Require full SHA-256 specification locks #15

Merged

lost-rob0t merged 3 commits from agent/full-sha256-locks into main

2026-08-13 04:43:15 +00:00

lost-rob0t commented

2026-08-13 04:41:51 +00:00

(Migrated from github.com)

What changed

add one transitional full-SHA-256 lock predicate for retained compiler/spec-domain compatibility paths
replace their runtime prefix-only digest acceptance with exact sha256:<64 hex digits> validation
keep the authoritative loader's existing strict digest policy unchanged
add fresh-process regression coverage for valid lowercase/uppercase hex and malformed, short, long, wrong-scheme, and non-string values

Why

STAR-LANG-RESEARCH-006 requires exact content locking. The loader already enforces full SHA-256 values, but the retained compiler IR and spec-domain prototype paths still accepted any non-empty sha256: prefix. This closes that compatibility gap without changing import resolution semantics.

Scope

This is intentionally smaller than issue #5's binary64/Ryu work. It does not claim full Research 000–009 conformance.

Validation

GitHub Actions / Nix are the authoritative validation path for this branch.

## What changed - add one transitional full-SHA-256 lock predicate for retained compiler/spec-domain compatibility paths - replace their runtime prefix-only digest acceptance with exact `sha256:<64 hex digits>` validation - keep the authoritative loader's existing strict digest policy unchanged - add fresh-process regression coverage for valid lowercase/uppercase hex and malformed, short, long, wrong-scheme, and non-string values ## Why `STAR-LANG-RESEARCH-006` requires exact content locking. The loader already enforces full SHA-256 values, but the retained compiler IR and spec-domain prototype paths still accepted any non-empty `sha256:` prefix. This closes that compatibility gap without changing import resolution semantics. ## Scope This is intentionally smaller than issue #5's binary64/Ryu work. It does not claim full Research 000–009 conformance. ## Validation GitHub Actions / Nix are the authoritative validation path for this branch.