test(sccm): harden #326 management corpus contract - #375
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@coderabbitai review Please perform a substantive full review of exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='0a5305165306dbf06b934e3b824d499ce4cf89ce'
head='516db1f8fe08417a65bab7fb25102a6015901c42'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
echo '=== exact range ==='
git diff --stat "$base" "$head"
echo '=== changed paths ==='
git diff --name-status "$base" "$head"
echo '=== changed Rust outline ==='
git diff --name-only "$base" "$head" | while IFS= read -r f; do
case "$f" in
*.rs)
echo "--- $f"
ast-grep outline "$f" --items all --type function,struct,enum,impl,trait 2>/dev/null || true
;;
esac
done
echo '=== commits ==='
git log --oneline "${base}..${head}"Length of output: 3625 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='0a5305165306dbf06b934e3b824d499ce4cf89ce'
head='516db1f8fe08417a65bab7fb25102a6015901c42'
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
doc_file='docs/sccm/preparation/issue-326-client-management-corpus.md'
echo '=== test diff, part 1 ==='
git diff --unified=60 "$base" "$head" -- "$test_file" | sed -n '1,520p'
echo '=== test diff, part 2 ==='
git diff --unified=60 "$base" "$head" -- "$test_file" | sed -n '521,1100p'
echo '=== manifest diffs ==='
git diff --unified=20 "$base" "$head" -- 'crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/**/manifest.json'
echo '=== contract document diff ==='
git diff --unified=40 "$base" "$head" -- "$doc_file"Length of output: 93916 🏁 Script executed: #!/bin/bash
set -euo pipefail
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
echo '=== all test names and validator landmarks ==='
rg -n -C 2 --type rust \
'^(fn validate_contract|fn normalized_record|fn validate_|fn .*mutation|#\[test\])|assert.*validate_contract|normalize_ccm_artifact' \
"$test_file"
echo '=== contract validator, lower half ==='
nl -ba "$test_file" | sed -n '600,1330p'
echo '=== adversarial tests ==='
nl -ba "$test_file" | sed -n '1331,1750p'
echo '=== normalize_ccm_artifact definitions and SCCM evidence types ==='
rg -n -C 5 --type rust \
'pub fn normalize_ccm_artifact|fn normalize_ccm_artifact|struct SccmArtifact|enum SccmTimeOrderingState|struct SccmEvidence' \
crates
echo '=== normalizer source outline ==='
normalizer=$(rg -l --type rust 'fn normalize_ccm_artifact|pub fn normalize_ccm_artifact' crates | head -n 1)
printf '%s\n' "$normalizer"
if [ -n "$normalizer" ]; then
ast-grep outline "$normalizer" --items all 2>/dev/null || true
nl -ba "$normalizer" | sed -n '1,360p'
fiLength of output: 5942 🏁 Script executed: #!/bin/bash
set -euo pipefail
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
print_range() {
local start="$1"
local end="$2"
local file="$3"
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$file"
}
echo '=== validate_contract, coverage through output checks ==='
print_range 757 1280 "$test_file"
echo '=== validate_contract, ownership and transaction checks ==='
print_range 1281 1910 "$test_file"
echo '=== exact-record and ownership/workflow mutation groups ==='
print_range 2360 2496 "$test_file"
echo '=== timestamp, coverage/causal, transaction, and path mutation groups ==='
print_range 2497 2735 "$test_file"
echo '=== locate normalizer definition ==='
rg -n -C 5 --type rust 'pub fn normalize_ccm_artifact|fn normalize_ccm_artifact' crates
normalizer="$(rg -l --type rust 'pub fn normalize_ccm_artifact|fn normalize_ccm_artifact' crates | head -n 1 || true)"
printf 'NORMALIZER=%s\n' "$normalizer"
if [ -n "$normalizer" ]; then
awk '{ printf "%6d %s\n", NR, $0 }' "$normalizer" | sed -n '1,420p'
fiLength of output: 76717 🏁 Script executed: #!/bin/bash
set -euo pipefail
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
print_range() {
local start="$1" end="$2" file="$3"
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$file"
}
echo '=== original adversarial mutation groups ==='
print_range 2090 2360 "$test_file"
echo '=== every reviewed mutation label ==='
rg -n --type rust 'accepted\.push\(' "$test_file"
echo '=== SCCM timestamp/evidence model and export ==='
rg -n -C 4 --type rust \
'enum SccmTimeOrderingState|struct SccmTimestamp|struct SccmEvidence|struct SccmRawEvidenceSnapshot|fn export|ordering_state|utc_millis' \
crates/cmtraceopen-parser/src/sccm
echo '=== CCM logical-record scanner ==='
rg -n -C 5 --type rust 'fn scan_logical_records|pub fn scan_logical_records' \
crates/cmtraceopen-parser/src
echo '=== selected valid script-success evidence and expected contract ==='
sed -n '1,80p' 'crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/evidence/client-scripts/current/Scripts.log'
sed -n '1,80p' 'crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/evidence/client-co-management/current/CoManagementHandler.log'
cat 'crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/expected.json'Length of output: 26659
I found no blocking issue in this range. The range remains preparation-only. It changes fixture manifests, the fixture contract test, and preparation documentation. It adds no production reducer, native collector, The contract now fails closed for the 19 reviewed mutations:
The mutation tests directly exercise each of these boundaries. This review did not treat compilation as acceptance. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 6 minutes. |
adamgell
added
test
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
BLOCKED at exact head 516db1f8fe08417a65bab7fb25102a6015901c42 against stacked base 0a5305165306dbf06b934e3b824d499ce4cf89ce.
The 19 previously requested adversarial mutations are now permanently closed, and the substantive exact-head CodeRabbit review is correctly scoped. Four new exact-head provenance bypasses remain, reproduced together by a disposable detached-worktree test:
5.00.TEST.UNKNOWNretains the selected versioned profile and exact/high workflow semantics because source versions are prefix-checked only: #375 (comment)SYNTHETIC://client/management/script-success/client-scripts/C:/Users/RealUser/current/Scripts.logpasses as sanitized source provenance: #375 (comment)safe:path:326:C:/Users/RealUser/Scripts.logpasses as a supposedly safe fingerprint.- the two mixed-unrelated Scripts.log artifacts may share one identical sanitized source path while retaining different fingerprints, disguising a physical source collision: #375 (comment)
These violate the versioned-profile, synthetic/privacy, and collision-safe physical-provenance boundaries. Add permanent RED-to-GREEN cases, require canonical profile-admitted version grammar, close the synthetic path/fingerprint token grammar, and enforce case-normalized physical source identity uniqueness independently of self-declared fingerprints.
Fresh verification of the committed suites with the disposable probe excluded: focused #326 17/17, client intake 3/3, SCCM spine 61/61, full parser aggregate, strict Clippy, Rust 1.88 wasm32, TypeScript no-emit, Rust 1.88 rustfmt, and git diff --check all pass. The four-case probe itself is RED with all four accepted. No implementation branch was edited or pushed.
The CodeRabbit no-blocker result is superseded by executable exact-head evidence. Keep PR #375 and issue #326 draft/open pending correction, a fresh substantive CodeRabbit readback, and a different exact-head independent review. Production remains blocked on stable #318/#319 contracts and future native Windows validation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Exact-head provenance correction pushed
|
|
@coderabbitai review Please perform a fresh substantive review of exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='0a5305165306dbf06b934e3b824d499ce4cf89ce'
head='cb2c707a26e46f3293486aca1f810722c099c553'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
echo '=== RANGE COMMITS ==='
git log --oneline "${base}..${head}"
echo '=== CHANGED PATHS ==='
git diff --name-status "${base}" "${head}"
echo '=== DIFF STAT ==='
git diff --stat "${base}" "${head}"
echo '=== RUST OUTLINES FOR CHANGED FILES ==='
git diff --name-only "${base}" "${head}" | while IFS= read -r file; do
case "${file}" in
*.rs)
printf '\n--- %s ---\n' "${file}"
ast-grep outline "${file}" --items all --type function,struct,enum,impl,trait 2>/dev/null || true
;;
esac
done
echo '=== CONTRACT TEST LANDMARKS ==='
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
if [ -f "${test_file}" ]; then
rg -n -C 3 --type rust \
'^(fn validate_contract|fn validate_|fn normalized_record|fn .*mutation|#\[test\])|normalize_ccm_artifact|eligible.*version|source.*path|fingerprint|physical.*ident|accepted\.push\(' \
"${test_file}"
fi
echo '=== DIFF: CONTRACT TEST ==='
git diff --unified=35 "${base}" "${head}" -- "${test_file}"
echo '=== DIFF: SCCM PREPARATION DOCUMENTATION ==='
git diff --unified=20 "${base}" "${head}" -- \
'docs/sccm/preparation/issue-326-client-management-corpus.md'Length of output: 135451 🏁 Script executed: #!/bin/bash
set -euo pipefail
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
echo '=== PROFILE SELECTION, OWNERSHIP, AND TRANSACTION VERSION CHECKS ==='
nl -ba "${test_file}" | sed -n '1040,1535p'
echo '=== PROVENANCE REGRESSION TEST ==='
nl -ba "${test_file}" | sed -n '2748,2835p'
echo '=== SCRIPT-SUCCESS MANIFEST AND EXPECTED PROFILE/OWNERSHIP/TRANSACTION ==='
jq '{
artifacts: [.artifacts[] | {
artifactId, logicalArtifactId, parserEligible, sourceVersion,
capturedUtc, sanitizedSourcePath, pathFingerprint, relativePath
}],
workflowFamily
}' \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/manifest.json
jq '{
extractionProfile,
ownership,
transactions: [.transactions[] | {
transactionId, workflow, confidence, key, evidence, phase, classification
}]
}' \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/expected.json
echo '=== ALL VERSION COMPARISONS AND PROFILE-STATE CONDITIONS ==='
rg -n -C 3 --type rust \
'source_version_matches_selected_profile|source_version\.starts_with|unknown_version_artifacts|required_profile_selection|selectionState' \
"${test_file}"
echo '=== MUTATION TEST GROUP NAMES ==='
rg -n --type rust '^fn [a-zA-Z0-9_]+\(\)' "${test_file}" | sed -n '1,160p'Length of output: 1747 🏁 Script executed: #!/bin/bash
set -euo pipefail
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
print_range() {
awk -v start="$1" -v end="$2" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$3"
}
echo '=== PROFILE SELECTION, OWNERSHIP, AND TRANSACTION VERSION CHECKS ==='
print_range 1040 1535 "${test_file}"
echo '=== PROVENANCE REGRESSION TEST ==='
print_range 2748 2835 "${test_file}"
echo '=== SCRIPT-SUCCESS MANIFEST ==='
cat crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/manifest.json
echo '=== SCRIPT-SUCCESS EXPECTED ==='
cat crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/expected.json
echo '=== ALL VERSION COMPARISONS AND PROFILE-STATE CONDITIONS ==='
rg -n -C 3 --type rust \
'source_version_matches_selected_profile|source_version\.starts_with|unknown_version_artifacts|required_profile_selection|selectionState' \
"${test_file}"
echo '=== MUTATION TEST GROUP NAMES ==='
rg -n --type rust '^fn [a-zA-Z0-9_]+\(\)' "${test_file}" | sed -n '1,160p'Length of output: 38341
The review is not clean until this mutation fails closed. I did not treat compilation or the prior-head review as acceptance. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 28 minutes. |
|
🟢 Correction claim: root owns the CodeRabbit P1 remediation in isolated worktree /Users/Adam.Gell/repo/cmtraceopen/.worktrees/sccm-326-cr-profile-fix-r4 on local branch codex/sccm-326-cr-profile-fix-r4, starting from exact head cb2c707. Owned file: crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs. I will first add the coherent unknownProfile mutation and record the focused RED, then make only the two fail-closed source-version checks, run focused and aggregate gates, publish to the existing PR branch with a remote-head guard, and request exact-head CodeRabbit plus a different independent review. |
|
Exact-head CodeRabbit P1 correction is published at b3a35ce, superseding cb2c707. TDD evidence:
No production reducer/native collector changed and no live Windows acceptance is claimed. Prior approval at cb2c707 is stale. |
|
@coderabbitai review Please perform a fresh substantive exact-head review of b3a35ce. Verify that both ownership and transaction evidence reject coherent unknown-profile versions, and treat all prior-head approvals as stale. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='0a5305165306dbf06b934e3b824d499ce4cf89ce'
head='b3a35ceeb55ebeb384335fcbe886090a3b079ff6'
test_file='crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '=== commits and changed paths ==='
git log --oneline "${base}..${head}"
git diff --name-status "${base}" "${head}"
printf '%s\n' '=== changed Rust structure ==='
git diff --name-only "${base}" "${head}" | while IFS= read -r file; do
case "${file}" in
*.rs)
printf '\n--- %s ---\n' "${file}"
ast-grep outline "${file}" --items all --type function,struct,enum,impl,trait 2>/dev/null || true
;;
esac
done
printf '%s\n' '=== exact version-validator and high-confidence evidence call sites ==='
rg -n -C 8 --type rust \
'fn source_version_matches_selected_profile|source_version_matches_selected_profile\(|starts_with\("5\.00\.TEST\."\)|SccmOwned|highConfidence|HighConfidence' \
"${test_file}"
printf '%s\n' '=== exact coherent unknown-profile mutation ==='
rg -n -C 18 --type rust \
'unknownProfile|UNKNOWN|coherent.*unknown|profile.*mutation|source.version.*mutation' \
"${test_file}"
printf '%s\n' '=== all adversarial test groups and accepted-mutation labels ==='
rg -n --type rust '^(fn [a-zA-Z0-9_]+\(\)|\s*accepted\.push\()' "${test_file}"
printf '%s\n' '=== range diff for the contract test ==='
git diff --unified=40 "${base}" "${head}" -- "${test_file}"
printf '%s\n' '=== fixture and documentation diffs ==='
git diff --unified=20 "${base}" "${head}" -- \
'crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/**' \
'docs/sccm/preparation/issue-326-client-management-corpus.md'Length of output: 177507
I found no blocking issue in this range. The previous P1 bypass is closed in both required paths:
The permanent regression is coherent:
I also rechecked the retained mutation groups. The range still rejects the prior record-local field, nested CCM envelope, timestamp/capture, ownership/workflow, malformed coverage, causal-language, transaction cardinality/key/phase, and source/path provenance bypasses. The range remains preparation-only. It changes corpus manifests, the fixture contract test, and preparation documentation. It adds no production reducer, native collector, SCCM parser kind, UI behavior, correlation behavior, or live Windows acceptance claim. This conclusion is based on static exact-head review. I did not treat compilation as acceptance. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 9 minutes. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
BLOCK — independent review of exact head b3a35ceeb55ebeb384335fcbe886090a3b079ff6 against stacked base 0a5305165306dbf06b934e3b824d499ce4cf89ce.
The intended CodeRabbit P1 correction is sound. source_version_matches_selected_profile now requires the exact 5.00.TEST. prefix plus four ASCII digits, both ownership and transaction admission use it, and the permanent mutation coherently changes the profile state/observation and both cited source versions to 5.00.TEST.UNKNOWN. The focused 18-test contract and independent grammar/provenance probes reject the ownership and transaction bypass.
Three adjacent executable mutations are still accepted:
mixedUnknownAndInvalidis selected from the workflow name rather than the surviving unknown/invalid artifact sets. Starting frommixed-unrelated, changingmixed-owner-unknownto5.00.TEST.3260and removing the onlyunknownProfileobservation still returnsOk(())with the stale mixed selection state.- Exact duplicate citations are accepted for both ownership and transaction evidence. The code verifies sort order but not uniqueness, so inserting an adjacent duplicate tuple returns
Ok(()). - Exported
sourceLocalObservations[].claimstrings are outside the privacy scan. Replacing the Software Center claim withObserved under C:\\Users\\RealUser for real.user@customer.example.returnsOk(())because only physical evidence files are scanned.
