round four: all nine findings, one shared rule per door - #344
Merged
Merged
Conversation
…p pick, and set equality
Round four (2026-09-13, reviewer antigravity, verifier codex): six findings,
all standing. Three were defects in round three's fix.
- R1 (high): for an entry that records signatures but no envelope hash
(intoto v0.0.2), the binding was a SUBSET test — an envelope with
signatures stripped, or its payloadType rewritten, passed as the logged
one. Now signature-set equality in both directions, and payloadType when
the log recorded one.
- R2: toEntry built an Entry with no SET that VerifyInclusion would refuse.
The constructor now refuses it too.
- R3, R4: three envelope parsers held three ideas of "valid" — one hashed a
MISSING payload to sha256(""), one counted a signature with no `sig` as an
empty signature and so reported "tampered" for "unreadable". There is one
parseEnvelope now and every door calls it.
- R5: Get reported an index mismatch as "not a dsse entry" because the kind
check was placed before the index check. Reordered.
- R6: Get ranged the response map and broke — the exact pick fixed in
fetchEntryByUUID in round three, twelve lines from code edited the same
day. One soleEntry now, and both doors call it.
Every new test fails against the pre-fix tree (negative control run on
main's source with the test file dropped in). Round three's intoto fixture
gained a payload, since an envelope without one is now malformed by rule.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The poller looked the dedupe row up under the policy's Context as written; the runner normalized whitespace to the default before saving; the store defaulted only the empty string. A programmatic Policy with Context " " was saved under corral/gate, looked up under " ", and re-run and re-certified on every tick. normalizeContext is the one rule now, and Policy.normalized, Save, GetByHead, MarkPosted and the poller all call it. Round four's R1 and R2 (the `;` guard's third defeat and the newline-eating strings.Fields split) were retired in #342 by changing the format; the new test file says where their tests live. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round four of the cold review (2026-09-13: codex on
internal/gate, antigravity oninternal/transparency, seats fully rotated) produced nine findings, four pre-existing and five introduced by the previous fix batch. All nine are closed here, one finding per commit, each with a test that was run as a negative control againstmain's tree and failed there.transparency (six)
payloadTypewhen the log recorded one.toEntryrefuses an entry with no SET, matchingVerifyInclusion.parseEnvelope; a missing payload or a signature with nosigis malformed at every door.rekor.goand left inlogger.go; onesoleEntrynow, both doors call it.gate (three)
normalizeContext, called by the runner, the store's three doors, and the poller.docs: round four's row in the churn-vs-drain table, with the treadmill result stated.
Not in this PR: round four's ledger entries. They were written to a worktree under
/tmpthat was pruned before they were pushed, so they are gone; the findings survive in the commit messages and code comments only.🤖 Generated with Claude Code