integration/consolidated-current — single-branch consolidation + Phase 2 (2A/2B) - #8
Draft
focusedbrain wants to merge 59 commits into
Draft
integration/consolidated-current — single-branch consolidation + Phase 2 (2A/2B)#8focusedbrain wants to merge 59 commits into
focusedbrain wants to merge 59 commits into
Conversation
…trix, migration and risk, refactor plan) Co-authored-by: Cursor <cursoragent@cursor.com>
…y, ingress admission, dead-path removal) One shared full-claim identity guard (issuer+subject+email+wrdesk id, exact match) replaces every partial comparison on ingest/ack/return paths; old comparators deleted. Additive iss columns on coordination_handshake_registry with lazy backfill (first write wins). New per-relationship ingress admission filter is the first stage for all inbound deliveries incl. the BEAP inbox - blocked transmissions die pre-visibility with an audit record. Removes dead skipConsentForAutomation field, unused verifier, and no-op version step, with structural-absence tests. Realm-distribution inventory + phase report in docs/analysis/wr-handshake-gap/phase-1-report.md. Co-authored-by: Cursor <cursoragent@cursor.com>
… frozen core record, key extraction, anti-rollback) Canonicalization module with domain-separation tags; frozen signed core record (wr_canonical_v3 envelope) carrying the complete capsule content as a critical declaration, verified fail-closed on receive on top of legacy rules; containers with preserve-unknown parsing and criticality refusal naming the namespace; namespace registry (implemented + reserved-inert). Dual-format emission: v2 surface stays byte-compatible for old peers; new receivers verify the envelope and mark evidence wire_format canonical_v3 / legacy_v2. Core nonce store rejects replayed cores; generic anti-rollback high-water store lands with documented backup/restore semantics. Key extraction migration (v73) moves private key material into a dedicated handshake_key_store (copy-before-null, idempotent); reads overlay the store. Acceptance tests 1-7 green (replay compat, container semantics, canonical determinism, nonce replay, key extraction, anti-rollback, do-not-regress at exact baseline parity). ingress_path log-only guard added. Phase report in docs/analysis/wr-handshake-gap/phase-2-report.md.
…, ledger freeze
- Profile registry (packages/ingestion-core/profileRegistry.ts): five records
(pbeap_publisher, private_personal, org_internal, org_cross, legacy_v0) fixing
signature cardinality, attestation rules, role symmetry, permitted ingress
paths. resolveProfile is fail-closed [VII.4.2]; no conversion path [VII.4.7].
- verifyCanonicalEnvelope dispatches on the registry: unknown profile/version
refusal naming the profile, distinct-key signature cardinality [VII.3.2],
schema-level attestation presence/absence [VII.4.5]. New reason codes
UNKNOWN_PROFILE / PROFILE_SCHEMA_VIOLATION surfaced in denial audit entries.
- Core store split (v75): wr_handshake_core append-only (UPDATE/DELETE aborted
by triggers, anti-rollback high-water gated) + wr_handshake_runtime mutable
slice; legacy writers dual-write through coreStore adapter; legacy_v0
backfill with null ingress_path, unknown_legacy provenance, empty signature
list (never fabricated).
- Ledger freeze at v74 via freezeAtVersion option + persisted ledger_meta
marker (closes the lazy-migration hole); one-time hygiene sweep copies out
and drops undocumented tables, re-asserts row-level key hygiene; hygiene
assertion on every ledger open.
- ingress_path registry with initial identifiers (Q4 groundwork; log-only).
- Fix: 64-char-hex seed keys signed with a RANDOM key because
generateKeyPairSync('ed25519', {seed}) silently ignores the seed; now
wrapped in PKCS#8 DER (canonicalCore.ts, signatureKeys.ts).
- 30 new acceptance tests (profile dispatch, migration parity, hash
stability, ledger freeze/sweep); phase report with handshake_type inventory
(249 occurrences / 78 files) and rollback plan.
