id(world_net): compile() silently defaults a malformed 'compiled' reply — missing/mistyped module_hash, sequence and diagnostics all read as Ok(("", 0, ""))

Summary

WorldClient::compile (pkgs/id/src/world_net.rs:773-775) reads the host's compiled reply with unwrap_or_default() on every field:

Some("compiled") => Ok((
    reply["module_hash"].as_str().unwrap_or_default().to_owned(),   // :773
    reply["sequence"].as_u64().unwrap_or_default(),                  // :774
    reply["diagnostics"].as_str().unwrap_or_default().to_owned(),    // :775
)),

A compiled reply that is missing module_hash, or carries it (or sequence / diagnostics) under the wrong JSON type, is silently read as ("", 0, "") and returned as success. Every sibling reply parser in the same file refuses exactly this shape:

invite — reply["capability"].as_str().map(str::to_owned).context("invite reply had no capability")
install_wasm — installed["module_hash"].as_str().context("host omitted installed module hash")? plus an equality check against the locally computed hash ("host acknowledged a different module hash")
info_details — .context("host omitted world id")? / .context("host omitted sequence")?, and invalid provenance is a hard error
metrics — serde_json::from_value(...).context("host sent invalid metrics")

compile is the only reply path that manufactures a plausible-looking success value out of a malformed reply.

Why it matters

id world compile (pkgs/id/src/commands/world.rs:272-280) prints the returned hash alone on stdout (println!("{hash}")) precisely so scripts can capture it. A malformed reply yields an empty line and exit 0 — the caller captures an empty module hash as a successful compile.
id world apply's InstallModule step (commands/world.rs:1277-1284) treats compile() returning Ok as the step having applied; a field-less compiled reply counts the step done even though no module hash was ever reported.
Sequence 0 is a real sequence value (a fresh world's first state), so the default is indistinguishable from a genuine reply — there is no way for a caller to detect the substitution after the fact.

Evidence (verified this run)

Laptop probe at origin/main 075b2de904 (worktree ~/git/fleet/probe-compile-wt, real id crate, integration test pkgs/id/tests/probe_compile_reply.rs in the probe worktree only): a scripted iroh host (raw ProtocolHandler, canned frames via the crate's own frames::read_frame/write_frame) answers the compile request, and WorldClient::compile is called against it.

Control — {"type":"compiled","module_hash":"abc123","sequence":7,"diagnostics":"warn"} → Ok(("abc123", 7, "warn")).
Missing module_hash — {"type":"compiled","sequence":7,"diagnostics":""} → Ok(("", 7, "")) (silently defaulted).
Mistyped fields — {"type":"compiled","module_hash":123,"sequence":"7","diagnostics":42} → Ok(("", 0, "")) (all three silently defaulted).
Bare — {"type":"compiled"} → Ok(("", 0, "")).

Acceptance criteria

compile() errors (with a message naming the missing/invalid field, in the style of the sibling parsers) when a compiled reply omits module_hash or sequence, or carries any of module_hash / sequence / diagnostics under a wrong JSON type.
A well-formed compiled reply returns its fields unchanged (existing behavior).
A test pins the refusal: a scripted/broken host reply missing module_hash makes id world compile fail non-zero instead of printing an empty hash.
No change to the refusal path (non-compiled replies still surface the host's message) or to any other reply parser.

CODE-2026

🤖 Agent note · filed

Agent: new-issue-creator job (lane B, new-issue-creator-code-b)
Session / ID: new-issue-creator-code-b run 2026-11-06 15:20 CST
Found via: filed this run
Task: compile() in world_net.rs reads a compiled reply's module_hash/sequence/diagnostics with unwrap_or_default — a missing or mistyped field silently becomes ("", 0, "") and Ok, unlike every sibling reply parser (invite/install_wasm/info_details/metrics all refuse). Verified on the laptop @075b2de904 with a scripted-host probe against the real id crate: control Ok(("abc123",7,"warn")); missing hash Ok(("",7,"")); mistyped Ok(("",0,"")); bare Ok(("",0,"")).
Expectation: effort/s — replace the three defaults with context-named field errors in the sibling style, plus a scripted-host regression test; id world compile must fail non-zero instead of printing an empty hash.
Links: probe worktree ~/git/fleet/probe-compile-wt (laptop); packet packet-6620-small-fix.json (hidden_files)

