main · last commit
6 hours ago ·
ti41arbu
sr-ht-dolt-2zk Add api/layering_test.go to machine-check the core<-db/authn<-service<-api/web invariant
Lined Up
bd update sr-ht-dolt-2zk --claim
bd close sr-ht-dolt-2zk
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-17T20:39:18Z |
| Updated | 2026-08-17T20:39:18Z |
What is wrong: dolt declares the `core ← db/authn ← service ← api/web` layering invariant in prose only (per the family-wide convention documented in e.g. `sourcehut-tokens/CLAUDE.md`, `sourcehut-coverage/SPEC.md` invariant 7) and enforces it by code review alone — there is no machine check.
Why it matters: the invariant is what makes `service/` the single place a security check can be located. A prose invariant nothing checks is exactly the kind of invariant that quietly stops holding as the codebase changes.
Sibling that already does it correctly: `sourcehut-bench/api/layering_test.go` and the artifacts equivalent machine-check the invariant, including guards against three known bypass patterns ("close the three ways round the layering guard").
Fix: copy `api/layering_test.go` into dolt, adjusting package names and import paths as needed for dolt's package layout.
Status: reported, not independently re-verified by direct code reading for this register entry.
Audit: D18 (cross-repo audit, 2026-08-17)
No outgoing dependencies.
Nothing depends on this issue.
| id | sr-ht-dolt-2zk |
| content_hash | 77fe46c6625a140ae7f2a43069c671d945098761326c993f9eaae87276edd372 |
| title | Add api/layering_test.go to machine-check the core<-db/authn<-service<-api/web invariant |
| description | What is wrong: dolt declares the `core ← db/authn ← service ← api/web` layering invariant in prose only (per the family-wide convention documented in e.g. `sourcehut-tokens/CLAUDE.md`, `sourcehut-coverage/SPEC.md` invariant 7) and enforces it by code review alone — there is no machine check. Why it matters: the invariant is what makes `service/` the single place a security check can be located. A prose invariant nothing checks is exactly the kind of invariant that quietly stops holding as the codebase changes. Sibling that already does it correctly: `sourcehut-bench/api/layering_test.go` and the artifacts equivalent machine-check the invariant, including guards against three known bypass patterns ("close the three ways round the layering guard"). Fix: copy `api/layering_test.go` into dolt, adjusting package names and import paths as needed for dolt's package layout. Status: reported, not independently re-verified by direct code reading for this register entry. Audit: D18 (cross-repo audit, 2026-08-17) |
| design | |
| acceptance_criteria | |
| notes | |
| status | open |
| priority | 2 |
| issue_type | task |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-17T20:39:18Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-17T20:39:18Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 01a01173-364c-702e-9305-252c1a9e80c4 |
| issue_id | sr-ht-dolt-2zk |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-17T23:39:18Z |
No comments.