[sinkog]

What

Documentation and measurement files only: no module code, no WASM change, no Relay code. D5 is split in two on purpose.

• Part A (measurement, section 1): what the module does today with a caller-given host and base_path, and what follows.
• Part B (proposal, concept, sections 3 and 4): the contract the architecture asks for. It is not an input validator: it asks why a caller supplies these values at all.

Files: docs/design/specs/target-origin-and-path-safety.md; docs/design/measurements/target-and-path/ (probe source, output, README with the exact environment and rerun steps); two index lines in docs/design/README.md.

Premise of Part B (to confirm)

The host, base_path, key_id, revision and the resource's OCID are not part of the domain intent; they belong to the realization (deployment) context, the provider contract and the observed state, and are meant to be derived from authenticated sources, not supplied freely to a provider module. This is the project owner's statement of the CIC model. I could not find it written anywhere in this repository (docs/, theads/) or in the local session transcripts, so this PR is its first written form here and is open to correction.

Measured (module 2ac19ec, mock host seam; the Relay's rule read at 55a899f and transcribed, not run)

• host and base_path are used as the caller wrote them. A host with userinfo, #, ? or / parses as another host while the module still asks sign to sign the raw value as the host: line; the transcribed egress rule denies those by the parsed host.
• The module's manifest rule is *.oraclecloud.com with no path rule: any OCI service and region is allowed, with the same key.
• A base_path with ? or # turns the resource path into a query or fragment; /20160918/../other and //evil.example.com are sent as written; an empty base_path leaves no API version; no leading slash merges it into the host; a newline puts a line of its own into the string handed to sign, and the sign call precedes the send.
• One function (opPath) builds the path for observe, execute, destroy and invoke; poll is already strict.
• The registry records no API version, base path or host; the schema extractor does not record one.

Proposed (concept), not implemented

Origin and authenticator per field (table in section 3); the module derives what it can (base_path, if the registry records the API version) and receives the rest from an authenticated source instead of a request parameter; target_digest binds the derived binding but is not the derivation, which would also need a digest of the realization context and of the observation the revision came from (missing). Today's M4a target input stays what it was: a caller-supplied value that the gate proves consistent; the document says so and does not call it the realization proof. Path building hardening (one builder, structural checks before sign) is a separate section, framed as safe execution of a derived target, not as the architecture's starting point.

Not measured

The real Relay, what OCI or a proxy does with dot segments, an encoded dot segment, a query where a path was meant or a double slash, and what the Go HTTP client sends for a URL with a fragment. The "egress allowed/denied" column is the verdict of a transcription of the rule, not a measurement of the Relay.

Not in this PR

No implementation, no registry or extractor change, no WASM rebuild or signature, no Relay change, no production-integration claim. Open decisions D5-1 to D5-5 are listed, not decided. No merge without explicit owner GO.

🤖 Generated with Claude Code