fix(wake): digest hard-locator gate covers top-level .claim entries (Closes #905) #906
Assignees
jason.woltje
Clear assignees
jason.woltje
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mosaicstack/stack#906
Reference in New Issue
Block a user
Delete Branch "fix/905-digest-toplevel-claim-locator-gate"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Gap (from #904 review)
The W3 fail-loud hard-locator validator in
digest.sh(~line 241) treats anentry as actionable via
class=="actionable"OR.locators.claim, but theRENDER tier also honors a top-level
.claim(it renders viajq -r '.claim // .locators.claim'). A hand-crafted entry such as{"class":"reaction","claim":"mergeable=true","locators":{}}fed via--stdin/--from-filerendered as aCLAIM@seqwith an empty locator,escaping the exit-4 hard-locator fail-loud gate.
store.shnever emits a top-level.claim(non-canonical shape), but anon-canonical caller could bypass the locator gate.
Fix (scalpel)
Align the fail-loud validator so it ALSO treats a top-level
.claimasactionable — mirroring the existing
.locators.claimcheck but applied tothe entry itself — so any entry that WILL render as a claim (top-level
.claimOR.locators.claimORclass=="actionable") must pass thehard-locator gate (precise repo/issue#, 40-char SHA, or file:anchor), else
FAIL LOUD (exit 4, nothing emitted). No changes to render logic, the
two-tier framing, or any other behavior.
Red-first evidence
Extended
test-wake-digest-hmac.sh(D2 group) with a case: a hand-craftedentry with a top-level
.claimand EMPTY.locators, fed via both--stdinand--from-file.digest.sh, kept new test): FAILED to fail loud —rendered a full digest body (
CLAIM@seq ... claim: mergeable=true ... locator:with an empty locator) and exited 0 via both--stdinand--from-file. 6 assertions failed, confirming the gap.--stdinand--from-file. All 6 test groups (D1–D4, H1–H2) pass.Gate results
test-wake-digest-hmac.sh: all invariants passed (6 groups) at head.pnpm --filter @mosaicstack/mosaic run test:framework-shell(all framework-shell suites, including
test-wake-store-ack.shandtest-wake-digest-hmac.sh): all green.--from-storepath (well-located actionable claim viastore.sh): renders correctly, exit 0.shellcheckon both touched files: clean.pnpm format:check: clean (run before push; touched files are.sh,outside prettier's glob, but full-repo check passes).
jason|woltje|jarvis): 0 matches in diff/staged/committedcontent.
Closes #905
Part of #892
The W3 fail-loud hard-locator validator (digest.sh) treated an entry as actionable via class=="actionable" OR .locators.claim, but the RENDER tier also honors a top-level .claim (it renders via `jq -r '.claim // .locators.claim'`). A hand-crafted entry like {"class":"reaction","claim":"mergeable=true","locators":{}} fed via --stdin/--from-file rendered as a CLAIM@seq with an EMPTY locator, escaping the exit-4 hard-locator fail-loud gate. store.sh never emits a top-level .claim (non-canonical shape), but a non-canonical caller could bypass the gate. Align the validator to also treat a top-level .claim as actionable, matching the render tier's precedence, so any entry that WILL render as a claim must pass the hard -locator gate or FAIL LOUD (exit 4, nothing emitted). Closes #905 Part of #892Record of Review — PR #906 (wake digest hard-locator gate covers top-level .claim; Closes #905, Part of #892)
VERDICT: APPROVE (GO on CI terminal-green). Reviewer: MS-LEAD (independent; ≠ builder
aa69985b/mosaic-coder). REVIEWED-HEAD:67f7cb6df4afe137c5e90d1d3257399318c4fb09.10d957d0) = 2 files:digest.sh(+7/-1),test-wake-digest-hmac.sh(+27). (Stale-local-ref inflated the raw diff — verified true delta via fresh fetch.) No other change.jq -e "has(\"claim\") and ((.claim // \"\") != \"\")"against the top-level$line(mirroring the existing.locators.claimcheck), so ALL 3 render-triggering conditions (top-level.claim/.locators.claim/class==actionable) must pass_has_hard_locatoror exit 4. Renderer/two-tier framing unchanged..claim/empty-.locatorsentry via--stdin/--from-filerendered with an empty locator (exit 0, 6 assertions failed); at head → exit 4, 0 bytes, both modes. Canonical--from-storepath still renders a well-located claim (exit 0).test:framework-shellgreen; shellcheck clean; firewalljason|woltje|jarvis=0; format:check clean; bodyCloses #905+Part of #892; commit-author mosaic-coder ≠ reviewer; mergeable.GO for id-11 + merge at FULL-40
67f7cb6df4afe137c5e90d1d3257399318c4fb09on CI terminal-green. Non-executor.GO — Gate-16 id-11 stamp, pinned to exact FULL head
67f7cb6df4.Basis: verbatim RoR (comment 18918) — review APPROVE (author ≠ reviewer identities per RoR); red-first proven: non-canonical top-level .claim inputs (--stdin/--from-file) now hit the hard-locator fail-loud exit-4, closing the gap tracked from the W3 review. True delta 2 files. CI terminal-green. Closes #905. Named executor: Mos (id-11), squash pinned.