Repository navigation
Require an agreement's terms.deliverable to match its listing's deliverable - #259
Merged
randomblocker merged 2 commits intoNov 6, 2026
Merged
Conversation
…erable DACS-3 8.5.2 item 4: terms.deliverable is a required DeliverableRef whose deliverableType, hash (sha256 hex of the anchored offering.deliverable) and schemaUrl must equal those of the listing. A missing or mistyped value is a malformed agreement; a well-formed value that differs does not match its listing. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…e deliverable rule deliverableRefShapeOk now accepts exactly what the pinned SDK validator accepts: only deliverableType, hash and schemaUrl, one of the four deliverable kinds, and a bare lowercase sha256 hex hash. A one-time startup step, keyed agreement-deliverable-schema-version, clears derived deal credit (refsVerified, reputationEligible, ratings) and recomputes reputation, so a catalog saved before the rule stops serving credit for deals whose Agreement now fails. Listings, withdrawal evidence and scan pointers are kept. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Directory accepted an agreement with no
terms.deliverable, or with one that differed from the listing's offered deliverable. Under DACS-3 §8.5.2 item 4,terms.deliverableis a required DeliverableRef. ItsdeliverableType, itshash(sha256 hex of the anchoredoffering.deliverable, built the same way as the SDK builds it) and itsschemaUrlmust equal the listing's.What changes (
reference-implementations/dacs-directory):terms.deliverableis now refused as a malformed agreement, and discovery refuses it too. The shape check matches the pinned SDK validator: onlydeliverableType,hashandschemaUrl, and only the four deliverable kinds.agreement-deliverable-schema-version) clears deal credit saved before this rule (verified and eligible flags, ratings) and recomputes reputation, keeping Listings, withdrawal evidence and scan pointers. The next successful reindex re-earns credit under the new rule.schemaUrldiffers from the listing's is refused as not matching its listing.test/agreement-deliverable.test.tscovers missing, wrong-type, extra-member, unknown-kind, equal and different values for both agreement profiles;test/agreement-deliverable-migration.test.tscovers the startup step and that it runs once. The shared agreement fixtures and four inline agreement fixtures in other tests now carry the matching deliverable. No assertion was weakened.Known limits:
offering.deliverableis refused by construction. No test covers this path, because such a listing is not admitted with the current fixtures.schemaUrlis compared exactly for every deliverable kind, as the Standard says, even though the SDK only writes it forstorage-program.sha256:prefix or in uppercase is refused. The Standard says hex, and the SDK writes bare lowercase.Closes #249
🤖 Generated with Claude Code
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.