Keep authenticated effect-cut work independent of digest digits

Merged
VA
3d ago
+1287-37

Problem

The unchanged effects::effect_request_and_result_bodies_never_enter_stream gate fails on main after unrelated lifecycle publications. A first-parent bisect identifies 7a4414bc6ad39b38981bcd920dcfa178bc03e513 (#513) as the first failing commit; parent 2993f654f12242864aecdfb26560f2a06d56eb52 passes. The bad observation grows by 8 copied bytes, 16 encoded bytes and 4 hashed bytes with identical I/O, item and allocation counts.

The effect-root proof canonicalizes digests as decimal JSON arrays. Its work consequently depends on digest digits rather than just the bounded fields being authenticated. A focused old-code probe reproduces that content-dependent work.

Design

Frame the root MAC directly from the domain, aggregate kind, length-prefixed issuer and aggregate identities, fixed-width revision, event digest and optional root. Hash borrowed fields without a temporary serialization buffer. Store each authenticated cut as one 65-byte tag/root/proof record, with a borrowed, strict decoder. Keep the existing atomic canonical-event anchor and all authority checks.

Deletions

Remove root-proof JSON materialization, its duplicate derived path, certificate JSON decoding and the obsolete JSON certificate allowance. Source and tests: +1286/-37, net +1249, across 16 files, including three binary corpus seeds. The review delta is verification only: +938/-21, net +917; it includes the frozen 398-line old workflow and a separate provider-observed fixture.

Decisions

The MAC domain and derived index are versioned: harness/v2/effect-history-root and harness/v3/effect-heads/. The reader and writer require the new index format; v2-only effect indexes are not silently accepted. This is an intentional derived-index format break, with no legacy decoder. Canonical event payloads retain their format.

Tests run

Signed head 3177522132e28aa23b92b5f00007d9f228f22cac. Review-fix validation ran through bs.ps1, sequentially. Production behavior is unchanged from the reviewed head; the added hook and exports exist only under native filesystem tests.

  • Root proofs: 4 passed in <0.01 s suite runtime (0.011 s process), including restored decimal serialization rejected by the same exact-work oracle for both sparse and dense digests, and the independence assertion rejecting their unequal work.
  • Binary codec: 3 passed in <0.01 s suite runtime; cut publication/verification: 7 passed in 0.17 s, including the shrinking old/new workflow comparison and independent storage-order/authentication-error negative controls.
  • Unchanged historical bound, rerun directly on its existing binary: 1 passed in 0.09 s. No limit, charge or assertion was raised or removed.
  • Windows GNU Harness --lib --tests with filesystem-local,native-execution,terminal,grpc,test-support,search-http,tui: passed in 120.125 s for this complete review delta.
  • Pinned nightly GNU cargo-fuzz: 256 runs, 0 s runtime, three checked-in seeds; complete command plus build/sync took 7.3 s. Explicit GNU target avoids the installed cargo-fuzz executable's musl default.

Paired measurement on the built unit binary:
/home/var/targets/gc-providers-706a68a1/debug/deps/acyclic_harness-3fd909b101080d38 effect_root_tests:: --nocapture

Fuzz command:
cargo +nightly-2026-07-01 fuzz run --dev --target x86_64-unknown-linux-gnu --no-default-features --fuzz-dir rust/crates/harness-fuzz effect_certificate -- -runs=256 -max_len=128

The verification includes an independently initialized buffered encoder, full proof-byte and ordered hash-trace comparison, exact error comparison, shrinking properties over revisions/digests/roots, exact production work and allocation assertions, restored-decimal exact-work and independence negative controls, byte-codec round trips and a malformed-absence negative control. The existing historical work bound is unchanged. A shared independent codec oracle is used by proptest and the effect_certificate cargo-fuzz target.

Live steps

The standalone fuzzer's Windows GNU engine build is blocked by libfuzzer-sys 0.4.13's MSVC-only __pragma in FuzzerExtFunctionsWindows.cpp. The missing C++ cross-compiler was first supplied from a hash-verified matching Ubuntu package in private temporary storage; GCC then exposed the upstream unsupported extension. No dependency flags or source were weakened, and no shared system packages were changed. The same codec and its properties compile in the passing Windows Harness proof; its actual fuzz execution passed on Linux GNU.

Review verification

The old workflow is frozen from parent 1b26e4a7770895b7afb5b967e359a59788e4ccdc. Each side initializes its own reducer, verifier, decoder path and MemoryStream; no journal, fixture state or candidate certificate decoder is shared. The scenario publishes an absent-root lifecycle cut followed by two effectful cuts, verifies historical reads, and compares authenticated roots plus exact error diagnostics for forged proofs, separate commits, missing anchors/cuts, zero byte bounds and foreign authority.

The ordered observer records complete actual storage requests. The only wire translations are v3 to v2 effect-head paths, certificates to their decoded root (both native MACs are checked independently), and immutable-node retry keys re-derived after first asserting their original path binding. Canonical event bytes, tree-node bytes, conditions, tails, mutation order and call order are compared exactly. Commit identities and read-byte totals necessarily bind the changed certificate representation; atomic membership and each format's proof are verified on their own workflow. Candidate fixed-size encoding/allocation assertions remain unchanged.

The paired new-framing MAC test remains a separate codec-level oracle. It is no longer the only workflow comparison. One control reverses the candidate's real commit mutations; another suppresses its forged-proof error. Both fail the common workflow oracle. The prior constant-one-byte copy control is replaced by the actual old decimal serializer, passed through the same exact-work assertion for zero and 255 digests, and through the same digest-independence assertion.

Exact review gate: Q:/lanes/bs.ps1 python3 -u -c (Get-Content Q:/lanes/gc-providers-851-review-gate.py -Raw). It builds only the changed library test target, runs the focused binaries directly and performs the canonical Windows GNU lib/tests cross-check. Log: Q:/lanes/gc-providers-851-review-gate-v2.log.

Additional paired workflow command on the built unit binary:
/home/var/targets/gc-providers-706a68a1/debug/deps/acyclic_harness-3fd909b101080d38 store::effect_heads::tests::cut_workflow:: --nocapture