Hosted CodeRabbit did perform a substantive exact-head review and reported no blocker: #375 (comment). Its older formal approval remains attached to stale cb2c707a26e46f3293486aca1f810722c099c553; these executable exact-head probes supersede the no-block result. The committed focused suite misses all three mutations.
Verification at exact head:
- PASS: focused management contract, 18/18.
- PASS: independent review harness, 23/23 (18 committed plus exact-profile grammar, coherent ownership/transaction rejection, and the three accepted-gap probes).
- PASS: SCCM spine 61/61; client intake 3/3; full parser 672 tests.
- PASS: wasm32 check; 28 JSON documents with
jq; scopedrustfmt;git diff --check; tracked sensitive-token scan; clean detached worktree. - INHERITED RED: strict parser-wide Clippy reports 59
uninlined_format_argsfindings only in untouched library source.cargo fmt --check --allalso reports unrelated pre-existing formatting drift; the issue-owned test passes scoped formatting.
No code was edited, pushed, merged, or closed during this independent review.
Before this test the public privacy predicate was field- and spelling-specific: it rejected only c:/, /users/, /home/, backslash, and at-sign spellings inside observation claims. Alternate drive paths such as D:/Profiles/RealUser and UNC shares such as //LAB-CLIENT-01/share/RealUser passed the claim check, and neither observationId nor nextArtifact.reason was privacy-checked at all. The four new mutation probes fail today and pin the review requirement that one fail-closed projection covers every public string surface. Refs #326
Before this change the claim privacy predicate blocklisted specific spellings (c:/, /users/, /home/, backslash, at-sign), so alternate drive letters and forward-slash UNC shares passed, and observation ids, transaction ids, and next-artifact reasons had no privacy projection. Replace the blocklist with one closed narrative grammar (bounded ASCII narrative characters, SID and dotted-host rejection) applied to claims and next-artifact reasons, and a closed lowercase identifier grammar applied to observation and transaction ids. Refs #326
Before this test ownership.coverageGapArtifactIds was checked for sort order only, so an adjacent duplicate of the same gap artifact id was accepted in both scenarios that declare an ownership coverage gap. The new mutation probes fail today and pin the review requirement that public deterministic arrays reject duplicate semantic entries. Refs #326
Before this change ownership and transaction coverageGapArtifactIds arrays only verified sort order, so adjacent duplicates of the same gap artifact id passed and let one gap claim count twice. Deduplicate the sorted projection before comparing so any repeated semantic entry in these public deterministic arrays fails closed, matching the observation artifactIds idiom. Refs #326
Before this change the new overlap helper and ownership overlap rejection did not match rustfmt output for the changed file. Reformat only the lane-authored test so the scoped rustfmt gate stays clean. Refs #326
Before this test the derived mixed selection state repair (f4f313d) had only one committed probe and the review thread stayed open. The new test pins the derivation with exact-error assertions: upgrading the only unknown-version artifact, relabeling to unknownProfile, and removing the artifact outright must each fail with the profile selection error and nothing incidental, while the coherent selected projection of the surviving profile/offset sets is accepted. Against the pre-repair workflow-name arm this test fails (stale mixedUnknownAndInvalid returns Ok), proving it guards the exact hole. Refs #326
Before this change evidence citations were only bounds-checked per tuple, so duplicating a transaction evidence citation in the success scenario, adding an overlapping updates-success-01-scan line 1-1 range beside the existing 1-2 range, and duplicating the supplemental-conflict observation citation all validated clean, double-counting the same logical CCM record for chronology and corroboration. Add a test proving each mutation is rejected, the class that blocked sibling lanes #326 and #375. Refs #323
|
@coderabbitai full review |
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 25 minutes. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Independent adversarial re-review of PR #375 at exact head 657a04b. Verdict: BLOCK.
Battery: descent check git merge-base HEAD a8a367c prints the foundation SHA (prior descent blocker resolved). Focused cargo test --locked -p cmtraceopen-parser --test sccm_client_management_fixture_contract 23 passed; --test sccm_spine_contract 136 passed; full parser crate 752 passed 0 failed; full workspace 1506 passed 0 failed; cargo clippy --workspace --all-targets -- -D warnings clean; cargo check -p cmtraceopen-parser --target wasm32-unknown-unknown clean. RED commits 6150687, 63b8758, 593c744 verified to fail without their paired fixes; the 657a04b pin verified to fail when the derived mixed-selection arm is reverted to a constant.
Adjudication of the prior round's findings:
- Descent from foundation a8a367c: RESOLVED (merge c32462a).
- P1 path-general privacy predicate: RESOLVED with two residual gaps (below). Byte-allowlisted free text now rejects alternate drives, UNC, raw backslash paths, emails, SIDs, underscores, and mid-sentence dotted hosts on claims and nextArtifact reasons; a realistic narrative claim is still accepted.
- P1 overlapping evidence ranges: RESOLVED. Per-(artifactId,line) citation uniqueness enforced for ownership and transactions; the review's two probes plus three-way overlap variants all fail closed.
- P2 mixed-selection-state derivation: RESOLVED and regression-pinned. An additional variant (repairing both invalid offsets so only the unknown-version artifact survives) also fails stale labels and accepts the derived state.
- P2 evidence-reference exact identity: RESOLVED. Sorted strictly-increasing tuples enforced; duplicate citation tuples fail closed.
- P2 claims privacy boundary: RESOLVED subject to the residual gaps below.
