base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Validate byte-preserving record fields as base64 strings

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-03 00:18:47 +00:00
parent 2a7bed87db
commit e0019abe31
5 changed files with 83 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/roadmap/implementation.md
View File

@@ -140,7 +140,11 @@ mismatch tests confirm that no remote tag query occurs.
without relying on diagnostic output.
1. Add record encoding and storage helpers under `internal/publish`. Use a JSON
envelope with integer `format_version: 1` and an `evidence` object. Its fields
envelope with integer `format_version` and an `evidence` object. Ordinary
UTF-8 evidence uses version 1; non-UTF-8 fields use version 2 and a separate
`evidence_bytes` object of base64 strings, preserving exact supported bytes.
See the [canonical format](../integrations/publication-records.md#private-attempt-record).
The evidence fields
are `repository_dir`, `module_dir`, `module_path`, `version`, `tag`,
`candidate_commit`, `tag_object`, `endpoint`, `remote`, and `recorded_at`.
Store the exact endpoint. Fields other than the envelope version/object can
@@ -150,7 +154,10 @@ without relying on diagnostic output.
malformed JSON, and structural type errors are `record_format` failures.
Accept additional fields within a supported version. Semantic evidence
completeness is evaluated by reconciliation, so a readable partial record
remains usable for discovery and any classification it can support.
remains usable for discovery and any classification it can support. Decode
known version-2 byte fields as strings, then decode standard base64. Invalid
structural types and malformed base64 return `record_format` with their
available causes. Additional unknown fields retain their existing handling.
3. Resolve the default directory with
`git rev-parse --path-format=absolute --git-common-dir`, then append
`releasekit/publication-attempts`. Use Git metadata discovery rather than
@@ -192,6 +199,11 @@ ignored, and unignored override. Use injected failures at the small file/Git
boundary when platform permissions cannot reliably induce a failure. Verify
that private records retain synthetic credentials while diagnostics redact them.
**R17 follow-up completed:** Known byte fields validate their string representation
before base64 decoding. Tests cover valid/empty strings, numeric arrays, other
structural errors, and retained JSON/base64 causes. Existing all-field byte
round trips and original-versus-decoy Git endpoint observations remain covered.
## Stage 3: Add the facade-owned recovery interfaces
**Completed:** 2026-11-02
@@ -522,6 +534,8 @@ contracts and a short consumer recovery workflow.
explicit push readiness and fresh later invocations.
R16 covers setup failure classifications and human/JSON guidance without
querying an invalid or substituted endpoint.
R17 adds byte-field structural and encoding failures at the codec boundary,
reusing the existing partial-record and lossless-observation fixtures.
2. Establish read-only behavior through resulting refs, worktree/branch state,
saved records, and controlled observations of candidate/hosted boundaries.
Reuse lower-level classification and codec tests. Tests use local remotes,

12
docs/roadmap/remediation.md
View File

@@ -1,8 +1,8 @@
# Publication reconciliation remediation
Status: open. R01–R13 are addressed and individually verified. R14–R17 record
remaining findings from the subsequent stage-by-stage review of `363f7cd`.
Address the two handoff defects first, then the classification and format gaps.
Status: all corrections are implemented and individually verified; final
assembled verification is pending. R01–R13 retain their completion evidence.
R14–R17 describe the subsequent stage-by-stage review of `363f7cd` and its fixes.
R01–R13 describe commits `4dff808` through `599ad81`, against planning baseline
`447b42a`. Their audit evidence and defect descriptions refer to that reviewed
@@ -734,6 +734,12 @@ reaching a substituted endpoint when a rewrite mismatch is detected.
## R17: Validate the documented version-2 byte-field representation — P3
**Completed:** Known byte fields load through explicit JSON string validation and
standard base64 decoding. Tests passed for valid/empty strings, numeric arrays,
other structural types, malformed base64, and retained decoding causes, alongside
existing partial/unknown-field, version-1, and lossless endpoint regressions.
Stage 2/8 instructions and the canonical format guide are updated.
**Relevant code:** `internal/publish/record.go:48–59`;
[private record format](../integrations/publication-records.md#private-attempt-record).
Affects Stage 2 and its Stage 8 format coverage.