security: publish the Symfony H3 decision packet - #17
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a19d12f127
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const manifest = fixtureManifestCanonical(); | ||
| if (await sha256Prefixed(manifest) !== FIXTURE_MANIFEST_SHA256) { |
There was a problem hiding this comment.
When --fixture-manifest-path names a missing or tampered file inside the allowed capsule directory, this branch ignores the file and hashes the generator's hard-coded fixtureManifestCanonical() value instead. The command therefore exits successfully and publishes a passing receipt even for a nonexistent manifest, so H3_FIXTURE_MANIFEST_DRIFT cannot validate the artifact the receipt claims to use.
Useful? React with 👍 / 👎.
| const localeInput = ["ä", "a", "z", "Å"]; | ||
| const localeA = [...localeInput].sort(new Intl.Collator("sv").compare); | ||
| const localeB = [...localeInput].sort(new Intl.Collator("en").compare); | ||
| const canonicalA = canonicalJson({ values: [...localeA].sort(compareCodeUnits) }); | ||
| const canonicalB = canonicalJson({ values: [...localeB].sort(compareCodeUnits) }); | ||
| const f13 = result("F13_locale_order", "H3_NONDETERMINISTIC_OUTPUT", localeA.join("|") !== localeB.join("|") && canonicalA === canonicalB && await sha256(canonicalA) === await sha256(canonicalB)); |
There was a problem hiding this comment.
F13 can pass even if decision-packet generation becomes locale-dependent because it compares only a hard-coded four-string array and never builds or hashes a packet under either locale. Consequently the emitted frozen falsifier receipt asserts H3_NONDETERMINISTIC_OUTPUT was tested without exercising the output whose determinism matters.
Useful? React with 👍 / 👎.
| const required: Record<string, ReasonCode> = { F1_missing_route: "H3_LEGACY_CANDIDATE_MISSING_ROUTE", F2_new_current_operation: "H3_CURRENT_OPERATION_UNSEEN_IN_POLICY", F3_method_change: "H3_METHOD_MISMATCH", F4_duplicate_owner: "H3_DUPLICATE_OPERATION", F5_unknown_method: "H3_METHOD_UNRESOLVED", F6_get_mutates: "H3_GET_SIDE_EFFECT", F8_count_drift: "H3_POLICY_COUNT_MISMATCH", F9_identity_leak: "H3_PII_INPUT", F14_resource_key_wrong_kind: "H3_KEY_KIND_MISMATCH", F15_resource_key_method: "H3_KEY_KIND_MISMATCH" }; | ||
| const reason = required[caseId]; | ||
| const pass = packetReasons.includes(reason) && packetResult.packet.recommendation === "fail_closed" && (packetResult.packet.status === "invalid" || caseId === "F1_missing_route" || caseId === "F2_new_current_operation" || caseId === "F3_method_change" || caseId === "F4_duplicate_owner" || caseId === "F5_unknown_method" || caseId === "F6_get_mutates"); |
There was a problem hiding this comment.
F4 checks only whether the packet-wide reason catalog contains H3_DUPLICATE_OPERATION. The unmutated synthetic inventory already produces that reason because operations 224–225 share all_departments and 226–228 share survey_admin, so F4 still reports pass if the intended duplicate of fixture:route:1 is not detected. Verify the target row and both expected operation IDs rather than the aggregate reason list.
Useful? React with 👍 / 👎.
1 participant
Design spec
design-specs/0015-security-h3-decision-packet.mdJourney
A maintainer generates a deterministic H3 security decision packet from the current Symfony security surface, with route closure evidence, unresolved risks, and an explicit decision boundary.
Experience it
Evidence
What is real
The security inventory and decision packet are reproducible. The substantive H3 production decision is still unresolved; this PR changes no runtime security policy, provider, credentials, deployment, or production behavior.