Repository navigation
id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report #6636
Description
id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report
Summary
WorldClient::set_caps_ceiling (pkgs/id/src/world_net.rs:851-875) checks only that the reply's type is "caps_ceiling" and then returns the whole reply verbatim:
if reply["type"] != "caps_ceiling" {
bail!(/* host message */);
}
Ok(reply)It never looks at report or message at all. The host's typed contract is ServerFrame::CapsCeiling { report: CapsReport, message: &'static str } (pkgs/id/src/world_session/types.rs:405-408; the host sends it at world_session/mod.rs:1369-1372), so a reply that omits report, sets it to null/123, or gives it the wrong shape is indistinguishable from a real ceiling change.
This is the third sibling of #6624 (caps()/update_caps() return reply["report"] unvalidated) — set_caps_ceiling is worse: it does not even extract the field.
Consumers
id world caps --ceiling …(pkgs/id/src/commands/world.rs:299-319): when no grant/revoke follows,ceiling_resbecomes the command result and is pretty-printed with exit 0 — a report-less reply prints{"message": …, "type": "caps_ceiling"}as if the ceiling change succeeded and was reported.- Manifest apply
ApplyStep::SetCeiling(pkgs/id/src/commands/world.rs:1257-1267): discards the value with.await?, so anycaps_ceiling-typed frame — including one with no report — counts as the step having applied.
Evidence (verified this run)
Probe on the laptop @ de90338c42 (origin/main), worktree ~/git/fleet/probe-ceiling-wt, test pkgs/id/tests/probe_ceiling_reply.rs (real id crate, scripted host replying with one canned frame per case; 1 passed):
- CONTROL
{"type":"caps_ceiling","report":{valid CapsReport},"message":"the ceiling applies immediately"}→Ok(full reply) - CASE missing report
{"type":"caps_ceiling","message":"…"}→Ok(no report at all) - CASE
report: null→Ok - CASE
report: 123→Ok - CASE report wrong shape
{"granted":"time.now"}(string whereCapsReport.granted: Vec<String>,pkgs/id/crates/id-core/src/world_caps.rs:1426) →Ok - CASE missing
message→Ok
Sibling oracles in the same file refuse malformed success replies: set_schedule/cancel_schedule parse via serde_json::from_value(reply["schedules"].clone()).context("host sent a malformed schedule map") (world_net.rs:891-960), and records_ticket requires the ticket string (world_net.rs:1769-1796).
Why it matters
The ceiling is the world's capability bound — the security-relevant limit on what a program may use. An admin (or manifest apply) that believes the ceiling was replaced, based on a reply carrying no valid post-change report, can leave a world running under the old ceiling while every surface reports success. The typed CapsReport exists precisely so the client can confirm the resulting state; returning the frame unchecked throws that confirmation away.
Acceptance criteria
-
set_caps_ceilingrefuses acaps_ceilingreply whosereportis missing or does not parse asCapsReport(routereply["report"]throughserde_json::from_value::<CapsReport>with a "host sent a malformed capability report" context, mirroringset_schedule), and returns the validated report (or a value containing it) instead of the raw frame. - A well-formed reply still succeeds, and the CLI caps command prints the validated report.
- A regression test with a scripted host covers at least: missing report,
report: null, and a wrong-shaped report — all refused; the well-formed control still Ok. - Existing world_net / world_session caps-ceiling tests stay green (
cargo test -p idfor the touched modules, on the laptop or CI).
Dedup
gh issue list --search "caps_ceiling" and --search "ceiling reply" (all states) on 2026-11-06: #6624 covers caps()/update_caps() only; #816 (closed) is the world-doctor ceiling checks; no open or closed issue covers set_caps_ceiling reply validation.
