Repository navigation
id(artifact): preserve pre-upgrade log replay for duplicate after and non-NFC fields #5625
Description
Receipt-audit follow-up from #3232 / design #3231
The new receipt checks for duplicate after hashes (#3196) and NFC in document.media_type / tag.name / tag.value (#3192) are unconditional on local replay today. ArtifactLog::open re-runs verify() and parsed_for_replay(), but verify() always checks the duplicate-after rule and parsed_mode(replay=true) still checks those NFC fields.
Before those checks landed, the supported artifact producer path could persist these shapes: SignedArtifact::sign_after accepted duplicate after entries, and Directory.publish_document / publish_tag passed text through the then-lenient parser. Such logs were accepted at the time; reopening them now fails, contrary to #3231's replay-compatibility criterion. Tests cover the home_declared replay exception and duplicate friend_remove replay, but not these pre-upgrade after/NFC cases.
Scope
- Decide and implement a trusted legacy boundary or narrowly scoped replay compatibility for these rules, while keeping fresh receipts strict.
- Add fixtures proving legacy logs reopen and new receipts with the same invalid shapes remain refused.
- Keep genuinely corrupt/authenticity failures strict.
- Coordinate with id(artifact): peer pulls halt on pre-upgrade home_declared entries — the #3187 strict receipt needs a trusted historical cutoff for receive_artifact #4459's artifact-format cutoff for remote peer pulls; do not reuse local replay leniency as a blanket remote-receipt policy.
This follow-up is separate from the #3232 audit; the audit records the gap and links this issue without changing validation behavior.
Acceptance criteria
- Pre-upgrade artifact logs containing duplicate
afterentries or non-NFCdocument.media_type/tag.name/tag.valuevalues reopen successfully under a narrowly scoped, trusted legacy replay boundary. - Fresh receipts with the same invalid shapes are still refused.
- Genuinely corrupt or inauthentic logs still fail verification.
- Fixtures/tests prove both directions (legacy reopen + fresh refusal), and local replay leniency is not reused as a blanket remote-receipt policy (coordination with id(artifact): peer pulls halt on pre-upgrade home_declared entries — the #3187 strict receipt needs a trusted historical cutoff for receive_artifact #4459's cutoff noted on the PR).
Activity
developing-today commentedon Nov 4, 2026
CODE-1395
dezren39 commentedon Nov 4, 2026
Intake review
— fleet monitor intake, 2026-11-04
24 remaining items
dezren39 commentedon Nov 5, 2026
🤖 Agent note · picked up
afterentries and non-NFC document/tag fields in pre-upgrade logs). Execution-lane assignment returneddirect; lane code-s is working it. Fresh check: issue id(artifact): preserve pre-upgrade log replay for duplicate after and non-NFC fields #5625 OPEN, no hard-stop labels, no existing PR or worktree for this task.dezren39 commentedon Nov 5, 2026
🤖 Agent note · parked
verify_for_replay()grandfathers only the duplicate-aftersub-rule andparsed_for_replay()now grandfathers the three id(artifact): parsed() accepts non-NFC text in document and tag — media_type, tag name and value bypass the NFC rule documents.rs and tag_claims.rs both enforce #3192 NFC fields; authenticity and all other rules stay strict in both modes, and remote/fresh receipt (insert) is unchanged — the leniency is reachable only from localopen/open_read_only. Full pkgs/id lib suite on the laptop: 2258 + 317 passed, 0 failed.fix(id/artifact): grandfather duplicate-after and non-NFC shapes in l…
dezren39 commentedon Nov 5, 2026
Resumed by repo queue worker lane code-c as task 10598: Codex review on PR #6321 completed with no findings (review state: has_any_findings=false), the diff is the single-file narrow replay boundary described in the PR, and the PR body records the full laptop test run (cargo test --lib in pkgs/id: 2258 + 317 passed, 0 failed). Merged PR #6321 (squash, merge commit c0b4ac6); this issue auto-closed via Fixes #5625. Task 10598 complete.