New blocking findings (both demonstrated by executed mutations against validate_contract):
- P2: A dotted hostname at sentence end bypasses the closed narrative grammar. "Observed records remain under lab-client-01.corp.local." is accepted as a public observation claim because public_free_text_is_safe does not trim the sentence-final period; the trailing empty label defeats the host-shape rejection. The same hostname mid-sentence is rejected. Trim trailing periods (or tolerate one trailing empty label) before the host test.
- P2: SID-shaped public identifiers are accepted. s-1-5-21-1004336348-1177238915-682003330-512 passes public_identifier_is_safe for both observationId and transactionId; the identifier grammar lacks the s-1-5- rejection the free-text grammar has. Reject the SID prefix in the identifier grammar.
Nit (non-blocking): the transaction path runs the citation-uniqueness walk before line-range validation, so an absurd endLine hangs the test rather than failing fast; the ownership path validates ranges first. Align the ordering.
Fixture privacy sweep of tests/fixtures/sccm/client/management (decoded JSON walk plus evidence bytes) and the f4f313d..HEAD diff found no identity-bearing data; corpus inventory pin (30 artifacts, 25 evidence files, 8648 bytes, digest 409619f730304018) intact. Both new gaps are small, localized predicate fixes in crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs; everything else in the stack holds up under adversarial probing.
Before this test the closed narrative grammar trimmed commas, semicolons, and bracket punctuation from token edges but not the sentence-final period, so a dotted hostname ending a sentence kept a trailing empty label and defeated the host-shape rejection. lab-client-01.corp.local. was accepted in both a public observation claim and a next-artifact request reason while the same hostname mid-sentence was rejected. The two new probes fail today and pin the review requirement. Refs #326
Before this change the token trim list for the host-shape rejection omitted the period, so a dotted hostname at sentence end carried a trailing empty label and slipped past the closed narrative grammar on claims and next-artifact reasons. Trim periods from token edges before the dotted-label test so sentence-final hostnames fail closed while mid-sentence rejection and legitimate narratives are unchanged. Refs #326
Before this test the closed public identifier grammar accepted any lowercase alphanumeric hyphen-separated string, so a synthetic machine SID s-1-5-21-... passed as both an observationId and a transactionId even though the free-text grammar already rejects the s-1-5- prefix. The two new probes fail today and pin the review requirement that identifier surfaces reject SID-shaped values. Refs #326
Before this change public_identifier_is_safe admitted any lowercase alphanumeric hyphen-separated string, so machine-SID values passed as observation and transaction ids. Require a leading lowercase letter and reject the s-1-5- prefix, matching the free-text grammar. All 19 shipped observation and transaction identifiers already begin with a lowercase letter, so no fixture changes are needed. Refs #326
Before this change the transaction path ran the citation-uniqueness expansion before evidence_records validated line ranges, so an absurd endLine iterated an unbounded range instead of failing fast; the ownership path already validated ranges first. Reorder the transaction checks to match ownership and add a fast-fail regression for a u64::MAX endLine on both surfaces. Also fold in rustfmt output for the hostname probe test. Refs #326
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Exact-head review for 59a6896 (round 8): BLOCKED on 2 residual gaps.
Battery at this head:
- cargo test -p cmtraceopen-parser --test sccm_client_management_fixture_contract: PASS 26/26
- cargo test -p cmtraceopen-parser --test sccm_spine_contract: PASS 136/136
- cargo test -p cmtraceopen-parser: PASS 755/755
- cargo clippy -p cmtraceopen-parser --all-targets -- -D warnings: PASS
- cargo build -p cmtraceopen-parser --target wasm32-unknown-unknown: PASS
Round-7 adjudication:
- Sentence-final dotted hostname in a public observation claim and in a nextArtifact reason: both fail closed (shipped test af1214d/a9fc487e). Boundary probes confirm rejection for a hostname followed by two periods, a parenthesized hostname at sentence end, a trailing comma-period, and mid-sentence placement; a legitimate narrative ending in a normal word plus period is still accepted on both surfaces. RESOLVED for hostnames.
- SID-shaped identifiers: the review SID fails as observationId and transactionId (shipped test e3623c5/325b29fe). Uppercase S-1-5 forms fail via the lowercase charset rule; leading-digit identifiers fail via the new leading-alpha rule. The 19/19 shipped-identifier audit was independently reproduced. RESOLVED for the s-1-5 authority.
- Absurd citation ranges: u64::MAX endLine on the transaction and ownership surfaces fails with "evidence line range ... is invalid" in 0.01s; the 59a6896 reorder places evidence_records range validation before the uniqueness walk on both surfaces. RESOLVED.
- The six earlier probe families and the mixed-selection pin all pass inside the 26.
PR #373 19-class accounting: all 19 mutation classes from the 2026-07-31T02:22Z review are CLOSED-BY-STACK at this head. The six permanent tests (exact_record_field_and_envelope, ownership_and_workflow_separation, additive_timestamp_and_capture_chronology, coverage_causal_and_unknown_semantic, transaction_identity_cardinality_and_phase, source_workflow_root_and_sanitized_role_path) reproduce the review's groups 1-6 (4+3+3+5+3+1). Attribution spot-probes per group reject with the correct error (duplicate structured field, postdates capturedUtc, fields are not closed, cardinality contract, provenance binding). The #326 base lane does not require another corpus round for these classes.
