golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(#4653): record the path-containment seam in CONTEXT.md and add the changeset

Browse Source 
The glossary had no entry for the containment predicate at all, which is the
epic's actual deliverable. The new entry states the engine/export split, the
branded type, the named acceptance policy, the preserved message contract, and
— the part most likely to be undone by a later cleanup — the two
implementations deliberately NOT collapsed and why each is stricter or
narrower rather than duplicative.

Glossary gate re-run: 269 refs, exit 0. Install-tree goldens regenerated and
confirmed byte-identical rather than assumed unchanged; lint:ci exits 0, so no
conformance-tier drift either.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
sim
2026-09-12 13:34:11 -04:00
parent 7086dcbbc9
commit 5967f1939a
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/eager-badgers-bark.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Changed
pr: 0
---
**The path-containment predicate is now a single exported seam** — `security.cjs` no longer exports `validatePath`; `assertWithinRoot` (throws), `tryWithinRoot` (returns null) and `requireSafePath` are the only containment exports, and all three return a branded `ContainedPath` so a validated path cannot be silently swapped for an unvalidated one. The per-call-site `{ allowAbsolute: true }` flag is replaced by the named `PathAcceptance` policy, which states what it actually permits: an absolute path outside the root was always rejected and still is. Rejection message text and every command's observable behavior are unchanged. (#4653)