How we read an airline's answer without changing it

A search product is a chain of translations. An airline’s booking engine answers in its own format; a parser turns that into structured data; a normaliser turns program-specific structures into comparable results; a page renders them. Every link is a place where a number can silently change. This article is about the machinery that keeps ours from doing that.

One direction of knowledge

Our integrations are layered with a strict rule: the transport acquires bytes and interprets nothing; the parser interprets one program’s format and knows nothing about acquisition; the adapter normalises and never sees raw bytes. Program-specific structures are forbidden from leaking past the adapter. The point is auditability — when a figure looks wrong, exactly one layer can be responsible for it.

Noticing change before it lies

The dangerous failure is not the parser that crashes — crashes are loud. It is the page that changes shape in a way the parser half-understands, so it keeps producing plausible output with wrong values. Against that we compute a structural fingerprint of every response and compare it to what the parser was built against. Drift raises a schema-change error: the search reports failure, loudly, rather than publishing a number nobody vouches for.

The parser that crashes is safe. The parser that half-understands is the dangerous one.

The replay corpus

Every response format we have ever supported lives on as a committed fixture — the real bytes, sanitised of anything personal, with the output the parser produced when we verified it by hand. The whole corpus replays in CI on every change: the current parser must reproduce every verified output exactly. A markup change at the airline fails a test; it does not quietly change a price on a page.

Fixtures are labelled by provenance — observed from a real response, derived from one, or constructed to cover an edge case — because a test corpus that cannot say which of its cases were ever real is itself an unaudited claim.

Numbers with signatures

Parsers and adapters carry versions, and every stored observation records which versions produced it. When we improve a parser, old observations keep the signature of the code that actually read them. Nothing in the archive pretends to have been read by code that did not exist yet — which sounds pedantic until the day you need to know whether a figure from March was affected by a bug fixed in April.

None of this machinery makes coverage broader. It makes one promise enforceable: that between the airline’s answer and your screen, nothing edited the number. On the day an airline grants us live access, that promise is what they are granting it to.