zara-memory: reject boolean JSON-RPC response identities #120

New issue

Closed

opened 2026-09-08 02:03:01 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:01 +00:00

Owner

Problem

SymbolicMemoryMCP._parse_response() compares the JSON-RPC response ID with Python !=. Because True == 1 and False == 0, a malformed boolean response ID can alias an integer request ID and be accepted as matching provider evidence.

Required behavior

response identity must match both the value and JSON scalar type of the issued integer request ID;
boolean IDs fail closed with SymbolicMemoryMCPError;
valid integer response IDs retain current behavior;
deterministic test proves the malformed response is rejected before provider evidence is accepted;
full compatibility/registry/plugin/Nix package gates stay green.

Advances provider-evidence integrity under #7.

## Problem `SymbolicMemoryMCP._parse_response()` compares the JSON-RPC response ID with Python `!=`. Because `True == 1` and `False == 0`, a malformed boolean response ID can alias an integer request ID and be accepted as matching provider evidence. ## Required behavior - response identity must match both the value and JSON scalar type of the issued integer request ID; - boolean IDs fail closed with `SymbolicMemoryMCPError`; - valid integer response IDs retain current behavior; - deterministic test proves the malformed response is rejected before provider evidence is accepted; - full compatibility/registry/plugin/Nix package gates stay green. Advances provider-evidence integrity under #7.

nsaspy closed this issue

2026-09-08 02:03:01 +00:00