| Filename | Latest commit message | Latest commit date |
|---|---|---|
2937721c03
All checks were successful
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Successful in 3m35s
Two fail-open defects, found by randomising what a presentation discloses and asserting the one property that matters for money: **no subset of the disclosures may accept a checkout the complete mandate refuses.** The first random round broke it. **The hash binding verified the mandate against itself.** `verify_checkout_hash` hashed the `checkout_jwt` carried *inside* the mandate and compared it to the `checkout_hash` also carried inside the mandate. That proves internal consistency and nothing else — a holder presenting a well-formed closed mandate for some entirely different checkout satisfies it too, because nothing tied the authorization to the cart in front of the merchant. `CheckoutFacts` now carries the checkout being completed and `verify_commits_to` checks the commitment against **that**, refusing a mandate that commits to one checkout while carrying another rather than resolving the contradiction in either direction. **Withholding the open mandate shed its constraints.** Chaining in this format is structural: the open mandate and the closed one derived from it are both elements of `delegate_payload`. So a presentation that drops the open one looks exactly like a standalone closed mandate, and the allowed-merchants and line-items constraints simply vanish — an agent could shed the limits its user set by disclosing less. What gives it away is that the signed payload still had a slot for the withheld member, and resolution counts the slots it could not fill. A gap in the delegate chain is now refused `ChainWithheld`: a withheld member may be the mandate whose constraints bound the one presented, and nothing in the remainder says what it required. The test that found both is the generalisation of the hand-written withholding cases: 256 random subsets against a corpus of checkouts the complete mandate refuses, plus the opposite direction — withholding an *unused* alternative merchant or item must still accept the authorized checkout — so the invariant cannot be satisfied by refusing everything. Third time this technique has paid today: write one adversarial case by hand, watch it fail, then let a generator walk the rest of the family. Co-Authored-By: Claude Opus 5 <[email protected]> |
||
| .. | ||
| src | ||
| Cargo.toml | ||