Repository navigation
id(boards): Post embed_ref is never validated — dangling and cross-board game-post references are accepted into BoardGraph #3963
Description
Bug
BoardGraph validates every object reference a Post carries — thread, parent post, and each attachment get existence + same-board scope checks via require_scoped — except embed_ref. A post whose embed_ref names a hash that is not in the graph at all, or a post that lives in a different board, is accepted into the graph. The module header promises the graph "checks signatures, canonical references, board scope, and the authority rules needed to accept an object" (pkgs/id/src/boards.rs:3-9); embed_ref is the one reference class that escapes that promise.
Evidence (verified this run, main @ e860d3a)
pkgs/id/src/boards.rs:62-68—GamePostRef { object: ArtifactHash }, "Hash of the immutable signed game-post object."pkgs/id/src/boards.rs:145—Post.embed_ref: Option<GamePostRef>.pkgs/id/src/boards.rs:505-524— theBoardObject::Postarm ofvalidate_linkschecksrequire_board,require_scoped(thread), the parent post (incl. same-thread), and every attachment —embed_refis never read.- Laptop probe
~/git/fleet/probe-2026-11-01-laneB-boards/(verbatimboards.rs, sha256bcc08b3e…matching the repo file @ e860d3a; faithful minimalSignedArtifactharness; all 8 built-in boards tests pass):- post with
embed_ref= hash of a nonexistent object → insert Ok (accepted) - post with
embed_ref= a real post in a different board → insert Ok (accepted) - controls: the same missing hash as an attachment → insert Err; the same foreign post as an attachment → insert Err
- post with
Why it matters
The board graph is the validation substrate every later layer (replication #3806, board views #2813) will trust: an object in the graph is supposed to have had its references checked. A dangling embed reference means projections must re-validate (or render broken embeds), and a cross-board embed reference breaks the board-scope invariant the rest of the module enforces everywhere else — including for the attachments on the very same post.
Acceptance criteria
- A
Postwhoseembed_refnames an object not present in the graph is rejected atBoardGraph::insertwith a clear error. - A
Postwhoseembed_refnames an object scoped to a different board is rejected at insert. - The expected kind of the referenced object is decided and documented (a dedicated game-post object kind does not exist yet in v1; at minimum existence + same-board scope via
require_scoped, with the kind rule stated in the code/docs for when the game-post type lands). - Regression tests in the
boards.rstest module cover the missing-object and cross-boardembed_refcases, mirroring the existing attachment controls. - All existing boards tests still pass.
Activity
dezren39 commentedon Nov 1, 2026
🤖 Agent note · filed
Post.embed_refinBoardGraph::validate_links(existence + same-board scope, like attachments), decide/document the expected referenced kind, and add regression tests for missing and cross-board embed references.dezren39 commentedon Nov 2, 2026
🤖 Agent note · adopted as Phase 1 of design #4113
embed_refis validated in thePostarm ofvalidate_linksviarequire_scoped(existence + same-board scope), and the kind rule is stated in the module doc: in v1 the target must be aPost— the only game-post object kind in the graph; when a dedicated game-post kind lands, the kind check updates in the same change that adds the kind. Lazy/projection-time validation was considered and rejected on Design: one signed set, one meaning — BoardGraph's gates hold at insert, projection and replication (pkgs/id) #4113.source/design-architect. Existing queued triage packet stands.66 remaining items
dezren39 commentedon Nov 3, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done