Repository navigation
spec(port): port the ratchet tree update integrity guard (Refs #8883) - #9949
dmitrii-f-t27 wants to merge 2 commits into
Conversation
…ag#8883) The twenty-fourth CR-CHAT-03 ring target (W3, R-CHAT-3): the tree-update rules, in the original's fixed order - the batch ceiling (two hundred fifty-six), then per update the node index inside the tree (one thousand twenty-four), the fresh node, the claimed parent hash equal to the computed one, the epoch equal to the current one, and the signer an active leaf member - as the D5 verdict with every payload field (the node index of the per-update rules, the signer leaf, the expected and got epochs), the original's rule order, and all ten RTUI tests transcribed plus helper, builder and rule-order tests. The original's BTreeSet probes become scans over the updates already visited and over the member leaf slice. The loop fixtures of the original - the node hash as the low byte of its index - arrive as a precomputed table the fixture builder reads, the computed and tabular forms matching exactly (the narrowing cast on the original's counter does not exist in t27). Checks (conventions 0-14): t27b test 15 passed 0 failed; t27c test-report 15/15, 0 vacuous; gen-rust output compiles under rustc; coverage Untested 0; ASCII only; seal saved, all hashes MATCH;
|
All required checks green (validate, check-linked-issue, parse-ratchet, t27b-native-linux, t27b-native-macos); cli-tri / duplicate-bodies / t27b-native-ratchet are the known non-required reds. Steward READY. Twenty-fourth CR-CHAT-03 target (24/47 T-PORT) — requesting owner merge when convenient, Refs #8883. |
|
Root cause found: the ledger row for this spec was inserted before ratchet_tree_resolution_guard, but ratchet_tree_u sorts after ratchet_tree_r — the loop-tools-tracked ledger-sort check failed. Fixed by a follow-up commit moving the row to its sorted position (after resolution, before unmerged_leaves); fast-forward push, CI re-running. Steward will re-check. |
|
Superseded by #9977 — the same two commits rebased onto the current master (c4bb3b6) after #9970 landed the duplicate-bodies dupe-ledger blessings this branch's old base (cd8a656) lacked. The spec content is unchanged; the earlier loop-tools-tracked ledger-sort failure was already fixed here in 178cafe. Closing in favor of the rebased PR (Refs #8883). |
1 participant
The twenty-fourth CR-CHAT-03 ring target (W3, tracker #8883, epic gHashTag/trios#1812): port of
crates/trios-chat/rings/CR-CHAT-03/src/ratchet_tree_update_integrity_guard.rs(Wave-84 Lane A, R-CHAT-3).Every TreeKEM update carries the parent hash binding its node to the tree structure; without the gate an attacker injects an orphan node outside consensus, swaps siblings and re-signs so recipients derive different keys, or replays a stale update from a prior epoch. Rules, in the original's fixed order:
Carried as the D5 verdict with every payload field: the node index (
HashMismatch(u64),InvalidNodeIndex(u64),DuplicateNode(u64)), the signer leaf (NonMemberSigner(u64)), and the expected/got epochs (EpochMismatch).Adaptations (t27 conventions): the original's
BTreeSetprobes → scans (seen nodes over the updates already visited; member set over the leaf slice); the loop fixtures' node-hash-as-low-byte-of-index arrives as a precomputed table read by a shared fixture-builder function (computed and tabular forms match exactly — the narrowing cast on the original's counter does not exist in t27); the builder's local array carries a literal initializer (the gen-rust E0381 lesson).All 10 original RTUI tests transcribed with exact asserts (the 257-flood and the exact-256 boundary), plus helper tests, a builder test and a rule-order ladder stacking each per-update violation on the later ones — 15 total.
Checks (conventions 0-14):
t27b test15 passed 0 failed, 0 blockers;t27c test-report15/15, 0 vacuous; gen-rust output compiles under rustc (0'static str, 0Vec<const); coverage Untested 0; ASCII only; seal saved, all hashes MATCH; ledger row added todocs/reports/t27b_expectations.json.Refs #8883