From ee7e1cd18a8f2a6e45625ffa7c6012f9b368d416 Mon Sep 17 00:00:00 2001 From: lamemustafa Date: Thu, 23 Jul 2026 01:35:03 +0530 Subject: [PATCH 1/2] feat(tally): gate first canary bootstrap --- .../compatibility/compatibility-matrix.json | 2 +- .../compatibility/compatibility-surface.json | 14 ++- .../crates/bridge-tally-write/src/lib.rs | 46 ++++++++- .../bridge-tally-write/tests/qualification.rs | 97 ++++++++++++++++++- 4 files changed, 152 insertions(+), 7 deletions(-) diff --git a/docs/tally/compatibility/compatibility-matrix.json b/docs/tally/compatibility/compatibility-matrix.json index 46d530a..fda568f 100644 --- a/docs/tally/compatibility/compatibility-matrix.json +++ b/docs/tally/compatibility/compatibility-matrix.json @@ -1,7 +1,7 @@ { "schema_version": 1, "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e", - "compatibility_surface_sha256": "540328895ce1d619208a573bb3a2b834ac73bb416b6cff7ba5d52a18bce04d32", + "compatibility_surface_sha256": "982e6f651ca6fbd62d2cf51ae31dc9c5c99254338107b26d3a08339e15bac297", "claims": [ { "claim_id": "erp9-6-6-3-windows-education-xml-one-company", diff --git a/docs/tally/compatibility/compatibility-surface.json b/docs/tally/compatibility/compatibility-surface.json index 57b0cfd..7d5c593 100644 --- a/docs/tally/compatibility/compatibility-surface.json +++ b/docs/tally/compatibility/compatibility-surface.json @@ -217,6 +217,18 @@ "path": "src-tauri/crates/bridge-tally-transport/tests/http_transport.rs", "sha256": "8fcca1f0a3629ef8893e3e067c7cbbc8654d4bfd5b573814ea956891b9358c03" }, + { + "path": "src-tauri/crates/bridge-tally-write/Cargo.toml", + "sha256": "c5fc0b9e3a6c473708f2f2e641dfe13792993176d65b0bd511f5b8cca021d3d7" + }, + { + "path": "src-tauri/crates/bridge-tally-write/src/lib.rs", + "sha256": "a0c465cdcb117dc1bcbd9cf92510ad8c8f607bee519d336cf47fac12a443be0d" + }, + { + "path": "src-tauri/crates/bridge-tally-write/tests/qualification.rs", + "sha256": "d6adffdc70ee0bd8db31816745f0ff9300fb9fea04248be124c7173218734450" + }, { "path": "src-tauri/crates/tally-protocol-simulator/Cargo.toml", "sha256": "45e0bb723e924938811bd058d91ee8a34cb12ca8edc2ddca84ca3a500618f6f0" @@ -362,5 +374,5 @@ "sha256": "5a5c6eaaba234c3cbda52dfa040ed3314f79e535f744b87bc14d8d76a2299811" } ], - "manifest_sha256": "540328895ce1d619208a573bb3a2b834ac73bb416b6cff7ba5d52a18bce04d32" + "manifest_sha256": "982e6f651ca6fbd62d2cf51ae31dc9c5c99254338107b26d3a08339e15bac297" } diff --git a/src-tauri/crates/bridge-tally-write/src/lib.rs b/src-tauri/crates/bridge-tally-write/src/lib.rs index 19ef0dc..b2d20c1 100644 --- a/src-tauri/crates/bridge-tally-write/src/lib.rs +++ b/src-tauri/crates/bridge-tally-write/src/lib.rs @@ -269,6 +269,13 @@ pub struct WriteAuthorization { approved_wire_sha256: String, approved_intended_state_sha256: String, approved_identity_query_sha256: String, + mode: WriteAuthorizationMode, +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum WriteAuthorizationMode { + ObservedCapability, + CanaryBootstrap, } impl std::fmt::Debug for WriteAuthorization { @@ -286,6 +293,21 @@ impl std::fmt::Debug for WriteAuthorization { pub fn authorize_synthetic_write( request: WriteAuthorizationRequest, +) -> Result { + authorize_synthetic_write_with_mode(request, WriteAuthorizationMode::ObservedCapability) +} + +/// Authorizes only a first, namespaced fixture canary. It never grants normal +/// write authority: preparation binds this mode to exactly one ledger create. +pub fn authorize_synthetic_canary_bootstrap( + request: WriteAuthorizationRequest, +) -> Result { + authorize_synthetic_write_with_mode(request, WriteAuthorizationMode::CanaryBootstrap) +} + +fn authorize_synthetic_write_with_mode( + request: WriteAuthorizationRequest, + mode: WriteAuthorizationMode, ) -> Result { if !request.explicit_opt_in { return Err(QualificationError::ExplicitOptInRequired); @@ -293,9 +315,16 @@ pub fn authorize_synthetic_write( if !request.synthetic_company_confirmed { return Err(QualificationError::SyntheticCompanyRequired); } - if request.capability != WriteCapability::Observed { + if mode == WriteAuthorizationMode::ObservedCapability + && request.capability != WriteCapability::Observed + { return Err(QualificationError::ObservedCapabilityRequired); } + if mode == WriteAuthorizationMode::CanaryBootstrap + && request.capability == WriteCapability::Unsupported + { + return Err(QualificationError::UnsupportedCanaryBootstrap); + } if !request.backup_guidance_acknowledged { return Err(QualificationError::BackupAcknowledgementRequired); } @@ -325,6 +354,7 @@ pub fn authorize_synthetic_write( approved_wire_sha256: request.approved_wire_sha256, approved_intended_state_sha256: request.approved_intended_state_sha256, approved_identity_query_sha256: request.approved_identity_query_sha256, + mode, }) } @@ -777,6 +807,10 @@ pub enum QualificationError { NoOpMutation, #[error("controlled ledger create requires an explicit parent")] CreateParentRequired, + #[error("first canary bootstrap must be one BRIDGE-CANARY ledger create")] + CanaryBootstrapSingleCreateRequired, + #[error("first canary bootstrap is unavailable for an unsupported endpoint")] + UnsupportedCanaryBootstrap, #[error("clearing controlled ledger field is not yet qualified: {0}")] UnsupportedFieldClear(&'static str), #[error("preflight readback did not exactly match the declared before state")] @@ -904,6 +938,16 @@ pub fn prepare_ledger_import( if mutations.is_empty() || mutations.len() > MAX_LEDGER_WRITE_BATCH { return Err(QualificationError::InvalidBatchSize); } + if authorization.mode == WriteAuthorizationMode::CanaryBootstrap { + let [mutation] = mutations.as_slice() else { + return Err(QualificationError::CanaryBootstrapSingleCreateRequired); + }; + if mutation.operation != LedgerOperation::Create + || !mutation.after.name.starts_with("BRIDGE-CANARY-") + { + return Err(QualificationError::CanaryBootstrapSingleCreateRequired); + } + } if authorization.company_guid != company.guid { return Err(QualificationError::SyntheticCompanyRequired); } diff --git a/src-tauri/crates/bridge-tally-write/tests/qualification.rs b/src-tauri/crates/bridge-tally-write/tests/qualification.rs index 8129d12..074c72f 100644 --- a/src-tauri/crates/bridge-tally-write/tests/qualification.rs +++ b/src-tauri/crates/bridge-tally-write/tests/qualification.rs @@ -1,8 +1,8 @@ use bridge_tally_write::{ - authorize_synthetic_write, prepare_ledger_import, preview_ledger_import, IdempotencyRegistry, - LedgerMutation, LedgerState, PreparedLedgerImport, QualificationError, SourceLineage, - SyntheticCompany, WriteAuthorizationRequest, WriteCapability, WriteOutcome, - MAX_LEDGER_WRITE_BATCH, + authorize_synthetic_canary_bootstrap, authorize_synthetic_write, prepare_ledger_import, + preview_ledger_import, IdempotencyRegistry, LedgerMutation, LedgerState, PreparedLedgerImport, + QualificationError, SourceLineage, SyntheticCompany, WriteAuthorizationRequest, + WriteCapability, WriteOutcome, MAX_LEDGER_WRITE_BATCH, }; const