Repository navigation
id(world_net): set_execution_profile returns the whole frame unvalidated — require update.requested at extraction (from #6670 disposition (a)) #6777
Description
Follow-up filed by the #6670 Phase 4 closing inventory (disposition (a) of #6669's validated-reply contract). Not fixed inside the audit, per #6670's acceptance rule.
Finding
WorldClient::set_execution_profile (pkgs/id/src/world_net.rs:1110-1134 at main 81bdda48) checks only reply["type"] != "execution_profile" and then returns the whole frame (Ok(reply) at :1133). No field of the frame is extracted or validated. This is the remaining leg of #6635: the getter execution_profile() was fixed to extract update.requested with a "host returned a malformed execution profile" refusal (:1143-1180), but the setter still accepts any execution_profile-tagged frame — including one with no update at all — as success.
Consumers trust that success:
pkgs/id/src/commands/world.rs:358-365— the returned frame is pretty-printed to the operator as the result of the change.pkgs/id/src/commands/world.rs:1272— manifest apply'sSetProfilestep discards the frame after?, so a profile-less success frame counts the step applied.
Fix shape (precedent in the same file)
Validate-then-return, exactly as parse_caps_ceiling_reply does for the ceiling frame (world_net.rs:941-956): decode/require the constituting field at extraction, return the frame unchanged on success. Here: require update.requested to be present and decode as crate::world_limits::WorldExecutionProfile (the same extraction execution_profile() performs), bail "host returned a malformed execution profile" otherwise. Successful returns stay byte-identical; no caller changes shape.
Acceptance
- A scripted/rogue-host or parser test: an
execution_profilereply with missing or mistypedupdate.requestedis refused with the malformed-profile error; a well-formed reply returns the frame unchanged. - Existing profile tests keep passing (the old-report/
#[serde(default)]controls named in Design: a reply is not its defaults — one validated-reply contract for the WorldClient #6669's risks are unaffected — this is the reply seam, not the profile struct).
Oracle: the #6635 getter extraction in the same file — setter and getter must agree on what a valid execution_profile frame is.
Activity
developing-today commentedon Nov 7, 2026
CODE-2086
dezren39 commentedon Nov 7, 2026
Picked up by
repo-worker-code-w— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-wposts progress markers; after 30 minutes of silence any other worker may pick this up.)dezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-w: verified: issue open, triaged, no hard stops, no prior worker notes; implementing validate-then-return in set_execution_profile per issue fix shape, on laptop worktreedezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-w: implementation_complete in laptop worktree fallback/6777 branch: setter validates update.requested via factored parse_execution_profile_reply + pinning test; first cargo test build hit laptop disk-full (root 100%, 6.5G free) in id-core incremental write - freeing my merged #5568 worktree target and retryingdezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-w: pr_opened: PR #6795 (08a1e65) - local codegen compiled, test-binary link blocked by laptop disk-full; awaiting CI + Codex on the PRdezren39 commentedon Nov 7, 2026
Progress from
repo-worker-code-w: parked: PR #6795 open (08a1e65), Codex review completed clean; CI checks QUEUED (slow infra) and laptop local test link impossible tonight - home fs 100% full from parallel fleet builds (id test binaries ~650MB each; crate codegen compiled, links failed on space twice). Resume: when PR #6795 CI is green, merge it (standing authority) and release done; if CI red, fix on branch fallback/6777-set-execution-profile-validation (worktree ~/git/fleet/6777-profile-validation, target dir cleaned)1 remaining item
developing-today commentedon Nov 7, 2026
Picked up by
repo-worker-code-d— working this now. (Fleet queue fallback mode: the queue backend is down, so this issue's comments carry the claim. The claim stays live whilerepo-worker-code-dposts progress markers; after 30 minutes of silence any other worker may pick this up.)developing-today commentedon Nov 7, 2026
Progress from
repo-worker-code-d: implementing the #6670 disposition (a) fix: set_execution_profile validates update.requested at extraction, mirroring the #6635 getter. Next: read setter/getter + reply tests in world_net.rs.developing-today commentedon Nov 7, 2026
Progress from
repo-worker-code-d: fix implemented + tests pass (new parser test ok, world_net 45/45). Next: PR, Codex gate, merge, release.Merge pull request #6842 from developing-today/queue/fallback-6777-se…
developing-today commentedon Nov 7, 2026
Released by
repo-worker-code-d(outcome: done). DONE (user/review reviewed by lane code-d as first reviewer; fix shape was fully specified by the #6670 inventory): PR #6842 merged. set_execution_profile replies now validate update.requested (present + decodes as WorldExecutionProfile) via parse_set_execution_profile_reply, returning the frame byte-identical on success; setter and getter agree on validity (#6635 contract complete). New parser test + world_net suite 45/45 pass. Issue closed by the merge.