-
Notifications
You must be signed in to change notification settings - Fork 0
fix(data-integrity): validate local collaboration user runtime fields #297
Copy link
Copy link
Open
Labels
area: apiAPI, protocol, event, or external contractAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingSomething isn't workingpriority: mediumNormal-priority or P2 workNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmentOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviorDefect or incorrect behavior
Description
Activity
Metadata
Metadata
Assignees
Labels
area: apiAPI, protocol, event, or external contractAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingSomething isn't workingpriority: mediumNormal-priority or P2 workNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmentOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviorDefect or incorrect behavior
Current authoritative state
Protected shipped truth is exact
main@a40b9489665bed7d95af619a6079b9c51cab299a; local collaboration identity values still reach string operations without a complete runtime/source boundary. Closed Draft #167 is historical evidence only.Issue-specific Draft PR #407 /
codex/collaboration-user-validation-297owns this repair. It is stacked on #406 at exact base02f55466c0111bb53c6886f5d4a95de2068e944a; current exact head is7a7093b92616296be6b4c3c7ce990880d12f8271. This is active-PR behavior, not protected-main shipped truth.Required behavior
serializeCollaborationUser()readsuserId,displayName, andcursorColorthrough one module-owned failure boundary. Each value must be a string no longer than 1,024 UTF-16 code units before trim or Unicode traversal; hostile getter/Proxy failures become stable field-specific errors without reflecting private values.In-bound behavior remains: identifiers are trimmed, descriptive, nonnumeric, and at most 80 Unicode code points without proportional array materialization; display names are trimmed and truncated to 80 Unicode code points without splitting a scalar value; six-digit colors are emitted lowercase.
Remote awareness remains untrusted presentation data. Provider transport/lifecycle, authorization, tenancy, persistence, credentials, deployment, retention, migration, model policy, and durable audit remain host-owned.
Exact-head evidence
Test-only
e37b10e97540701cd9db58f9b975693af8d98674reproduces 10 failures with 30 existing checks passing. Current GREEN head passes:Repository-local success is not protected integration, independent approval, or release proof. Keep #407 Draft until its dependency chain integrates or is otherwise resolved, and while #118 owns the protected release boundary. Before lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.