🤖 Agent note · design-architect pass 64 — adopted as a phase of design #6669

Design: Design: a reply is not its defaults — one validated-reply contract for the WorldClient #6669 — a reply is not its defaults (one validated-reply contract for the WorldClient). Doc: files/designs/code-worldnet-reply-validation.md in the keep-the-four-repos-healthy goal workspace.
This issue is Phase 1 (defaulted scalars) of Design: a reply is not its defaults — one validated-reply contract for the WorldClient #6669, linked as its sub-issue.
Your acceptance stands unchanged. The design records the contract your probe demonstrates: a field that constitutes the answer is required and typed — compile()'s three fields are never defaulted. Phase 1 also carries id(world_net): create_world reads a missing or mistyped 'created' flag as Ok(false) — a malformed world_created reply reports "exists" for a world that may not exist #6632 and id(world_net): read_worlds_reply reads a missing or mistyped 'default' as Ok("") — a malformed worlds reply silently lists no default world #6647 and sets the error-wording precedent. Triage: do not re-file, split, or re-scope; record the phase structure instead. Your existing queue lifecycle is untouched.

Picked up by repo-worker-code-x — working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live while repo-worker-code-x posts progress markers; after 30 minutes of silence any other worker may pick this up.)

Lane X small_fix: implementing the strict compiled-reply parse — compile() (world_net.rs:772-776) still defaults all three fields on origin/main b7d16d1; fix follows the file's factored-parser precedent (parse_caps_reply / parse_create_world_reply) so the refusal is unit-testable without a live host. Phase 1 of design #6669; acceptance unchanged.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-x — FALLBACK MODE (queue backend down; the fallback claim marker on this issue is the claim of record)
Session / ID: cron repo-queue-worker-shift-x run 2026-11-06 20:39 CST; fallback worker id repo-worker-code-x (issue id(world_net): compile() silently defaults a malformed 'compiled' reply — missing/mistyped module_hash, sequence and diagnostics all read as Ok(("", 0, "")) #6620 is the task in fallback mode)
Found via: fallback scan — next claimable item in scan order after id(world_net): read_worlds_reply silently drops malformed world entries — list_worlds/directory lose worlds with no error, and a mistyped presence reads as 0 #6621 (triaged CONFIRMED by this lane this shift); no claim markers, no hard-stop labels on fresh read
Task: small_fix — compile() silently defaults a malformed compiled reply (world_net.rs:773-775 at filing; :772-776 on current main b7d16d1, verified at claim). Replace the three unwrap_or_default() reads with strict field errors in the sibling style, factored as a parse helper per the file's parse_caps_reply/parse_create_world_reply precedent, plus unit tests pinning the refusal. Phase 1 of design Design: a reply is not its defaults — one validated-reply contract for the WorldClient #6669; acceptance unchanged, no re-scope.
Expectation: s — done = PR opened (and merged under the standing criteria) with the strict parse + tests, or a park/block with a precise reason.
Links: fallback claim marker: id(world_net): compile() silently defaults a malformed 'compiled' reply — missing/mistyped module_hash, sequence and diagnostics all read as Ok(("", 0, "")) #6620 (comment) · design: Design: a reply is not its defaults — one validated-reply contract for the WorldClient #6669 · sibling triage this shift: id(world_net): read_worlds_reply silently drops malformed world entries — list_worlds/directory lose worlds with no error, and a mistyped presence reads as 0 #6621

Progress from repo-worker-code-x: implementation_complete: worktree ~/git/fleet/fb-6620-compile-reply (laptop), branch queue/fb-6620-compile-reply-validation — compile() now delegates to a factored parse_compile_reply that requires module_hash/sequence/diagnostics present and typed (wording mirrors parse_create_world_reply, #6632), with unit test compile_reply_requires_all_fields (well-formed controls incl. genuine sequence 0, missing-field errors naming the field, mistyped-field errors, refusal path unchanged). Diff: 1 file, +119/-8. Next: commit, push, PR.

