statecraft.
Catalog/spec-spine

147-a-link-above-the-derived-root-is-checked-on-read

A link above the derived root is checked on read

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Spec 144's link walk skips every symbolic link at or above the derived and state roots and leaves them to spec 127, whose refusal fires only on write. A read-only verb therefore reads through such a link unchecked: with `.statecraft` a link to a directory outside the repository, `check` reads the committed derived tree and a governed file stored beside it from outside and reports the repository fresh, exit 0. This spec checks those links on read with 144's own rule, while still not descending into either root.

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "corrective",
  "spec": "144-a-repository-path-is-one-type",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/pathutil.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "144-a-repository-path-is-one-type",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/tests/repo_path.rs"
  }
}

Source headings

  1. 147: A link above the derived root is checked on read
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 The roots and their ancestors are checked, not entered (amends 144 3.4)
  6. 3.2 The message says which read it guards
  7. 4. Out of scope
  8. 5. Resolved decisions
  9. Verification

Frozen anchors

No frozen anchors declared.