mosaicstack/stack
1
0
Fork 0
Code Issues 87 Pull Requests 1 Actions Packages Projects Releases 15 Wiki Activity

fix(wake): digest hard-locator gate covers top-level .claim entries (Closes #905) (#906)
Some checks failed
ci/woodpecker/push/publish Pipeline was successful
Details
ci/woodpecker/push/ci Pipeline was canceled
Details

Browse Source 
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
This commit was merged in pull request #906.
This commit is contained in:
jason.woltje
2026-07-26 00:58:40 +00:00
committed by Mos
parent 10d957d095
commit dd1391fd76
2 changed files with 33 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
packages/mosaic/framework/tools/wake/test-wake-digest-hmac.sh
View File

@@ -117,6 +117,33 @@ echo "== D2: HARD-LOCATOR enforcement — actionable claim with no locator FAILS
export WAKE_STATE_HOME
"$STORE" enqueue --seq 1 --class actionable --locators "$(jq -cn --arg s "$SHA40" '{claim:"ci=green",sha:$s}')" >/dev/null
"$DIGEST" render >/dev/null 2>&1 || fail_msg "D2: a well-located actionable claim must render"
# --- #905: a NON-CANONICAL entry with a TOP-LEVEL `.claim` (store.sh never
# emits this shape; only .locators.claim is canonical) and EMPTY .locators,
# fed via --stdin / --from-file, must ALSO fail loud. The render tier honors
# `.claim // .locators.claim` (renders CLAIM@seq either way), so the
# fail-loud gate must cover top-level .claim too, else a hand-crafted /
# non-canonical caller could bypass the hard-locator gate entirely.
WAKE_STATE_HOME="$(fresh_state d2d)"
export WAKE_STATE_HOME
toplevel_claim_entry='{"class":"reaction","claim":"mergeable=true","locators":{}}'
out=""
if out="$(printf '%s\n' "$toplevel_claim_entry" | "$DIGEST" render --stdin 2>/dev/null)"; then
fail_msg "D2(#905): top-level .claim + empty locators must FAIL via --stdin, but render succeeded"
fi
[ -z "${out:-}" ] || fail_msg "D2(#905): --stdin top-level-.claim bypass emitted body instead of failing loud [$out]"
rc=0
printf '%s\n' "$toplevel_claim_entry" | "$DIGEST" render --stdin >/dev/null 2>&1 || rc=$?
[ "$rc" -eq 4 ] || fail_msg "D2(#905): expected fail-loud exit 4 for top-level .claim via --stdin, got $rc"
ff="$TMP_ROOT/d2d-entry.jsonl"
printf '%s\n' "$toplevel_claim_entry" >"$ff"
out2=""
if out2="$("$DIGEST" render --from-file "$ff" 2>/dev/null)"; then
fail_msg "D2(#905): top-level .claim + empty locators must FAIL via --from-file, but render succeeded"
fi
[ -z "${out2:-}" ] || fail_msg "D2(#905): --from-file top-level-.claim bypass emitted body instead of failing loud [$out2]"
rc=0
"$DIGEST" render --from-file "$ff" >/dev/null 2>&1 || rc=$?
[ "$rc" -eq 4 ] || fail_msg "D2(#905): expected fail-loud exit 4 for top-level .claim via --from-file, got $rc"
) && ok
echo "== D3: TWO-TIER — orientation no-op with ZERO tool calls; actionable = claim-to-verify =="