open/portfolio-optimiser-commons
1
0
Fork 0
Code Issues Releases Activity
portfolio-optimiser-commons/examples/nav-golden-escape
History
Exact
Kjell Tore Guttormsen b6417414c8 docs(examples): nav-golden fixture class — bundle → read-context goldens 
New fixture class for the D4 step-0 split (commons-owned; delivered into
catalog's corpus/runner). A nav-golden case is bundle in / expected-read-
context out — the shape that expresses "two conformant implementations MUST
produce an identical read-context" (method-spec §3 Step 1).

- nav-golden-hierarchy/ (positive): depth-first first-seen order, both link
  forms (/ = bundle root vs relative), one segment per level, resolved-path
  dedup, cycle termination, recursive verdict exclusion, missing-index binds
  root alone, flat render.
- nav-golden-escape/ (negative, gate must go red): .. escapes and a
  /etc/passwd root-relative trap; conformant returns only valid.md.

Both expected-read-context.md verified byte-for-byte against a conformant
navigator implementing §3 Step 1; the negative case verified to diverge
under a naive navigator.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUCuNNvnCkayuUDy2WFgeU
2026-07-21 10:22:50 +02:00
..
bundle docs(examples): nav-golden fixture class — bundle → read-context goldens 2026-07-21 10:22:50 +02:00
expected-read-context.md docs(examples): nav-golden fixture class — bundle → read-context goldens 2026-07-21 10:22:50 +02:00
README.md docs(examples): nav-golden fixture class — bundle → read-context goldens 2026-07-21 10:22:50 +02:00
SHOULD-NOT-BE-READ.md docs(examples): nav-golden fixture class — bundle → read-context goldens 2026-07-21 10:22:50 +02:00

README.md

nav-golden-escape — negative navigation golden (the gate must be able to go red)

Per catalog's requirement that step 0's gate must be able to fail (a gate that can only pass proves nothing), this negative case makes a conformant navigator and a naive one provably diverge. It is the counterpart to nav-golden-hierarchy (the positive case).

bundle/index.md links one valid sibling and three escaping / trap targets:

Link Class Conformant outcome
valid.md in-bundle returned
../SHOULD-NOT-BE-READ.md .. escape (the decoy really exists, one level up) skipped; decoy never read
../../../../etc/passwd deep .. escape skipped
/etc/passwd root-relative trap skipped

The trap is the load-bearing one. Under the ratified rule, a leading / denotes the bundle root, so /etc/passwd resolves to {bundle}/etc/passwd (no such file → skip), NOT the filesystem path. A naive implementation that reads / as filesystem-absolute opens the real /etc/passwd — a path-traversal breach. This case fails for any implementation that raises, reads the decoy, or leaks /etc/passwd content; it passes only when the read-context is exactly valid.md.

The malformed-target sub-class (an embedded null byte, other invalid path components) is covered by the method-spec §11 Navigation boundary seam as a unit test — a literal null byte does not belong in a committed text fixture. (See the relocated finding docs/plan/2026-07-20-funn-portfolio-optimiser-nullbyte.local.md for the concrete null-byte reproduction that motivates the seam.)