From 9df913d56389d39d77600ac6a306e13898f97b1e Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 21:27:17 -0700 Subject: [PATCH 1/3] Remove 30 placeholder tests that asserted nothing Every one was #[ignore]d with a todo! or unimplemented! body. They read as coverage of copy-on-write overlays, privacy and claims, merge regimes, open portals and bucket footprints, and checked none of it. - parallel_cow.rs, parallel_privacy.rs and parallel_merge.rs held only placeholders (24) and are deleted. - Four placeholders and their plan comments leave parallel_openportal_rules.rs, along with the unimplemented lint allowance added for them; two leave parallel_footprints.rs. Each test name and its stated intent is recorded on #814. Fixes #814. Co-Authored-By: Claude Opus 5.5 --- crates/warp-core/tests/parallel_cow.rs | 116 ------------- crates/warp-core/tests/parallel_footprints.rs | 30 ---- crates/warp-core/tests/parallel_merge.rs | 150 ---------------- .../tests/parallel_openportal_rules.rs | 135 +-------------- crates/warp-core/tests/parallel_privacy.rs | 162 ------------------ 5 files changed, 1 insertion(+), 592 deletions(-) delete mode 100644 crates/warp-core/tests/parallel_cow.rs delete mode 100644 crates/warp-core/tests/parallel_merge.rs delete mode 100644 crates/warp-core/tests/parallel_privacy.rs diff --git a/crates/warp-core/tests/parallel_cow.rs b/crates/warp-core/tests/parallel_cow.rs deleted file mode 100644 index ea1ff20d9..000000000 --- a/crates/warp-core/tests/parallel_cow.rs +++ /dev/null @@ -1,116 +0,0 @@ -// SPDX-License-Identifier: Apache-2.0 -// © James Ross Ω FLYING•ROBOTS -#![allow(clippy::todo)] -//! Parallel Execution COW Overlay Semantics Tests (ADR-0007 §5) -//! -//! Tests for Copy-on-Write semantics: -//! - Delete is unlink (view-only) -//! - Overlay precedence -//! - Structural sharing - -mod common; - -// ============================================================================= -// T2: COW Overlay Semantics -// ============================================================================= - -// TODO(COW-001): Implement once Snapshot + Overlay view resolution exists. -#[test] -#[ignore = "COW-001: Parallel COW overlay not yet implemented"] -fn t2_1_delete_is_unlink_not_physical_delete() { - // Given: base snapshot has node X; overlay deletes X - // Expect: reads from overlay show X absent; base snapshot still contains X - // - // This test asserts the ADR contract: - // - base snapshot remains unchanged - // - overlay removes visibility in the next snapshot/view - // - // Wire this once you have Snapshot + Overlay view resolution. - todo!( - "COW-001: build base with node X, apply overlay delete, \ - assert view hides X but base still has X" - ); -} - -// TODO(COW-002): Implement once DeltaView wiring exists. -#[test] -#[ignore = "COW-002: Parallel COW overlay not yet implemented"] -fn t2_2_overlay_wins_over_base_reads() { - // Given: base has attachment A; overlay sets A to new value - // Expect: read yields overlay value; commit includes overlay value - todo!( - "COW-002: base has attachment A; overlay sets A; \ - reads return overlay; commit includes overlay" - ); -} - -// TODO(COW-003): Implement once segment-level COW optimization exists. -#[test] -#[ignore = "COW-003: Parallel COW overlay not yet implemented"] -fn t2_3_structural_sharing_reuses_unchanged_segments() { - // Given: commit changes only one node attachment - // Expect: only the affected segments differ; unchanged segments reused - // - // - Build commit C0 - // - Build commit C1 with one small change - // - Compare segment manifests: most hashes identical - // - // NOTE: This test is for future segment-level COW optimization. - // Per ADR-0007 migration plan, skip until god test passes. - todo!( - "COW-003: commit C0 then C1 with tiny change; \ - verify segment manifest reuses most segments" - ); -} - -// ============================================================================= -// Reachable-only semantics (§5.4 - COW view) -// NOTE: This test uses COW naming (t2_4) to stay with COW tests. -// If parallel_snapshot.rs is added later, consider moving this test there as t1_3. -// ============================================================================= - -// TODO(COW-004): Implement once reachability harness is wired. -#[test] -#[ignore = "COW-004: Parallel reachability not yet wired to harness"] -fn t2_4_reachable_only_semantics() { - // Given: unreachable node/edge exists in object store but not reachable from root - // Expect: snapshot excludes it; state_root unchanged if only unreachable changes - // - // - Add unreachable objects to CAS (or builder inputs) - // - Ensure snapshot excludes them - // - Ensure state_root ignores them - todo!