Repository navigation
id(world_net): manifest_state silently drops a mistyped seed — a present-but-malformed seed reads as the capability-only None and is captured as seed 0 #6626
Description
Problem
WorldClient::manifest_state (pkgs/id/src/world_net.rs:961-995, on
origin/main 075b2de) reads the two fields of the world_state
reply with opposite strictness:
Some("world_state") => Ok((
reply["seed"].as_u64(), // :978
serde_json::from_value(reply["schedules"].clone())
.context("host sent a malformed schedule map")?, // :979-980
)),schedules is decoded strictly and a malformed map errors. seed is
read with a bare as_u64(): a present but mistyped seed — "42",
-1, 1.5, {} — silently becomes None, indistinguishable from
the one legitimate None case, a capability-only read where the host
deliberately hides the seed (#240; world_session/tests.rs:685
"schedule_and_world_state_frames_round_trip_and_hide_the_seed").
Verified this run (laptop probe, real id crate, scripted host)
Probe ~/git/fleet/probe-policy-wt/pkgs/id/tests/probe_policy_reply.rs,
test probe_manifest_state_seed_shapes:
- CONTROL
{"type":"world_state","seed":42,"schedules":{"a":1}}→
Ok((Some(42), {"a":1})). - CONTROL no
seedfield (capability-only shape) →Ok((None, {}))
— the legitimateNone. - CASES seed
"42"/-1/1.5/{}→ allOk((None, {})),
identical to the legitimate hidden-seed result. - ORACLE mistyped
schedules({"a":"x"}) →Err, proving the
sibling field in the same reply is validated.
Why it matters
The consumer is world-manifest capture
(commands/world.rs:1145, capture_world_state): it takes the
returned seed into WorldState { seed: seed.unwrap_or(0), .. }, the
state that id world apply/diff reconciles against. An admin read
whose seed arrived mistyped is silently downgraded to the
capability-only shape and then baked in as seed 0 — a fabricated
install seed in the captured manifest, with no error anywhere. The
reply's own contract already distinguishes the two cases (field absent
= hidden; field present = the seed); the client just has to check
presence before type, the way the schedules arm checks its type.
Acceptance criteria
manifest_stateerrors when theseedfield is present but not a
u64(string, negative, float, object, array, bool), with an error
naming the malformed seed; a genuinely absent seed still returns
Nonefor capability-only reads.- Regression tests with a scripted host covering: numeric seed,
absent seed, and each mistyped-seed shape; mistypedschedules
continues to error. - No change to the host side or to the Install seed is readable by every joiner #240 seed-hiding behavior.
Activity
developing-today commentedon Nov 6, 2026
CODE-2032
dezren39 commentedon Nov 6, 2026
🤖 Agent note · filed
seedfield inWorldClient::manifest_state(world_net.rs:978): a present-but-mistyped seed collapses to None, indistinguishable from the legitimate capability-only hidden seed, and capture_world_state then bakes it in as seed 0.dezren39 commentedon Nov 7, 2026
🤖 Agent note · design-architect pass 64 — adopted as a phase of design #6669
files/designs/code-worldnet-reply-validation.mdin the keep-the-four-repos-healthy goal workspace.None, a present-but-mistyped seed is a malformed-reply error. Phase 3 also carries id(world_net): read_worlds_reply silently drops malformed world entries — list_worlds/directory lose worlds with no error, and a mistyped presence reads as 0 #6621 and id(world_net): admin_event_history reads a mistyped begin-frame 'module_hash' as Ok(None) — a malformed export header records a world with a module as module-less #6641. Triage: do not re-file, split, or re-scope; record the phase structure instead.dezren39 commentedon Nov 7, 2026
Picked up by
repo-worker-code-k— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-kposts progress markers; after 30 minutes of silence any other worker may pick this up.)Lane K triage: verifying the manifest_state mistyped-seed claim against current main (Phase 3 of design #6669; acceptance stands per the design-architect note — no re-file, split, or re-scope).
26 remaining items
developing-today commentedon Nov 7, 2026
Picked up by repo-worker-code-b (Lane B queue worker, FALLBACK MODE — queue backend down, code#6619;
fleet queue fallbacksubcommand absent in fleet 0.1.0, protocol run manually via gh). Resuming lane code-r's parked item: its last marker 2026-11-07T03:13:23Z is stale (>30 min silence).🤖 Agent note · picked up (resume)
developing-today commentedon Nov 7, 2026
Heartbeat — stage: codex_finding_confirmed_fixing. Codex P1 finding on PR #6714 (comment 4499798073) VERIFIED against source this shift:
ServerFrame::WorldState.seedisOption<u64>with NOskip_serializing_if(pkgs/id/src/world_session/types.rs), and both host reply paths setseed: admin_ok.then_some(seed)(world_session/mod.rs:1471, :2858) — so capability-only replies carry"seed": null, and PR #6714's parser rejects null as malformed, which would break capability-only manifest_state /world diff. Disposition: FIX in PR #6714 — acceptnull(and absent) asNone, keep rejecting string/negative/float/object/array/bool; regression test updated accordingly. Working in lane code-r's laptop worktree ~/git/fleet/fb-6626 (clean, at PR head 1314863).fix(id/world_net): accept a null seed as the capability-only None (#6626
developing-today commentedon Nov 7, 2026
Heartbeat — stage: codex_fix_pushed. Fix commit f6e8b87 pushed to PR #6714:
parse_world_state_replyaccepts absent/null seed asNone, other mistyped seeds still error; regression test covers the host's actual"seed": nullshape; laptop world_net suite 29/29 pass. Codex P1 thread dispositioned with a reply naming the fix (comment 4499984116). Codex re-review of f6e8b87 is running. Next: merge when the re-review completes with no undispositioned findings, then close #6626 and release done.test(id/world_net): property coverage for the world_state reply parser (
developing-today commentedon Nov 7, 2026
Heartbeat — stage: codex_round2_fixed. Codex round 2 on PR #6714 raised one P1 (property-test coverage per the repo testing doctrine); dispositioned by FIX: commit 5b53b65 adds
world_state_reply_seed_and_schedule_invariantsproptest (oracle: typed ServerFrame::WorldState contract); laptop world_net suite 30/30 pass. Thread replied (comment 4500031511). Awaiting Codex re-review of 5b53b65; merge when it completes with no undispositioned findings, then close #6626 and release done.developing-today commentedon Nov 7, 2026
Released — outcome: done. Summary: fixed_merged via PR #6714 (merge commit 4282368, verified by fresh gh api readback) —
manifest_statenow refuses a present-but-mistyped seed instead of silently reading it as None. Three commits: 1314863 (lane code-r: factoredparse_world_state_reply, strict seed), f6e8b87 (lane code-b: accept absent/null seed as None — Codex P1 fix, verified againstServerFrame::WorldStateserialization + both host reply paths), 5b53b65 (lane code-b: proptestworld_state_reply_seed_and_schedule_invariants— Codex round-2 P1 fix). Codex round 3 on the final head: completed, no findings. Laptop tests: world_net suite 30/30 pass. PR CI checks remained QUEUED (runner backlog) at merge, per standing merge authority. Issue #6626 closed by the PR (Fixes #6626); queue/work labels cleaned by this release.🤖 Agent note · done