Repository navigation
scientific(membership): reject support wire states impossible under canonical membership admission #651
Description
Finding
#649 now verifies canonical ordering, individual weight validity and design/topology consistency, but a parsed support row can still describe a state that canonical MembershipNetwork could never admit:
- two simultaneously active entries with the same
(role, group)but different weights; or - same-role group shares whose exact represented binary64 sum exceeds
1.0.
MembershipNetwork::insert already owns both invariants. Accepting such bytes in tepp.membership_observation_support_projection.v1 would make the wire structurally reconstructable but scientifically outside the owner aggregate's reachable state space.
Required RED
Starting from a valid owner-produced payload, mutate only the support topology while keeping every individual weight in (0,1] and the declared design otherwise plausible. Require MembershipObservationSupportWire::from_json to fail closed for:
- duplicate
(role, group_ordinal)entries with different exact binary64 weight bits; and - same-role weights whose exact represented binary64 sum exceeds unity, including an overrun that ordinary
f64accumulation could round back to1.0.
Minimal causal repair
Do not create a second share-budget arithmetic implementation. Reuse the canonical exact binary64 budget predicate from Membership admission at crate scope, and validate each reconstructed observation against the same reachable-state invariants. Keep the parser non-authoritative; this repair only constrains wire bytes to states the owner aggregate can actually issue.
Activity
test(membership): reject unreachable support-wire states (#651)
refactor(membership): share exact weight-budget predicate (#651)
fix(membership): validate support wire against admission invariants (#…
docs(membership): record reachable support-wire invariants (#651)
seonghobae commentedon Sep 21, 2026
Implemented on canonical #605 owner branch.
RED
2774e1c327f971dcba370dfec28dc74b81f49c99adds two unreachable-state parser fixtures: duplicate(role, group_ordinal)edges with distinct valid weights, and exact same-role overrun1.0 + minimum_subnormalwhose ordinary binary64 sum can round back to1.0. Both must be refused even when the declared design remains otherwise plausible.fff822d40cd8ad28f6ed8aa3c17b63beafbcbf15exposes the existing exact represented-binary64 share-budget predicate at crate scope only; estimator arithmetic and admission thresholds are unchanged. Causal parser repair8a73734d3f3f36dfa8f141bacea6c08171cca938rejects duplicate role/group edges and applies that same canonical exact budget predicate per role before accepting reconstructed support. CHANGELOG/current head is3177e98c40135368f81644bf5354baaf80216a46.Fresh exact-head runs are non-terminal: Rust Foundation
35643667975, Security35643668031, Semgrep35643668510, CodeQL35643667919, Documentation35643667994. Rust Foundation's four jobs remain queued before runner admission. Keep this issue open through exact-head GREEN, independent approval, protected landing, and downstream released-contract consumption.