( - "COW-004: add unreachable node, verify snapshot excludes it, \ - verify state_root unchanged" - ); -} - -// ============================================================================= -// View resolution during execution -// ============================================================================= - -// TODO(COW-005): Implement once DeltaView is implemented. -#[test] -#[ignore = "COW-005: Parallel DeltaView not yet implemented"] -fn delta_view_resolves_overlay_then_base() { - // Given: base snapshot + in-progress TickDelta with some writes - // Expect: DeltaView::get() returns overlay value if present, else base value - // - // This validates the read path during execution before commit. - todo!( - "COW-005: create DeltaView over snapshot + delta, \ - verify reads resolve correctly" - ); -} - -// TODO(COW-006): Implement once DeltaView tombstone handling exists. -#[test] -#[ignore = "COW-006: Parallel DeltaView not yet implemented"] -fn delta_view_handles_tombstones() { - // Given: base has node X; delta contains DeleteNode(X) - // Expect: DeltaView::get_node(X) returns None - todo!( - "COW-006: create DeltaView with delete tombstone, \ - verify node appears absent" - ); -} diff --git a/crates/warp-core/tests/parallel_footprints.rs b/crates/warp-core/tests/parallel_footprints.rs index 2e4411352..d399dc247 100644 --- a/crates/warp-core/tests/parallel_footprints.rs +++ b/crates/warp-core/tests/parallel_footprints.rs @@ -42,36 +42,6 @@ fn t3_1_footprint_independence_is_symmetric() { } } -// TODO(FP-001): Implement once bucket target enforcement exists. -#[test] -#[ignore = "FP-001: Parallel bucket target enforcement not yet implemented"] -fn t3_2_no_write_read_overlap_admitted() { - // Given: two planned rewrites where one writes a node the other reads - // Expect: only one admitted - todo!( - "FP-001: build two PlannedRewrites with write/read overlap; \ - assert only one is admitted" - ); -} - -// TODO(FP-002): Implement once bucket target enforcement exists. -#[test] -#[ignore = "FP-002: Parallel bucket target enforcement not yet implemented"] -fn t3_3_deletes_that_share_adjacency_bucket_must_conflict() { - // The classic race: delete e1=(A->B) and e2=(A->C) both mutate edges_from[A]. - // Your footprint model must claim the bucket target - // (e.g., AttachmentKey::EdgesFromBucket(A)). - // - // Given: two edge deletes with same `from` but different edge_id - // Expect: independence fails when adjacency bucket target is claimed - // - // (This test prevents the "retain() race" forever.) - todo!( - "FP-002: build two PlannedRewrites deleting edges from same node; \ - assert admission rejects running both concurrently" - ); -} - #[cfg(any(debug_assertions, feature = "footprint_enforce_release"))] #[cfg(not(feature = "unsafe_graph"))] mod enforcement { diff --git a/crates/warp-core/tests/parallel_merge.rs b/crates/warp-core/tests/parallel_merge.rs deleted file mode 100644 index ed89d7e48..000000000 --- a/crates/warp-core/tests/parallel_merge.rs +++ /dev/null @@ -1,150 +0,0 @@ -// SPDX-License-Identifier: Apache-2.0 -// © James Ross Ω FLYING•ROBOTS -#![allow(clippy::unimplemented)] -//! Parallel Execution Collapse/Merge Tests (ADR-0007 §9) -//! -//! Tests for multi-parent merge semantics: -//! - Commutative merge parent order invariance -//! - Canonical parent ordering for order-dependent merges -//! - Conflict artifact determinism - -mod common; - -// ============================================================================= -// T6: Merge / Collapse -// ============================================================================= - -#[test] -#[ignore = "Parallel collapse/merge not yet implemented"] -fn t6_1_commutative_merge_is_parent_order_invariant() { - // Given: same set of parents in different orders - // Expect: identical merge commit hash for mergeable types - // - // For mergeable types (commutative+associative), parent order must not matter. - unimplemented!