Add inactive control policy-set validator

[yihanzhu]

Summary

• Add the first inactive Control foundation seam: one canonical control_policy_set.v1 identity bundle.
• Bind the selected core contract plus exactly six immutable policy/decision refs.
• Add a pure bounded validator, focused adversarial proof, and restore docs.

Boundary

This unit defines identity only. It does not contain or evaluate policy, grant authority, access credentials, launch an adapter, enforce a sandbox, persist kill-switch state, store evidence, publish, activate, or write externally. Those are separate Roadmap item 2 units.

Targeted proof

Exact head/base: 25474f5a58d61d655b3ec4380863e5e0a6ae18b9 / f8c51f10c3c6cba1a1b6f86bf82f976f00114714.

• official jq 1.6 proof: 61/61 focused checks
• fixed /bin/bash interpreter; jq resolution must return an absolute regular executable
• malicious cwd with fake bash and fake jq returns E_RUNTIME; neither sentinel is created
• all content refs reject colon/slash IDs; 12 section refs plus package ref pass the public core wrapper
• canonical/single-root/size/depth/member/string limits
• exact six-section order and unique immutable refs
• no private core schema import or generation-path dependency
• portable core schema proof: 47/47 rules, 141/141 direct cases, 39/39 guards, zero failures
• fail-closed inactive state and forbidden-field injection checks
• ShellCheck 0.11.0, Bash syntax, diff, and restore-manifest checks: clean
• dependency refresh: merge-only updates from repaired main; no rebase or force-push

Roadmap item 2: Control foundation.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 7e74fb2
Reviewed-base: cac3a2e
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/206-99875/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator safely rejects most malformed inputs, but a non-string generation ID is misreported as an internal runtime failure rather than a shape violation. This makes the validator's error contract incorrect for a valid malformed-input scenario.

Review comment:

• [P2] [Bugs] Classify non-string generation IDs as shape errors — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.JbFCKu2KZs/control/v1/policy-set.jq:24-24
  When generation_id is present but is a number, object, array, or null, test(...) raises a jq runtime error instead of returning false. validate.sh consequently emits E_RUNTIME, although this is malformed input and should produce E_SHAPE; add a string type guard before applying the regex.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	25474f5
Status:	✅  Deploy successful!
Preview URL:	https://a15a4d44.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-control-policy-set-v1.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 5c10268
Reviewed-base: f8c51f1
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/206-85616/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The new validator mandates control reference IDs that the existing portable-core content-reference contract rejects. This prevents the identity bundle from being used at its intended downstream integration seam.

Review comment:

• [P2] Use core-compatible IDs for control references — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.mmOU1KJUuR/control/v1/policy-set.jq:53-56
  When these policy or decision refs are carried through the portable core—for example as a gate decision's decision_record_ref—the core contract rejects them because schema::content_ref_ok forbids : in content_id. These relations require every ref to use control-policy:<section> or control-decision:<section>, making all validator-approved section refs incompatible with the intended core seam; use the core's dot-separated content-ID form and constraints instead.

[yihanzhu]

Scoped revision for review finding 5486663695

Head: 823aa9a
Base: f8c51f1

Changed only the control policy/decision content IDs to dot-separated core-compatible forms and added a direct check of every section ref against the current core v2 schema.

Focused proof:

• control policy set: 58 focused checks passed
• pinned jq 1.6 identity passed
• ShellCheck 0.11.0 passed
• bash -n passed
• git diff --check passed
• restore manifest/docs assertions passed

Exact CI and fresh independent final review remain pending for this new head.

[yihanzhu]

Scoped correction after CI run 33454712679

Head: 1b97a84
Base: f8c51f1

The dot-separated IDs remain unchanged. The compatibility regression now uses only the public scripts/core-contract.sh validate-document seam. It creates a selected-core v2 stage request from the existing public fixture and verifies all 12 policy/decision refs through the wrapper. The private schema import and embedded generation path are gone.

