bip93: reject HRPs longer than 83 characters by BenWestgate · Pull Request #33 · BenWestgate/python-codex32

BenWestgate · 2026-09-22T20:08:54Z

Fixes #32.

BIP-93 specifies a generalized human-readable part using the BIP-173 grammar, including the 1–83 character HRP limit. Enforce that limit in bech32_decode, where Bech32-like strings cross the decoding boundary, and reject overlong public correction-context HRPs as well.

The regression coverage uses the generalized-HRP draft vectors from BenWestgate/bips PR #2 at 01374bf: the valid 83-character HRP, invalid 84-character HRP, generalized-HRP share/recovery vectors, expanded-codeword 94/95 gap cases, and lowercase-HRP checksum rule. The obsolete >83-character frozen vectors were removed rather than repurposed as checksum-layer tests.

Current head b1b1b27 is the same four focused, human-authored commits mechanically replayed onto refreshed #13. All four stable patch-ids are unchanged./ No HRP behavior or vector content changed during the restack; the PR now targets #13 so GitHub shows only the four HRP commits. /

Validation on the resolved tree:

tests/test_generic_hrp.py + tests/test_correction_bch.py: 105 passed;
strict mypy: clean across all 21 source files;
git diff --check: clean;
the resolved pre-rebase merge tree and final rebased tree have the same tree hash (521f07bf);
exact-head GitHub push and pull-request matrices are fully green across Python 3.10–3.15 compatibility and the 3.12/3.13 Linux/macOS/Windows test matrix;
no unresolved review threads remain.

Keep the generalized BIP93/BIP173 vectors as the source of truth; do not resurrect removed >83-character frozen vectors as checksum-layer tests.

Disclosure: AI tools were used for the authorized mechanical branch restack and verification. The four patch commits retain Ben Westgate as their author.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 605131826a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

BenWestgate · 2026-09-22T21:36:12Z

aNACK

Add the check in _decode_codex32 rather than bech32_decode: the
latter is exercised directly by the generic BIP-0173 checksum-period
test vectors, which use HRPs far longer than 83 characters to test
the long checksum's own 1023-symbol period independent of any one
application's rules.

This really belongs in bech32_decode actually as it applies to all bech32-like encodings due to limits on needing to decode the HRP to know codex32 is being used and memory issues.

Also why was this closed?

PR #33's recorded head became unreachable when this branch was rebuilt, which left the pull request unable to reopen. This merge makes the old commits reachable again without changing any file: the tree is identical to the current branch, and the superseded approach (the 83-character check in bip93.py, and the test that bypassed bech32_decode) stays superseded.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d1e43e759

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

BenWestgate · 2026-09-24T10:49:21Z

#33 is open. #35 was the superseded duplicate and was closed after its useful changes were retained here.

BenWestgate · 2026-09-24T20:50:36Z

@claude review this PR

BenWestgate · 2026-09-25T14:02:16Z

Addressed the aNACK at the current head (e49d23f): the 83-character HRP boundary is enforced in bech32_decode, not only in codex32 parsing, and the old >83 generic long-HRP vectors were removed from the accepted set. The focused boundary tests now use the generalized-HRP BIP93 vectors copied from the bip93-generalize-hrp work rather than inventing replacement vectors. Focused verification: 13 relevant generalized-HRP/context tests pass; the PR is merge-clean and CI is green.

BenWestgate

AI-generated review (Claude), posted at the maintainer's request.

ACK e49d23f, one nit.

The 83-char limit sits at the separator in bech32_decode, so every parse path gets it. CorrectionContext is covered too.
Draft vectors match 01374bf; the only later commit on that branch (87d096b) is a changelog entry.

BenWestgate

Codex current-head re-review: ACK b1b1b27.

The 83-character BIP173 HRP limit is enforced both by parsing and by correction-context validation before search. The current tests cover the 83/84 boundary and generalized-HRP vectors while removing the inappropriate oversized legacy fixture; prior provenance and context findings are resolved. Exact-head Python-package runs 638 and 639 both succeeded.

No code blocker found; ready for human integration review after #13.

BenWestgate

Codex current-head review at b1b1b27: no findings. The 83-character HRP bound is enforced consistently in decoding and correction contexts and covered by the generalized-HRP boundary vectors.

BenWestgate · 2026-10-06T13:28:04Z

@codex review

Please review current head b1b1b27d14 only. This is the final current-head audit check before human review; focus on correctness, security, and release-blocking regressions.

BenWestgate

AI-assisted current-head review: ACK b1b1b27. I rechecked the earlier HRP-boundary concern against the generalized-HRP BIP work: both the referenced staging vector commit and the current BenWestgate/bips PR #2 still specify an 83-character maximum HRP; 1023 is the expanded-codeword checksum bound, not an HRP-length allowance. This PR enforces 83 at decode and public correction-context boundaries, uses the generalized-HRP vectors directly, and removes the obsolete >83 frozen vectors rather than keeping them as checksum tests. Exact-head Python-package runs are green and there are no unresolved review threads. No correctness or release blocker found.

BenWestgate · 2026-10-23T23:03:23Z

@codex review

chatgpt-codex-connector · 2026-10-23T23:03:37Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T04:09:55.272445Z	`53621df`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-23T23:05:08Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: b1b1b27d14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-24T06:21:58Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

BenWestgate · 2026-10-24T09:07:53Z

@codex review

chatgpt-codex-connector · 2026-10-24T09:09:11Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: b36490376c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

BenWestgate

LGTM

Reject human-readable parts longer than 83 characters at the generic Bech32 decoding boundary and in correction contexts. Keep checksum-period coverage at the checksum layer so it does not depend on invalid Bech32 HRPs. Fixes #32.