Co-authored-by: Cursor <cursoragent@cursor.com>
…gate, handshake_type elimination, silent revocation, edge-agent retirement) Single formation pipeline (V1): formationPipeline.ts dispatches on the Phase-3 profile registry; the four dialects are deleted (initiatorPersist, recipientPersist, inbound auto-insert, edge-agent pairing). handshake_type branching is eliminated - the admission situation is the profile parameter same_principal (Q9: internal_device, UI label "Cross-Device"); legacy wire compat is confined to samePrincipalWire.ts, the frozen db column, and declared envelope-parse boundaries. Capture methods + Connect-offer staging (V2, C1-C3): capture-method and invitation-class registries (scan/assisted_discovery fail-closed stubs, targeted_bound refusal-only); inbound invitations land in connect-offers.db (own SQLite file, outside both relationship handles) and only a consent event forms a record. Failed verification suppresses the offer entirely - structurally unreachable, no override. 7-day timeout (Q7). Capture provenance is a signed contract declaration (optirando.decl.capture_provenance) on new formations; consent records are Hash-Pinned (preview + bound-definition + contract-state hashes) with tamper invalidation. Silent revocation (V5): revoke-notify capsule removed - enforcement is exclusively the Phase-1 ingress admission filter (zombie old-build peers' sends die pre-visibility with a logged record, verified). Q8: revocation no longer deletes context blocks/embeddings/audit rows; content deletion is the separate explicit operator action deleteRevokedRelationshipContent (handshake.deleteRevokedContent RPC). Edge-agent fold-in (V8/I3): edge_ingestor dialect retired for new formations (RETIRED_FORMATION_DIALECTS, fail-closed unknown_profile); legacy pairings stay readable by the agent dist; lockstep upgrade documented. Acceptance tests 1-8 green (phase4OneFormationPipeline, phase4SilentRevocation, phase4EdgeAgentFoldIn acceptance suites + structural scans). Wide do-not-regress sweep: failure set byte-identical to the Phase-3 baseline (0 new, 0 fixed). Sequencing evidence and deviations in docs/analysis/wr-handshake-gap/phase-4-report.md. Co-authored-by: Cursor <cursoragent@cursor.com>
…tap execution consent, Tier-L evidence chain, capability tokens) Grant objects (E2-E4, E9) [VII.10.x]: wr_grants (migration v76, vault only) with delivery/preparation rights and deliberately no execute variant; the Phase-1 receiver-side ingress filter now consumes grant scopes (off-scope blocked pre-visibility + logged + revoke offer after repetition); admitted deliveries carry grant_ref provenance on email and P2P BEAP paths; legacy relationships lazily backfilled from effective_policy (never a fabricated consent); limit extensions parse-level critical. Execution grants deleted + per-tap consent (V4) [VII.10.1, IX.19.2]: GRANTED_TOOLS and ACTIVE-handshake blanket authorization removed; every execution requires a fresh, single-use, Intent-Hash-bound human consent tap (executionConsent.ts, wr_execution_consents); divergence from the presented preview refuses execution and records a deviation PoAE; fail-closed kill switch WRDESK_EXECUTION_CONSENT_TAP (never a consent-free path). Evidence chain (H1-H4) [IX.19.1, X.10.1]: wr_evidence_chain - append-only by trigger, per-contract monotonic sequence, SHA-256 prev-hash chaining, explicit genesis at cutover; PoAC/PoAE writers on formation, grant lifecycle, admission blocks, content deletion, and executions; BER schema representable now (writers in Phase 6). Ledger repurposing (Q10): handshake-ledger.db is the Tier-L evidence home (ledger-native schema, hygiene-allowlisted); header docs state the actual transitional dual role honestly. Capability-token schema (T4/Q13) [XII.12.6 annex-number-provisional]: carriage-only tokens with preserve-unknown-optional parsing (p2p_signal pattern), optional context_scope/delegation_chain, delegable defaults false, critical limit extensions. Hygiene (H5): deleteHandshakeRecord no longer deletes audit rows; audit_log frozen for mutation via triggers on both handles (INSERT stays open); retention carve-out excludes wr_evidence_chain and audit_log. Pre-existing purge losses are unrecoverable and the chain claims no pre-cutover continuity. Also fixes a Phase-4 latent bug: the default Connect-offer staging DB now uses :memory: under vitest so test runs stop staging offers into the developer-profile connect-offers.db (163 leaked fixture rows purged). Acceptance tests 1-8 green (phase5GrantsEvidence.acceptance.test.ts et al); do-not-regress verified against the Phase-4 baseline worktree - identical pre-existing failure set, zero new regressions. Report: docs/analysis/wr-handshake-gap/phase-5-report.md Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…sponsibility logging EOF Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…json Co-authored-by: Cursor <cursoragent@cursor.com>
