Repository navigation
id(artifact): validate known-kind bodies in generic signing helpers #5623
Description
Receipt-audit follow-up from #3232 / design #3231
The public SignedArtifact::sign / sign_after helpers are generic over kind strings. They enforce sequence/after construction rules and sign arbitrary JSON, but do not call the known-kind parser. Consequently, a direct caller can obtain a signed friend_remove, home_declared, document, or tag value that parsed() / ArtifactLog::insert refuses. ArtifactLog::sign and the directory's document/tag producers also reach the shared receipt check only on insertion, after a temporary signature has been made.
Scope
- Make known-kind signing/build paths refuse the same typed-body rules as receipt.
- Preserve unknown-kind forward compatibility: unknown kinds remain signable envelope-only and parsed() continues returning None.
- Keep authenticity failures distinct from Forbidden policy failures.
- Add focused construction-vs-receipt symmetry tests for known kinds and unknown kinds.
This is not implemented in the #3232 audit. See the field-by-field disposition and evidence in the follow-up PR for issue #3232. after builder symmetry is already enforced by #3196 / PR #5576.
Acceptance criteria
- Known-kind signing/build paths (
SignedArtifact::sign/sign_afterand the shared producers) refuse the same typed-body rules that receipt (parsed()/ArtifactLog::insert) enforces. - Unknown kinds remain signable envelope-only, and
parsed()continues returning None for them (forward compatibility preserved). - Authenticity failures stay distinct from Forbidden policy failures.
- Focused construction-vs-receipt symmetry tests exist for known kinds and unknown kinds.
Metadata
Metadata
Assignees
Labels
Package/app: id (pkgs/ or apps/ in this repo)Medium: expected under 1 day of workSomething isn't working (prefixed form of the classic bug label)Intake review done: acceptance criteria, links, and normalized labels addedOrdinary priority (the default)Filed or worked by the queue/worker pilotQueue packet kind: verify, reproduce, and route this item
Activity
developing-today commentedon Nov 4, 2026
CODE-1394
dezren39 commentedon Nov 4, 2026
Intake review
afterbuilder symmetry was already enforced by id(artifact): check() accepts duplicate after hashes — the same hash can fill all 32 frontier slots, unlike chain.rs which refuses DuplicateAfter #3196 / PR id(artifact): finish the receipt contract — frontier policy is Forbidden, builders refuse what receipt refuses #5576 — this is the remaining kind-body symmetry gap. Sibling follow-ups: id(artifact): preserve pre-upgrade log replay for duplicate after and non-NFC fields #5625, id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624.parsed()/ArtifactLog::insertthen refuse, so callers can mint signed-but-uninsertable artifacts. The unknown-kind forward-compatibility constraint is explicit and must be preserved.— fleet monitor intake, 2026-11-04
12 remaining items
developing-today commentedon Nov 5, 2026
agent-note:v1
task: 10523
lane: code-u
state: parked
summary: Implementation complete and PR opened: PR #6240 (branch queue/10523-5623-sign-validate-known-kinds, commit a118611). SignedArtifact::sign/sign_after now validate known-kind bodies via the receipt check itself; unknown kinds unchanged. Verified on the laptop: cargo test --lib artifact:: 38 passed; full id lib 2256 passed, 0 failed. Task parked for CI: PR checks (native arm64 determinism, id builds without world feature, guard PR check list) were still queued after the 5-minute polling window, and no Codex review comments were present at park time.
next: on resume, re-check PR #6240 checks and any Codex findings (disposition each), then merge under the standing criteria and complete task 10523.
Merge pull request #6240 from developing-today/queue/10523-5623-sign-…
dezren39 commentedon Nov 5, 2026
🤖 Agent note · done
parsed()check inSignedArtifact::sign_afterbefore returning; unknown kinds stay envelope-only; refusal classes preserved. Lane code-u's laptop verification stands: cargo test artifact:: 38 passed, full id lib 2256 passed, 0 failed (note 6660048817). No Codex findings on PR id(artifact): validate known-kind bodies in SignedArtifact::sign / sign_after (#5623) #6240; PR checks were still QUEUED (infra backlog) at merge — merged under the standing merge authority (verified work, CI runs on main).