amadan
Store door: chunk shape/size guard for the app-log write grant Issue open
Migrated from github.com/carlosframework/platform issue #146, opened 2026-08-11. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: The store door's app-log write grant has no chunk shape or size guard, and the box segment is an unverifiable pseudonym.
---
Follow-up from PR #145 (spec F3 caveat). The fleet store door grants segment-exact PUT+DELETE on apps/<own-sqid>/<app>/logs/** for log shipping. The grant is account-wide and the <box> key segment is an unverifiable machine-id pseudonym, so a compromised fleet box can forge or delete log chunks for the account's apps on PLATFORM boxes too, bounded only by the 32 MiB per-PUT cap (no quota, retention is the writing box's own job). Wanted: a door-side guard — validate chunk key shape (applog.ChunkKey grammar incl. embedded size matching body length), plausibility-cap chunk size, and optionally bind the <box> segment to the authenticated fleet label for door-written chunks.
🤖 Generated with Claude Code