feat(prs-556): make ABI trust posture an explicit policy - #440
Closed
pepe-anchor wants to merge 1 commit into
Closed
feat(prs-556): make ABI trust posture an explicit policy#440pepe-anchor wants to merge 1 commit into
pepe-anchor wants to merge 1 commit into
Conversation
pepe-anchor
force-pushed
the
prs-556-core-policy
branch
from
August 6, 2026 13:29
c6d7606 to
3d3cba4
Compare
Add MetadataTrustPolicy enum (AcceptUnsigned | RequireAllowlistedSigner) and SignerAllowlist to visualsign::signing. No Default impl — a deployment must state which posture it runs. Mark enum #[non_exhaustive].
pepe-anchor
force-pushed
the
prs-556-core-policy
branch
from
August 6, 2026 14:14
3d3cba4 to
81fcdfc
Compare
Contributor
Author
|
Closing in favour of a replacement PR. This one is still the last live member of GitHub stack #445 (the other four entries are the closed/merged #441-#444), which locks its base against retargeting and keeps showing a stack topology that no longer exists. Same branch, same commit, no content change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why am I making this PR?
The parser currently makes ABI trust decisions per-request, meaning a caller can opt into leniency by omitting a signature. The trust posture should be a deploy-time choice, fixed at startup and auditable in the TVC manifest.
What am I changing?
Add
MetadataTrustPolicyenum (AcceptUnsigned | RequireAllowlistedSigner) andSignerAllowlisttovisualsign::signing. No Default impl — a deployment must explicitly state which posture it runs. Marked#[non_exhaustive]so future posture variants are safe.What is the Linear ticket?
PRS-556
What are the rollback steps?
Revert the commit. No wire-format or API changes at this layer.
Is this change backwards compatible?
Yes. No existing callers are broken —
MetadataTrustPolicyhas no Default impl so every construction site is explicit.Does this require cross-team/service coordination?
No.
How do I know it works as designed? Which tests exercise this code?
Existing signing.rs unit tests cover SignerAllowlist construction and policy accessors.