…; stamp build046 Co-authored-by: Cursor <cursoragent@cursor.com>
…nce import depth Channel provenance (SPF/DKIM/DMARC) and publisher resolution are mandatory structural pipeline stages, not an opt-in trigger filter. A message failing them yields no WR code and no affordance at all, so there is no class of "WRCode-stamped email" a per-trigger checkbox could select. Disabling the control left it naming a concept that does not exist. Nothing ever produced the verdict it read: NormalizedEvent.wrcodeValid had no writer, EventTagMatcher.evaluate has no production caller, and the router behind the control is fed inline-chat and OCR text, never mail. Removes the type, union member, evaluators, schema enum value, vestigial wrcodeMatch field and the control itself; strips the condition from stored agent configs at every read boundary. InputCoordinator's default: branch now fails closed to match EventTagMatcher, which makes that stripping load-bearing rather than cosmetic. Also fixes email/providers/zoho.ts, which resolved aiProvenance five levels up where its three peers in the same directory correctly use six - the cause of both the blocked session:build and the 77 suite-load failures. Co-authored-by: Cursor <cursoragent@cursor.com>
Brings main's document commits onto the branch so a fresh build covers the complete state: WR Handshake Phases 1-5, art50 AI provenance, WR Code email E2E Phase 1, and main. No code conflicts - main touched no source files. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…II additions) Additive delta to the v1.0 email E2E order: A-series decisions A1-A5, Phase 3 additions 3D-3F (CatalogHead, DualAssuranceEnvelope, EVP), Phase 4 offer-schema and status additions, Phase 5 EVP-first-render, and acceptance items (e)-(h). Tracked rather than left in chat because the v1.0 order never was, which is part of how the work lost its paper trail. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…ug 2026) Normative source for Delta v1.1 decisions A2 (EVP-first-render, XVII.4.4), A4 (audit link, XVII.6) and A5 (platform suspension, XVII.3.3). Placed at repository root alongside the other annexes. Note: this annex depends throughout on Annex XIV 5.5 (Execution Authorization Proof Chain and Catalog Commitment), which the Annex XIV copy in this repo (v1.0, 26 July 2026) does not contain. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Author ruling on the collision named against Annex XVII XVII.3.2/XVII.3.3: three orthogonal layers whose convergence is display-only. entry.status is publisher-signed and platform suspension lives only in the envelope, so the two cannot collide in data. Admission is conjunctive and fail-closed across D4 status, entry.status and envelope.suspension; display keeps all three distinct with headline precedence platform > entry > publisher-part. Phase 4 bullet cross-references A6 for the composition rule. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Supersedes the A5 cross-reference wording with the authoritative statement: the surface composes three orthogonal fields (D4 publisher-part status, publisher-signed entry.status, platform envelope.suspension) under A6's conjunctive fail-closed admission rule and headline precedence, with distinct copy per layer. Offer-schema bullet unchanged. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Brings Refactor Order v1.0 (754e87e), the authoritative Annex XIV v1.1 carrying XIV.5.5, Annex XVII, and the updated Annexes IX/X/XI onto the Phase-2 branch before order-02 work begins. Plain merge commit per the author ruling: no cherry-picks, no rebase. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Order 02 / 2A: the CPR already sat at Step 0 from Phase 1, but its verdict was recorded rather than acted on. Detection is now extracted into detectBeapPackageFromMessage and called only when channel_pass holds, so a failing D5 verdict short-circuits every WR parse and code extraction: the message lands plain carrying its CPR, and no affordance is derived from it. Suppression is structural. The detector is not reached rather than its result discarded, and NO_DETECTION is deliberately shape-identical to looked-and-found-nothing so nothing downstream can special-case a provenance-failed message into an affordance. The seam carrier test fixture gains an aligned DKIM pass - without one it was asserting the suppression case under the carrier case's name - and the same bytes minus that header are pinned as a new suppression test. Baseline for this phase: 543 files / 5927 tests / 173 failures (phase2-before-native.json, validity guard 543 >= 100). Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…path Order 02 / 2A with author-authorized scope extension to all three branches. A depackage that failed produced a row we could not validate. Each of the three ways quarantining can itself fail - no custody key (~754), sealing failed (~766), validator rejected (~793) - fell back to a PLAIN inbox row, presenting unvalidated carrier content as ordinary mail. The worse the failure, the weaker the handling. All three now throw DepackageCutoverHeldError, which is what the seam path already did in quarantineRawBytes for the identical three conditions. Held means not inserted and not downgraded; the sync caller retries. Closing one of three would have left the invariant false on the same code path. pbeapTrustPersistence fixtures gain an aligned DKIM pass: they assert the pBEAP trust verdict, which only exists on the BEAP route, so they need a channel-authenticated message to reach it. Do-not-regress: 0 new failures against phase2-before-native.json across apps/electron-vite-project/electron/main/email/__tests__ (23 failing, all 23 pre-existing at baseline). Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Nine guards across three invariants that can each break independently: - detection is called exactly once and only under the channel_pass gate; the CPR is produced before the detector is reached; NO_DETECTION carries no marker a later change could branch on to resurrect an affordance. - the quarantine path contains no plain-inbox fallback, all three branches hold, and the seam path still holds on the same conditions - an invariant true on one of two paths is not an invariant. - per the author ruling: no trust verdict is computed in the guest, the guest hands over material rather than a verdict, and every consumer of guest package output is reached through the gated router. The last group encodes the deliberate reading of order 2A: header parsing is a precondition of provenance evaluation, so no-parse-before-provenance cannot be literal in-guest. Provenance gates ACTION on parse results at the trust boundary, and the boundary is the host. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
ONE component in @repo/shared-beap-ui for every channel-consequential surface. No dismiss, no acknowledge, no null state once the trigger holds: the art50 disclosure pattern is deliberately not reused, because it carries acknowledgement state and an acknowledged warning is one the operator can be trained to click away. The component owns the trigger rule rather than accepting a boolean, so no caller can render the alert under its own idea of when it applies - the decision register requires identical verdict semantics on every surface, and a per-caller predicate is how that drifts. The record is structurally typed to the two fields the rule reads, so the package needs no dependency on @repo/ingestion-core and stays consumable by both apps; a cross-check test against the canonical channelAlertRequired keeps the rule honest. Copy states unverifiability rather than maliciousness, and says explicitly that carried links and codes have no verified origin either. Extension wiring is exactly the authorized minimum: workspace dependency, vite alias, tsconfig path. Nothing else in that app is touched. Styles set explicit foreground with every background so the alert cannot render low-contrast on a surface whose parent theme differs. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Build an initial graphify map of code/ using tree-sitter AST extraction only. PDFs and documentation are excluded via .graphifyignore so the graph reflects the current codebase; docs can be added selectively later. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Apply row-level session visibility to handshake.get/queryStatus/delete, require assertRecordForServiceRpc for sandbox DC capability responses, and use canonical role/eligibility policy in internalSandboxesApi instead of local_role. Add regression coverage for each fix. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Resolve conflicts by keeping Phase-4 Connect-offer helpers from the Email E2E stack and restoring row-level session visibility / service-RPC eligibility gates from the authorization fixes. Eligibility keeps Phase-2 same_principal plus assertRecordForServiceRpc + canonical role derive. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
isHostSandboxPairEligible now requires same_principal=true; update Host-AI eligibility and sandbox DC service-RPC fixtures accordingly. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Replace npm ci/cache with pnpm/action-setup@10.28.2, setup-node cache:pnpm keyed on code/pnpm-lock.yaml, and frozen-lockfile install. Bump Node 22. Applies to release gate, quarantine, and opt-in E2E jobs. Co-authored-by: Cursor <cursoragent@cursor.com> (cherry picked from commit 8be0f44)
