chore: sync Cargo.lock with manifests (0.5.1 + icaptcha-client sha2 dep)

The committed lockfile lagged the manifests: workspace crates were bumped to 0.5.1 and icaptcha-client's Cargo.toml declares sha2, but the lock still carried 0.5.0 and no sha2 entry. Every build regenerated it, leaving Cargo.lock perpetually dirty. Regenerated offline (no dependency upgrades) so the tree stays clean.
fix(node): make the SDL mutation-fence wiring load-bearing; admit deprecated
2026-11-09 05:20:05 -10:00 · 2026-08-28 23:16:43 -05:00 · 2026-08-28 23:16:38 -05:00 · 2026-08-28 23:16:38 -05:00 · 2026-08-28 23:16:36 -05:00 · 2026-08-28 23:16:03 -05:00
6 changed files with 74 additions and 203 deletions
@@ -770,23 +770,6 @@ dependencies = [
 "zeroize",
 ]

-[[package]]
-name = "ark-ff"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7a806ac6c8307b929df4645776290a50ee2aac754ad09d8bdf73391309e43af"
-dependencies = [
- "ark-ff-asm 0.6.0",
- "ark-ff-macros 0.6.0",
- "ark-serialize 0.6.0",
- "ark-std 0.6.0",
- "digest 0.10.7",
- "educe",
- "num-bigint",
- "num-traits",
- "zeroize",
-]
-
 [[package]]
 name = "ark-ff-asm"
 version = "0.3.0"
@@ -817,16 +800,6 @@ dependencies = [
 "syn 2.0.117",
 ]

-[[package]]
-name = "ark-ff-asm"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1479009684adc073dff49a1025d3a7065b317a9ead25aaaca38cdc70058ba8a2"
-dependencies = [
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ark-ff-macros"
 version = "0.3.0"
@@ -865,19 +838,6 @@ dependencies = [
 "syn 2.0.117",
 ]

-[[package]]
-name = "ark-ff-macros"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0691ed21ef00ef89c1e9bda832eba493dda3ec2f8d892fb25b705f73f06bb8"
-dependencies = [
- "num-bigint",
- "num-traits",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ark-serialize"
 version = "0.3.0"
@@ -911,30 +871,6 @@ dependencies = [
 "num-bigint",
 ]

-[[package]]
-name = "ark-serialize"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a74dd304fd536fb95d0a328e72be759209cc496a9da094c5bc56e5fea4f9e86b"
-dependencies = [
- "ark-serialize-derive",
- "ark-std 0.6.0",
- "digest 0.10.7",
- "num-bigint",
- "serde_with",
-]
-
-[[package]]
-name = "ark-serialize-derive"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f153690697a2b91e5e1251ff98411ee5371500a111a0fd317a70e588eb300f9"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ark-std"
 version = "0.3.0"
@@ -965,16 +901,6 @@ dependencies = [
 "rand 0.8.6",
 ]

-[[package]]
-name = "ark-std"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "367c9c827ed431bff6868b7aa926e05b16eb46603cc8b6e768e4a5553fa1d155"
-dependencies = [
- "num-traits",
- "rand 0.8.6",
-]
-
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -3374,22 +3300,19 @@ dependencies = [

 [[package]]
 name = "git-remote-gitlawb"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
 "anyhow",
 "gitlawb-core",
- "libc",
 "mockito",
 "reqwest",
- "tempfile",
 "tracing",
 "tracing-subscriber",
- "windows-sys 0.61.2",
 ]

 [[package]]
 name = "gitlawb-attest"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
 "base64",
 "ed25519-dalek",
@@ -3406,7 +3329,7 @@ dependencies = [

 [[package]]
 name = "gitlawb-core"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
 "anyhow",
 "base64",
@@ -3427,14 +3350,13 @@ dependencies = [
 "sha2",
 "thiserror 2.0.18",
 "tokio",
- "url",
 "uuid",
 "zeroize",
 ]

 [[package]]
 name = "gitlawb-node"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
 "alloy",
 "anyhow",
@@ -3490,11 +3412,10 @@ dependencies = [

 [[package]]
 name = "gl"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
 "alloy",
 "anyhow",
- "base64",
 "chrono",
 "clap",
 "dirs",
@@ -3543,9 +3464,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.18"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -3864,7 +3785,7 @@ dependencies = [
 "libc",
 "percent-encoding",
 "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
 "tokio",
 "tower-service",
 "tracing",
@@ -3900,7 +3821,6 @@ version = "0.4.0"
 dependencies = [
 "anyhow",
 "gitlawb-core",
- "mockito",
 "reqwest",
 "serde",
 "serde_json",
@@ -5432,7 +5352,7 @@ dependencies = [
 "quinn-udp",
 "rustc-hash",
 "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
 "thiserror 2.0.18",
 "tokio",
 "tracing",
@@ -5469,7 +5389,7 @@ dependencies = [
 "cfg_aliases",
 "libc",
 "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
 "tracing",
 "windows-sys 0.52.0",
 ]
@@ -5819,15 +5739,14 @@ dependencies = [

 [[package]]
 name = "ruint"
-version = "1.20.0"
+version = "1.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5e99bff0393163bb25029a6af25d3d8d202ba5b5438a74d1bd8789f5c822970"
+checksum = "c141e807189ad38a07276942c6623032d3753c8859c146104ac2e4d68865945a"
 dependencies = [
 "alloy-rlp",
 "ark-ff 0.3.0",
 "ark-ff 0.4.2",
 "ark-ff 0.5.0",
- "ark-ff 0.6.0",
 "bytes",
 "fastrlp 0.3.1",
 "fastrlp 0.4.0",
@@ -71,7 +71,7 @@ Known limitations:
 - Agent lifecycle revocation is not enforced by HTTP Signature authorization; do not rely on removing or revoking an agent record to block a compromised signer.
 - Read visibility is not a blanket data-classification boundary: task, IPFS-pin, and Arweave-anchor listings are not repository-gated; withheld path names can be visible to a root reader; and later visibility changes cannot retract content already announced or externally anchored.
 - Peer writes are signed by upgraded nodes, but strict signed-peer enforcement is opt-in during rolling upgrades.
- GraphQL mutations require a signed identity (a verified signer bound to the acting DID), are limited to the agent-task queue, and are covered by a CI completeness fence that requires signer acquisition and actor binding on every registered mutation; repo writes are not exposed over GraphQL and remain REST-only.
+- GraphQL mutations require a signed identity (a verified signer bound to the acting DID) but are limited to the agent-task queue; repo writes are not exposed over GraphQL and remain REST-only.
 - Pull-request review comments do not yet have threaded line-level anchors, and merges do not enforce approval requirements.

 See:
@@ -313,32 +313,15 @@ mod authz_guard {
    ///      from the SDL AST, not from this scrape.
    #[test]
    fn every_graphql_mutation_has_its_gate() {
-        // (Rust snake name, schema field in camelCase, expected gate markers). The
-        // four are Bucket C signer-self: `/graphql` uses optional_signature, so each
-        // resolver must call `require_signer(ctx)?` and bind the acting DID with
-        // `did_matches(`. A repo-write would be Bucket A (`require_repo_owner(`).
-        // Same-named REST rows live in the guard above against `api/tasks.rs`.
-        let registered: &[(&str, &str, &[&str])] = &[
-            (
-                "create_task",
-                "createTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-            (
-                "claim_task",
-                "claimTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-            (
-                "complete_task",
-                "completeTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-            (
-                "fail_task",
-                "failTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
+        // (Rust snake name, schema field in camelCase, expected gate marker). The
+        // four are Bucket C signer-self (`did_matches(`); a repo-write would be
+        // Bucket A (`require_repo_owner(`). Same-named REST rows live in the guard
+        // above against `api/tasks.rs`.
+        let registered: &[(&str, &str, &str)] = &[
+            ("create_task", "createTask", "did_matches("),
+            ("claim_task", "claimTask", "did_matches("),
+            ("complete_task", "completeTask", "did_matches("),
+            ("fail_task", "failTask", "did_matches("),
        ];

        // Completeness + hidden-mutation cross-check against the REAL schema (#219),
@@ -358,16 +341,14 @@ mod authz_guard {
        }

        // Marker present (source scrape; the vacuity limit, backstopped by the
-        // adversarial tests): each resolver body carries every required gate marker.
+        // adversarial tests): each resolver body carries its bucket marker.
        let masked = mask_comments(include_str!("../graphql/mutation.rs"));
-        for (snake, _, markers) in registered {
+        for (snake, _, marker) in registered {
            let body = resolver_body(&masked, snake);
-            for marker in *markers {
-                assert!(
-                    body.contains(marker),
-                    "GraphQL mutation `{snake}` is missing its gate marker `{marker}`: gate removed"
-                );
-            }
+            assert!(
+                body.contains(marker),
+                "GraphQL mutation `{snake}` is missing its gate marker `{marker}`: gate removed"
+            );
        }
    }

@@ -186,78 +186,57 @@ mod tests {
            .join("; ")
    }

-    /// N2: every GraphQL mutation requires a verified signer and binds the acting
-    /// DID to it. Unsigned is rejected; a signer other than the claimed actor is
+    /// N2: GraphQL mutations require a verified signer and bind the acting DID to
+    /// it. Unsigned is rejected; a signer other than the claimed actor is
    /// rejected; the matching signer passes the auth gate.
    #[sqlx::test]
-    async fn each_mutation_requires_and_binds_signer(pool: PgPool) {
+    async fn mutation_requires_and_binds_signer(pool: PgPool) {
        let state = crate::test_support::test_state(pool).await;
        let schema = state.graphql_schema.as_ref();
-        let actor = "did:key:zGQLACTORAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        let other = "did:key:zGQLOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
-        let cases: Vec<(&str, String)> = vec![
-            (
-                "createTask",
-                format!(
-                    r#"mutation {{ createTask(delegatorDid: "{actor}", input: {{ kind: "build", capability: "repo:write" }}) {{ id }} }}"#
-                ),
-            ),
-            (
-                "claimTask",
-                format!(
-                    r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{actor}") {{ id }} }}"#
-                ),
-            ),
-            (
-                "completeTask",
-                format!(
-                    r#"mutation {{ completeTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
-                ),
-            ),
-            (
-                "failTask",
-                format!(
-                    r#"mutation {{ failTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
-                ),
-            ),
-        ];
+        let assignee = "did:key:zASSIGNEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+        let q = format!(
+            r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{assignee}") {{ id }} }}"#
+        );

-        for (name, q) in &cases {
-            let resp = schema.execute(Request::new(q.as_str())).await;
-            assert!(
-                errors(&resp).contains("authentication required"),
-                "{name}: unsigned mutation must be rejected: {}",
-                errors(&resp)
-            );
+        // 1. Unsigned → rejected before any DB work.
+        let resp = schema.execute(Request::new(&q)).await;
+        assert!(
+            errors(&resp).contains("authentication required"),
+            "unsigned mutation must be rejected: {}",
+            errors(&resp)
+        );

-            let resp = schema
-                .execute(Request::new(q.as_str()).data(AuthenticatedDid(other.into())))
-                .await;
-            assert!(
-                errors(&resp).contains("authenticated signer"),
-                "{name}: DID mismatch must be rejected: {}",
-                errors(&resp)
-            );
+        // 2. Signed as someone other than the claimed assignee → rejected.
+        let resp = schema
+            .execute(Request::new(&q).data(AuthenticatedDid(
+                "did:key:zOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB".into(),
+            )))
+            .await;
+        assert!(
+            errors(&resp).contains("authenticated signer"),
+            "DID mismatch must be rejected: {}",
+            errors(&resp)
+        );

-            let resp = schema
-                .execute(Request::new(q.as_str()).data(AuthenticatedDid(actor.into())))
-                .await;
-            let errs = errors(&resp);
-            assert!(
-                !errs.contains("authentication required") && !errs.contains("authenticated signer"),
-                "{name}: matching signer must pass the auth gate: {errs}"
-            );
-            if *name == "claimTask" {
-                assert!(
-                    errs.contains("task not claimable"),
-                    "claim race / missing task must keep its business message: {errs}"
-                );
-                assert!(
-                    !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
-                    "business error must not be rewritten as opaque DB error: {errs}"
-                );
-            }
-        }
+        // 3. Signed as the claimed assignee → passes the auth gate. The missing
+        //    task is a business error from claim_task, not a sqlx fault, so the
+        //    actionable message must survive (not the opaque DB string) (#250).
+        let resp = schema
+            .execute(Request::new(&q).data(AuthenticatedDid(assignee.into())))
+            .await;
+        let errs = errors(&resp);
+        assert!(
+            !errs.contains("authentication required") && !errs.contains("authenticated signer"),
+            "matching signer must pass the auth gate: {errs}"
+        );
+        assert!(
+            errs.contains("task not claimable"),
+            "claim race / missing task must keep its business message: {errs}"
+        );
+        assert!(
+            !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
+            "business error must not be rewritten as opaque DB error: {errs}"
+        );
    }

    /// #250: mutation DB faults must be opaque; create_task hits agent_tasks.
@@ -41,7 +41,7 @@ Owner focus: protocol/auth.
 - Close default-open repo write authorization and wire trusted UCAN delegation into repository permissions.
 - Close the remaining visibility gaps: restrict or document task, pin, and anchor metadata routes, and publish an irreversible-publication policy.
 - Add UCAN revocation or blocklisting, with an emergency compromised-key runbook.
- GraphQL mutations require a verified signer (shipped, #87). Keep the surface limited to the agent-task queue; do not expose an owner-gated repo-write mutation over GraphQL without its owner-gate and REST parity. The `every_graphql_mutation_has_its_gate` fence forces any new mutation to be classified in its table (discovered from the schema SDL, with an introspection cross-check for hidden fields, so none can slip in unlisted) and requires `require_signer` plus actor binding in each registered resolver; the owner-gate and REST parity themselves stay the INV-1 review check, not something the fence proves.
+- GraphQL mutations require a verified signer (shipped, #87). Keep the surface limited to the agent-task queue; do not expose an owner-gated repo-write mutation over GraphQL without its owner-gate and REST parity. The `every_graphql_mutation_has_its_gate` fence forces any new mutation to be classified in its table (discovered from the schema, so none can slip in unlisted); the owner-gate and REST parity themselves stay the INV-1 review check, not something the fence proves.
 - Harden peer registration and outbound peer calls against SSRF and peer-list poisoning.
 - After all live peers upgrade, enable signed peer writes by default.

@@ -92,7 +92,7 @@ Fixed or staged in this pass:

 Live-network blockers to prioritize:

- GraphQL POST is still open for compatibility; GraphQL mutations should get mutation-aware auth before it becomes a public write API surface.
+- GraphQL mutations now require a verified signer bound to the acting DID (#87), and the surface stays limited to the agent-task queue, so there is no public repo-write GraphQL API to gate. Queries remain open by design. (Resolved; kept here as posture, not a live blocker.)
 - Push authorization is still not capability-complete. A valid DID signature is authentication, not authorization. Owner checks are now enforced on every branch, protected or not (`GITLAWB_ENFORCE_OWNER_PUSH`, on by default); what remains is that a UCAN `git/push` capability is not yet honored, so a delegated or CI key cannot push.
 - UCAN chain validation is incomplete and UCAN revocation/blocklisting is not implemented as an operator feature.
 - Private repository reads are not enforced. `is_public` and `GITLAWB_PUBLIC_READ` exist, but per-repository private-read behavior is not wired.
@@ -151,11 +151,3 @@ Risks:
 4. Harden peer registration and outbound fetch behavior against SSRF and peer-list poisoning.
 5. Add Docker/installer/release smoke tests to CI.
 6. Label PoS/economics docs consistently with the current live contract and rewards status.
-
-## Status updates (post-snapshot)
-
-These entries record security-posture changes after the 2026-05-28 inspection above. They do not rewrite that snapshot's command output or test counts.
-
-### 2026-08-30: GraphQL mutation auth and completeness fence (#87, #219)
-
-At `main` from `bfc44f92` onward, GraphQL mutations require a verified signer bound to the acting DID. The surface stays limited to the agent-task queue; repo writes are not exposed over GraphQL. PR #219 adds `every_graphql_mutation_has_its_gate`, a CI completeness fence that discovers mutations from the built schema SDL (with an introspection cross-check for hidden fields) and requires signer acquisition plus actor binding in each registered resolver.
Author	SHA1	Message	Date
beardthelion	361805b1bd	chore: sync Cargo.lock with manifests (0.5.1 + icaptcha-client sha2 dep) The committed lockfile lagged the manifests: workspace crates were bumped to 0.5.1 and icaptcha-client's Cargo.toml declares sha2, but the lock still carried 0.5.0 and no sha2 entry. Every build regenerated it, leaving Cargo.lock perpetually dirty. Regenerated offline (no dependency upgrades) so the tree stays clean.	2026-08-28 23:16:43 -05:00
beardthelion	526ee87344	fix(node): make the SDL mutation-fence wiring load-bearing; admit deprecated An adversarial review of the SDL switch found three gaps: - The fence's completeness source (SDL) and its hidden-mutation cross-check were not load-bearing: because the real MutationRoot has no visible=false field, reverting `fields` back to introspection and dropping the cross-check left the whole suite green (INV-21). Extract the sourcing + cross-check into a generic `assert_mutation_fence<Q,M,S>` that the real fence AND a synthetic hidden schema both drive. A new #[should_panic] test (fence_rejects_a_hidden_mutation) feeds a visible=false mutation that IS registered, so only the cross-check can fire; reverting the SDL source or deleting the cross-check now changes/removes that panic and turns the test RED (verified). - The introspection cross-check used bare `fields { name }` (GraphQL default includeDeprecated:false), so a `#[graphql(deprecation = "...")]` mutation -- executable and present in SDL -- would false-red as a hidden visible=false mutation. Use `fields(includeDeprecated: true)`; a new test (fence_admits_a_deprecated_mutation) pins it, going RED without the flag. - schema_lists_exactly_the_registered_mutations still sourced from introspection and its comment called introspection "the source of truth", contradicting the fix. Retargeted at the SDL set with a corrected comment. Also folds the two introspection navigations into one generic helper (introspection_mutation_fields) and points the version-safety test at it, so there is a single introspection query. cargo test -p gitlawb-node --bins green (497); clippy and fmt clean. Only api/mod.rs changed.	2026-08-28 23:16:38 -05:00
beardthelion	70b01aa320	fix(node): source the GraphQL mutation fence from SDL, not introspection Resolves jatmn's #219 P1. The every_graphql_mutation_has_its_gate completeness fence enumerated mutation fields via async-graphql introspection, which filters out `#[graphql(visible = false)]` fields. Those fields stay executable, so a future hidden mutation would need no registry row and no marker while both set-equality checks stayed green -- defeating the fence's guarantee that no live mutation goes unclassified. (Confirmed by execution: a synthetic visible=false mutation is absent from introspection, executable, and present in schema.sdl().) Source completeness from the engine's own SDL instead. A new pure helper mutation_field_names_from_sdl parses schema.sdl() with async-graphql's parser AST (async_graphql::parser::parse_schema) and reads the mutation type's fields; SDL includes visible=false fields and the AST parse is immune to a brace in a field description. Introspection is kept as a cross-check: any field present in SDL but hidden from introspection now fails named as a forbidden hidden mutation. The stale doc comments (which claimed introspection could not hide a field) are corrected. A self-checking version-safety test builds a synthetic schema with a visible=false mutation and asserts the SDL-sourced set includes it while introspection omits it -- so if a future async-graphql ever filters SDL by visibility, that test goes RED rather than the gap reopening silently. Load-bearing verified by execution: stubbing the SDL enumeration to empty turns four tests RED, including the fence itself; restoring returns green. Only api/mod.rs changed; the mutation resolvers are untouched. `cargo test -p gitlawb-node --bins` green (495); clippy and fmt clean.	2026-08-28 23:16:38 -05:00
beardthelion	a31fed4a67	docs(node): reconcile GraphQL mutation-auth claims with the shipped state README's known limitations, the OSS-readiness live-network blockers, and the maintainer roadmap still listed GraphQL mutation auth as an open item, which contradicts #87: GraphQL mutations already require a verified signer bound to the acting DID. Reconcile each to the shipped reality while keeping the genuinely-open nuance: the GraphQL mutation surface is the agent-task queue, repo writes stay REST-only, and no owner-gated repo-write mutation is exposed over GraphQL. The every_graphql_mutation_has_its_gate fence forces any new mutation to be classified in its table; owner-gate and REST parity stay the INV-1 review check.	2026-08-28 23:16:36 -05:00
beardthelion	626c545553	test(node): add a completeness fence over the GraphQL mutation surface Gate the GraphQL mutation surface the way REST is gated, as a SEPARATE guard with its own bucket table (a guard over a heterogeneous set must classify per member, INV-1). every_graphql_mutation_has_its_gate asserts the mutation set is complete (every mutation classified) and that each carries its gate marker. Completeness is derived from async-graphql's own introspection: the field names come from the engine as structured data, so no source-text or SDL-format shape (a brace or async fn in a comment or string, a whitespace/generic/skip variant, a brace in a rustdoc description) can hide a live mutation. A new unregistered mutation, including a repo-write, fails the build. The marker check (does each resolver body call its gate) is a best-effort static backstop, bounded to each resolver's own comment-masked, string-aware body. It is explicitly not the completeness guarantee and not load-bearingness: a marker inside a string literal is a documented vacuity residual, and the adversarial sqlx tests in graphql/mutation.rs are the real proof the gates reject. Verified by execution: an unregistered mutation reddens (unclassified), a removed did_matches gate reddens (missing marker), the clean tree is green; no DB, no feature flag.	2026-08-28 23:16:03 -05:00