COMPANY_GUID: &str = "00000000-0000-4000-8000-000000000001"; @@ -135,6 +135,95 @@ fn authorization_gates_are_mandatory() { ); } +#[test] +fn canary_bootstrap_is_single_namespaced_create_only() { + let company = company(); + let canary = vec![create(REMOTE_ID, state("BRIDGE-CANARY-LEDGER-001", "0"), 1)]; + let preview = preview_ledger_import(&company, &canary, "mapping-v1").unwrap(); + let request = WriteAuthorizationRequest { + explicit_opt_in: true, + synthetic_company_confirmed: true, + company_guid: COMPANY_GUID.to_owned(), + capability: WriteCapability::Unknown, + backup_guidance_acknowledged: true, + approval_evidence_sha256: HASH.to_owned(), + approved_wire_sha256: preview.wire_digest().as_hex().to_owned(), + approved_intended_state_sha256: preview.intended_state_digest().as_hex().to_owned(), + approved_identity_query_sha256: preview.identity_query_digest().as_hex().to_owned(), + idempotency_key: "bootstrap-key".to_owned(), + outbox_id: "bootstrap-outbox".to_owned(), + mapping_version: "mapping-v1".to_owned(), + }; + prepare_ledger_import( + company.clone(), + canary, + authorize_synthetic_canary_bootstrap(request.clone()).unwrap(), + &mut IdempotencyRegistry::default(), + ) + .expect("one reviewed namespaced canary may proceed to later qualification"); + + let ordinary = vec![create(REMOTE_ID, state("ORDINARY LEDGER", "0"), 1)]; + let ordinary_preview = preview_ledger_import(&company, &ordinary, "mapping-v1").unwrap(); + let mut ordinary_request = request.clone(); + ordinary_request.approved_wire_sha256 = ordinary_preview.wire_digest().as_hex().to_owned(); + ordinary_request.approved_intended_state_sha256 = + ordinary_preview.intended_state_digest().as_hex().to_owned(); + ordinary_request.approved_identity_query_sha256 = + ordinary_preview.identity_query_digest().as_hex().to_owned(); + assert_eq!( + prepare_ledger_import( + company.clone(), + ordinary, + authorize_synthetic_canary_bootstrap(ordinary_request).unwrap(), + &mut IdempotencyRegistry::default(), + ) + .unwrap_err(), + QualificationError::CanaryBootstrapSingleCreateRequired + ); + + let two_canaries = vec![ + create(REMOTE_ID, state("BRIDGE-CANARY-LEDGER-001", "0"), 1), + create( + "bridge-synthetic-ledger-002", + state("BRIDGE-CANARY-LEDGER-002", "0"), + 2, + ), + ]; + assert_eq!( + prepare_ledger_import( + company.clone(), + two_canaries, + authorize_synthetic_canary_bootstrap(request.clone()).unwrap(), + &mut IdempotencyRegistry::default(), + ) + .unwrap_err(), + QualificationError::CanaryBootstrapSingleCreateRequired + ); + + let canary_alter = vec![alter( + REMOTE_ID, + state("BRIDGE-CANARY-LEDGER-001", "0"), + state("BRIDGE-CANARY-LEDGER-001", "1"), + )]; + assert_eq!( + prepare_ledger_import( + company, + canary_alter, + authorize_synthetic_canary_bootstrap(request.clone()).unwrap(), + &mut IdempotencyRegistry::default(), + ) + .unwrap_err(), + QualificationError::CanaryBootstrapSingleCreateRequired + ); + + let mut unsupported = request; + unsupported.capability = WriteCapability::Unsupported; + assert_eq!