FAILURE MAP
← Case archive

FA-74141 / Feature flag rollout bucketing / Open access

Multi-context canonical key: Any single-kind context uses a bare key · case 01

An org-only context collides with a user whose key equals the org key.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The bare-key shortcut applies to any single context rather than only to the user kind.

VERIFIED REPAIR

Use the bare key only for a context consisting solely of kind "user".

Unsuccessful approach: Using the bare key whenever a user kind is present collapses multi-kind contexts.

Case contract

contexts maps kind -> key. Empty input or any empty key -> None. A context containing only the kind "user" is keyed by the bare user key. Otherwise join, over kinds in sorted order, kind + ":" + escaped key with ":", where escaping replaces "%" by "%25" and then ":" by "%3A".

Why this case matters

Canonical context keys feed bucketing and caches; two spellings of one context split its traffic.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(contexts):
    def esc(s):
        return s.replace('%', '%25').replace(':', '%3A')
    if not contexts or any(k == '' for k in contexts.values()):
        return None
    if len(contexts) == 1:
        return next(iter(contexts.values()))
    return ':'.join(kind + ':' + esc(contexts[kind]) for kind in sorted(contexts))
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('percent is escaped before colon', [{'org': 'a:b', 'user': '50%'}], 'org:a%3Ab:user:50%25'),
  ('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 1', [{'device': '50%', 'user': 'z', 'app': 'a:b'}], 'app:a%3Ab:device:50%25:user:z'),
  ('context sample 2', [{'device': 'acme', 'user': 'z', 'org': 'z'}], 'device:acme:org:z:user:z')],
 [('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 4', [{'user': 'z', 'org': 'a:b'}], 'org:a%3Ab:user:z'),
  ('context sample 33', [{'org': 'x%3Ay'}], 'org:x%253Ay')],
 [('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('context sample 11', [{'org': 'x%3Ay', 'app': 'a:b', 'device': 'z'}], 'app:a%3Ab:device:z:org:x%253Ay'),
  ('context sample 49', [{'device': 'x%3Ay', 'user': 'x%3Ay'}], 'device:x%253Ay:user:x%253Ay'),
  ('context sample 59', [{'org': 'z'}], 'org:z')],
 [('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 16', [{'org': 'x%3Ay', 'app': 'z'}], 'app:z:org:x%253Ay'),
  ('context sample 28', [{'app': 'acme'}], 'app:acme')],
 [('percent is escaped before colon', [{'org': 'a:b', 'user': '50%'}], 'org:a%3Ab:user:50%25'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 7', [{'org': 'a:b', 'device': 'a:b', 'user': 'z'}], 'device:a%3Ab:org:a%3Ab:user:z'),
  ('context sample 21', [{'org': 'x%3Ay', 'app': 'z'}], 'app:z:org:x%253Ay'),
  ('context sample 55', [{'app': 'bob'}], 'app:bob')]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
percent is escaped before colonorg:a%3Ab:user:50%25org:a%3Ab:user:50%25Passed
already escaped text is escaped againorg:x%253Ay:user:boborg:x%253Ay:user:bobPassed
kinds are sorted regardless of insertionorg:acme:user:boborg:acme:user:bobPassed
single non-user kind is prefixedacmeorg:acmeFailed
single user kind stays bare with colona:ba:bPassed
three kindsapp:z:device:d1:user:bobapp:z:device:d1:user:bobPassed
context sample 1app:a%3Ab:device:50%25:user:zapp:a%3Ab:device:50%25:user:zPassed
context sample 2device:acme:org:z:user:zdevice:acme:org:z:user:zPassed

SHA-256 / f552ff35f62cd41c18b124db92723ccb83c5cc07f4022c5d9879e96fd1254632

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(contexts):
    def esc(s):
        return s.replace('%', '%25').replace(':', '%3A')
    if not contexts or any(k == '' for k in contexts.values()):
        return None
    if 'user' in contexts:
        return contexts['user']
    return ':'.join(kind + ':' + esc(contexts[kind]) for kind in sorted(contexts))
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('percent is escaped before colon', [{'org': 'a:b', 'user': '50%'}], 'org:a%3Ab:user:50%25'),
  ('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 1', [{'device': '50%', 'user': 'z', 'app': 'a:b'}], 'app:a%3Ab:device:50%25:user:z'),
  ('context sample 2', [{'device': 'acme', 'user': 'z', 'org': 'z'}], 'device:acme:org:z:user:z')],
 [('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 4', [{'user': 'z', 'org': 'a:b'}], 'org:a%3Ab:user:z'),
  ('context sample 33', [{'org': 'x%3Ay'}], 'org:x%253Ay')],
 [('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('context sample 11', [{'org': 'x%3Ay', 'app': 'a:b', 'device': 'z'}], 'app:a%3Ab:device:z:org:x%253Ay'),
  ('context sample 49', [{'device': 'x%3Ay', 'user': 'x%3Ay'}], 'device:x%253Ay:user:x%253Ay'),
  ('context sample 59', [{'org': 'z'}], 'org:z')],
 [('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 16', [{'org': 'x%3Ay', 'app': 'z'}], 'app:z:org:x%253Ay'),
  ('context sample 28', [{'app': 'acme'}], 'app:acme')],
 [('percent is escaped before colon', [{'org': 'a:b', 'user': '50%'}], 'org:a%3Ab:user:50%25'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 7', [{'org': 'a:b', 'device': 'a:b', 'user': 'z'}], 'device:a%3Ab:org:a%3Ab:user:z'),
  ('context sample 21', [{'org': 'x%3Ay', 'app': 'z'}], 'app:z:org:x%253Ay'),
  ('context sample 55', [{'app': 'bob'}], 'app:bob')]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
percent is escaped before colon50%org:a%3Ab:user:50%25Failed
already escaped text is escaped againboborg:x%253Ay:user:bobFailed
kinds are sorted regardless of insertionboborg:acme:user:bobFailed
single non-user kind is prefixedorg:acmeorg:acmePassed
single user kind stays bare with colona:ba:bPassed
three kindsbobapp:z:device:d1:user:bobFailed
context sample 1zapp:a%3Ab:device:50%25:user:zFailed
context sample 2zdevice:acme:org:z:user:zFailed

