mosaic-coder 67f7cb6df4 fix(wake): digest hard-locator gate covers top-level .claim entries ...

The W3 fail-loud hard-locator validator (digest.sh) treated an entry as
actionable via class=="actionable" OR .locators.claim, but the RENDER
tier also honors a top-level .claim (it renders via
`jq -r '.claim // .locators.claim'`). A hand-crafted entry like
{"class":"reaction","claim":"mergeable=true","locators":{}} fed via
--stdin/--from-file rendered as a CLAIM@seq with an EMPTY locator,
escaping the exit-4 hard-locator fail-loud gate.

store.sh never emits a top-level .claim (non-canonical shape), but a
non-canonical caller could bypass the gate. Align the validator to also
treat a top-level .claim as actionable, matching the render tier's
precedence, so any entry that WILL render as a claim must pass the hard
-locator gate or FAIL LOUD (exit 4, nothing emitted).

Closes #905
Part of #892

2026-07-25 19:44:56 -05:00

16 KiB

Executable File

Raw Blame History

View Raw