Blocking gaps (temporary probes, removed after):
- IPv4 network identifiers pass every public free-text surface. Mutating the software-center-observed claim to "Observed records remain under 10.20.30.40." and the notification-deferred nextArtifact reason to "Collect the bounded continuation from 10.20.30.40." both validate Ok. The host-shape check in public_free_text_is_safe requires an alphabetic final label, so dotted-quad addresses are never flagged. Same finding family as the round-7 hostname P2.
- SID authorities other than 5 pass everywhere. "s-1-12-1-3355607559-1223570380-3352662188-1023" (Entra account SID shape) and "s-1-15-3-1024-1065365936" validate Ok as observationId and transactionId, and the free-text guard is a literal "s-1-5-" substring so the same values pass inside claims. The round-7 SID class is only closed for the s-1-5 authority; a generic shape rule (s-1- followed by all-numeric segments) closes it.
Nit: a hyphen-joined hostname token evades the host check ("Records stay on lab-client-01.corp.local-side storage." validates Ok) because the final label "local-side" is not all-alphabetic. Informational: bare "s-1-5" is accepted as an identifier; it is not itself a SID and needs no change.
Privacy sweep of f4f313d..HEAD: clean. All identity-shaped strings in the diff are synthetic probe payloads; no real hosts, users, addresses, or emails.
This review was performed at the exact head 59a6896 in a detached worktree; the worktree ends clean.
Before this test the host-shape rejection required an alphabetic final label, so a sentence-final dotted quad 10.20.30.40. passed both public free-text surfaces and a hyphen-joined final label such as lab-client-01.corp.local-side. evaded the hostname check. The three new probes fail today and pin the class requirement that any multi-dot token is network-identifier shaped regardless of final label charset. Refs #326
Before this change the host-shape rejection keyed on an alphabetic final label, so dotted quads and hosts ending in hyphen-joined labels slipped through while ordinary hostnames were caught. Close the class: after edge trimming, any token with two or more dots and all labels non-empty is network-identifier shaped and fails regardless of label charset; single-dot tokens keep the alphabetic-suffix host test. No shipped claim or reason contains a multi-dot token, so all fixtures still validate. Refs #326
Before this test SID rejection was a literal s-1-5- substring in free text and prefix in identifiers, so Entra account SIDs (s-1-12-1-...) and capability SIDs (s-1-15-3-...) passed as observation ids, transaction ids, claims, and next-artifact reasons. The four new probes fail today and pin the class requirement of a generic SID shape rule; boundary controls keep bare s-1-5 (no subauthority run) acceptable on both surfaces. Refs #326
Before this change SID rejection was spelled as a literal s-1-5- substring or prefix, so SIDs under other authorities (Entra s-1-12-, capability s-1-15-, and any future authority) passed identifier and free-text validation. Close the class with one helper that flags any s-1- run followed by two or more all-numeric dash-joined segments, applied to both public_identifier_is_safe and the free-text guard. Bare s-1-5 has no subauthority run and stays acceptable. Also fold in rustfmt output for the probe test. Refs #326
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Round 9 closing review of PR #375 at exact head 89d538b (worktree pinned to 89d538b; merge-base with foundation a8a367c confirmed). Verdict: BLOCK on one demonstrated defect.
Battery at head: focused sccm_client_management_fixture_contract 28/28; sccm_spine_contract 136/136; full parser crate suite 757/757; cargo clippy --all-targets -D warnings clean; wasm32-unknown-unknown check clean.
Network class rule: verified with novel variants, all correct. Rejected: 1.2.3.4.5, mid-sentence 172.31.9.200, trailing-period-free 10.20.30.40, customer.example (alphabetic-suffix single-dot test), archive.tar.gz, parenthesized and hyphen-glued dotted quads; colon forms (fe80::1, full IPv6) rejected at the charset gate. Accepted as designed: 5.00, 1.2, ellipsis and consecutive-dot tokens (empty labels fall outside the class and outside valid network syntax). The multi-dot filename rejection is not over-broad: no shipped narrative references a dotted filename. Identifiers ban dots entirely by charset. This class holds by construction.
SID class rule: does not hold by construction. contains_sid_shaped_run splits the remainder of the whole string on '-', so the final subauthority segment only counts when it reaches end-of-string or another dash. In free text a following word or a sentence-final period absorbs it. Demonstrated end-to-end via the shipped mutation_was_accepted machinery: validate_contract ACCEPTED the claim "Observed records remain under s-1-0-0 markers.", the claim "Observed records remain withheld at s-1-16-12288.", and the next-artifact reason "Collect the bounded continuation for s-1-1-0 records." The escape class is any s-1-A-B SID with exactly two subauthorities and A != 5 (Nobody, Everyone, integrity levels), mid-sentence or sentence-final. Personal SID families remain caught (s-1-5-21 via the s-1-5- literal; Entra s-1-12-1 and capability s-1-15-3 carry three or more subauthorities). Exposure is therefore low, but the round 8 claim that any s-1- run followed by two or more all-numeric dash-joined segments is flagged is false, and the sentence-final-period failure mode is the same grammar variant already fixed for hostnames in a9fc487. The round 8 RED test only probed SIDs with three or more subauthorities, which is why it passed. Suggested fix: apply the SID run check per edge-trimmed whitespace token, reusing the tokenizer the network rule already employs; all three probes then fail closed. The identifier surface is unaffected: dash-joined grammar keeps segments clean, and all identifier probes behaved correctly, including charset rejection of uppercase SID runs and the designed acceptance of bare s-1-5.
