zara-coding: fail closed on unknown symbolic task-state protocol status #167

New issue

Closed

opened 2026-09-08 02:03:07 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:07 +00:00

Owner

Problem

TaskStateSession._request() accepts any JSON object whose status value is a string. The owned Prolog protocol has a closed response vocabulary (ok / rejected), so a corrupted or incompatible task-state process can currently return an unknown status and have it propagated as structured coding state.

Required slice

deterministic RED proving unknown protocol status is rejected;
accept only the canonical ok / rejected response statuses;
surface a bounded CodingError for incompatible protocol responses;
preserve existing valid response behavior;
run zara-coding, registry compatibility, Nix, and package gates.

This is local protocol hardening for #1 and does not require or bypass Zara Core #400.

## Problem `TaskStateSession._request()` accepts any JSON object whose `status` value is a string. The owned Prolog protocol has a closed response vocabulary (`ok` / `rejected`), so a corrupted or incompatible task-state process can currently return an unknown status and have it propagated as structured coding state. ## Required slice - deterministic RED proving unknown protocol status is rejected; - accept only the canonical `ok` / `rejected` response statuses; - surface a bounded `CodingError` for incompatible protocol responses; - preserve existing valid response behavior; - run zara-coding, registry compatibility, Nix, and package gates. This is local protocol hardening for #1 and does not require or bypass Zara Core #400.

nsaspy closed this issue

2026-09-08 02:03:07 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:43 +00:00

registry: reject non-canonical published string metadata #397