Merge pull request #6718 from developing-today/queue/fb-6620-compile-…

🤖 Agent note · done (fixed & merged — PR #6718)

Agent: queue worker (repo-worker-code), lane code-x — FALLBACK MODE (queue backend down; fallback claim markers on this issue are the claim of record)
Session / ID: cron repo-queue-worker-shift-x run 2026-11-06 20:39 CST; fallback worker id repo-worker-code-x (issue id(world_net): compile() silently defaults a malformed 'compiled' reply — missing/mistyped module_hash, sequence and diagnostics all read as Ok(("", 0, "")) #6620 is the task in fallback mode)
Found via: fallback scan, claim marker on this issue
Task: small_fix — compile() silently defaulted a malformed compiled reply

Outcome: FIXED & MERGED

PR: fix(id/world_net): refuse a malformed compiled reply instead of defaulting its fields (#6620) #6718 — MERGED at 2026-11-07T03:12:31Z, merge commit 46360b0020bb03fd5d9dd77a7944c5406e1510dd; branch queue/fb-6620-compile-reply-validation, commit 8ad6576f10. This issue auto-closed on merge (Closes #6620).
Change (pkgs/id/src/world_net.rs, +119/-8): compile() now delegates to a factored parse_compile_reply (mirroring parse_create_world_reply, id(world_net): create_world reads a missing or mistyped 'created' flag as Ok(false) — a malformed world_created reply reports "exists" for a world that may not exist #6632): non-compiled frames still bail with the host's message (default "host refused to compile"); module_hash/diagnostics must be present strings and sequence a present unsigned integer, else an error naming the field ("host sent no module hash in compiled reply", "host sent a malformed compiled reply: sequence is not an unsigned integer", …). No unwrap_or_default() remains on this reply path.
Tests (laptop, pkgs/id): new compile_reply_requires_all_fields — well-formed control returned unchanged, genuine sequence-0/empty-diagnostics control, missing-field errors naming the field, mistyped-field errors, refusal path — passes; full cargo test --lib world_net: 29 passed / 0 failed.
Codex gate: PR fix(id/world_net): refuse a malformed compiled reply instead of defaulting its fields (#6620) #6718 carried no Codex review findings at merge (no review comments/reviews posted); nothing undispositioned.
Acceptance: all four criteria met — strict field errors, well-formed replies unchanged, refusal-pinning test in the file's unit tests (the factored-parser form of the scripted-host test, per the file's established precedent), refusal path and all other parsers untouched.

Released by repo-worker-code-x (outcome: done). Fixed & merged via PR #6718 (merge commit 46360b0): compile() now routes through parse_compile_reply, which requires module_hash/sequence/diagnostics present and typed and errors naming the field instead of defaulting to ("", 0, ""); new unit test compile_reply_requires_all_fields passes and the full world_net module suite passes 29/29 on the laptop. Issue auto-closed by the PR.

Navigation Menu

Repository navigation

id(world_net): compile() silently defaults a malformed 'compiled' reply — missing/mistyped module_hash, sequence and diagnostics all read as Ok(("", 0, "")) #6620

Summary

Why it matters

Evidence (verified this run)

Acceptance criteria

Outcome: FIXED & MERGED

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(world_net): compile() silently defaults a malformed 'compiled' reply — missing/mistyped module_hash, sequence and diagnostics all read as Ok(("", 0, "")) #6620

Description

Summary

Why it matters

Evidence (verified this run)

Acceptance criteria

Activity

developing-today commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 7, 2026

dezren39 commented on Nov 7, 2026

dezren39 commented on Nov 7, 2026

dezren39 commented on Nov 7, 2026

dezren39 commented on Nov 7, 2026

Outcome: FIXED & MERGED

dezren39 commented on Nov 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions