Skip to content

fix(reliability): reject cyclic document JSON snapshots without unbounded traversal #217

Description

@seonghobae

Current authoritative state

This cycle-termination defect is repaired on canonical single-writer Draft PR #218 / fix/document-snapshot-cycle-217. Protected shipped truth and the frozen v0.6.0 candidate remain main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is eafd5462db71654e7fa85fd3aa8804d7c51c55f6, synchronized non-destructively with protected main. Fresh ancestry resolves protected main as merge base, 23 commits ahead / 0 behind, with exactly four document-snapshot source/test files changed.

Current production uses iterative enter/exit DFS to reject active-path cycles without recursive call-stack growth while preserving legitimate shared acyclic references and deep freezing. The same canonical lane also fail-closes accessor-backed properties, symbols/non-enumerable metadata, exotic containers, unsupported/non-finite primitives, lossy array shapes, hostile reflection failures and invalid runtime editor modes.

Representative cycle RED is 8d8540a604ae17ac9adad4a024d120027caa6003. On unchanged exact head eafd5462db71654e7fa85fd3aa8804d7c51c55f6, CI 32101276070, Security Scan 32101276077, and SAST Semgrep 32101276001 are completed / success; formal submitted reviews are 0. Technical success is not qualifying independent approval and does not replace applicable central workflows.

The defect is repaired on active Draft #218 but not protected-main shipped behavior. Keep #218 Draft/unmerged while #118 owns exact v0.6.0 publication/provenance/digest acceptance and qualifying independent latest-push approval plus every applicable central gate remain incomplete. Do not create a competing snapshot writer, transfer predecessor evidence, self-approve, weaken gates, move protected main, or fabricate release identity.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions