[BUG] Build-scope target IDs can collapse distinct Cargo targets #15

New issue

Open

opened 2026-09-12 10:14:04 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 10:14:04 +02:00

Owner

Summary

The unpublished build-scope checker prototype can give two distinct Cargo
targets the same descriptive target ID. Its dictionary then keeps only one,
allowing incomplete target ownership/output coverage to appear complete.
This affects static inventory admission; no guest build proof is established
by this checker, and no released runtime is known to be affected.

Reproduction

Create two original Cargo manifests in one selected source repository:

Cargo.toml has an explicit library named x/Cargo.toml#lib:y.
Cargo.toml#lib:x/Cargo.toml has an explicit library named y.

Give each manifest its own ordinary tracked Rust source path. Both manifests
pass independent offline cargo metadata --no-deps --offline checks. The
prototype concatenates source, manifest, kind and name with unescaped delimiters;
both targets obtain integration:Cargo.toml#lib:x/Cargo.toml#lib:y.

Supply ownership and output coverage for the surviving entry. The original
prototype returns declared-scope-complete after silently discarding the other.
The deterministic reproduction is retained independently of ordinary fixtures.

Expected and actual behavior

Expected: distinct source/manifest/kind/name tuples have distinct IDs, and every
target needs its own reviewed ownership and applicable output coverage. Duplicate
derived identities must fail instead of replacing an earlier target.

Actual: delimiter-bearing names and paths collide; dictionary insertion loses
one target and the static completeness result is false.

Environment and identity

Integration build-scope prototype under erix/integration#12, still unpublished
when the defect was found; no released checker version is affected.
Reviewed model SHA-256:
bd509d7c601e40dd1ddfe540b6df85c0b8aea71c52a0c228453c8bce0a0fbfdc.
Linux host, independently authored local Git/manifest fixtures and offline
Cargo metadata. No guest VM, service route or runtime capability is involved.
Ordinary existing target IDs do not trigger this fixture; no prior working
implementation of delimiter-bearing identity handling is established.

Evidence and prior checks

The reproduction admits one target from two selected valid declarations. The
correction at signed e7995dc7a2cb32bcc13a923c473e1d5c0e731303 canonically escapes percent, hash and colon characters in
manifest/name ID components and rejects duplicate derived IDs before insertion.
Original descriptive fields and ordinary existing IDs remain unchanged.

Regression coverage must prove both independent targets survive, omission of
either prevents complete coverage, and duplicate derived IDs fail closed.
The existing catalog/receipt tests and real incomplete source inventory must
retain their original outcomes. No performance or guest-build gate is relaxed.

Tracking

Owning inventory design: erix/integration#1. Audit: erix/integration#11.
Implementation review: erix/integration#12.

Retain independent Cargo-valid declarations and the false-completeness result.
Publish injective target-ID encoding and duplicate-ID rejection.
Verify independent ownership/output coverage in 56 warning-denied tests.
Review complete exact-head CI.

## Summary The unpublished build-scope checker prototype can give two distinct Cargo targets the same descriptive target ID. Its dictionary then keeps only one, allowing incomplete target ownership/output coverage to appear complete. This affects static inventory admission; no guest build proof is established by this checker, and no released runtime is known to be affected. ## Reproduction Create two original Cargo manifests in one selected source repository: - `Cargo.toml` has an explicit library named `x/Cargo.toml#lib:y`. - `Cargo.toml#lib:x/Cargo.toml` has an explicit library named `y`. Give each manifest its own ordinary tracked Rust source path. Both manifests pass independent offline `cargo metadata --no-deps --offline` checks. The prototype concatenates source, manifest, kind and name with unescaped delimiters; both targets obtain `integration:Cargo.toml#lib:x/Cargo.toml#lib:y`. Supply ownership and output coverage for the surviving entry. The original prototype returns `declared-scope-complete` after silently discarding the other. The deterministic reproduction is retained independently of ordinary fixtures. ## Expected and actual behavior Expected: distinct source/manifest/kind/name tuples have distinct IDs, and every target needs its own reviewed ownership and applicable output coverage. Duplicate derived identities must fail instead of replacing an earlier target. Actual: delimiter-bearing names and paths collide; dictionary insertion loses one target and the static completeness result is false. ## Environment and identity - Integration build-scope prototype under erix/integration#12, still unpublished when the defect was found; no released checker version is affected. - Reviewed model SHA-256: `bd509d7c601e40dd1ddfe540b6df85c0b8aea71c52a0c228453c8bce0a0fbfdc`. - Linux host, independently authored local Git/manifest fixtures and offline Cargo metadata. No guest VM, service route or runtime capability is involved. - Ordinary existing target IDs do not trigger this fixture; no prior working implementation of delimiter-bearing identity handling is established. ## Evidence and prior checks The reproduction admits one target from two selected valid declarations. The correction at signed `e7995dc7a2cb32bcc13a923c473e1d5c0e731303` canonically escapes percent, hash and colon characters in manifest/name ID components and rejects duplicate derived IDs before insertion. Original descriptive fields and ordinary existing IDs remain unchanged. Regression coverage must prove both independent targets survive, omission of either prevents complete coverage, and duplicate derived IDs fail closed. The existing catalog/receipt tests and real incomplete source inventory must retain their original outcomes. No performance or guest-build gate is relaxed. ## Tracking Owning inventory design: erix/integration#1. Audit: erix/integration#11. Implementation review: erix/integration#12. - [x] Retain independent Cargo-valid declarations and the false-completeness result. - [x] Publish injective target-ID encoding and duplicate-ID rejection. - [x] Verify independent ownership/output coverage in 56 warning-denied tests. - [ ] Review complete exact-head CI.

erikinkinen added the

phase-6

bug

labels

2026-09-12 10:14:04 +02:00

~~erikinkinen referenced this issue 2026-09-12 10:21:05 +02:00~~

WIP: Coordinate native authority, shell workspace and source transport #12