Keep hand-authored Graphify config (.graphifyignore, Cursor rule) and gitignore the reproducible graph.json/html/report/cache outputs. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Email E2E Phase 2 added workspace dependency @repo/shared-beap-ui to apps/extension-chromium without updating pnpm-lock.yaml importer entries. Regenerated lockfile so pnpm install --frozen-lockfile succeeds on the consolidated stack. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
This 2MB JSON file is a vitest run summary (numTotalTests, testResults) committed during Email E2E Phase 2 work, not an intentional source artifact. Ignore similar dumps going forward. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Untracked Cursor agent state and dumps no longer appear in status. Already-tracked hand-authored rules under .cursor/rules/ remain tracked (gitignore does not untrack them). Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…umbing Trace showed BeapMessage is populated only via sanitisedPackageToBeapMessage and inboxRowToBeapMessage. CPR lives in Electron depackaged_metadata, but handshake.beapInbox.list does not return that field — Option 1 would require sync-path surgery. Option 2 applied: Electron surfaces read CPR locally; BeapMessageDetailPanel takes an optional channelProvenanceRecord prop with unit tests; plumbing named "extension CPR plumbing (Phase 5)" in Delta v1.1. Also lands the consolidation section in the Phase-2 report (branch map, archive tags, ancestor checks, PR dispositions, workflow supersession). Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Supersedes the wholesale .cursor/ ignore. The Graphify integration is hand-authored and belongs in the repo: the always-on rule under .cursor/rules/ and, when used, .cursor/mcp.json. Agent state and dumps stay ignored; graph output stays untracked (derived, per-machine). Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
The order named ai_analysis_json as a candidate attachment point; it is the analysis OUTPUT column, not an input. The actual input point is the combined inbox analysis prompt: buildScamWatchdogUserContext / appendScamWatchdogToSystemPrompt, used by inbox:aiAnalyzeMessage and inbox:aiAnalyzeMessageStream. Only verdicts cross into the prompt — the depackaging boundary keeps raw Authentication-Results out, and the typed projection has no slot for them. Absence is stated explicitly so a missing record never reads as authenticated. Layering is one-directional and guarded: an unauthenticated channel may strengthen a concrete finding but is never a finding by itself, an authenticated one never clears a signal, and the model is told the rule-8 alert is the application's, not its to restate or replace. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…ss capture Records the Option-2 trace and ruling, the actual 2C attachment point (the analysis prompt, not ai_analysis_json), and both captures. The 30 apparent new failures against the old phase-2-branch baseline are attributed by re-running the five suites at 743fd75: they predate this phase's work and arrived with the consolidation merges. Against the consolidated baseline the failure identity sets are equal. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Bounded pass ordered after phase-2-complete and before Phase 3, because p2p/coordination-client overlaps Phase-3 territory. Of the 35 failing identities in the five suites, only 29 are consolidation- inherited: they step in at exactly one commit, the #7 merge dffec03, whose canonical coordination-device-id role derivation the four clone-prepare fixtures do not satisfy — they still encode the retired local_role model and set no coordination ids. The product fails closed as that merge intended. The other 6 predate the consolidation and split three ways: harness schema lag, one unresolved seal-verification case where a product defect is not excluded, and two coordination-client tests that assert a deliberately retired relay path and an enqueue shape that no longer validates. CC_05b also fails alone at every commit probed yet passed in one full-workspace run, so the suite can report a broken test as green. Counting failures would not have caught that; the identity-set comparison did. No fixes applied; fix-vs-defer is the author's per class. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Delivered verbatim by the author via sandbox commit. Fulfils the Phase-3 prerequisite: the contract is an INTERFACE REFERENCE for the Phase-3 resolution client, not a build order for the WRC service. Phase 3 is built contract-first against local fixtures/mocks behind an isolated transport interface; no WRC service code. Not a Phase-3 start signal. Phase 3 begins only on an explicit author signal after the fix-vs-defer decision on the consolidation-inherited failures. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
