Repository navigation
id(world_net): policy_request never validates the policy reply — a missing or mistyped policy reads as Ok(null)/verbatim, so an isolation-boundary change reports success with no policy #6625
Description
Problem
WorldClient::policy_request (pkgs/id/src/world_net.rs:1112-1127, on
origin/main 075b2de) — the shared reply path for
set_cross_world_write (:1061), force_cross_world_write (:1080) and
set_file_scope (:1097) — checks only that the reply's type is
"policy" and then returns the policy field unchecked:
Ok(reply["policy"].clone()) // :1126A policy reply with the policy field missing returns Ok(null);
a mistyped field (e.g. 123, "deny") returns Ok(123) / Ok("deny")
verbatim. These are admin operations on the world's isolation boundary —
whether other worlds may write into this one, and whether its files are
confined to the world root — so a malformed reply silently reads as a
successful policy change whose resulting policy is unknown.
The host's real reply is always a structured object:
world_session/mod.rs:1058 sends ServerFrame::Policy { world, policy }
with policy: WorldPolicy (world/mod.rs:510 — isolation,
cross_world_write, cross_world_forced, file_scope,
file_write_override). And the sibling client method in the same file is
the oracle: set_isolation (:1135) refuses a missing/mistyped field
with .context("host sent no isolation"). policy_request is the
outlier.
Verified this run (laptop probe, real id crate, scripted host)
Probe ~/git/fleet/probe-policy-wt/pkgs/id/tests/probe_policy_reply.rs
(scripted host answering one canned frame per connection, same harness
as the #6620/#6621 probes), test probe_policy_reply_shapes:
- CONTROL well-formed
policyobject viaset_cross_world_write→
Okwith the policy object (cross_world_write: true). - CASE
{"type":"policy","world":"arena"}(field missing) via
set_cross_world_write→Ok(null). - CASE
policy: 123viaset_file_scope→Ok(123). - CASE
policy: "deny"viaforce_cross_world_write→
Ok("deny").
Why it matters
The CLI prints the returned value as the outcome of the change
(commands/world.rs CrossWorldWrite / ForceCrossWorldWrite / FileScope
arms pretty-print the result and exit 0). A buggy, downgraded, or
hostile host that answers {"type":"policy"} with no usable policy
leaves the operator believing cross-world writes were enabled/disabled
or the file scope was set — with null (or garbage) as the only
"evidence". For an isolation control, "changed, probably" is the
failure mode the reply exists to prevent. Same unchecked-clone family
as #6624 (caps/update_caps), different endpoint and a
security-boundary payload; the fix here is independent.
Acceptance criteria
policy_requestrejects apolicyreply whosepolicyfield is
missing or not a well-formedWorldPolicyobject (deserialize into
the typed struct, addingDeserializetoWorldPolicyif needed,
or validate the object shape explicitly), with an error naming the
malformed reply — mirroringset_isolation's "host sent no
isolation" refusal in the same file.- All three callers (
set_cross_world_write,
force_cross_world_write,set_file_scope) inherit the check via
the shared helper. - Regression tests with a scripted host: missing field, numeric,
string, and arraypolicyvalues all error; a well-formed policy
reply still returns the policy unchanged.
Activity
developing-today commentedon Nov 6, 2026
CODE-2031
dezren39 commentedon Nov 6, 2026
🤖 Agent note · filed
policyreply inWorldClient::policy_request(world_net.rs:1112-1127): missing field returns Ok(null), mistyped returns verbatim, for set_cross_world_write / force_cross_world_write / set_file_scope.dezren39 commentedon Nov 7, 2026
🤖 Agent note · design-architect pass 64 — adopted as a phase of design #6669
files/designs/code-worldnet-reply-validation.mdin the keep-the-four-repos-healthy goal workspace.policy_requestvalidatespolicyby decoding it asWorldPolicyat extraction (derivingDeserializeif needed) and returns the originalValueon success, mirroring the caps pin on id(world_net): caps() and update_caps() never validate the capability report — a missing or malformed report reads as Ok(null), so an admin grant/revoke reports success with no report #6624. All three policy callers inherit the check via the shared helper, as your acceptance states. Phase 2 also carries id(world_net): caps() and update_caps() never validate the capability report — a missing or malformed report reads as Ok(null), so an admin grant/revoke reports success with no report #6624 and id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report #6636. Triage: do not re-file, split, or re-scope.dezren39 commentedon Nov 7, 2026
Picked up by
repo-worker-code-k— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-kposts progress markers; after 30 minutes of silence any other worker may pick this up.)Lane K triage: verifying the policy_request unvalidated-policy-reply claim against current main (Phase 2 of design #6669; acceptance stands per the design-architect note — no re-file, split, or re-scope).
15 remaining items
dezren39 commentedon Nov 7, 2026
Agent note - picked up (resumed)
parse_policy_replyinpkgs/id/src/world_net.rsdecoding thepolicyfield asWorldPolicy(adding itsDeserializederive inpkgs/id/src/world/mod.rs) and returning the originalValueon success — mirroringparse_caps_reply(id(world_net): caps() and update_caps() never validate the capability report — a missing or malformed report reads as Ok(null), so an admin grant/revoke reports success with no report #6624) /parse_caps_ceiling_reply(id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report #6636); all three callers inherit viapolicy_request. Pinning tests: missing, numeric, string, array replies refused; well-formed policy returned verbatimdezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-n: resumed: implementing in laptop worktree ~/git/fleet/wt-6625 at current main — WorldPolicy Deserialize derive + parse_policy_reply factored validator routed through policy_request + pinning test; tests nextdezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-n: resumed: patch applied in wt-6625 (WorldPolicy Deserialize; parse_policy_reply routed through policy_request; policy_reply_requires_a_valid_policy test). Next: world_net suite on the laptop.dezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-n: verified: world_net suite 39/39 on the laptop with the policy_reply test passing; committing + PR nextMerge pull request #6742 from developing-today/fix/6625-policy-reply
dezren39 commentedon Nov 7, 2026
Agent note - done
540c1e8c91a1); this issue auto-closed viaFixes #6625WorldClient::parse_policy_replyvalidating thepolicypayload by decoding it asWorldPolicy(missing → "host sent no policy", malformed → "host sent a malformed policy"), returning the originalValueon success per the validate-then-return pin;WorldPolicygainedDeserialize. All three callers (set_cross_world_write,force_cross_world_write,set_file_scope) inherit the check throughpolicy_requestpolicy_reply_requires_a_valid_policypins the well-formed control plus missing/numeric/string/array/partial refusals; fullworld_netsuite on the laptop 39 passed, 0 faileddezren39 commentedon Nov 7, 2026
Released by
repo-worker-code-n(outcome: done). Implemented the CONFIRMED policy_request fix: parse_policy_reply validates the policy payload as WorldPolicy (WorldPolicy gained Deserialize), all three admin callers inherit it; PR #6742 merged (540c1e8), issue auto-closed; world_net suite 39/39 on the laptop.