M12-04F Status

status: done task: enforce archive entry, total, count, directory-depth, and filename-length budgets updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

The production asset-library-io parser now enforces the existing compressed/uncompressed per-entry and total-byte budgets together with a 100,000-entry limit, 64 directory levels, and a 255-byte UTF-8 filename limit. Compression-ratio and declared source-byte checks remain fail-closed in the same path. Budget checks happen while parsing metadata, before any payload allocation or extraction.

Evidence

npm --prefix web run test:library-archive-budget passed 4/4 unit tests.
Exact boundary cases for entry bytes, total bytes, entry count, directory depth, and Unicode filename bytes are accepted; one-byte overflows return stable budget errors.
Existing compression-ratio, duplicate/prefix, and declared source-byte checks remain covered.

Artifact Hashes

parent manifest: d935392fb23c2e6ad651fb6ad6cb67f8ead3d562e626bb230d2febd9d7f03b1c
protocol: e02efa79668f4ee10b1c28786709eba2c93691b28ccf1155c6213dda12f59a8f
unit: b0d8356c6fb348d98e28ce220052845a29439b34b3c976b21a4dbf370ea19593
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c

Next Task

M12-04G: reject compression-ratio, overlapping range, duplicate path, and file/directory prefix conflicts.

Rollback

Remove the budget checks, unit suite, manifest, package command, and this status entry. Restore M12-04E to pending and move the machine queue back to M12-04F. No parity ledger rollback is required.

1.6 KiB Raw Blame History