( + authorize_synthetic_canary_bootstrap(unsupported).unwrap_err(), + QualificationError::UnsupportedCanaryBootstrap + ); +} + #[test] fn approval_must_bind_the_exact_preview_commitments() { let company = company(); From 1476d166bd413847a1264391396fe107827c1221 Mon Sep 17 00:00:00 2001 From: lamemustafa Date: Thu, 23 Jul 2026 01:43:28 +0530 Subject: [PATCH 2/2] fix(tally): close premature canary bypass --- .../compatibility/compatibility-matrix.json | 2 +- .../compatibility/compatibility-surface.json | 6 +- .../crates/bridge-tally-write/src/lib.rs | 46 +-------- .../bridge-tally-write/tests/qualification.rs | 97 +------------------ 4 files changed, 9 insertions(+), 142 deletions(-) diff --git a/docs/tally/compatibility/compatibility-matrix.json b/docs/tally/compatibility/compatibility-matrix.json index fda568f..9717053 100644 --- a/docs/tally/compatibility/compatibility-matrix.json +++ b/docs/tally/compatibility/compatibility-matrix.json @@ -1,7 +1,7 @@ { "schema_version": 1, "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e", - "compatibility_surface_sha256": "982e6f651ca6fbd62d2cf51ae31dc9c5c99254338107b26d3a08339e15bac297", + "compatibility_surface_sha256": "37a41940c7e2c360acd07e05cdcd30a29b772ca13d53159ab489301a050490b0", "claims": [ { "claim_id": "erp9-6-6-3-windows-education-xml-one-company", diff --git a/docs/tally/compatibility/compatibility-surface.json b/docs/tally/compatibility/compatibility-surface.json index 7d5c593..6258851 100644 --- a/docs/tally/compatibility/compatibility-surface.json +++ b/docs/tally/compatibility/compatibility-surface.json @@ -223,11 +223,11 @@ }, { "path": "src-tauri/crates/bridge-tally-write/src/lib.rs", - "sha256": "a0c465cdcb117dc1bcbd9cf92510ad8c8f607bee519d336cf47fac12a443be0d" + "sha256": "5d8fe928bab95988c2bd529cbb99a60d83cec0b74c53594f380e2b05045aad02" }, { "path": "src-tauri/crates/bridge-tally-write/tests/qualification.rs", - "sha256": "d6adffdc70ee0bd8db31816745f0ff9300fb9fea04248be124c7173218734450" + "sha256": "8c86a394fe9444cba2892e59218ac3348aaef4cdc67503cddf48975189f8e33f" }, { "path": "src-tauri/crates/tally-protocol-simulator/Cargo.toml", @@ -374,5 +374,5 @@ "sha256": "5a5c6eaaba234c3cbda52dfa040ed3314f79e535f744b87bc14d8d76a2299811" } ], - "manifest_sha256": "982e6f651ca6fbd62d2cf51ae31dc9c5c99254338107b26d3a08339e15bac297" + "manifest_sha256": "37a41940c7e2c360acd07e05cdcd30a29b772ca13d53159ab489301a050490b0" } diff --git a/src-tauri/crates/bridge-tally-write/src/lib.rs b/src-tauri/crates/bridge-tally-write/src/lib.rs index b2d20c1..19ef0dc 100644 --- a/src-tauri/crates/bridge-tally-write/src/lib.rs +++ b/src-tauri/crates/bridge-tally-write/src/lib.rs @@ -269,13 +269,6 @@ pub struct WriteAuthorization { approved_wire_sha256: String, approved_intended_state_sha256: String, approved_identity_query_sha256: String, - mode: WriteAuthorizationMode, -} - -#[derive(Debug, Clone, Copy, PartialEq, Eq)] -enum WriteAuthorizationMode { - ObservedCapability, - CanaryBootstrap, } impl std::fmt::Debug for WriteAuthorization { @@ -293,21 +286,6 @@ impl std::fmt::Debug for WriteAuthorization { pub fn authorize_synthetic_write( request: WriteAuthorizationRequest, -) -> Result { - authorize_synthetic_write_with_mode(request, WriteAuthorizationMode::ObservedCapability) -} - -/// Authorizes only a first, namespaced fixture canary. It never grants normal -/// write authority: preparation binds this mode to exactly one ledger create. -pub fn authorize_synthetic_canary_bootstrap( - request: WriteAuthorizationRequest, -) -> Result { - authorize_synthetic_write_with_mode(request, WriteAuthorizationMode::CanaryBootstrap) -} - -fn authorize_synthetic_write_with_mode( - request: WriteAuthorizationRequest, - mode: WriteAuthorizationMode, ) -> Result { if !request.explicit_opt_in { return Err(QualificationError::ExplicitOptInRequired); @@ -315,16 +293,9 @@ fn authorize_synthetic_write_with_mode( if !request.synthetic_company_confirmed { return Err(QualificationError::SyntheticCompanyRequired); } - if mode == WriteAuthorizationMode::ObservedCapability - && request.capability != WriteCapability::Observed - { + if request.capability != WriteCapability::Observed { return Err(QualificationError::ObservedCapabilityRequired); } - if mode == WriteAuthorizationMode::CanaryBootstrap - && request.capability == WriteCapability::Unsupported - { - return Err(QualificationError::UnsupportedCanaryBootstrap); - } if !request.backup_guidance_acknowledged { return Err(QualificationError::BackupAcknowledgementRequired); } @@ -354,7 +325,6 @@ fn authorize_synthetic_write_with_mode( approved_wire_sha256: request.approved_wire_sha256, approved_intended_state_sha256: request.approved_intended_state_sha256, approved_identity_query_sha256: request.approved_identity_query_sha256, - mode, }) } @@ -807,10 +777,6 @@ pub enum QualificationError { NoOpMutation, #[error("controlled ledger create requires an explicit parent")] CreateParentRequired, - #[error("first canary bootstrap must be one BRIDGE-CANARY ledger create")] - CanaryBootstrapSingleCreateRequired, - #[error("first canary bootstrap is unavailable for an unsupported endpoint")] - UnsupportedCanaryBootstrap, #[error("clearing controlled ledger field is not yet qualified: {0}")] UnsupportedFieldClear(&'static str), #[error("preflight readback did not exactly match the declared before state")] @@ -938,16 +904,6 @@ pub fn prepare_ledger_import( if mutations.is_empty() || mutations.len() > MAX_LEDGER_WRITE_BATCH { return Err(QualificationError::InvalidBatchSize); } - if authorization.mode == WriteAuthorizationMode::CanaryBootstrap { - let [mutation] = mutations.as_slice() else { - return Err(QualificationError::CanaryBootstrapSingleCreateRequired); - }; - if mutation.operation != LedgerOperation::Create - || !mutation.after.name.starts_with("BRIDGE-CANARY-") - { - return Err(QualificationError::CanaryBootstrapSingleCreateRequired); - } - } if authorization.company_guid != company.guid { return Err(QualificationError::SyntheticCompanyRequired); } diff --git a/src-tauri/crates/bridge-tally-write/tests/qualification.rs b/src-tauri/crates/bridge-tally-write/tests/qualification.rs index 074c72f..8129d12 100644 --- a/src-tauri/crates/bridge-tally-write/tests/qualification.rs +++ b/src-tauri/crates/bridge-tally-write/tests/qualification.rs @@ -1,8 +1,8 @@ use bridge_tally_write::{ - authorize_synthetic_canary_bootstrap, authorize_synthetic_write, prepare_ledger_import, - preview_ledger_import, IdempotencyRegistry, LedgerMutation, LedgerState, PreparedLedgerImport, - QualificationError, SourceLineage, SyntheticCompany, WriteAuthorizationRequest, - WriteCapability, WriteOutcome, MAX_LEDGER_WRITE_BATCH, + authorize_synthetic_write, prepare_ledger_import, preview_ledger_import, IdempotencyRegistry, + LedgerMutation, LedgerState, PreparedLedgerImport, QualificationError, SourceLineage, + SyntheticCompany, WriteAuthorizationRequest, WriteCapability, WriteOutcome, + MAX_LEDGER_WRITE_BATCH, }; const