Repository navigation
Phase 4 (audit) of #4202 — closing field-by-field disposition for pkgs/id app_manifest #4203
Description
Phase 4 (audit) of design #4202 — closing field-by-field disposition for pkgs/id app_manifest
Parent design: #4202 ("the app folder is the unit of trust — one gate for what an app manifest may name"). Design doc: files/designs/code-id-app-manifest-folder-contract.md in the keep-the-four-repos-healthy goal workspace. Audit baseline: origin/main cc5effd8.
Gated on Phases 1–3 of the design: Phase 1 = #4059 + #4067 (folder confinement: [resources].files under program.source's component rule; symlinked folders resolved and contained), Phase 2 = #4085 + #4168 (one entry rule for every list field — non-blank, unpadded, no duplicates), Phase 3 = #4060 + #4061 (route/socket shape + uniqueness across the discovered set; missing root as a named error). Do not start the inventory before all three land.
Scope
A field-by-field disposition of pkgs/id/src/app_manifest.rs against the #4202 contract, recorded in the module doc: every AppManifest field (app.id/name/version/description, program.kind/source/module_hash, interfaces.cli.commands, interfaces.web.mode/route/socket, capabilities.request, resources.files) and every discover_apps behaviour (root read, entry filtering, per-app error isolation, the program.source existence check, sort order), each dispositioned as gated-by-a-named-rule / deliberately ungated with the reason.
Required dispositions (named in the design; each must be answered explicitly, not passed over):
- Symlinks inside a real app folder — the posture for the
program.sourceexistence check and for pack-time[resources].filesresolution (the pack step's confinement question): state the discovery-side rule and name the pack step as the owner of the pack-time half, or file it. - Empty
files = []— decision 3 of The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202 keeps it legal (optional section, packages nothing); record the posture in the module doc so it is deliberate, or file the change if the inventory shows a consumer that reads it as a defect. - Route edge spellings — trailing slash,
//segments,route = "/": disposition each against the Phase 3 segment-sanity rule (holds / tightened here if small / filed). - App-
iduniqueness — structural via the folder-name-equality check (one folder name, one directory entry): state it in the module doc, do not add a redundant check. [program].kindvocabulary — a free string today with one checked-in value ("roc-world"): disposition only (no enumeration without a second kind).- Uniqueness against the host's own routes — The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202 decision 4 leaves this to id: implement the [interfaces.web] adapter binding — parameterise /world + /ws/world from app.toml #2325's binding (it owns the host route table): record that disposition and confirm id: implement the [interfaces.web] adapter binding — parameterise /world + /ws/world from app.toml #2325's scope names it, or file the gap.
Acceptance criteria
- The disposition table is in the
app_manifest.rsmodule doc, covering every field and discovery behaviour above, each cell dispositioned (gated by rule / deliberately ungated with reason / filed follow-up). - All six required dispositions are answered explicitly in the table.
- A summary with any findings is posted on design The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202.
- Any confirmed same-shape gap (a field a consumer trusts that no rule gates, a discovery behaviour that can fail silently) is either fixed under this issue — only if small and within one field — or filed as a named follow-up issue linked from The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202. Never left as a comment-only finding.
- No behaviour changes beyond the dispositions taken; existing app_manifest tests still pass (CI).
🤖 Filed by the design architect (pass 36, 2026-11-01) as Phase 4 (audit) of design #4202.
Activity
dezren39 commentedon Nov 2, 2026
🤖 Agent note · filed as Phase 4 (audit) of design #4202, pass 36
source/design-architect,status/blocked,queue/queued.dezren39 commentedon Nov 2, 2026
agent-note:v1 — picked up
Agent: repo-worker-code (OpenChamber scheduled lane)
Task: repo-health-code-pilot task 6098 (triage)
Started: 2026-11-02T05:41Z
Plan: verify #4203 and design #4202 against fresh GitHub/main state, record Phases 1–3 gating, then complete triage or park with a resume brief.
dezren39 commentedon Nov 2, 2026
Triage verdict — Phase 4 remains gated
Scope matches design #4202 and its six required dispositions. Fresh GitHub state: #4202 and all Phase 1–3 issues are OPEN; no open app_manifest PR clears the gate. Current main is
b1523ee0a3c13e75ca5504e0bfab7acacec4afd2.app_manifest.rsstill does not validate[resources].filespaths, and discovery still filters onpath.is_dir()without resolving/containing symlink targets.[resources].filesentry validation./, has no route/socket segment or discovered-set uniqueness gate, and silently returns default discovery on a missing root.PR #4082 is merged, but it implements the separate #4063 value-validation scope; its body explicitly leaves #4059 and #4060 untouched. It does not clear these gates. Phase 4 is independently scoped as written, but must not start until Phases 1–3 land.
Disposition: keep #4203
status/blocked. No implementation packet is enqueued yet: an immediately claimable packet would let a worker start before the prerequisites land, contrary to this issue’s explicit gate. Enqueue the Phase 4 follow-up with the acceptance criteria intact after all six prerequisite issues are resolved and the corresponding behavior is verified on main. Follow-up verification belongs in CI, including thepkgs/idapp-manifest tests; no local build was run for this triage.29 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
is_safe_web_pathempty-segment tightening; summary posted on The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202). Codex review completed at head6415eca3awith no findings; targeted tests pass on the laptop (22 app_manifest tests). The only check, production line-limit, is still QUEUED after 5+ minutes (Actions runner backlog).docs(id): Phase 4 app_manifest disposition table; reject empty web-pa…
dezren39 commentedon Nov 4, 2026
🤖 Agent note · done