M12-02C Status

status: done task: enforce MIME, pixel, byte, and compression-ratio budgets before preview decode updated: 2026-08-17 America/New_York enablingTask: true parityStateChange: false

Scope

The schema 1 pre-decode planner accepts only the M12-02B content identity and an exact ArrayBuffer payload. It checks the 16 MiB encoded-byte limit before hashing, then binds the content SHA-256, declared MIME to the PNG/WebP container header, header dimensions to the identity, and dimensions to pixel and RGBA8 decoded-byte budgets. The final gate limits decoded-to-encoded compression ratio to 100 before any browser image decoder or decoded allocation is invoked.

PNG dimensions come only from a valid signature and first IHDR header. WebP dimensions come only from a size-bound RIFF/WEBP VP8X, VP8L, or VP8 header. Unsupported headers, content drift, and dimension drift fail closed; a rejected input does not affect a following valid preview plan.

Evidence

npm --prefix web run test:asset-preview-decode-budget passed 5/5 M12-02B/C protocol tests.
The positive 513-byte Blender-generated PNG plans 64 pixels and 256 decoded RGBA8 bytes without calling a decoder.
Eight negative cases cover payload hash/length drift, MIME mismatch, dimension mismatch, over-width/height and decoded-byte budget, compression ratio, encoded-byte budget, and corrupt container signature. The checked-in small preview passes immediately after each rejection.
npm --prefix web run typecheck, npm --prefix web run lint, and git diff --check passed.

Artifact Hashes

decode protocol: 3d1c491af2503a7a6012541ed43400d680f8e666cc12a54db284aeb6ac18ff63
unit suite: 1a65df86d568ae8defd7cd9242f426ac900d92637eb3bed2cbb4a0fae2e86c20
package commands: 8563916637fc3cb29b53432ae9b80d1dcf6269f2f5c092b595e72c6b0ada55ab
manifest: 934b3ca29d905ad2f5c46f35acff4cf4b9ea291c423fb3aad4afe7e9f10e6244

Next Task

M12-02D: commit a catalog preview reference only after its content-addressed payload is durably written to OPFS.

Rollback

Remove the preview decode planner, unit suite, M12-02C manifest, package command, and this status entry. Restore M12-02C to pending and nextTask to M12-02C. No parity ledger rollback is required.

2.2 KiB Raw Blame History