A1. The hand-rolled in-memory inbox_messages schema never gained the two columns the production migration added, so suites that INSERT them died on SqliteError before reaching their assertion. The harness has lacked them since the columns were introduced; no test that inserts them has ever run green. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…erivation B. PR #7 replaced the local_role role derivation with the canonical coordination-device-id derive, on the grounds that local_role is a per-device view that can disagree with the ledger. These fixtures still set only local_role and no coordination ids, so the derive returned device_id_not_in_handshake and the product refused every prepare. The fail-closed refusal is the enforcement #7 added and is left untouched; the fixtures now name the local instance, following the 2a24cdb precedent. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
A2. The four failing cases sealed rows with the inner key, tagged them seal_key_source='vmk', then unbound the inner provider and expected the read to succeed anyway. sealedQuery routes vmk rows to the inner provider only, so the rows were filtered and prepare returned MESSAGE_NOT_FOUND. No product change can make that pass without a verification bypass, and reject mode states there is none in any environment. The tests encode the pre-B-9 trusted read that "source read uses sealedQuery" deliberately removed. Three of them are about content extraction per row shape, not about key routing, so they now seal per the product's own policy (effectiveInboxRowSealKeySource returns 'ledger' for every one of these shapes) and exercise their real subject. The fourth asserted cloning a row with no canonical plaintext. Production writes NULL depackaged_json only where no plaintext exists yet (beap_qbeap_pending_main, main-process decode errors), so there is nothing to clone; it now pins the refusal rather than a body_text fallback. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…bient mode A3. CC_06 asserted that use_coordination=false sends outbound to a relay URL. That path was retired; the queue refuses it with a typed permanent PREFLIGHT_FAILED / CONFIG_PERMANENT and never calls fetch. The test now pins the refusal, per the ruling that the refusal is the invariant worth keeping. A4. CC_05b enqueued a content-bearing message_package and discarded the result. enqueueOutboundCapsule does return a typed rejection on every path and logs it, so nothing was dropped silently and no product change is warranted; the silence was the test throwing the result away. It now asserts the enqueue. The rejection was SANDBOX_DATA_EGRESS_FORBIDDEN: the Electron mock's userData dir is shared and persists across files and runs, and roughly seventeen suites write orchestrator mode into it, so whichever suite ran last decided whether this one could send. That is the mechanism behind the false green. The suite now pins host mode for its own duration and restores what it found. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
All 35 pinned identities green in isolation and in the full workspace, 0 new failures, 201 -> 166. No product code changed: every fix is in tests or the harness. Records what the package deliberately did not do. A2 needed no product change: the four cases asserted the pre-B-9 trusted read that "source read uses sealedQuery" removed. A4's authorized typed rejection already exists - enqueueOutboundCapsule returns a typed result on every path and logs it, so the never-fails-silently condition never triggered; the silence was the test discarding it. Names the root cause behind the false green: the Electron mock shares one userData dir whose orchestrator-mode.json survives across files and runs, and two suites write mode 'sandbox' without restoring it. Correcting the count in c5447a4, which said roughly seventeen; it is two. Adds the error-taxonomy item for the MESSAGE_NOT_FOUND conflation with a remediation proposal, and the seal-policy divergence between verificationKeySourcesForInboxRow and sealedQuery. Both reported, neither implemented. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Remediation accepted; the consolidation-inherited item is closed. What came out of it now carries its own names and schedules, so none of it rides along unowned: - test-isolation bidirectional risk: root cause attached, mock untouched until a dedicated decision. - inbox-read error taxonomy: adopted in principle, scheduled with Phase 4 as an authorized bounded item - same never-fails-silently family as the Phase-4 status surface. - seal-key-source policy unification: bounded diagnosis at Phase-4 entry, implementation only on approval. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Interface reference against WRC-Registry-API-Contract v1.0 @20794bff. No WRC service code; everything below the transport interface is swappable and an unconfigured deployment refuses with not_configured rather than looking like a registry that answered "no such publisher". 3A hardened client: https only, redirect refused rather than followed, TLS 1.2 floor with no way to weaken rejectUnauthorized, total deadline, streaming size cap, and an SSRF guard at the resolved ADDRESS via a custom lookup - checking the hostname would fall to DNS rebinding. Placed in main rather than a shared package because both shared packages are imported by the MV3 extension and the guards need node:dns/net/https; reported as a deliberate deviation. 3B orders the chain so the ordering is the security property: registry claim, then DNS + manifest, then the part cross-check, then head, envelope, EVP. No branch reaches a trusted presentation having skipped a leg, and the registry is consulted last for key material so it can only ever be caught diverging. 3C folds r7 alignment through the CPR ratchet, so this stage can tighten a verdict and structurally cannot loosen one, and activates discovery_record. 3D persists the epoch floor separately from the record cache: evicting a publisher must not reopen a rollback window. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
…ment
Contract-faithful double signs real Ed25519 material, builds a real Merkle
tree and a real epoch sequence, so verification is proven against signatures
rather than stubs that return true.
Two findings from writing them, both fixed here:
- parseOutboundUrl let a bracketed IPv6 literal through. URL.hostname keeps the
brackets and isIP('[::1]') is 0, so https://[::1]/ passed the literal-address
check and was caught only later by the lookup guard. Now unwrapped.
- The signature tamper helper flipped the LAST base64url character, which for a
64-byte signature carries two meaningful bits and four discarded padding
bits. Several tampers decoded to identical bytes, so whether a test caught a
forged signature depended on which random key was generated. Tampering the
first character now, with an assertion that the decoded bytes actually
differ; the matrix was run five times over fresh keys to confirm.
Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
Records the deliberate 3A placement deviation and its reason, the two findings from writing the tests (bracketed IPv6 bypassing the URL guard; a signature tamper that decoded to identical bytes and made forgery detection depend on the random key), the integration-pending live legs, and one contract gap: the contract defines DelegationRecord and a write endpoint for it but no read path, so a client that has never seen a delegation cannot verify a head signed by a delegated catalog key. Co-authored-by: focusedbrain <focusedbrain@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Permanent development branch for the WR-Code Email E2E slice. Single-branch workflow; phase boundaries marked by reports and
phase-<N>-completetags.Phase 2 — complete and ratified (
phase-2-complete@a310cb96)2A pipeline reorder and fail-open closure; 2B unsuppressible rule-8 alert (Option 2, with the named Phase-5 plumbing item); 2C CPR as a typed input to local scam analysis at the real attachment point. Do-not-regress clean.
Consolidation-inherited remediation — accepted
All 35 pinned identities green in isolation and in the full workspace, no product code changed. Three findings carried forward with schedules: test-isolation bidirectional risk, inbox-read error taxonomy (adopted in principle, with Phase 4), seal-key-source policy unification (bounded diagnosis at Phase-4 entry).
Phase 3 — complete (
phase-3-complete@1c1cb3ef)Resolution infrastructure, contract-first against
WRC-Registry-API-Contract v1.0@20794bff— fixtures and a signing double behind an isolated transport interface, no WRC service code.discovery_record.Do-not-regress vs
4a3695b5: identical failure identity set (166 = 166), +48 passing tests. Five remediated suites verified in both modes.Reported, not implemented: a contract gap —
DelegationRecordhas a write endpoint but no read path, so a client that has never seen a delegation cannot verify a head signed by a delegated catalog key. Also the epoch floor's storage hardening and the single-domain bound origin set.Details:
code/docs/analysis/wr-code-email-e2e/.Notes
mainremains for author-designated document drops only.