M12-04G Status

status: done task: reject archive compression bombs, overlapping ranges, duplicate paths, and prefix conflicts updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

Archive range validation now checks each compressed range against the declared source length and the global archive bound, sorts ranges by offset, and rejects overlap before any payload read. It also rejects duplicate canonical paths, file/directory prefix conflicts, zero-byte compression bombs, and expansion ratios above 100:1. Valid ranges return deterministic totals and explicit non-overlap/path invariants.

Evidence

npm --prefix web run test:library-archive-conflicts passed 4/4 unit tests.
Non-overlapping ranges produce stable compressed/uncompressed totals.
Compression-ratio, overlap, duplicate, prefix, source-bound, and undeclared-field negatives all return IO_ARCHIVE_UNSAFE before payload scheduling.

Artifact Hashes

parent manifest: cda905b1e27b62d9ea3a05170f975015480ce6739c15bdf1f5a1f0b79f93ce06
protocol: 3bec372e4f67ec309f28534cebcbaf8b492144adfa82ff6c8603f88c3ba16254
unit: 3f2d44dce33b1c17b3a48f58b04fdd821abc88d98ce3d3b5bb724859e0f0ab3c
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c

Next Task

M12-04H: cancellation removes staging and never modifies the committed project.

Rollback

Remove the archive conflict protocol, unit suite, manifest, package command, and this status entry. Restore M12-04F to pending and move the machine queue back to M12-04G. No parity ledger rollback is required.

1.6 KiB Raw Blame History