: a6cbc18c-651c-4b64-b0d4-07a72d669aee

📥 Commits

Reviewing files that changed from the base of the PR and between 8138547 and 92daae8.

📒 Files selected for processing (10)

• crates/ogar-ad/src/lib.rs
• crates/ogar-ad/tests/main.rs
• crates/ogar-az/src/lib.rs
• crates/ogar-az/tests/main.rs
• crates/ogar-dir-core/src/lib.rs
• crates/ogar-dir-core/src/schema.rs
• crates/ogar-dir-core/src/sid.rs
• crates/ogar-dir-core/tests/main.rs
• crates/ogar-dir-sim/src/exchange.rs
• docs/DIRECTORY-SIMULATION-POC.md

 _________________________________________________
< Energizer Bunny with a computer science degree. >
 -------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T22:00:04.433612Z	92daae8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.