User description

Part of #445 / #921 (Gate 3, slice 3B, part 1). No production authority switch: PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.

Scope

Slice 3B is split at its proof boundary:

• 3B part 1 (this PR): the record-commit marker codec, which is pure, headless and vector-proven.
• 3B part 2 (next PR): the commit write protocol (PENDING → stage/promote → ACTIVE), startup reconciliation, and orphan/superseded staging classification. It builds on this codec and on slice 3A's stage_and_promote.

What lands (crates/worldscript-secure-storage/src/marker.rs)

• content_digest (§5.4): SHA-256 over worldscript-r15/content/v1 and the complete WSR1 envelope.
• CommitMarker and its canonical body bytes (§5.4):
  • the header is the class token, the §6.2-tagged logical/project bindings, marker_generation and state_code, followed by the state body;
  • the bindings are reused from canonical AAD through a new crate-internal tagged_identity_bindings, so rule D's direct/hashed choice has one implementation.
• marker_entry_digest, the value slice 3C's root marker_set_digest will bind.
• Admitted states: ACTIVE, PENDING, RECOVERY_REQUIRED.
  • DELETE_PENDING, TOMBSTONED (§8.5) and READ_AUTHORITY_PENDING (migration) keep their reserved codes but are refused until their gates admit them.
  • is_chunked = 1 is also refused, because the chunked envelope is not implemented.
• Strict decoding:
  • the identity must equal the requested record's marker;
  • flags must be exactly 0 or 1, and no trailing bytes are allowed;
  • counters follow the §5.4 lifecycle (never 0 or u64::MAX);
  • a pending target must be exactly the next generation (1 for a first write, otherwise old + 1);
  • operation_id must be 1–128 bytes;
  • the record schema must be admitted.
• Sealing: each marker generation is sealed as its own record-commit record with envelope record_generation = marker_generation. Opening refuses a body whose generation differs from its envelope's, which prevents replay under another generation's name.

Proof

tests/gate3b_marker_test.rs (17 tests):

• vectors assembled byte by byte from the contract text;
• the marker_entry_digest vector pinned from an independent Python hashlib computation;
• every truncation and trailing bytes;
• non-canonical flags, chunked bodies and digestless ACTIVE bodies;
• reserved and unknown states;
• identity mismatch;
• counter lifecycle, target ordering, operation-id bounds and schema admission;
• rule-D hashed bindings;
• seal/open identity binding and generation-replay refusal;
• Debug redaction.

Local runs: cargo clippy --all-targets -D warnings is clean, the full crate suite passes, and pnpm docs:check (including the R-15 gate status guard) passes.

Docs

• Contract §20 has a new slice 3B part 1 entry, and both status-split sentences are extended.
• Ledger row 10 is updated.
• The canonical R15_GATE3 token is now SLICE_3B_MARKER_CODEC in the status block and ledger row 10.

Summary by Sourcery

Implement the headless Gate 3 slice 3B record-commit marker codec without changing production storage authority.

New Features:

• Add a headless protected-storage codec for creating, encoding, decoding, hashing, sealing, and opening record-commit markers for admitted ACTIVE, PENDING, and RECOVERY_REQUIRED states.

Bug Fixes:

• Reject malformed, unsupported, identity-mismatched, invalid-generation, chunked, and replayed commit markers.

Enhancements:

• Share canonical identity binding logic between AAD and marker encoding while enforcing strict lifecycle, schema, operation, and generation validation.

Documentation:

• Document the slice 3B marker codec and update R-15 Gate 3 status to SLICE_3B_MARKER_CODEC while retaining the prohibition on production authority switching.

Tests:

• Add contract-based byte vectors and adversarial coverage for marker encoding, decoding, digests, sealing, identity binding, validation, replay protection, and debug redaction.

Chores:

• Record the marker codec in the unreleased changelog.

Summary by cubic

Adds the Gate 3 slice 3B part 1 record-commit marker codec to the headless worldscript-secure-storage crate: canonical body encoding, strict decoding, and generation-bound sealing of one record's commit marker, vector-proven against the contract. It decides no authority and PRODUCTION_AUTHORITY_SWITCH_ALLOWED stays NO; the commit write protocol and startup reconciliation are a later slice 3B part 2.

What lands

• content_digest is SHA-256 over the domain and the complete WSR1 envelope; marker_entry_digest is the value slice 3C's root marker_set_digest will bind.
• Marker identity bindings reuse canonical AAD through a new shared tagged_identity_bindings (pulled out of aad.rs), so rule D's direct/hashed choice has one implementation.
• Admits ACTIVE, PENDING, and RECOVERY_REQUIRED; DELETE_PENDING, TOMBSTONED, READ_AUTHORITY_PENDING, and chunked bodies keep reserved codes but are refused.
• Decoding is strict: identity match, flags exactly 0/1, no trailing bytes, lifecycle-safe counters, a pending target exactly the next generation (1 for a first write, otherwise old + 1), operation_id 1–128 bytes, an admitted record schema, and an ordinary-write fence of 0 (journal-owned positive fences refused). A well-formed foreign record-commit header is an identity mismatch; truncated or malformed headers are corruption.
• Each marker generation seals as its own record-commit record whose envelope generation must equal the body's — opening refuses a mismatch, blocking replay under another generation's name.
• 17 tests pin the contract's state codes, operation-id bound, fence rule, and both digest vectors to an independent Python computation; clippy, the crate suite, and docs:check pass, and contract §20 and ledger row 10 are updated (R15_GATE3=SLICE_3B_MARKER_CODEC).

^{Written for commit 525bad8. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Added support for encoding, validating, and sealing protected-storage markers that identify a record’s committed version and track pending or recovery-required states.
  • Marker data is checked for valid identity, generation, and supported record format. User data is not yet read or written through this codec; commit writing and startup recovery remain forthcoming.
• Documentation
  • Updated secure-storage contract and migration notes to reflect the marker codec’s implementation status.

CodeAnt-AI Description

Add a strict record-commit marker codec for protected storage

What Changed

• Adds encoding, decoding, hashing, sealing, and opening for ACTIVE, PENDING, and RECOVERY_REQUIRED record markers.
• Rejects malformed, truncated, replayed, cross-record, unsupported, chunked, fenced, and invalid-generation markers instead of accepting them.
• Enforces exact generation transitions, valid operation IDs and schemas, lifecycle counters, and identity bindings shared with canonical storage authentication.
• Adds independent byte-level vectors and coverage for valid markers, rejection cases, digest calculation, sealing, replay protection, and operation-ID redaction.
• Documents Gate 3 slice 3B part 1 as headless only; production storage authority, commit writes, and startup reconciliation remain unchanged.

Impact

✅ Strict marker validation
✅ Replay-resistant record generations
✅ Contract-pinned storage compatibility

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review