COMPANY_GUID: &str = "00000000-0000-4000-8000-000000000001"; @@ -135,95 +135,6 @@ fn authorization_gates_are_mandatory() { ); } -#[test] -fn canary_bootstrap_is_single_namespaced_create_only() { - let company = company(); - let canary = vec![create(REMOTE_ID, state("BRIDGE-CANARY-LEDGER-001", "0"), 1)]; - let preview = preview_ledger_import(&company, &canary, "mapping-v1").unwrap(); - let request = WriteAuthorizationRequest { - explicit_opt_in: true, - synthetic_company_confirmed: true, - company_guid: COMPANY_GUID.to_owned(), - capability: WriteCapability::Unknown, - backup_guidance_acknowledged: true, - approval_evidence_sha256: HASH.to_owned(), - approved_wire_sha256: preview.wire_digest().as_hex().to_owned(), - approved_intended_state_sha256: preview.intended_state_digest().as_hex().to_owned(), - approved_identity_query_sha256: preview.identity_query_digest().as_hex().to_owned(), - idempotency_key: "bootstrap-key".to_owned(), - outbox_id: "bootstrap-outbox".to_owned(), - mapping_version: "mapping-v1".to_owned(), - }; - prepare_ledger_import( - company.clone(), - canary, - authorize_synthetic_canary_bootstrap(request.clone()).unwrap(), - &mut IdempotencyRegistry::default(), - ) - .expect("one reviewed namespaced canary may proceed to later qualification"); - - let ordinary = vec![create(REMOTE_ID, state("ORDINARY LEDGER", "0"), 1)]; - let ordinary_preview = preview_ledger_import(&company, &ordinary, "mapping-v1").unwrap(); - let mut ordinary_request = request.clone(); - ordinary_request.approved_wire_sha256 = ordinary_preview.wire_digest().as_hex().to_owned(); - ordinary_request.approved_intended_state_sha256 = - ordinary_preview.intended_state_digest().as_hex().to_owned(); - ordinary_request.approved_identity_query_sha256 = - ordinary_preview.identity_query_digest().as_hex().to_owned(); - assert_eq!( - prepare_ledger_import( - company.clone(), - ordinary, - authorize_synthetic_canary_bootstrap(ordinary_request).unwrap(), - &mut IdempotencyRegistry::default(), - ) - .unwrap_err(), - QualificationError::CanaryBootstrapSingleCreateRequired - ); - - let two_canaries = vec![ - create(REMOTE_ID, state("BRIDGE-CANARY-LEDGER-001", "0"), 1), - create( - "bridge-synthetic-ledger-002", - state("BRIDGE-CANARY-LEDGER-002", "0"), - 2, - ), - ]; - assert_eq!( - prepare_ledger_import( - company.clone(), - two_canaries, - authorize_synthetic_canary_bootstrap(request.clone()).unwrap(), - &mut IdempotencyRegistry::default(), - ) - .unwrap_err(), - QualificationError::CanaryBootstrapSingleCreateRequired - ); - - let canary_alter = vec![alter( - REMOTE_ID, - state("BRIDGE-CANARY-LEDGER-001", "0"), - state("BRIDGE-CANARY-LEDGER-001", "1"), - )]; - assert_eq!( - prepare_ledger_import( - company, - canary_alter, - authorize_synthetic_canary_bootstrap(request.clone()).unwrap(), - &mut IdempotencyRegistry::default(), - ) - .unwrap_err(), - QualificationError::CanaryBootstrapSingleCreateRequired - ); - - let mut unsupported = request; - unsupported.capability = WriteCapability::Unsupported; - assert_eq!( - authorize_synthetic_canary_bootstrap(unsupported).unwrap_err(), - QualificationError::UnsupportedCanaryBootstrap - ); -} - #[test] fn approval_must_bind_the_exact_preview_commitments() { let company = company();