SHA-256 / 2cbd7c77ad1f85ccad5a606b424b3a0ea0fc8ddf8325cc0082184a3f0b77ffeb

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(contexts):
    def esc(s):
        return s.replace('%', '%25').replace(':', '%3A')
    if not contexts or any(k == '' for k in contexts.values()):
        return None
    if list(contexts) == ['user']:
        return contexts['user']
    return ':'.join(kind + ':' + esc(contexts[kind]) for kind in sorted(contexts))
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('percent is escaped before colon', [{'org': 'a:b', 'user': '50%'}], 'org:a%3Ab:user:50%25'),
  ('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 1', [{'device': '50%', 'user': 'z', 'app': 'a:b'}], 'app:a%3Ab:device:50%25:user:z'),
  ('context sample 2', [{'device': 'acme', 'user': 'z', 'org': 'z'}], 'device:acme:org:z:user:z')],
 [('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 4', [{'user': 'z', 'org': 'a:b'}], 'org:a%3Ab:user:z'),
  ('context sample 33', [{'org': 'x%3Ay'}], 'org:x%253Ay')],
 [('kinds are sorted regardless of insertion', [{'user': 'bob', 'org': 'acme'}], 'org:acme:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('context sample 11', [{'org': 'x%3Ay', 'app': 'a:b', 'device': 'z'}], 'app:a%3Ab:device:z:org:x%253Ay'),
  ('context sample 49', [{'device': 'x%3Ay', 'user': 'x%3Ay'}], 'device:x%253Ay:user:x%253Ay'),
  ('context sample 59', [{'org': 'z'}], 'org:z')],
 [('already escaped text is escaped again', [{'org': 'x%3Ay', 'user': 'bob'}], 'org:x%253Ay:user:bob'),
  ('single non-user kind is prefixed', [{'org': 'acme'}], 'org:acme'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 16', [{'org': 'x%3Ay', 'app': 'z'}], 'app:z:org:x%253Ay'),
  ('context sample 28', [{'app': 'acme'}], 'app:acme')],
 [('percent is escaped before colon', [{'org': 'a:b', 'user': '50%'}], 'org:a%3Ab:user:50%25'),
  ('single user kind stays bare with colon', [{'user': 'a:b'}], 'a:b'),
  ('empty key is invalid', [{'org': 'acme', 'user': ''}], None),
  ('empty mapping is invalid', [{}], None),
  ('three kinds', [{'device': 'd1', 'app': 'z', 'user': 'bob'}], 'app:z:device:d1:user:bob'),
  ('context sample 7', [{'org': 'a:b', 'device': 'a:b', 'user': 'z'}], 'device:a%3Ab:org:a%3Ab:user:z'),
  ('context sample 21', [{'org': 'x%3Ay', 'app': 'z'}], 'app:z:org:x%253Ay'),
  ('context sample 55', [{'app': 'bob'}], 'app:bob')]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
percent is escaped before colonorg:a%3Ab:user:50%25org:a%3Ab:user:50%25Passed
already escaped text is escaped againorg:x%253Ay:user:boborg:x%253Ay:user:bobPassed
kinds are sorted regardless of insertionorg:acme:user:boborg:acme:user:bobPassed
single non-user kind is prefixedorg:acmeorg:acmePassed
single user kind stays bare with colona:ba:bPassed
three kindsapp:z:device:d1:user:bobapp:z:device:d1:user:bobPassed
context sample 1app:a%3Ab:device:50%25:user:zapp:a%3Ab:device:50%25:user:zPassed
context sample 2device:acme:org:z:user:zdevice:acme:org:z:user:zPassed

SHA-256 / 30c106d47e78a9bf7a45c975b5546a47d63599068468f45534d4b2c9d94cac7b

Verification & scope

A deterministic toy flag-evaluation model with a stipulated contract; it does not reproduce any vendor SDK byte for byte. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:48:53.902157+00:00.

Case digest / e75571c6fbd9eb0ea6f69b2bd5dbc4deffbd3e110c9980e44a0ef3946b5015fc