( - "Implement: create two parent commits with commutative attachment merges; \ - merge in both orders; commit_hash equal" - ); -} - -#[test] -#[ignore = "Parallel collapse/merge not yet implemented"] -fn t6_2_order_dependent_merge_uses_canonical_parent_order() { - // Given: order-dependent merge type - // Expect: merge uses parent commit hash sort order and is stable - // - // If you support order-dependent merges, the engine must canonicalize - // parent ordering by sorting parents by commit_hash, then folding. - unimplemented!( - "Implement: make an order-dependent merge type; \ - verify parent ordering by commit hash yields stable result" - ); -} - -#[test] -#[ignore = "Parallel collapse/merge not yet implemented"] -fn t6_3_irreconcilable_conflicts_produce_deterministic_conflict_artifact() { - // Given: two parents write different non-mergeable values to same key - // Expect: merge yields conflict artifact (bytes + hash stable) - // - // When merge cannot resolve: - // - Emit a conflict artifact attachment/object containing only: - // - parent commit hashes - // - statement/value hashes - // - type ids - // - policy hashes - // No secrets, no raw sensitive bytes. - unimplemented!( - "Implement: two parents write different non-mergeable values; \ - merge yields deterministic conflict artifact" - ); -} - -// ============================================================================= -// Merge regimes (§9.2) -// ============================================================================= - -#[test] -#[ignore = "Parallel typed merge registry not yet implemented"] -fn merge_regime_crdt_like_is_preferred() { - // Preferred: commutative + associative merges (CRDT-like) for mergeable types. - // This test validates that types declaring MergeBehavior::Mergeable - // can be merged without conflicts. - unimplemented!( - "Implement: create mergeable type with CRDT merge function; \ - verify multi-parent merge succeeds" - ); -} - -#[test] -#[ignore = "Parallel typed merge registry not yet implemented"] -fn merge_regime_lww_with_canonical_order() { - // Allowed: order-dependent merges only with canonical parent order. - // LWW (Last Writer Wins) uses deterministic winner by canonical ordering key. - unimplemented!( - "Implement: create LWW type; \ - verify canonical ordering determines winner" - ); -} - -// ============================================================================= -// Presence vs Value (§9.3) -// ============================================================================= - -#[test] -#[ignore = "Parallel presence policy not yet implemented"] -fn presence_policy_delete_wins() { - // For each key: - // - Presence policy: delete-wins | add-wins | LWW - // - Default: delete-wins for reachability - // - // Given: one parent deletes key, another keeps it - // Expect: merged view shows key deleted (default policy) - unimplemented!( - "Implement: one parent deletes node, one keeps; \ - verify delete-wins policy applies" - ); -} - -#[test] -#[ignore = "Parallel presence policy not yet implemented"] -fn presence_policy_add_wins() { - // Given: policy set to add-wins for a specific attachment type - // Expect: if any parent has the key, merged view has it - unimplemented!( - "Implement: configure add-wins policy; \ - verify key survives if any parent has it" - ); -} - -// ============================================================================= -// Conflict artifacts (§9.4) -// ============================================================================= - -#[test] -#[ignore = "Parallel conflict artifacts not yet implemented"] -fn conflict_artifact_is_first_class_and_deterministic() { - // Conflict artifacts are first-class, deterministic, safe. - // They contain only: - // - parent commit hashes - // - statement/value hashes - // - type ids - // - policy hashes - // - // Multiple runs with same inputs must produce identical artifact bytes. - unimplemented!( - "Implement: create conflict scenario; \ - verify artifact is deterministic across multiple runs" - ); -} - -#[test] -#[ignore = "Parallel conflict artifacts not yet implemented"] -fn conflict_artifact_contains_no_secrets() { - // Verify that conflict artifacts never contain raw sensitive bytes. - // Only hashes and metadata. - unimplemented!( - "Implement: create conflict with sensitive data; \ - verify artifact contains only hashes, no raw bytes" - ); -} diff --git a/crates/warp-core/tests/parallel_openportal_rules.rs b/crates/warp-core/tests/parallel_openportal_rules.rs index e8e94814f..2de083ca9 100644 --- a/crates/warp-core/tests/parallel_openportal_rules.rs +++ b/crates/warp-core/tests/parallel_openportal_rules.rs @@ -1,13 +1,6 @@ // SPDX-License-Identifier: Apache-2.0 // © James Ross Ω FLYING•ROBOTS -// The four ignored placeholder tests at the end of this file have -// `unimplemented!` bodies. Issue #814 removes them. -#![allow( - clippy::expect_used, - clippy::unwrap_used, - clippy::panic, - clippy::unimplemented -)] +#![allow(clippy::expect_used, clippy::unwrap_used, clippy::panic)] //! OpenPortal rule tests for parallel execution. //! //! These tests verify the "no same-tick new warp writes" rule - rewrites cannot @@ -508,129 +501,3 @@ fn openportal_with_require_existing_init() { _ => panic!("expected WarpOp::OpenPortal"), } } - -// ============================================================================= -// Future tests (blocked on scheduler integration) -// ============================================================================= - -// TODO(T7.1): Implement when OpenPortal scheduling lands. -// Steps to wire this test: -// 1. Execute tick N with R1 (creates child_warp via OpenPortal) -// 2. Commit tick N -// 3. Execute tick N+1 with R2 (writes to child_warp) -// 4. Assert tick N+1 commits successfully -// 5. Assert the child warp contains both child_root and the new node -#[test] -#[ignore = "OpenPortal scheduling not yet implemented - tracks T7.1"] -fn openportal_creates_valid_child_warp() { - // Document expected behavior for future implementation: - // - // Setup: - // 1. Tick N: Rule R1 emits OpenPortal(child_warp_id) creating a new warp - // 2. Tick N+1: Rule R2 targets child_warp_id - // - // Expected: - // - Tick N commits successfully with the OpenPortal op - // - Tick N+1: R2 can successfully target child_warp_id - // - The child warp is fully accessible after the creating tick commits - // - // Rationale: - // - Once the creating tick commits, the child warp is part of committed state - // - Subsequent ticks can read/write to it normally - - let parent_warp = make_warp_id("test/parent-next"); - let parent_node = make_node_id("test/parent-node-next"); - let child_warp = make_warp_id("test/child-next"); - let child_root = make_node_id("test/child-root-next"); - - // Tick N: create the child warp - let _tick_n_op = make_open_portal_op(parent_warp, parent_node, child_warp, child_root); - - // Tick N+1: write to the child warp (should succeed) - let tick_n1_target_node = make_node_id("test/new-node-next-tick"); - let _tick_n1_op = WarpOp::UpsertNode { - node: NodeKey { - warp_id: child_warp, - local_id: tick_n1_target_node, - }, - record: NodeRecord { - ty: make_type_id("test/new-node"), - }, - }; - - // TODO(T7.1): Wire the execution harness when OpenPortal scheduling is implemented. - unimplemented!( - "OpenPortal scheduling not yet implemented: \ - verify child warp is accessible in subsequent ticks" - ); -} - -// FIXME(T7.1): Implement when OpenPortal scheduling lands. -// Footprint should declare: (1) attachment slot write, (2) child warp creation. -#[test] -#[ignore = "OpenPortal scheduling not yet implemented - tracks T7.1"] -fn openportal_footprint_declares_child_warp_write() { - // Document expected behavior: - // - // When a rule emits OpenPortal(child_warp), its footprint should declare: - // - Write to the parent attachment slot (a_write) - // - Write to the child warp instance (new warp creation) - // - // This footprint enables the scheduler to: - // 1. Detect conflicts with other rules touching the same attachment slot - // 2. Track "new warps this tick" for same-tick write filtering - - // TODO(T7.1): Wire footprint assertions when scheduling lands. - unimplemented!( - "OpenPortal footprint tracking not yet implemented: \ - footprint should declare both attachment write and child warp creation" - ); -} - -// TODO(T7.1): Implement when OpenPortal scheduling lands. -// Verify multiple independent OpenPortal ops execute in same tick correctly. -#[test] -#[ignore = "OpenPortal scheduling not yet implemented - tracks T7.1"] -fn openportal_multiple_child_warps_same_tick() { - // Document expected behavior: - // - // Setup: - // - Rule R1 emits OpenPortal(child_a) - // - Rule R2 emits OpenPortal(child_b) - // - Both execute in the same tick - // - // Expected: - // - Both portals are created successfully (different attachment slots) - // - Neither child_a nor child_b is writable in this tick - // - Both are writable in the next tick - - // TODO(T7.1): Wire execution harness when scheduling lands. - unimplemented!( - "OpenPortal multiple creations not yet tested: \ - verify multiple independent OpenPortal ops in same tick" - ); -} - -// TODO(T7.1): Implement when OpenPortal scheduling lands. -// Verify same-slot OpenPortal conflict is detected and resolved by canonical ordering. -#[test] -#[ignore = "OpenPortal scheduling not yet implemented - tracks T7.1"] -fn openportal_same_attachment_slot_conflict() { - // Document expected behavior: - // - // Setup: - // - Rule R1 emits OpenPortal(child_a) on attachment slot S - // - Rule R2 emits OpenPortal(child_b) on attachment slot S - // - Both execute in the same tick - // - // Expected: - // - Conflict detected (both writing to same attachment slot) - // - Exactly one wins based on conflict policy (canonical ordering) - // - The loser is rejected - - // TODO(T7.1): Wire conflict detection tests when scheduling lands. - unimplemented!( - "OpenPortal conflict detection not yet tested: \ - verify same-slot OpenPortal conflict handling" - ); -} diff --git a/crates/warp-core/tests/parallel_privacy.rs b/crates/warp-core/tests/parallel_privacy.rs deleted file mode 100644 index 871e51f5b..000000000 --- a/crates/warp-core/tests/parallel_privacy.rs +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: Apache-2.0 -// © James Ross Ω FLYING•ROBOTS -#![allow(clippy::unimplemented)] -//! Parallel Execution Privacy Tests (ADR-0007 §10) -//! -//! Tests for mind mode enforcement and claim merging: -//! - ForbiddenInLedger atoms rejected in mind mode -//! - Invalid proofs quarantined during claim merge -//! - Conflicting valid claims produce conflict artifacts -//! - Commitments are dictionary-safe with pepper - -#[allow(unused)] -mod common; - -// ============================================================================= -// T7: Privacy: Mind vs Diagnostics -// ============================================================================= - -#[test] -#[ignore = "Parallel privacy enforcement not yet implemented"] -fn t7_1_mind_mode_forbids_forbidden_in_ledger_atoms() { - // Given: attempt to emit attachment bytes of forbidden type - // Expect: deterministic rejection (error) OR forced indirection - // (commitment/proof/private_ref) - // - // In mind mode, the ledger must be publishable. Therefore: - // - No SSNs, credit cards, nude images, private chats, etc. - // - Only: commitments, ZK proofs (or proof hashes), opaque private refs, - // policy hashes, canonical metadata - unimplemented!( - "Implement: in mind mode, attempt to emit ForbiddenInLedger atom bytes; \ - assert deterministic rejection or forced indirection" - ); -} - -#[test] -#[ignore = "Parallel claim merging not yet implemented"] -fn t7_2_invalid_proofs_do_not_win_claim_merge() { - // Given: same claim_key, one valid proof, one invalid - // Expect: merge selects valid; invalid produces audit artifact or - // is excluded by policy - // - // During collapse for a claim_key: - // - verify proofs - // - if invalid: quarantine (not canonical) - // - if multiple valid proofs with same statement: dedupe - unimplemented!( - "Implement: same claim_key, one valid proof, one invalid; \ - merge keeps valid, quarantines invalid deterministically" - ); -} - -#[test] -#[ignore = "Parallel claim merging not yet implemented"] -fn t7_3_conflicting_valid_claims_produce_conflict_artifact() { - // Given: same claim_key, different statement_hash, both verify - // Expect: conflict artifact unless policy resolves - // - // If multiple valid proofs with different statements: claim conflict → - // conflict artifact unless a declared deterministic policy resolves - unimplemented!( - "Implement: same claim_key, two different statement_hash, both verify; \ - conflict artifact unless policy resolves" - ); -} - -#[test] -#[ignore = "Parallel commitment pepper not yet implemented"] -fn t7_4_commitment_is_dictionary_safe_with_pepper() { - // Commitments must be dictionary-safe. - // Never commit as H(secret) for guessable secrets. - // - // Use: - // - secret pepper (not recorded in ledger), e.g. H(pepper || canonical(secret)) - // - OR commitment to encrypted payload stored in vault - // - // Given: known secret and commitment - // Expect: commitment changes when pepper changes; cannot be reproduced - // without pepper - unimplemented!("Implement: commit(secret, pepper1) != commit(secret, pepper2)"); -} - -// ============================================================================= -// Atom type policy (§3) -// ============================================================================= - -#[test] -#[ignore = "Parallel type registry not yet implemented"] -fn atom_type_declares_sensitivity() { - // Each Atom type MUST declare (via registry metadata): - // - Sensitivity: Public | Private | ForbiddenInLedger - // - // Verify the registry enforces this requirement. - unimplemented!( - "Implement: register atom type with sensitivity; \ - verify registry accepts/rejects based on declaration" - ); -} - -#[test] -#[ignore = "Parallel type registry not yet implemented"] -fn atom_type_declares_merge_behavior() { - // Each Atom type MUST declare: - // - MergeBehavior: Mergeable | LWW | ConflictOnly - unimplemented!( - "Implement: register atom type with merge behavior; \ - verify collapse respects declared behavior" - ); -} - -#[test] -#[ignore = "Parallel type registry not yet implemented"] -fn atom_type_declares_disclosure_policy() { - // Each Atom type MUST declare: - // - Disclosure: Never | ByConsent | ByWarrant | DiagnosticsOnly - unimplemented!( - "Implement: register atom type with disclosure policy; \ - verify access control respects declaration" - ); -} - -// ============================================================================= -// ClaimRecord (§10.2) -// ============================================================================= - -#[test] -#[ignore = "Parallel ClaimRecord not yet implemented"] -fn claim_record_is_canonical() { - // We record a deterministic claim record: - // - claim_key (stable identity of the claim) - // - scheme_id (ZK / verifier identity) - // - statement_hash (public statement) - // - commitment (to secret or ciphertext) - // - proof_bytes OR proof_hash (policy-controlled) - // - private_ref (optional pointer into erasable vault) - // - policy_hash (redaction/disclosure/retention rules) - // - issuer (rule/subsystem id), tick, etc. - // - // Verify all fields are present and deterministically encoded. - unimplemented!( - "Implement: create ClaimRecord; \ - verify canonical encoding and all required fields" - ); -} - -// ============================================================================= -// Diagnostics mode (§3, §10.1) -// ============================================================================= - -#[test] -#[ignore = "Parallel diagnostics mode not yet implemented"] -fn diagnostics_mode_allows_richer_introspection() { - // Diagnostics mode: richer data MAY be permitted, but still governed by - // type policy (no "oops logged SSN" allowed). - // - // Verify that diagnostics mode enables additional data access while - // still respecting type-level sensitivity declarations. - unimplemented!( - "Implement: in diagnostics mode, verify additional access is granted \ - for DiagnosticsOnly types while ForbiddenInLedger still rejected" - ); -} From a264f912de7be98e58c6db885a1c55bf86a2cafc Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 21:32:27 -0700 Subject: [PATCH 2/3] Docs: point the privacy evidence links at the recorded plans Both security pages linked parallel_privacy.rs, which this branch deletes. They now link the record of those plans on #814 and say plainly that no privacy tests exist. Found by review of #847. Co-Authored-By: Claude Opus 5.5 --- docs/topics/security/README.md | 2 +- docs/topics/security/ThreatModel.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/topics/security/README.md b/docs/topics/security/README.md index d8990d799..83117d7c9 100644 --- a/docs/topics/security/README.md +++ b/docs/topics/security/README.md @@ -273,7 +273,7 @@ process without that compromise being outside the local model. - [Capability validation witnesses](../../../crates/warp-core/tests/capability_grant_validation_tests.rs) - [Optic admission witnesses](../../../crates/warp-core/tests/optic_invocation_admission_tests.rs) - [Attachment boundary witnesses](../../../crates/warp-core/tests/optic_attachment_tests.rs) -- [Privacy tests and explicit gaps](../../../crates/warp-core/tests/parallel_privacy.rs) +- [Privacy gaps (issue #814)](https://github.com/flyingrobots/echo/issues/814#issuecomment-6160885917): the planned privacy tests were never implemented - [Application admission security ramp](../../architecture/application-contract-hosting.md#admission-security-ramp) - [Retained reading proof boundary](../../adr/0020-retained-reading-storage-and-proof-boundary.md) - [Public optic boundary](../../adr/0021-public-optic-observation-boundary.md) diff --git a/docs/topics/security/ThreatModel.md b/docs/topics/security/ThreatModel.md index e00a5c5cc..95e7938ca 100644 --- a/docs/topics/security/ThreatModel.md +++ b/docs/topics/security/ThreatModel.md @@ -438,7 +438,7 @@ Use these questions in security-sensitive code review: - [Optic invocation admission tests](../../../crates/warp-core/tests/optic_invocation_admission_tests.rs) - [Optic attachment tests](../../../crates/warp-core/tests/optic_attachment_tests.rs) - [WSC storage tests](../../../crates/warp-core/tests/wsc_store_tests.rs) -- [Explicitly unimplemented privacy tests](../../../crates/warp-core/tests/parallel_privacy.rs) +- [Unimplemented privacy plans (issue #814)](https://github.com/flyingrobots/echo/issues/814#issuecomment-6160885917): ledger-mode atoms, claim merging, commitment peppers and atom-type declarations have no tests - [Continuum authority decision](../../adr/0013-echo-continuum-authority-boundary.md) - [Application admission security ramp](../../architecture/application-contract-hosting.md#admission-security-ramp) - [Echo 1.0 release integrity requirements](../../releases/echo-1.0-contract.md) From 7b02716676fd12775176f1d75cb468996959028c Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 21:32:39 -0700 Subject: [PATCH 3/3] Docs: format the security index after the link change Co-Authored-By: Claude Opus 5.5 --- docs/topics/security/README.md | 46 +++++++++++++++++----------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/docs/topics/security/README.md b/docs/topics/security/README.md index 83117d7c9..cff1bc072 100644 --- a/docs/topics/security/README.md +++ b/docs/topics/security/README.md @@ -37,13 +37,13 @@ ignored test is not an implemented security boundary. Security claims in this topic set use these labels: -| Label | Meaning | -| ------------- | ----------------------------------------------------------------------- | -| Implemented | Current code and an executable witness enforce the claim. | -| Partial | A typed boundary or isolated control exists, but the end-to-end path is incomplete. | -| Required | The architecture requires the control, but current code does not prove it. | -| Assumption | Echo relies on the host, operating system, dependency, or cryptographic premise. | -| Non-goal | Echo deliberately does not claim this property at the named boundary. | +| Label | Meaning | +| ----------- | ----------------------------------------------------------------------------------- | +| Implemented | Current code and an executable witness enforce the claim. | +| Partial | A typed boundary or isolated control exists, but the end-to-end path is incomplete. | +| Required | The architecture requires the control, but current code does not prove it. | +| Assumption | Echo relies on the host, operating system, dependency, or cryptographic premise. | +| Non-goal | Echo deliberately does not claim this property at the named boundary. | The status applies to the exact proposition in its row. An implemented digest check does not make authentication implemented. An implemented recovery test @@ -209,23 +209,23 @@ failure is still an availability failure. ## Current Posture Matrix -| Boundary or property | Status | Current posture | -| ------------------------------------- | ------------ | --------------- | -| Canonical causal-anchor claims | Implemented | Canonical roots, schema checks, claim digests, and value/admission separation have executable witnesses. | -| Causal-anchor trusted admission | Implemented | Current basis and