zara-coding: validate git log object IDs before projecting evidence #195

New issue

Closed

opened 2026-09-08 02:03:12 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:12 +00:00

Owner

Advances #1.

RepositoryInspector.log() parses bounded structured history but currently trusts commit and parent fields as opaque strings. Malformed Git/mock output can therefore be projected as repository evidence even though downstream symbolic verification treats these as object identities.

Acceptance:

deterministic RED for malformed commit and parent object IDs;
accept both 40- and 64-hex Git object IDs;
fail with bounded CodingError tied to malformed structured git log output;
preserve history bounds, structured author/time/subject fields, fixed argv/no shell;
focused tests, registry compatibility, full nix flake check, generated package builds, exact-head protected merge.

Advances #1. `RepositoryInspector.log()` parses bounded structured history but currently trusts commit and parent fields as opaque strings. Malformed Git/mock output can therefore be projected as repository evidence even though downstream symbolic verification treats these as object identities. Acceptance: - deterministic RED for malformed commit and parent object IDs; - accept both 40- and 64-hex Git object IDs; - fail with bounded `CodingError` tied to malformed structured `git log` output; - preserve history bounds, structured author/time/subject fields, fixed argv/no shell; - focused tests, registry compatibility, full `nix flake check`, generated package builds, exact-head protected merge.

nsaspy closed this issue

2026-09-08 02:03:12 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:38 +00:00

coding: reject malformed numstat evidence explicitly #383