Focused proof:

• control policy set: 58 focused checks passed
• portable core schema: 47/47 rules, 141/141 direct cases, 39/39 activation guards, failures 0
• pinned jq 1.6 and ShellCheck 0.11.0 passed
• bash -n, git diff --check, and required-files structure check passed

Exact CI and fresh independent final review remain pending for this head.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 1b97a84
Reviewed-base: f8c51f1
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/206-98688/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator can accept a core package reference that the repository's public core contract rejects, breaking the intended interoperability of the identity bundle.

Review comment:

• [P2] Reject core-incompatible package content IDs — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GSrEGX8O5L/control/v1/policy-set.jq:10-13
  When core_contract.package_ref.content_id contains a colon, this validator accepts it because id_ok permits colons and no later relation constrains the package ID. The portable core's content_ref_ok explicitly rejects colon-containing IDs, so such a policy set passes here but cannot be carried through the core contract. Align this predicate with the public core seam and include the package reference in the compatibility test.

[yihanzhu]

Scoped revision for review finding 5486955661

Head: eaa147a
Base: f8c51f1

All control content refs now share a core-compatible content ID predicate that rejects colon and slash. Added package-ref colon/path negatives and included package_ref as the 13th public core-contract.sh validate-document compatibility case.

Focused proof:

• control policy set: 60 focused checks passed
• portable core schema: 47/47 rules, 141/141 direct cases, 39/39 activation guards, failures 0
• pinned jq 1.6 and ShellCheck 0.11.0 passed
• bash -n, git diff --check, and required-files structure check passed

Exact CI and fresh independent final review remain pending for this head.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: eaa147a
Reviewed-base: f8c51f1
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/206-7661/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator can execute a working-directory-controlled jq binary under a relative PATH, undermining its fail-closed and ambient-independence guarantees.

Review comment:

• [P2] Require an absolute jq executable path — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.nyhz7sxkVl/control/v1/validate.sh:31-33
  When PATH contains a relative entry such as . or bin and validation runs from an untrusted working directory, command -v jq can return a candidate-controlled relative executable. The file/version checks are spoofable, so that executable can accept invalid policy sets or perform writes despite the validator's fail-closed claim. Reject non-absolute paths, as the core ingress validator already does.

[yihanzhu]

Scoped revision for review finding 5487160953

Head: 136ee7f
Base: f8c51f1

The validator now rejects a non-absolute command -v jq result before any file, version, or jq execution. Existing regular-file, executable, non-symlink, and pinned-version checks remain. The new untrusted-cwd test places a sentinel-writing fake jq behind a relative PATH entry and proves E_RUNTIME with no sentinel.

Focused proof:

• control policy set: 61 focused checks passed
• portable core schema: 47/47 rules, 141/141 direct cases, 39/39 activation guards, failures 0
• ShellCheck 0.11.0 passed
• bash -n, git diff --check, and required-files structure check passed

Exact CI and fresh independent final review remain pending for this head.

[yihanzhu]

Scoped completion of review finding 5487160953

Head: 25474f5
Base: f8c51f1

The validator now starts with fixed /bin/bash, avoiding PATH lookup before its own checks. The relative-PATH adversarial case places both fake bash and fake jq in an untrusted cwd; validation fails E_RUNTIME and neither sentinel is created. The absolute-jq and existing file/version checks remain. Trusted-directory qualification is intentionally deferred.

Focused proof:

• control policy set: 61 focused checks passed
• portable core schema: 47/47 rules, 141/141 direct cases, 39/39 activation guards, failures 0
• ShellCheck 0.11.0 passed
• bash -n, git diff --check, and required-files structure check passed

Exact CI and fresh independent final review remain pending for this head.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 25474f5
Reviewed-base: f8c51f1
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/206-18325/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator consistently enforces canonical input, bounded resources, exact schema relationships, and inactive fail-closed semantics. The focused tests cover valid integration with the public core seam and relevant malformed, unsafe-path, and ambient-environment cases.