Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id)

Design (design-architect pass 23): reconstruction is admission — validate authority-bearing inputs where they are rebuilt.

Design doc: files/designs/code-id-reconstruction-validation.md in the keep-the-four-repos-healthy goal workspace. Audited against origin/main 206f4fd7.

Summary

Six issues filed independently in one evening are one defect with six addresses: in pkgs/id, data that carries authority is validated when it is created live, and trusted when it is reconstructed — a world journal being restored, an attestation being computed from decoded objects, a manifest being parsed, a schedule cap being checked. The live path enforces invariants (only issued, JOIN-holding participants act; claims answer the agreement they name; a manifest step means what it says); the reconstruction paths enforce almost none of them, so a crafted or corrupted artefact acquires authority the live path would never have granted.

The recorded rule: reconstruction is admission. Anywhere pkgs/id rebuilds authority-bearing state from stored or supplied data, the rebuilding code validates the same invariants the live path enforces at creation, and refuses (never partially applies, never silently repairs) data that violates them. Corollaries: validate against state you hold, not claims the input makes; unnamed means refused (scope bits, manifest keys, outcomes); the system shape (sequence 0 / participant 0) is not borrowable by authority-carrying entries.

Evidence (origin/main `206f4fd`)

pkgs/id/src/world/core.rs restore: the Committed arm's only check is sequence continuity, then commit_prepared spends by event.participant_id with no record lookup (id(world): journal restore never validates Committed/Checkpoint event authors — inputs and chat from never-issued participants restore, replay, and project #2894); the Checkpoint arm validates ordering/schedules but no author; the Issued arm validates digest/parent/expiry/uses but never scopes — unnamed bits and CHAT/INPUT without JOIN restore clean (id(world): journal restore never validates Issued scopes — unnamed bits and JOIN-less capabilities restore clean, and a CHAT-/INPUT-only token can act without ever joining #2890). The function's own doc comment promises "unknown participants" are refused.
The live invariants exist: issuance requires JOIN (core.rs issuance path, scopes.contains(WorldScopes::JOIN)), delegation subsets keep JOIN (world/mod.rs WorldScopes), admission runs authorize(token, required) per act. Restore consults none of it.
pkgs/id/src/attestation.rs compute_state: signatures (verified by chain::decode) prove who signed, not that the agreement is well-formed — players = [A, A] computes Agreed from one key (id(attestation): compute_state never checks the two players are distinct — players=[A,A] attests Agreed from one key's single genesis + single claim #2863), and a claim's free-form winner naming a third party computes Agreed (id(attestation): compute_state never validates the claim outcome's domain — claims naming a third party (or any string) as winner compute Agreed #2868).
check_schedule_replacing trusts a caller-supplied replacing: bool for the pending-schedule cap restore enforces — a mismatched flag admits a 65th pending schedule and underflows on an empty map (id(world): check_schedule_replacing trusts a caller-supplied replacing flag — a mismatched flag admits a 65th pending schedule past the cap restore enforces, and underflows on an empty map #2882). The ground truth is in self.schedules.
pkgs/id/src/world_manifest.rs: serde with defaults, no deny_unknown_fields — a typo'd grants/ceiling revocation parses clean, plans zero steps, diff says "no drift" (id(world-manifest): unknown or misspelled world.toml keys are silently ignored — a typo'd grants/ceiling revocation parses clean, plans zero steps, and diff reports 'no drift' #2876).
Safety of strictness: there are no Revoked journal entries in the enum yet, and every capability live code has issued satisfies JOIN + named bits — a strict restore cannot refuse a journal the live code actually wrote.

Phases (adopted origins — no parallel issues filed)

Phase 1 — journal restore validates authors and scopes. id(world): journal restore never validates Committed/Checkpoint event authors — inputs and chat from never-issued participants restore, replay, and project #2894 (Committed + Checkpoint author check: author issued, holding the scope its kind requires) + id(world): journal restore never validates Issued scopes — unnamed bits and JOIN-less capabilities restore clean, and a CHAT-/INPUT-only token can act without ever joining #2890 (Issued scope check: named bits only, JOIN required). One seam, the security core. Independent.
Phase 2 — attestation agreement validity. id(attestation): compute_state never checks the two players are distinct — players=[A,A] attests Agreed from one key's single genesis + single claim #2863 (players must be distinct, else Proposed) + id(attestation): compute_state never validates the claim outcome's domain — claims naming a third party (or any string) as winner compute Agreed #2868 (claim outcome domain: winner is None or one of the two players; out-of-domain claims ignored under the existing non-player rule). Independent of Phase 1.
Phase 3 — derive-don't-trust + closing audit. id(world): check_schedule_replacing trusts a caller-supplied replacing flag — a mismatched flag admits a 65th pending schedule past the cap restore enforces, and underflows on an empty map #2882 (schedule predicate derived from self.schedules; trusted parameter removed) + id(world-manifest): unknown or misspelled world.toml keys are silently ignored — a typo'd grants/ceiling revocation parses clean, plans zero steps, and diff reports 'no drift' #2876 (deny_unknown_fields on the manifest's authority-bearing structs) + a closing inventory audit of the remaining reconstruction seams (sandbox snapshot restore, world_store restore_program, directory/petname persistence), each dispositioned already-validating / fixed / exempt-with-reason, and the rule written into the restore and attestation module docs.

Alternatives considered

Fix the six sites independently: each lands, the rule stays unstated, the next seam re-opens the hole — the six-in-one-evening pattern is the evidence this is a family.
Validate at write time only: journals outlive and out-travel the writer (forks copy them, backups restore under newer binaries); restore is the only point where data, invariants and refusal coexist.
Sanitise at consumers: many consumers, one state; a phantom capability record has no single consumer to patch.
Version-gate strictness: the invariants are not new, so no legitimately-written old journal can violate them; a gate would only protect journals that were never valid.

Risks / open questions

Restore corpus (v1/v2 headers, delegate expiry, fork fixtures) must pass unchanged; if Phase 1 triage finds a legitimate historical scope/kind mismatch, the issued-author check stands and the mismatch is filed as evidence — the check is not silently dropped.
Manifest strictness: Phase 3 greps the repo's own manifest writers/fixtures for extra keys before the attribute lands.
Open questions stay in the design doc (Revoked-entry semantics when that feature arrives; payload-shape validation at replay is execution, not admission; outcome domains for non-duel agreements; sandbox snapshot integrity if the audit finds authority flowing through it).

Agent note: this issue is the design of record for #2894, #2890, #2863, #2868, #2882, #2876 — they are adopted as its phases and linked as sub-issues. Their triage should record the phase structure, not re-file or split them.

Acceptance criteria

Every authority-bearing reconstruction path in pkgs/id named by this design (journal restore, attestation computation, manifest parsing, schedule checks) validates the same invariants its live creation path enforces, and refuses — never partially applies, never silently repairs — violating input.
Each of the six filed instances (id(world): journal restore never validates Committed/Checkpoint event authors — inputs and chat from never-issued participants restore, replay, and project #2894, id(world): journal restore never validates Issued scopes — unnamed bits and JOIN-less capabilities restore clean, and a CHAT-/INPUT-only token can act without ever joining #2890, and the siblings named in the design doc) is either fixed under this contract or explicitly dispositioned against it.
Regression tests exist for at least the journal-restore and attestation paths proving crafted/corrupted artefacts are refused.
The recorded rule ("reconstruction is admission") is documented where a future reconstruction path author will find it.

Agent note (design-architect, 2026-10-30): design of record for the six adopted origins, linked as sub-issues and labelled source/design-architect: Phase 1 = #2894 + #2890 (journal restore), Phase 2 = #2863 + #2868 (attestation), Phase 3 = #2882 + #2876 (derive-don't-trust + manifest strictness + closing audit). Each origin already carries a queued triage packet (queue/queued verified at filing); no new implementation issues or packets were created by this design — triage of each origin should record its phase structure and the decisions noted on it, not re-file or split. Phase 3 closes this issue with the closing-audit evidence. Register: added to files/potential-projects.md (status: proposed).

Correction (design-architect, same pass): the design doc has been amended after a full read of the six origins' acceptance criteria. Three corrections of record:

Participant 0 is a legitimate Committed author (host chat + ProgramInstalled, per id(world): journal restore never validates Committed/Checkpoint event authors — inputs and chat from never-issued participants restore, replay, and project #2894's acceptance) — the author rule is "0, or issued earlier in the journal and not revoked before that entry"; events by a participant revoked later stay valid. An earlier draft of the doc wrongly implied participant-0 events were borrowable system shape only, and wrongly stated Revoked entries do not exist — they do, and their restore arm already validates; the Committed/Checkpoint arms simply never consult revocation state.
The attestation outcome domain includes the "draw" sentinel (documented on ResultClaim.outcome) alongside the two seat players' id-as-hex — not a None winner. Whether an out-of-domain claim is ignored or counts as a position is id(attestation): compute_state never validates the claim outcome's domain — claims naming a third party (or any string) as winner compute Agreed #2868's triage pin.
Phase 1's Issued arm also carries id(world): journal restore never validates Issued scopes — unnamed bits and JOIN-less capabilities restore clean, and a CHAT-/INPUT-only token can act without ever joining #2890's adjacent ruling (delegate scopes vs parent's implied scopes), and Phase 3's manifest strictness names WorldExecutionProfile (world_limits.rs) plus the commands/world.rs JSON round-trip check from id(world-manifest): unknown or misspelled world.toml keys are silently ignored — a typo'd grants/ceiling revocation parses clean, plans zero steps, and diff reports 'no drift' #2876's acceptance.

The design doc (files/designs/code-id-reconstruction-validation.md) now states all three; the per-issue notes have matching corrections.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-j
Session / ID: task 9204
Found via: queue claim
Task: task 9204 (triage, issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898) claimed and revalidated fresh: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 OPEN, no hard-stop labels. Execution lane assigned opencode — handing off to the opencode claimant, which launches the bound session to triage and route per the packet.
Expectation: effort/l; done when the triage verdict is posted and the fix packet is enqueued (or the issue is closed with evidence)
Links: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-v
Session / ID: task 9204
Found via: queue claim
Task: Handing task 9204 (triage, issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898) to the opencode claimant — execution lane assigned opencode; the claimant launches the bound session. Fresh revalidation: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 OPEN, no held / user/owned / do-not-merge / do-not-auto-edit labels. Design triage (epic); prior progress already handed off once at 14:33Z - this is a re-handoff after lease expiry.
Expectation: claimant session works task 9204 to a terminal state under this queue's worker id
Links: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898

agent-note:v1
task: 9204
lane: code-y
stage: handed_off
execution_lane: opencode
Issue #2898 verified OPEN (expedite), no hard-stop labels; parked labels resynced to queue/claimed + status/in-progress. Task 9204 claimed by lane code-y (attempt 4/6) and handed off to the opencode claimant for triage and routing.

agent-note:v1
event: handed_off
task: 9204
worker: repo-worker-code (lane code-f)
stage: handed_off
summary: Task 9204 (triage) re-claimed by lane code-f; execution-lane assignment again returned assigned_lane=opencode (session_id null), so this lane hands off per the runbook without working it directly. The opencode claimant remains the owner for launching the bound session.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-a
Session / ID: task 9204
Found via: queue claim
Task: task 9204 (triage) for issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 re-claimed by lane code-a; execution-lane assignment returned opencode, so the task is handed off — the laptop opencode-claimant launches a bound session to drive it to its terminal state. Caution: task 9204 is at attempt 11 of 12 — if the claim lease expires unbound once more it may hit the attempts cap.
Expectation: the bound opencode session triages issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 (reconstruction-is-admission validation design for pkgs/id) and routes it: enqueue the fix packet or close with evidence if already resolved.
Links: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-e
Session / ID: task 9204
Found via: queue claim
Task: triage for issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 handed off to the opencode execution lane; the laptop claimant launches the bound opencode session for task 9204
Expectation: claimant session drives task 9204 to its terminal state
Links: n/a

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-t
Session / ID: task 9204
Found via: queue claim
Task: task 9204 (triage) for issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 was assigned to the opencode execution lane; handing off to the opencode claimant. Issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 verified OPEN fresh with no hard-stop labels; labels already synced (queue/claimed, status/in-progress, work/assigned).
Expectation: the claimant launches the bound opencode session for task 9204; that session drives the triage of issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 to its terminal state.
Links: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898

Agent note — picked up, handed off to opencode claimant (task 9204)

Task: task 9204 (repo-health-code-pilot, lane code-r, 2026-11-05). Execution-lane assignment returned opencode, so this worker does not work the task directly.
Fresh revalidation: issue Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898 OPEN, no hard-stop labels. Attempts now 15/24.
Handoff: checkpointed stage handed_off; the laptop opencode-claimant launches the bound session for task 9204.

Navigation Menu

Repository navigation

Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898

Summary

Evidence (origin/main `206f4fd`)

Phases (adopted origins — no parallel issues filed)

Alternatives considered

Risks / open questions

Acceptance criteria

62 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Design: reconstruction is admission — validate authority-bearing inputs where they are rebuilt (pkgs/id) #2898

Description

Summary

Evidence (origin/main 206f4fd)

Phases (adopted origins — no parallel issues filed)

Alternatives considered

Risks / open questions

Acceptance criteria

Activity

dezren39 commented on Oct 31, 2026

dezren39 commented on Oct 31, 2026

62 remaining items

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (origin/main `206f4fd`)