host-owned exact root support are required before atomic WAL fact/receipt commit. | -| Trusted runtime WAL commit/recovery | Implemented | Commit-before-return, crash-tail exclusion, corruption refusal, and read-only index rebuild are witnessed. | -| Same-process API authority split | Implemented | App handles cannot install policies, append WAL facts, tick, or recover; this is not process isolation. | -| Generated package compatibility | Implemented | Registry, schema, artifact, codec, and operation bindings reject incompatible packages. | -| Production intent authentication | Required | Current canonical intent acceptance does not prove an authenticated session or principal. | +| Boundary or property | Status | Current posture | +| ------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | +| Canonical causal-anchor claims | Implemented | Canonical roots, schema checks, claim digests, and value/admission separation have executable witnesses. | +| Causal-anchor trusted admission | Implemented | Current basis and host-owned exact root support are required before atomic WAL fact/receipt commit. | +| Trusted runtime WAL commit/recovery | Implemented | Commit-before-return, crash-tail exclusion, corruption refusal, and read-only index rebuild are witnessed. | +| Same-process API authority split | Implemented | App handles cannot install policies, append WAL facts, tick, or recover; this is not process isolation. | +| Generated package compatibility | Implemented | Registry, schema, artifact, codec, and operation bindings reject incompatible packages. | +| Production intent authentication | Required | Current canonical intent acceptance does not prove an authenticated session or principal. | | End-to-end target authorization | Partial | Capability grant and obstruction machinery exists; all public app paths and trusted expiry/revocation policy are not yet wired through it. | -| Product optic authorization | Partial | Basis, aperture, attachment, and budget checks exist; trusted capability and law binding is incomplete. | -| WAL payload confidentiality | Non-goal now | Current writes retain full plaintext payload bytes. | -| Secure deletion from causal history | Non-goal | Append-only evidence and replicated/CAS material cannot promise erasure without a separate design. | -| Continuum peer/channel authentication | Required | Transport arrival is non-authoritative, but production peer identity and channel security need separate proof. | -| Whole-store rollback detection | Required | Internal chains detect inconsistency; a valid older store needs an external freshness anchor to be distinguishable. | -| Comprehensive hostile-input DoS | Partial | Local budgets and checked codecs exist; no system-wide adversarial resource envelope is proven. | -| Compromised trusted host resistance | Non-goal | A host that owns admission keys, policy, scheduler, and storage can violate Echo's local trust assumptions. | -| Side-channel resistance | Non-goal now | Timing, access-pattern, memory-remanence, and speculative-execution leakage are not presently claimed. | +| Product optic authorization | Partial | Basis, aperture, attachment, and budget checks exist; trusted capability and law binding is incomplete. | +| WAL payload confidentiality | Non-goal now | Current writes retain full plaintext payload bytes. | +| Secure deletion from causal history | Non-goal | Append-only evidence and replicated/CAS material cannot promise erasure without a separate design. | +| Continuum peer/channel authentication | Required | Transport arrival is non-authoritative, but production peer identity and channel security need separate proof. | +| Whole-store rollback detection | Required | Internal chains detect inconsistency; a valid older store needs an external freshness anchor to be distinguishable. | +| Comprehensive hostile-input DoS | Partial | Local budgets and checked codecs exist; no system-wide adversarial resource envelope is proven. | +| Compromised trusted host resistance | Non-goal | A host that owns admission keys, policy, scheduler, and storage can violate Echo's local trust assumptions. | +| Side-channel resistance | Non-goal now | Timing, access-pattern, memory-remanence, and speculative-execution leakage are not presently claimed. | ## Trusted Computing Base