Non-blocking Phase-3 candidate from the post-merge review of #472 (mesh thread phase2-review, review comment: #472 (comment)):
Phase-2 enforcement (H-008) requires a scheme-tagged content_hash on referenced_act (git-sha:, sha256-content:, sha256-pointer:), but the value after the tag isn't format-validated — git-sha:zzz passes. Scheme-tag-only enforcement was the stated Phase-2 scope, so this is not a defect; tightening closes the last gap between "tagged" and "meaningful".
Proposed hardening: hex-shape validation per scheme —
git-sha: → 40 (or 64 for sha256 repos) lowercase hex charssha256-content: / sha256-pointer: → 64 lowercase hex chars
Fail-closed 400 on mismatch, same as the Phase-2 gates. Should come with regression tests alongside phase2_untagged_or_missing_content_hash_is_rejected.
Refs: #472, #474 (sibling follow-up on freshness classification), thread sec-mesh-freshness.
Non-blocking Phase-3 candidate from the post-merge review of #472 (mesh thread
phase2-review, review comment: #472 (comment)):Phase-2 enforcement (H-008) requires a scheme-tagged
content_hashonreferenced_act(git-sha:,sha256-content:,sha256-pointer:), but the value after the tag isn't format-validated —git-sha:zzzpasses. Scheme-tag-only enforcement was the stated Phase-2 scope, so this is not a defect; tightening closes the last gap between "tagged" and "meaningful".Proposed hardening: hex-shape validation per scheme —
git-sha:→ 40 (or 64 for sha256 repos) lowercase hex charssha256-content:/sha256-pointer:→ 64 lowercase hex charsFail-closed 400 on mismatch, same as the Phase-2 gates. Should come with regression tests alongside
phase2_untagged_or_missing_content_hash_is_rejected.Refs: #472, #474 (sibling follow-up on freshness classification), thread
sec-mesh-freshness.