Name BenWestgate/bips PR #2 as the source of the generalized-HRP draft vectors. No vector data or parser behavior changes.

BenWestgate · 2026-10-27T04:08:51Z

@codex review

chatgpt-codex-connector · 2026-10-27T04:09:54Z

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 53621df187

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

BenWestgate

LGTM

chatgpt-codex-connector Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread src/codex32/bip93.py Outdated

BenWestgate closed this Sep 22, 2026

BenWestgate deleted the fix-hrp-83-limit branch September 22, 2026 20:49

BenWestgate restored the fix-hrp-83-limit branch September 22, 2026 21:34

BenWestgate reopened this Sep 22, 2026

BenWestgate closed this Sep 22, 2026

BenWestgate deleted the fix-hrp-83-limit branch September 22, 2026 21:48

BenWestgate mentioned this pull request Sep 22, 2026

bip93: reject HRPs longer than 83 characters #35

Closed

BenWestgate reopened this Sep 23, 2026

chatgpt-codex-connector Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread tests/data/bip93_vectors.py Outdated

BenWestgate force-pushed the fix-hrp-83-limit branch from 4d1e43e to d8eebe7 Compare September 23, 2026 12:12

BenWestgate added the gate: adversarial review Resolve, merge, or explicitly defer before the next full adversarial review. label Sep 24, 2026

This comment has been minimized.

Sign in to view

BenWestgate added bip93 BIP93 encoding, checksum, parsing, and format rules. bug Something isn't working labels Sep 24, 2026

BenWestgate mentioned this pull request Sep 25, 2026

docs: Prepare the v1 review handoff #38

Open

BenWestgate mentioned this pull request Sep 25, 2026

bip93: Reject non-ASCII before normalization #13

Merged

BenWestgate commented Sep 25, 2026

View reviewed changes

Comment thread tests/data/bip93_vectors.py Outdated

BenWestgate mentioned this pull request Sep 25, 2026

docs: Record security audit verdict #23

Merged

This comment has been minimized.

Sign in to view

BenWestgate force-pushed the fix-hrp-83-limit branch from 197f7b2 to e49d23f Compare September 27, 2026 03:05

This comment has been minimized.

Sign in to view

BenWestgate force-pushed the fix-hrp-83-limit branch from 3499c1f to e49d23f Compare September 27, 2026 03:09

This comment has been minimized.

Sign in to view

BenWestgate changed the base branch from reviewability-v1 to codex/v1-ascii-normalization October 2, 2026 00:42

This comment has been minimized.

Sign in to view

BenWestgate commented Oct 3, 2026

View reviewed changes

This was referenced Oct 3, 2026

Security audit: python-codex32 findings #20

Open

gui: Require wallet identity before restore #118

Draft

BenWestgate commented Oct 6, 2026

View reviewed changes

BenWestgate mentioned this pull request Oct 6, 2026

docs: Close adversarial audit tracking gaps #127

Open

This comment has been minimized.

Sign in to view

BenWestgate commented Oct 7, 2026

View reviewed changes

BenWestgate added this pull request to stack #192 October 24, 2026 06:16

BenWestgate force-pushed the fix-hrp-83-limit branch from b1b1b27 to b364903 Compare October 24, 2026 06:21

BenWestgate commented Oct 24, 2026

View reviewed changes

Base automatically changed from codex/v1-ascii-normalization to codex/63-private-core-descriptors October 27, 2026 03:58

BenWestgate added 4 commits October 26, 2026 22:58

bip93: Enforce the BIP173 HRP limit

698b773

Reject human-readable parts longer than 83 characters at the generic Bech32 decoding boundary and in correction contexts. Keep checksum-period coverage at the checksum layer so it does not depend on invalid Bech32 HRPs. Fixes #32.

bip93: Drop oversized frozen vector

b073501

bip93: use generalized-HRP draft vectors

e18f236

tests: Correct HRP vector provenance

53621df

Name BenWestgate/bips PR #2 as the source of the generalized-HRP draft vectors. No vector data or parser behavior changes.

BenWestgate force-pushed the fix-hrp-83-limit branch from b364903 to 53621df Compare October 27, 2026 03:58

BenWestgate commented Oct 27, 2026

View reviewed changes

BenWestgate merged commit 36dbad2 into codex/63-private-core-descriptors Oct 27, 2026
20 checks passed

Conversation

BenWestgate commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

BenWestgate commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

BenWestgate commented Sep 24, 2026

Uh oh!

This comment has been minimized.

BenWestgate commented Sep 24, 2026

Uh oh!

BenWestgate commented Sep 25, 2026

Uh oh!

BenWestgate left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

BenWestgate left a comment

Choose a reason for hiding this comment

Uh oh!

BenWestgate left a comment

Choose a reason for hiding this comment

Uh oh!

BenWestgate commented Oct 6, 2026

Uh oh!

This comment has been minimized.

BenWestgate left a comment

Choose a reason for hiding this comment

Uh oh!

BenWestgate commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026

Uh oh!

BenWestgate commented Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026

Uh oh!

BenWestgate left a comment

Choose a reason for hiding this comment

Uh oh!

BenWestgate commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

BenWestgate left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BenWestgate commented Sep 22, 2026 •

edited

Loading

BenWestgate commented Sep 22, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading