[object Object]

← back to Ticket System

Reject non-file entries in TK-10928 replay

4c6d4f78e8631c09db49caa2f6c503023eee22cb · 2026-09-03 22:07:12 -0700 · Steve Abrams

Files touched

Diff

commit 4c6d4f78e8631c09db49caa2f6c503023eee22cb
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 22:07:12 2026 -0700

    Reject non-file entries in TK-10928 replay
---
 .../evidence/TK-10928-20260904T0444Z-vpops/README.md |  2 +-
 .../TK-10928-20260904T0444Z-vpops/e2e-proof.json     |  3 ++-
 .../TK-10928-20260904T0444Z-vpops/manifest.json      | 12 ++++++------
 .../evidence/TK-10928-20260904T0444Z-vpops/replay.sh | 20 ++++++++++++++++----
 4 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md
index de13d53f..45ea8420 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md
@@ -19,6 +19,6 @@ This R0 bundle preserves the exact point-in-time ticketmaster snapshot, the late
 
 Expected semantics: snapshot timestamp `2026-09-04T04:44:11.309Z`; 56 open/active; zero actionable pickups; zero `execute`; zero `fast-track-local`; TK-10928 is open, `hold-policy`, and Steve-gated. The preserved blocker defers the read-only scheduler/artifact correlation until `2026-09-04T11:10:00Z` and keeps remediation gated.
 
-Run `CHECK_LIVE_SOURCES=1 bash replay.sh . <trusted-commit>`. The commit argument binds the bundle to Git. Replay validates JSON, hashes/sizes, an exact top-level file allowlist (the manifest is the sole intentional self-exclusion), board/blocker semantics, exact guard bytes, pinned installed scripts, zero-cost enforcement before every paid-provider branch with inherited `DTD_ZERO_COST` absent, and live-source identity. It then invokes the actual replay against retained unmanifested-file and actionable-tamper fixtures, requiring nonzero rejection and the expected failure boundary; nested fixture runs set `RUN_NEGATIVE_FIXTURES=0` to prevent recursion. Omit `CHECK_LIVE_SOURCES=1` after canonical sources advance. Temporary directories are retained for OS reclamation.
+Run `CHECK_LIVE_SOURCES=1 bash replay.sh . <trusted-commit>`. The commit argument binds the bundle to Git. Replay validates JSON, hashes/sizes, an exact top-level entry allowlist whose expected entries must all be regular non-symlink files (the manifest is the sole intentional self-exclusion), board/blocker semantics, exact guard bytes, pinned installed scripts, zero-cost enforcement before every paid-provider branch with inherited `DTD_ZERO_COST` absent, and live-source identity. It then invokes the actual replay against retained unmanifested-file, nested-directory, and actionable-tamper fixtures, requiring nonzero rejection and the expected failure boundary; nested fixture runs set `RUN_NEGATIVE_FIXTURES=0` to prevent recursion. Omit `CHECK_LIVE_SOURCES=1` after canonical sources advance. Temporary directories are retained for OS reclamation.
 
 Cost: USD 0. No DTD, Claude, provider API, paid HTTP endpoint, external write, process action, or gated mutation was invoked.
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json
index 77b2e384..62173c32 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json
@@ -22,8 +22,9 @@
     {"boundary":"DTD static enforcement","check":"installed scripts force zero cost before all four paid-provider branches and blank provider keys without inherited DTD_ZERO_COST","verdict":"PASS"},
     {"boundary":"Git trust anchor","check":"every bundle path matches the supplied trusted commit","verdict":"PASS"},
     {"boundary":"canonical source identity","check":"captured snapshot and latest blocker compare byte-for-byte with canonical sources","verdict":"PASS"},
-    {"boundary":"integrity","check":"manifest payload hashes and sizes plus exact top-level file allowlist with manifest self-exclusion","verdict":"PASS"},
+    {"boundary":"integrity","check":"manifest hashes/sizes plus exact top-level entry allowlist; every expected entry is a regular non-symlink file; manifest self-excluded","verdict":"PASS"},
     {"boundary":"negative","check":"actual replay rejects retained unmanifested-file fixture with nonzero status","verdict":"PASS"},
+    {"boundary":"negative","check":"actual replay rejects retained nested-directory payload fixture with nonzero status","verdict":"PASS"},
     {"boundary":"negative","check":"actual replay rejects retained actionable-tamper fixture with nonzero status and recursion disabled","verdict":"PASS"}
   ],
   "cleanup": "No cleanup; unique mktemp tamper directory retained for OS reclamation.",
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json
index 07d90062..947d7cff 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json
@@ -4,8 +4,8 @@
   "files": [
     {
       "path": "README.md",
-      "bytes": 2731,
-      "sha256": "63bb25d84d8872e94008c775a8cec367e971415de9460d8f853464f3924f7357"
+      "bytes": 2812,
+      "sha256": "3a7a75c8138a2f12b228dd82a8e63e8b8b839288f8b6b98721d5677d1b0fe298"
     },
     {
       "path": "dtd-cost-mode",
@@ -14,8 +14,8 @@
     },
     {
       "path": "e2e-proof.json",
-      "bytes": 2721,
-      "sha256": "a450fb7c8f49e57e3a381edbf5e75dcfbe247de39317efde5f5ac08b01403dfa"
+      "bytes": 2897,
+      "sha256": "88e369946d91c11a20e51a59bc1ba50f4ff79380623d4a998c6041571d45e948"
     },
     {
       "path": "installed-panel.sh",
@@ -34,8 +34,8 @@
     },
     {
       "path": "replay.sh",
-      "bytes": 8418,
-      "sha256": "35ab0682f244293ca104c50821d157cf5732d84766801582c59de309e3ab59a2"
+      "bytes": 9361,
+      "sha256": "e0bf18c2f6f7d6bc34e97e4b4be5d5fdc13d9399b7f7cce77a0e30021835f428"
     },
     {
       "path": "ticketmaster-latest.json",
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh
index de5eb170..a695cf47 100755
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh
@@ -21,9 +21,10 @@ pass "JSON parses"
 
 LIST_DIR="$(mktemp -d)"
 jq -r '.files[].path, "manifest.json"' manifest.json | LC_ALL=C sort > "$LIST_DIR/expected-files.txt"
-find . -mindepth 1 -maxdepth 1 -type f -print | sed 's#^./##' | LC_ALL=C sort > "$LIST_DIR/actual-files.txt"
-cmp -s "$LIST_DIR/expected-files.txt" "$LIST_DIR/actual-files.txt" || fail "unexpected or unmanifested top-level bundle file"
-pass "top-level file allowlist including manifest self-exclusion"
+find . -mindepth 1 -maxdepth 1 -print | sed 's#^./##' | LC_ALL=C sort > "$LIST_DIR/actual-entries.txt"
+cmp -s "$LIST_DIR/expected-files.txt" "$LIST_DIR/actual-entries.txt" || fail "unexpected or unmanifested top-level bundle entry"
+while IFS= read -r expected_file; do [[ -f "$expected_file" && ! -L "$expected_file" ]] || fail "expected top-level entry is not a regular file: $expected_file"; done < "$LIST_DIR/expected-files.txt"
+pass "top-level regular-file allowlist including manifest self-exclusion"
 jq -e '.ts == "2026-09-04T04:44:11.309Z" and .totals.open_or_active == 56 and .orchestration_reasons.actionable_pickups == 0' ticketmaster-latest.json >/dev/null || fail "board totals"
 jq -e '([.top[] | select(.disposition == "execute")] | length) == 0 and ([.top[] | select(.disposition == "fast-track-local")] | length) == 0' ticketmaster-latest.json >/dev/null || fail "executable lanes"
 jq -e '[.top[] | select(.id == "TK-10928-cron-issue-com-steve-dw-backup-canary") | select(.status == "open" and .disposition == "hold-policy" and .steveGated == true and .approvalLane == "hold-policy")] | length == 1' ticketmaster-latest.json >/dev/null || fail "TK-10928 row"
@@ -87,9 +88,20 @@ if [[ "${RUN_NEGATIVE_FIXTURES:-1}" == 1 ]]; then
   unexpected_status=$?
   set -e
   [[ "$unexpected_status" -ne 0 ]] || fail "actual replay accepted unmanifested file"
-  rg -q 'FAIL unexpected or unmanifested top-level bundle file' "$NEGATIVE_DIR/unexpected-file.log" || fail "unmanifested rejection reason"
+  rg -q 'FAIL unexpected or unmanifested top-level bundle entry' "$NEGATIVE_DIR/unexpected-file.log" || fail "unmanifested rejection reason"
   pass "actual replay rejected unmanifested file fixture status=$unexpected_status"
 
+  cp -R . "$NEGATIVE_DIR/nested-directory"
+  mkdir "$NEGATIVE_DIR/nested-directory/unmanifested-directory"
+  printf 'nested payload\n' > "$NEGATIVE_DIR/nested-directory/unmanifested-directory/payload.txt"
+  set +e
+  (cd "$NEGATIVE_DIR/nested-directory" && env SKIP_GIT_BINDING=1 RUN_NEGATIVE_FIXTURES=0 CHECK_LIVE_SOURCES=0 bash replay.sh . ignored) > "$NEGATIVE_DIR/nested-directory.log" 2>&1
+  directory_status=$?
+  set -e
+  [[ "$directory_status" -ne 0 ]] || fail "actual replay accepted unmanifested directory"
+  rg -q 'FAIL unexpected or unmanifested top-level bundle entry' "$NEGATIVE_DIR/nested-directory.log" || fail "directory rejection reason"
+  pass "actual replay rejected nested-directory fixture status=$directory_status"
+
   cp -R . "$NEGATIVE_DIR/actionable-tamper"
   jq '.orchestration_reasons.actionable_pickups = 1' ticketmaster-latest.json > "$NEGATIVE_DIR/actionable-tamper/ticketmaster-latest.json"
   tampered_size="$(wc -c < "$NEGATIVE_DIR/actionable-tamper/ticketmaster-latest.json" | tr -d ' ')"

← f67741f4 Harden TK-10928 evidence replay negatives  ·  back to Ticket System  ·  Log TK-10928 guarded monitoring cycle 2a9850c3 →