feat(x5820): ActionIntent commits over CNP-0-JCS canonical bytes

[s0fractal]

Myc half of the joint ActionIntent adoption gate, round 2/2. Replaces PR #1, which pointed at 468ae52 on an old base and was CONFLICTING.

Myc candidate: e02d7f98637c1ea7fcc793c7023e3e015bbecf7e
Trinity candidate: 2db70569551a186b106765e03d00bed2bf2c05ef — trinity#27

Base main@2fbcdbaf. Three ActionIntent files plus the strict-intake wiring in x5800_propose.ts.

Round-1 P1s closed

Raw JSON erased forbidden evidence. Both boundaries now take raw bytes: UTF-8 decoded fatally, duplicate top-level member names detected before JSON.parse collapses them, names decoded first so "verb" cannot smuggle a second verb.

Executed, at the CLI, asserting on disk:

duplicate verb        proposals_written=0  duplicate-member-name: "verb" appears more than once
escaped duplicate     proposals_written=0  duplicate-member-name: "verb" appears more than once
0xff inside verb      proposals_written=0  invalid-utf8: the input is not well-formed UTF-8

Check-then-reread. normalizeIntent reads every property exactly once into owned copies (arrays copied, not aliased); the encoder uses only that snapshot. Controlled for four getter schedules: no canonical text ever contains a non-string effect, and any digest produced equals a validated value's.

Cross-stored E2E lives on the Trinity side (it needs both) — see trinity#27.

Boundaries

No general JSON migration; the strict path is used by --action-intent only. No proxy sandbox. No other stable() touched. No status claim in this PR.

standalone  deno task check green
targeted    x5820 10/10, x5800 10/10

[qodo-code-review]

PR Summary by Qodo

Adopt CNP-0-JCS commitments for ActionIntent authority grants

✨ Enhancement 🐞 Bug fix 🧪 Tests 🕐 40+ Minutes

AI Description

• Hash ActionIntents over versioned CNP-0-JCS canonical bytes.
• Reject ambiguous or malformed byte inputs before proposal creation.
• Pin canonical vectors and fail-closed authority behavior end to end.

Diagram

graph TD
  A["Intent bytes"] --> B["Strict intake"] --> C["Owned snapshot"] --> D["JCS bytes"] --> E["SHA-256 digest"] --> F["Proposal artifact"]
  B -->|"rejects ambiguity"| G["Fail closed"]
  C -->|"closed schema"| G

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a duplicate-aware JSON parser

• ➕ Avoids maintaining a custom lexical scanner
• ➕ Can enforce duplicate rules throughout arbitrary nested JSON
• ➖ Adds a dependency to a standalone authority path
• ➖ Provides broader behavior than the closed ActionIntent schema requires
• ➖ Still needs strict UTF-8 handling and domain normalization

2. Adopt a general CNP-0-JCS encoder

• ➕ Centralizes canonicalization for future protocol migrations
• ➕ Can reuse broader conformance vectors across domains
• ➖ Expands this tranche beyond ActionIntent
• ➖ Introduces unneeded numeric and generic JSON surface into an authority gate
• ➖ Raises review and migration risk for unrelated stable encoders

Recommendation: Keep the scoped, domain-specific encoder and strict byte boundary for this adoption gate. The closed string-only schema, shared canonical-byte vector, and end-to-end persistence tests make the narrow implementation preferable now; a general parser or encoder should be introduced separately only when multiple domains need it and full conformance coverage is available.

Files changed (4) +812 / -89

Enhancement (1) +360 / -53

x5820_action_intent.tsImplement strict CNP-0-JCS ActionIntent commitments +360/-53

Implement strict CNP-0-JCS ActionIntent commitments

• Replaces ad hoc stable stringification with versioned CNP-0-JCS canonical UTF-8 bytes and SHA-256 hashing. Centralizes validation into a single owned normalization, closes the schema, canonicalizes requested effects as a set, rejects unpaired surrogates, and adds strict raw-byte parsing for duplicate names and malformed UTF-8.

src/x5820_action_intent.ts

Bug fix (1) +7 / -4

x5800_propose.tsRead ActionIntent input as strict raw bytes +7/-4

Read ActionIntent input as strict raw bytes

• The proposal CLI now reads ActionIntent files as bytes and delegates to strict parsing before computing an action grant. Invalid UTF-8, duplicate members, and other rejected inputs stop proposal creation instead of being normalized by permissive text decoding or JSON parsing.

src/x5800_propose.ts

Tests (2) +445 / -32

x5800_propose_test.tsVerify committed grants and fail-closed CLI intake +182/-1

Verify committed grants and fail-closed CLI intake

• Adds end-to-end assertions that the CNP-0-JCS commitment is persisted and the superseded digest is absent. Exercises unpaired surrogates, literal and escaped duplicate names, and invalid UTF-8 while confirming no proposal is written.

src/x5800_propose_test.ts

x5820_action_intent_test.tsPin canonical bytes and adversarial validation behavior +263/-31

Pin canonical bytes and adversarial validation behavior

• Expands coverage for the shared canonical byte and digest vectors, profile identifiers, Unicode handling, effect-set semantics, and rejection parity between validation and encoding. Adds getter-schedule, schema-bypass, duplicate-member, and invalid UTF-8 tests to protect the authority boundary.

src/x5820_action_intent_test.ts

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[s0fractal]

Codex acceptance, final round 2/2. Reviewed exact head e02d7f9; replayed the duplicate-name, escaped-duplicate, invalid-UTF-8, changing-getter, and stored-descriptor E2E cases. Targeted tests and the standalone MYC check are green. Accepted for merge; this establishes the implementation side of the bounded ActionIntent adoption claim, not independent interoperability.