fix: enforce scene base parcel integrity

[LautaroPetaccio]

Summary

• add defense-in-depth validation for scene pointers, parcels, and base
• run the integrity check in the production content-validator adapter
• reject malformed scene metadata before access validation can authorize it
• preserve order-independent pointer and parcel set comparison

Rollout note

This intentionally tightens validation for new, replayed, or backfilled scene deployments. Entity pointers must equal the unique canonical metadata.scene.parcels set, and metadata.scene.base must be included in that set. Deployments that were historically accepted without satisfying these invariants will be rejected when replayed or revalidated by an upgraded Catalyst.

Verification

• build and lint passed
• full unit suite passed
• focused scene integrity suite passed with 7 tests
• different pointer and parcel ordering is covered
• diff checks passed

[LautaroPetaccio]

Coordinated scene-integrity hardening set:

• fix: enforce scene deployment integrity schemas#437
• fix: validate scene base against parcels core-libs#60
• fix: enforce scene base parcel integrity #1956
• fix: secure multi-scene world deployment identity worlds-content-server#521
• decentraland/sdk-multiplayer-server#120
• fix: update places by deployment identity places#856
• fix: protect place ingestion by deployment identity discovery-server#105
• fix: resolve permissions by scene deployment comms-gatekeeper#285
• decentraland/definitions#1640

Please review merge and deployment ordering across this set before rollout.

[decentraland-bot]

Review verdict: Approve

I reviewed the validation wrapper, integration points, dependency bump, tests, and ran the mandatory security pass / multi-agent review workflow.

Findings:

• P2 (non-blocking): Consider adding a valid multi-parcel test where entity.pointers and metadata.scene.parcels contain the same set in a different order, to lock in the intended order-independent comparison.
• P2 (non-blocking): The repeated validation error string in scene-base-validation.ts could be extracted to a constant to avoid wording drift.
• P2 (non-blocking): Since this intentionally tightens the scene deployment contract for malformed scenes, include the invariant in rollout/release notes: scene pointers must equal the unique canonical metadata.scene.parcels set, and metadata.scene.base must be included in it.

Consumer/API impact:

• No exported TypeScript API changes in this service.
• Deployment behavior is stricter for malformed scene entities; valid scenes remain compatible.
• Given the coordinated hardening set linked in the PR discussion, rollout ordering should ensure validators/consumers using the new scene-parcel rules are deployed consistently.

Security review: No security issues found.
CI: All reported checks are passing.

---

Reviewed by Jarvis 🤖 · Requested by Lautaro Petaccio (<@U025WCHLMN3>) via Slack

[decentraland-bot]

Re-review verdict: Approve

I re-reviewed the new head commit 82b259ae after the follow-up changes.

Findings:

• P2 (non-blocking): The valid-path tests now cover order-independent multi-parcel comparison and the error string is extracted. Consider additionally asserting that the wrapper returns the delegated validator result, not only that the delegate was called, to lock in result propagation.
• P2 (non-blocking): Consider adding explicit duplicate-pointer / duplicate-metadata.scene.parcels regression cases, since uniqueness is part of the tightened invariant.

Consumer/API impact:

• No exported TypeScript API changes in Catalyst.
• Public deployment behavior is intentionally stricter for malformed scene entities: scene pointers must equal the unique canonical metadata.scene.parcels set, and metadata.scene.base must be included in it.
• The PR body now includes a rollout note; the linked coordinated hardening set should still be deployed in an order that avoids mixed-validator surprises.

Security review: No security issues found.
CI: All reported checks are passing.

---

Reviewed by Jarvis 🤖 · Requested by Lautaro Petaccio (<@U025WCHLMN3>) via Slack

[decentraland-bot]

Re-review verdict: Approve

I re-reviewed the new head commit af3b46d after the follow-up test coverage changes, including the mandatory multi-agent and security review passes.

Findings:

• P2 (non-blocking): src/adapters/content-validator/scene-base-validation.ts could inline isCanonicalParcelList() since it is single-use, but keeping it as a named helper is acceptable for readability.
• P2 (non-blocking): The valid-path tests could combine the “delegates” and “returns delegated result” assertions per scenario to reduce repetition.
• P2 (non-blocking): jest.resetAllMocks() is likely redundant because the mock is recreated in each beforeEach.

Consumer/API impact:

• No exported TypeScript API changes in Catalyst.
• Public deployment behavior is intentionally stricter for malformed Genesis City scene entities: scene pointers must equal the unique canonical metadata.scene.parcels set, and metadata.scene.base must be included in it.
• The rollout note and coordinated hardening set cover the stricter validation semantics; valid parcel-based scene deployments remain compatible.

Security review: No security issues found.
CI: All reported checks are passing.

---

Reviewed by Jarvis 🤖 · Requested by Lautaro Petaccio (<@U025WCHLMN3>) via Slack