Activity
developing-today commentedon Nov 6, 2026
CODE-2042
dezren39 commentedon Nov 6, 2026
🤖 Agent note · filed
set_caps_ceiling()returns the host reply verbatim after a type check only; verified with a scripted-host probe against the realidcrate on the laptop @ de90338 (missing/null/mistyped/wrong-shape report and missing message all read as Ok; well-formed control Ok).reply["report"]asCapsReport(mirroringset_schedule'sfrom_valuerefusal) and add a scripted-host regression test; done when the acceptance criteria on the issue hold.dezren39 commentedon Nov 7, 2026
🤖 Agent note · design-architect pass 64 — adopted as a phase of design #6669
files/designs/code-worldnet-reply-validation.mdin the keep-the-four-repos-healthy goal workspace.set_caps_ceilingvalidates thatreportdecodes asCapsReportand, on success, returns the frame as its consumers expect (a value containing the validated report). Phase 2 also carries id(world_net): caps() and update_caps() never validate the capability report — a missing or malformed report reads as Ok(null), so an admin grant/revoke reports success with no report #6624 and id(world_net): policy_request never validates the policy reply — a missing or mistyped policy reads as Ok(null)/verbatim, so an isolation-boundary change reports success with no policy #6625. Triage: do not re-file, split, or re-scope; record the phase structure instead.dezren39 commentedon Nov 7, 2026
Picked up by
repo-worker-code-a— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-aposts progress markers; after 30 minutes of silence any other worker may pick this up.)1 remaining item
dezren39 commentedon Nov 7, 2026
🤖 Agent note · picked up
repo-worker-code-a(issue id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report #6636 is the task in fallback mode)queue/queueditems in scan order)WorldClient::set_caps_ceilingvalidate the reply'sreportas aCapsReport(missing / null / wrong-shaped → "host sent a malformed capability report") and return the validated report; regression tests for the malformed shapes + well-formed controlqueue/6636-set-caps-ceiling-validate-report(laptop worktree~/git/fleet/fb-6636), to be created this shiftdezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-a: verified live on current main (2b426f7): set_caps_ceiling returns Ok(reply) with no report validation. Implementing in laptop worktree ~/git/fleet/fb-6636 (branch queue/6636-set-caps-ceiling-validate-report): factored parse_caps_ceiling_reply validating report as CapsReport (frame preserved with validated report re-serialized, so the live caps-ceiling test and CLI output shape stay intact) + unit tests for missing/null/non-object/wrong-shaped reports.dezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-a: targeted_tests_passed: cargo test -p id --lib caps_ceiling (serial) — new set_caps_ceiling_reply_requires_a_valid_report + live caps_ceiling_is_admin_only_over_iroh_and_applies_at_once both PASS. Committed and pushed; opening PR.Merge pull request #6685 from developing-today/queue/6636-set-caps-ce…
dezren39 commentedon Nov 7, 2026
🤖 Agent note · done
repo-worker-code-a(issue id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report #6636 is the task in fallback mode)set_caps_ceilingnow validates the reply through the factoredWorldClient::parse_caps_ceiling_reply:reportmust parse as aCapsReport("host sent a malformed capability report" otherwise), and the returned frame carries the validated report re-serialized (frame shape unchanged for the CLI and the live test).2bdf90edf993c9c66152f6950dd42cbb3a12f1af), closing issue id(world_net): set_caps_ceiling() never validates the reply — a caps_ceiling reply with a missing or malformed report reads as Ok, so an admin ceiling change reports success with no report #6636. Codex review on head44f2110c49: completed, zero findings. PR CI checks stayed QUEUED (runner backlog) — merged under standing criteria on laptop verification:cargo test -p id --lib caps_ceiling -- --test-threads=1— new unit test (missing / null /123/ wrong-shaped reports refused; well-formed control returns the validated report) and the livecaps_ceiling_is_admin_only_over_iroh_and_applies_at_onceboth PASS.queue/6636-set-caps-ceiling-validate-report· commit44f2110c49dezren39 commentedon Nov 7, 2026
Released by
repo-worker-code-a(outcome: done). Done: set_caps_ceiling validates the reply report as CapsReport via factored parse_caps_ceiling_reply and returns the frame carrying the validated report. PR #6685 merged (2bdf90e), closing #6636. Laptop: new unit test + live caps-ceiling test PASS (serial); Codex zero findings; PR CI QUEUED (runner backlog).