Repository navigation
Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232
Description
Phase 3 (closing audit) of design #3231 — "a signed artifact is validated as strictly as it is built: one receipt contract for pkgs/id artifacts" (design doc: files/designs/code-id-artifact-receipt-validation.md in the keep-the-four-repos-healthy goal workspace). Filed by design-architect pass 28 (2026-10-31); gated on Phases 1–2 of #3231 landing (Phase 1: #3196 + #3146, list integrity; Phase 2: #3192 + #3187, text fields).
Scope
Build the field-by-field disposition table for pkgs/id/src/artifact.rs: every field of every known kind (friend_remove, home_declared, document, tag) plus every envelope field (author, seq, prev, kind, body, after, hash, signature), set against the producer or sibling-validator rule that governs it (directory.rs producers, documents.rs DocumentRef::check, tag_claims.rs check_text, chain.rs ChainExt::validate, world_hub.rs validate_world_name). Each field is dispositioned in the closing evidence:
- (a) enforced at receipt — name the check in
check()/parsed()and the phase that landed it, or - (b) deliberately unvalidated — with the one-line reason, or
- (c) a gap the phases missed and rule 1 of Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231 covers — file it as a named follow-up and link it here; do not fix it inside this audit.
Explicit dispositions required
- The
kindstring of unknown kinds: length/NFC bounds (chain kinds are 1..=MAX_KIND_BYTES and NFC) versus the module's stored-but-never-applied forward-compatibility rule for future kinds. Decide and record the trade. document.contentinternal strings:chain.rscheck_valuerequires NFC for every text string including map keys; the artifact document rule governs onlymedia_type(thedocuments.rsprecedent). Disposition whether content text is governed data or opaque payload.prev's shape beyond the chain-position equalityArtifactLog::storealready enforces.- Full builder-side symmetry:
documents.rs/chain.rsbuilders apply their checks at build time; artifactsignis generic over kind strings including future kinds. Record whethersignshould runparsed()for known kinds, with the reasoning (Phase 1 pins only the duplicate-afterrefusal insign_after). world_idcharset evidence: gather howArtifactLog::declared()consumers resolve aworld_idto a served world (the design doc's open question —validate_world_name'sa-z0-9-_versusWorldCore::new's any-non-blank rule). Record the evidence here; pinning the charset, if warranted, is a follow-up filed from this audit, not a fix inside it.
Contract statement
Write the #3231 rule into the artifact.rs module doc — the builder/decoder symmetry sentence documents.rs and chain.rs already carry, in artifact terms: a signed artifact is validated at receipt (check() + parsed()) against every rule its producers and the crate's sibling validators obey; a signed list names each thing once; text fields follow the crate's text rules. Note the unknown-kind exception in the same paragraph.
Acceptance
- Disposition table posted on this issue (or a linked PR): every known-kind field and envelope field with a disposition (a)/(b)/(c)
- The five explicit dispositions above are each recorded with their reasoning
- Any (c) follow-ups filed and linked; no fixes landed inside this audit issue itself
- Contract statement landed in the
artifact.rsmodule doc; design issue Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231 closed with a link to this evidence - This phase did not start before Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231 Phases 1–2 landed (record their closing state in the evidence)
Activity
dezren39 commentedon Oct 31, 2026
🤖 Design-architect pass 28 (2026-10-31) — agent note: this issue is Phase 3 (closing audit) of design #3231 ("a signed artifact is validated as strictly as it is built"), filed this pass as a sub-issue of #3231 (verified in #3231's sub_issues list: 3196, 3146, 3192, 3187, 3232), labelled source/design-architect + status/blocked, with a triage packet enqueued to repo-health-code-pilot as task 4727 (verified: queue=repo-health-code-pilot, status=queued, attempts=0, last_error=null). It is GATED on Phases 1–2 of #3231 (Phase 1 = #3196 + #3146; Phase 2 = #3192 + #3187) — triage should record the gating and keep status/blocked until both land; do not start the field-by-field audit early. Design doc: files/designs/code-id-artifact-receipt-validation.md in the keep-the-four-repos-healthy goal workspace.
dezren39 commentedon Oct 31, 2026
🤖 Agent note · picked up
321 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · picked up
requestsis the one known-kind body parsed() never validates — any count, any shape, any length passes, and every string lands permanently in the directory's removed_requests void guard #3146, issue id(artifact): parsed() accepts non-NFC text in document and tag — media_type, tag name and value bypass the NFC rule documents.rs and tag_claims.rs both enforce #3192, issue id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187 must all be CLOSED before the audit startsdezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
requestsis the one known-kind body parsed() never validates — any count, any shape, any length passes, and every string lands permanently in the directory's removed_requests void guard #3146 CLOSED, issue id(artifact): parsed() accepts non-NFC text in document and tag — media_type, tag name and value bypass the NFC rule documents.rs and tag_claims.rs both enforce #3192 CLOSED, issue id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187 OPEN (itself parked; blocker issue id(artifact): peer pulls halt on pre-upgrade home_declared entries — the #3187 strict receipt needs a trusted historical cutoff for receive_artifact #4459 OPEN; PR fix(id/artifact): bound home_declared world_id and refuse duplicate endpoints (#3187) #4432 OPEN, Drew-authored, untouched)dezren39 commentedon Nov 4, 2026
Agent note — task 4733 parked (gate re-checked fresh, lane code-p)
requestsis the one known-kind body parsed() never validates — any count, any shape, any length passes, and every string lands permanently in the directory's removed_requests void guard #3146 CLOSED, id(artifact): parsed() accepts non-NFC text in document and tag — media_type, tag name and value bypass the NFC rule documents.rs and tag_claims.rs both enforce #3192 CLOSED; id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187 still OPEN (status/parked, queue/parked, work/assigned) — the only remaining gate. Its fix PR fix(id/artifact): bound home_declared world_id and refuse duplicate endpoints (#3187) #4432 is still OPEN and unmerged, and issue id(artifact): peer pulls halt on pre-upgrade home_declared entries — the #3187 strict receipt needs a trusted historical cutoff for receive_artifact #4459 (historical-cutoff follow-up for id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187) is OPEN.dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
requestsis the one known-kind body parsed() never validates — any count, any shape, any length passes, and every string lands permanently in the directory's removed_requests void guard #3146 CLOSED, id(artifact): parsed() accepts non-NFC text in document and tag — media_type, tag name and value bypass the NFC rule documents.rs and tag_claims.rs both enforce #3192 CLOSED, but id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187 is still OPEN (parked). Per the packet's hard gate, the audit does not begin.dezren39 commentedon Nov 4, 2026
Agent note — task 4733 completed as superseded (lane code-b)
ghat 2026-11-04T17:41Z.requestsis the one known-kind body parsed() never validates — any count, any shape, any length passes, and every string lands permanently in the directory's removed_requests void guard #3146, id(artifact): parsed() accepts non-NFC text in document and tag — media_type, tag name and value bypass the NFC rule documents.rs and tag_claims.rs both enforce #3192, id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187 all CLOSED (issue id(artifact): home_declared world_id gets only an is_empty check in parsed() — a 100 KB, whitespace-only, control- or bidi-bearing world_id is accepted and stored, and the same endpoint can be listed twice with different worlds #3187 closed via merged PR fix(id/artifact): bound home_declared world_id and refuse duplicate endpoints (#3187) #4432 at 2026-11-04T15:37Z).superseded; queue/status/work labels cleared.docs(id): complete #3232 receipt validation audit
Merge pull request #5626 from developing-today/fix/id-3232