zara-coding: validate branch inventory object IDs before projecting evidence #194

New issue

Closed

opened 2026-09-08 02:03:12 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:12 +00:00

Owner

Advances #1.

RepositoryInspector._parse_branch_inventory() currently accepts the %(objectname) field from bounded git for-each-ref output as opaque text. A malformed Git/mock response can therefore become structured branch evidence even though downstream symbolic verification treats it as an object identity.

Acceptance:

deterministic RED for malformed branch object IDs;
accept both 40- and 64-hex Git object IDs;
fail with bounded CodingError tied to malformed structured branch inventory;
preserve branch inventory bounds, upstream fields, double-snapshot recheck, fixed argv/no shell;
focused tests, registry compatibility, full nix flake check, generated package builds, exact-head protected merge.

Advances #1. `RepositoryInspector._parse_branch_inventory()` currently accepts the `%(objectname)` field from bounded `git for-each-ref` output as opaque text. A malformed Git/mock response can therefore become structured branch evidence even though downstream symbolic verification treats it as an object identity. Acceptance: - deterministic RED for malformed branch object IDs; - accept both 40- and 64-hex Git object IDs; - fail with bounded `CodingError` tied to malformed structured branch inventory; - preserve branch inventory bounds, upstream fields, double-snapshot recheck, fixed argv/no shell; - focused tests, registry compatibility, full `nix flake check`, generated package builds, exact-head protected merge.

nsaspy closed this issue

2026-09-08 02:03:12 +00:00