Surface coverage confirmed: claims and nextArtifact reasons pass through public_free_text_is_safe; observationId and transactionId pass through public_identifier_is_safe; prohibitedClaims is pinned to an exact constant; transaction key fields are prefix-pinned and cross-checked against digest-pinned evidence bytes.
Earlier families: all pass inside the 28. Spot-checks: the mixed-selection pin exercises stale-state, derived-state, and artifact-removal directions; the overlap rule plus the citation range validator reject double-counted records and absurd ranges before expansion. Internal consistency at this head: the 14-scenario matrix, workflow counts, corpus digest pin (14 scenarios, 30 artifacts, 25 evidence files, 8648 bytes, digest 409619f730304018), and the all-scenario acceptance test agree.
Privacy sweep of f4f313d..HEAD (+549/-28 on the lane file): all sensitive-shaped strings in the diff are adversarial probe inputs inside mutation tests; the fixture corpus bytes contain no SIDs, IP addresses, hostnames, email addresses, or real-world identifiers.
Required before merge: close the minimal-SID free-text gap with a RED probe covering two-subauthority SIDs mid-sentence and sentence-final, then a GREEN tokenized fix. Everything else in this contract is defensible at merge.
This review was performed entirely at exact head 89d538b; no other commits were consulted for verification, and the worktree ends clean.
The SID run check splits the whole string, so a trailing space or sentence-final period absorbs the last subauthority and leaves only one counted segment. Any s-1-A-B SID with A other than 5 escapes on the claim and next-artifact reason surfaces. Probes both free-text surfaces mid-sentence, sentence-final, parenthesized and comma-followed, and pins the designed acceptances plus the identifier surface as controls. Refs #326
Hoist the edge-trimming tokenizer the network rule already used into a shared helper and run the SID check over those tokens, so a following space or sentence-final period no longer absorbs the last subauthority segment. The per-token predicate is unchanged, so bare s-1-5 and non-numeric runs such as s-1-abc-123 stay accepted, and the identifier surface is a single token by construction and keeps its exact behaviour. Refs #326
There was a problem hiding this comment.
Pull request overview
Prepares and hardens the issue #326 SCCM client-management fixture corpus contract (pre-production), tightening the validator to reject previously accepted unsafe mutations around timestamps, structured fields, provenance, ownership/workload binding, and transaction constraints.
Changes:
- Adds a new focused Rust integration test (
sccm_client_management_fixture_contract) that validates a closed manifest/expected schema and includes adversarial mutation coverage. - Introduces the synthetic SCCM client-management fixture corpus (14 scenarios) and supporting preparation documentation.
- Pins corpus inventory (scenario/artifact/file/byte counts + digest) and enforces conservative “preparation-only” boundaries (no production findings).
Reviewed changes
Copilot reviewed 31 out of 56 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/sccm/preparation/issue-326-client-management-corpus.md | Preparation-only spec and validation boundaries for the #326 client-management corpus |
| crates/cmtraceopen-parser/tests/sccm_client_management_fixture_contract.rs | New contract + adversarial-mutation test enforcing closed schemas, provenance, and conservative outcomes |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/README.md | Corpus README documenting synthetic/proposal-only constraints |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-intune-owned/manifest.json | Scenario manifest (co-management / Intune-owned) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-intune-owned/expected.json | Scenario expected contract (co-management / Intune-owned) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-intune-owned/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM evidence for co-management / Intune-owned |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-sccm-owned/manifest.json | Scenario manifest (co-management / SCCM-owned) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-sccm-owned/expected.json | Scenario expected contract (co-management / SCCM-owned) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-sccm-owned/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM evidence for co-management / SCCM-owned |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-transitioning/manifest.json | Scenario manifest (co-management / transitioning) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-transitioning/expected.json | Scenario expected contract (co-management / transitioning) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-transitioning/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM evidence for co-management / transitioning |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-unknown/manifest.json | Scenario manifest (co-management / unknown ownership) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/co-management-unknown/expected.json | Scenario expected contract (co-management / unknown ownership) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/manifest.json | Scenario manifest (scripts / success) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/expected.json | Scenario expected contract (scripts / success) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/evidence/client-scripts/current/Scripts.log | Synthetic CCM evidence for scripts / success |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-success/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for scripts / success |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-failure/manifest.json | Scenario manifest (scripts / failure) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-failure/expected.json | Scenario expected contract (scripts / failure) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-failure/evidence/client-scripts/current/Scripts.log | Synthetic CCM evidence for scripts / failure |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-failure/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for scripts / failure |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-incomplete/manifest.json | Scenario manifest (scripts / incomplete rotation/cap) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-incomplete/expected.json | Scenario expected contract (scripts / incomplete rotation/cap) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-incomplete/evidence/client-scripts/current/Scripts.log | Synthetic capped/partial fragment evidence for scripts / incomplete |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-incomplete/evidence/client-scripts/lo/Scripts.lo_ | Synthetic rotation fragment evidence for scripts / incomplete |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-incomplete/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for scripts / incomplete |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-intune-handoff/manifest.json | Scenario manifest (scripts / Intune handoff) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-intune-handoff/expected.json | Scenario expected contract (scripts / Intune handoff) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-intune-handoff/evidence/client-scripts/current/Scripts.log | Synthetic CCM evidence for scripts after Intune handoff (unkeyed/local) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/script-intune-handoff/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for scripts / Intune handoff |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-received/manifest.json | Scenario manifest (notification / received→ack) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-received/expected.json | Scenario expected contract (notification / received→ack) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-received/evidence/client-notification/current/CcmNotificationAgent.log | Synthetic CCM evidence for notification / received→ack |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-received/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for notification / received→ack |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-failure/manifest.json | Scenario manifest (notification / failure) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-failure/expected.json | Scenario expected contract (notification / failure) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-failure/evidence/client-notification/current/CcmNotificationAgent.log | Synthetic CCM evidence for notification / failure |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-failure/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for notification / failure |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-deferred/manifest.json | Scenario manifest (notification / deferred) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-deferred/expected.json | Scenario expected contract (notification / deferred) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-deferred/evidence/client-notification/current/CcmNotificationAgent.log | Synthetic CCM evidence for notification / deferred |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/notification-deferred/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for notification / deferred |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-observed/manifest.json | Scenario manifest (Software Center / observed candidate) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-observed/expected.json | Scenario expected contract (Software Center / observed candidate) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-observed/evidence/client-software-center/current/SCClient_SYNTHETIC_1.log | Synthetic candidate evidence (parser-ineligible) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-observed/evidence/client-co-management/current/CoManagementHandler.log | Synthetic CCM ownership evidence for Software Center observation |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-insufficient/manifest.json | Scenario manifest (Software Center / insufficient evidence) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-insufficient/expected.json | Scenario expected contract (Software Center / insufficient evidence) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/software-center-insufficient/evidence/client-software-center/current/SCClient_SYNTHETIC_2.log | Synthetic malformed bytes for candidate (parseFailed→malformed) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/mixed-unrelated/manifest.json | Scenario manifest (mixed adversarial / unrelated evidence) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/mixed-unrelated/expected.json | Scenario expected contract (mixed adversarial / unrelated evidence) |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/mixed-unrelated/evidence/client-notification/current/CcmNotificationAgent.log | Synthetic evidence (invalid offset) for mixed adversarial scenario |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/mixed-unrelated/evidence/client-co-management/current/CoManagementHandler.log | Synthetic conflicting ownership evidence for mixed adversarial scenario |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/mixed-unrelated/evidence/client-scripts/root-a/current/Scripts.log | Synthetic unkeyed script evidence (root-a) for mixed adversarial scenario |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/management/mixed-unrelated/evidence/client-scripts/root-b/current/Scripts.log | Synthetic unkeyed script evidence (root-b) for mixed adversarial scenario |
| if components.first().map(String::as_str) != Some("evidence") | ||
| || components.get(1).map(String::as_str) != Some(logical_artifact) | ||
| || components.last().map(String::as_str) != Some(source_name) | ||
| || !components | ||
| .iter() | ||
| .any(|component| component == rotation_kind) | ||
| { |
| if !valid { | ||
| return Err(format!( | ||
| "{context} structured fields are outside the closed {logical_artifact} contract: {actual:?}" | ||
| )); | ||
| } | ||
| Ok(()) |
Before this change evidence citations were only bounds-checked per tuple, so duplicating a transaction evidence citation in the success scenario, adding an overlapping updates-success-01-scan line 1-1 range beside the existing 1-2 range, and duplicating the supplemental-conflict observation citation all validated clean, double-counting the same logical CCM record for chronology and corroboration. Add a test proving each mutation is rejected, the class that blocked sibling lanes #326 and #375. Refs #323
Scope
Stacked correction for #326 and draft PR #373. This PR contains one issue-scoped commit based directly on exact PR #373 head
0a5305165306dbf06b934e3b824d499ce4cf89ce; it does not overwrite the existing owner branch.The slice remains preparation-only. It adds no production reducer, native collector,
ParserKind::Sccm, duplicate CCM parser, server/cross-side causal rule, UI behavior, or live Windows acceptance claim. Production implementation remains dependent on stable #318/#319 contracts.Root cause and correction
The preparation validator consumed legacy public
LogEntrytimestamps and substring scans, while several JSON, path, ownership, and transaction structures remained open-ended. Exact-head adversarial review therefore found 19 accepted unsafe mutations.This correction:
normalize_ccm_artifactevidence and additive SCCM timestamp provenance;capturedUtcand rejects cited normalized records after capture;parseFailedas explicit malformed-record coverage;TDD evidence
Before validator changes, the focused Rust 1.88 target ran 17 tests: 11 existing tests passed and all 6 new adversarial groups failed because all 19 reviewed mutations were accepted. The RED result is recorded on #326: #326 (comment)
After the smallest structural correction:
cargo +1.88.0 test --locked -p cmtraceopen-parser --test sccm_client_management_fixture_contract— PASS, 17/17cargo +1.88.0 test --locked -p cmtraceopen-parser— PASS, 671/671cargo clippy --locked -p cmtraceopen-parser --all-targets -- -D warnings— PASScargo +1.88.0 check --locked -p cmtraceopen-parser --target wasm32-unknown-unknown— PASSnpx tsc --noEmit— PASSgit diff --check— PASSCorpus identity remains 14 scenarios, 30 artifacts, 25 evidence files, 8,648 evidence bytes, digest
409619f730304018.Review gates
A local authenticated CodeRabbit 0.7.1 review was attempted after verification but was rate-limited, so it is not represented as clean. A substantive hosted exact-head CodeRabbit review is requested separately.
Keep this PR draft/open. Do not merge, ready, close #326, or claim native Windows acceptance until independent exact-head review and the upstream dependency gates are satisfied.