Repository navigation
id: audit: produce the #3232 closing-audit evidence — field disposition table for artifact.rs never landed (closed as superseded) #5786
Description
Summary
Produce the closing-audit evidence #3232 was for, or formally disposition why each piece is no longer needed. #3232 was closed on 2026-11-04 as "superseded" by the direct receipt-contract implementation (#5539, PR #5576) — but its acceptance deliverables were the evidence, and the evidence was never produced.
The record
#3232 (Phase 3 of #3231) was an audit-only issue: build the field-by-field disposition table for pkgs/id/src/artifact.rs — every field of every known kind plus every envelope field, each dispositioned (a) enforced at receipt, (b) deliberately unvalidated with reason, or (c) a gap filed as a named follow-up — plus five explicitly-required dispositions (unknown-kind bounds, document.content string governance, prev shape, builder-side symmetry of sign, world_id charset evidence), plus the contract statement written into the artifact.rs module doc.
The closure trail: the issue closed 2026-11-04T17:03:48Z; a later agent note (17:41Z) records task 4733 "completed as superseded," reasoning that because the Phases 1–2 gates had cleared and the implementation had landed directly, "the gated Phase 3 audit is superseded by that implementation; no audit worktree or code changes were made." The programme map on #2056 repeats the warning: closed state alone is not evidence the audit completed.
Why "superseded" doesn't close it
The implementation and the audit are different artefacts. The implementation asserts the contract; the audit was the check that every field is actually governed — its (c) category existed precisely to catch gaps the phases missed. An implementation landing without the disposition table means the gap-discovery step never ran: nobody has enumerated the fields against the rules since. Five named dispositions were required with their reasoning — none is recorded. The module-doc contract statement was an acceptance item; whether it landed is unverified.
What this issue asks
- Build the disposition table against current
artifact.rs(post-id: implement One receipt contract for pkgs/id artifacts (design #3231) #5539/id(artifact): finish the receipt contract — frontier policy is Forbidden, builders refuse what receipt refuses #5576), exactly per Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232's scope: every known-kind field and envelope field, (a)/(b)/(c), with (c) items filed as follow-ups, not fixed here. - Record the five explicit dispositions with reasoning.
- Verify (or land) the module-doc contract statement.
- If any part is genuinely moot post-implementation, disposition that in the table with the reason — the table is the deliverable either way.
- On completion, Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231's closure evidence links here.
Relations
Parent: #3231 (still open). Subject: #3232 (closed — do not reopen; this issue carries its unfinished evidence). Implementation under audit: #5539, PR #5576. Flagged by: PR #5707 §3 and the #2056 programme map. Filed in the 2026-11-04 gap pass (WS-F) as a done-check failure.
Activity
developing-today commentedon Nov 5, 2026
CODE-1469
dezren39 commentedon Nov 5, 2026
🤖 Agent note · done
doc/2026-11-04_audit_id3232_receipt_validation.md· issue Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232 · issue Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231Triage verdict — already done (task 10189)
Issue #5786 asked for the closing-audit evidence issue #3232 was for. That evidence landed after issue #5786 was filed, in PR #5626 ("audit(id): complete #3232 receipt-validation dispositions", MERGED 2026-11-05T01:49:54Z,
Closes #3231,Refs #3232). Verified fresh this shift:doc/2026-11-04_audit_id3232_receipt_validation.md(82 lines) dispositions every common-envelope field (author,seq,prev,kind,body,after,hash,signature) and every known-kind body field (friend_remove,home_declared,document,tag), each as (a) enforced at receipt, (b) deliberately unvalidated with reason, or (c) gap routed to a named follow-up — exactly per issue Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232's scope.kindbounds (forward compatibility wins),document.contentstring governance (opaque payload, size only),prevshape (chain relation is sufficient), builder-side symmetry ofsign(gap — routed to issue id(artifact): validate known-kind bodies in generic signing helpers #5623), andworld_idcharset evidence (do not impose hub-name grammar).artifact.rslines 11–21 from PR id(artifact): finish the receipt contract — frontier policy is Forbidden, builders refuse what receipt refuses #5576, and I confirmed the "Receipt contract (Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231)" paragraph is present in thepkgs/id/src/artifact.rsmodule doc on current main first-hand this shift.home_declaredpeer pulls).cargo test -p id --lib artifact::tests(37 passed) andcargo test -p id --lib directory::tests::(53 passed).Closing issue #5786 as completed — the deliverable it asked for is on main, and manufacturing a second audit would duplicate PR #5626.