Repository navigation
SPEC-029 Amendment 1: refuse a request without an actions assertion - #204
Merged
Merged
Conversation
…ertion c2pa-rs 0.91 verifies after signing and refuses a claim-v2 manifest with no actions assertion, so the service answers 500 where SPEC-029 AC6 expected a signature (measured on c2pa-node 0.9.10, NOTES Step 74). The amendment makes the service refuse such a request itself, with a 400 and a named reason, on every engine. SPEC-011's "not required" about the contents of the actions assertion stays as it is. Found while writing it, measured on the current service: with REQUIRE_AI_MARKING=true, a body without the extra_assertions key is signed (200), because rejectAssertions() returns before the policy check when the key is absent. AC12 pins both forms. Draft: no code, no tests yet.
Amendment 1 approved 2026-11-02. rejectAssertions() treats an absent extra_assertions key as an empty array and refuses when no c2pa.actions assertion is present, with "an actions assertion (c2pa.actions.v2) is required", before the REQUIRE_AI_MARKING check. This also closes a policy gap: with REQUIRE_AI_MARKING=true a body without the key returned early and was signed with no AI marking. Tests first, seen red on the pre-amendment service: AC10 (three datasets, 200 each) and AC12 under REQUIRE_AI_MARKING (no key: 200; []: the policy reason). The old "still signs" test is replaced, and spec030Post() now sends an actions assertion. Verified locally: integration 219 passed / 25 skipped (defaults), 220 / 24 (REQUIRE_AI_MARKING=true), SPEC-030 in the auth-limited settings 11 / 4, bin/e2e.php trusted with the Article 50 mark, composer check 528 / 7.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
POST /v1/signnow refuses a request that carries no actions assertion. That covers a body withoutextra_assertions, an empty array, and an array with noc2pa.actionsassertion. The answer is 400 withan actions assertion (c2pa.actions.v2) is required, the audit recordsrejected, and nothing is signed. The spec text is SPEC-029 Amendment 1, approved 2026-11-02, with a one-line pointer from SPEC-011's resolved question. That resolution about the assertion's contents stands.Why
Invalid. Neither outcome is useful. This check is independent of the engine, so it can ship before the bump.REQUIRE_AI_MARKING. With the policy on, a body without theextra_assertionskey was signed with no AI marking at all.rejectAssertions()returned early when the key was absent, before the policy check. An empty array was refused correctly. Measured 2026-11-02, reachable only with the service token.Who notices
ManifestBuilderusers: nobody. The builder always emits exactly one actions assertion.new Manifest($type, []): it now gets aSigningFailedExceptioninstead of anInvalidmanifest. Nothing in the repository builds one.Tests
ActionsStructureTest, three datasets. They assert the error text, the audit outcome and the audit reason. Seen red on the pre-amendment service: 200 in all three.REQUIRE_AI_MARKING=true(thehardenedprofile). Seen red before the fix: without the key, 200; with[], the policy reason.UnauthenticatedBoundsTest'sspec030Post()now sends an actions assertion.Verified locally
REQUIRE_AI_MARKING=true: 220 passed / 24 skipped.--group=SPEC-030with theauth-limitedsettings: 11 passed / 4 skipped.bin/e2e.php: trusted, Article 50 mark intact.composer check: 528 passed / 7 skipped.bin/spec-check.php: 0 errors.Delivery
The behaviour is in
service/, so it arrives throughgit pulland a rebuild, not through a tag. The docs (docs/service.md, primer §3) are indocs/, so they ship with the next tag. The CHANGELOG says both.