Two refusals had no test, found by breaking them #61

2026-09-22T14:50:44Z

paulhitt commented

2026-09-22 14:50:44 +00:00

(Migrated from gitlab.com)

Six checks were disabled one at a time to see which suites noticed. Four
died immediately. Two survived every suite, including interop and the
live relay run, so the gap was the repository's and not just CI's:

X3DH.initiate refuses a bundle whose signed prekey is not signed by
the identity key. It is the first check session establishment makes
and the one a relay substituting a signed prekey has to beat. Every
test handed it a well-formed bundle, so deleting the refusal broke
nothing.
verifyConsistency refuses a proof that does not connect two heads.
Every assertion about it was the same happy-path line, that a valid
proof verifies, so returning true unconditionally kept them all green.

The second is what §19.5 already warns about, on §19's own feature: a
happy-path test certifies the reverse as correct.

Eight tests. The consistency ones needed an RFC 6962 proof generator
written here, because this engine only verifies and the relay is what
produces proofs, which is plausibly why nobody wrote the refusal. It
asserts the honest proof verifies FIRST: without that line the four
refusals would pass against a verifier that always said no.

scripts/mutate.py ships the harness, so this is repeatable rather than
something done once. All six mutations now die, and the tree is restored
whether a run passes or throws.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Six checks were disabled one at a time to see which suites noticed. Four died immediately. Two survived every suite, including `interop` and the live `relay` run, so the gap was the repository's and not just CI's: - `X3DH.initiate` refuses a bundle whose signed prekey is not signed by the identity key. It is the first check session establishment makes and the one a relay substituting a signed prekey has to beat. Every test handed it a well-formed bundle, so deleting the refusal broke nothing. - `verifyConsistency` refuses a proof that does not connect two heads. Every assertion about it was the same happy-path line, that a valid proof verifies, so returning true unconditionally kept them all green. The second is what §19.5 already warns about, on §19's own feature: a happy-path test certifies the reverse as correct. Eight tests. The consistency ones needed an RFC 6962 proof generator written here, because this engine only verifies and the relay is what produces proofs, which is plausibly why nobody wrote the refusal. It asserts the honest proof verifies FIRST: without that line the four refusals would pass against a verifier that always said no. `scripts/mutate.py` ships the harness, so this is repeatable rather than something done once. All six mutations now die, and the tree is restored whether a run passes or throws. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

paulhitt commented

2026-09-22 14:50:44 +00:00

(Migrated from gitlab.com)

assigned to @paulhitt

paulhitt commented

2026-09-22 14:50:49 +00:00

(Migrated from gitlab.com)

restored source branch test/the-refusals-have-tests

restored source branch `test/the-refusals-have-tests`

paulhitt (Migrated from gitlab.com) merged commit 32f01d11d4 into main

2026-09-22 15:24:39 +00:00

paulhitt commented

2026-09-22 15:24:40 +00:00

(Migrated from gitlab.com)

mentioned in commit 32f01d11d4

mentioned in commit 32f01d11d4aa296d00077376a33e1d737adcd38b

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-e2e#61