600 pvl pr 2 holonnode envelope validation vertical slice

[owleyeview]

PVL PR 2 — HolonNode Envelope Validation (Vertical Slice)

Closes #600.

Summary

First MAP-level rejection logic in the Integrity zome. Implements descriptor-independent envelope validation for the HolonNode entry as an end-to-end vertical slice — pure-core rules, substrate-adapter entry point, Integrity wiring for all HolonNode entry-op forms, and explicit violation→Invalid mapping — turning the PR 1 limit/violation contracts into enforced rules on the live write path.

Per PVL Design Spec v0.4 (§5.1–5.2, §10) and Implementation Plan v2.4 (PR 2), validation covers:

• serialized entry size (MAX_HOLON_NODE_BYTES = 262,144) → MAP-PVL-1003
• typed decode → MAP-PVL-1001 (DecodeFailed)
• canonical encoding (raw bytes byte-match the model re-encode) → MAP-PVL-1001 (NonCanonicalEncoding)
• property count (MAX_PROPERTY_COUNT = 256) → MAP-PVL-1101

Rules run in a deterministic, consensus-relevant order: size → decode → canonical → count, pinned by tests.

Why

Before this PR, validate_create_holon / validate_update_holon were no-ops and the zome accepted every decodable HolonNode unconditionally — no floor on entry size, property count, or non-canonical encoding, so a coordinator defect or peer could commit oversized/incoherent entries every peer must then store, gossip, and traverse. This establishes the deterministic hygiene floor without consulting descriptors or runtime state.

Design

Follows the PVL §3.3 layering, with the Integrity zome holding dispatch + callback mapping only:

holons_integrity        → validate() dispatch + violation→Invalid mapping
  holons_guest_integrity → raw-op extraction, decode, canonical re-encode, byte-compare
    shared_validation    → pure rules → Result<(), PvlViolation>  (no hdi/hdk/holo_hash)

• Raw-first guard. A prepare_holon_node_envelope(&op) guard runs before op.flattened(), extracting the inner app-entry bytes directly from the raw Op (StoreEntry, StoreRecord, RegisterUpdate). It measures and rejects oversized entries before typed decode and before any dependency request — in the StoreRecord-update arm, before its existing must_get_valid_record.
• Canonical-encoding check. The decoded model is re-encoded and byte-compared against the stored entry. This is what makes the "canonical shape" rule non-empty (serde BTreeMap decoding is last-wins for duplicate keys, so nothing is observable post-decode) and doubles as the guest/preflight serialization-parity guarantee. It catches duplicate keys, non-canonical ordering, non-canonical integer widths, and ignored extra fields.
• Explicit rejection mapping. Err(PvlViolation) → ValidateCallbackResult::Invalid(violation.to_string()), so the consensus-visible message is exactly the MAP-PVL-<code>: <summary> contract rather than a substrate-wrapped guest string.
• Wiring cleanup. All five HolonNode entry-op forms route through the one adapter entry point; the create-then-update double validation in the StoreRecord-update arm is removed; the superseded no-op validators and their zome wrappers are deleted.

Storage SL2 breadcrumbs (no behavior change)

ForUpdateNewVersion still persists via create_entry. Breadcrumb comments mark the anticipated Storage SL2 switch (root-addressed native update_entry against the lineage-root Create, removal of original_id from the entry shape, parity-fixture revisit) at the guest commit path and the RegisterUpdate / StoreRecord-update arms. The update-op wiring is exercised by adapter tests but is dead for MAP writes until SL2, since writes currently emit only Create actions.

Scope / impact

• DNA hash + validation semantics change (first real rejection logic in validate()) — requires fresh test state; acceptable pre-production.
• Commit path & loader: every entry-producing staged commit now passes envelope checks; the 379-holon core-schema corpus continues to load clean (positive coverage via existing loader fixtures).
• No host / TS SDK / wire changes — HolonError::PvlViolation and its SDK mirror landed in PR 1; violations stay inside Integrity until preflight (PR 8).

Testing

• Pure core: size/count boundaries (inclusive), saturating narrowing, rule ordering.
• Adapter: stored-payload↔encode parity and model↔guest-entry parity (both legs of the canonical-compare pinned); decode-failure; duplicate-key / reordered / non-canonical integer-width / ignored-extra-field → NonCanonicalEncoding; oversized-before-decode; over-count.
• Conductor (sweetest): a 257-property HolonNode is rejected with the exact MAP-PVL-1101: property count exceeds 256 message reaching the author, via a reusable assert_commit_rejected_with_pvl harness helper.
• npm run check, npm run fmt:check, npm run test:unit, and npm run sweetest all pass (corpus loads; existing dance suites green).

Explicitly out of scope

Property-name / native-value rules (PR 3); identifier shape (PR 4); update/delete target, lineage, original_id immutability (PR 5 + Storage SL2); SmartLink validation (PR 6); dependency-budget + coordinator preflight (PR 8); changing how ForUpdateNewVersion persists (Storage SL2). Only TooManyProperties is exercised at the conductor level here by design; broader negative-path conductor coverage is PR 8.

[evomimic]

Review Findings

The PR is close, but I don't think it's merge-ready yet.

• P2: The issue contract requires five-op adapter coverage for the new public envelope seam, but the added tests do not exercise that seam across the actual Holochain op variants. The implementation now routes validation through prepare_holon_node_envelope(...) in happ/crates/holons_guest_integrity/src/holon_node_envelope.rs, and raw-byte selection depends on holon_node_entry_bytes(...) there as well. However, the tests in that file only drive the internal run(raw) helper with synthetic byte slices, and the new conductor test in tests/sweetests/tests/pvl_validation_tests.rs covers only the 257-property rejection on the authoring path. As a result, the PR does not yet prove the required behavior for all five HolonNode entry-op forms, including correct raw app-entry extraction and the “size before must_get_valid_record” guarantee on the StoreRecord update path.

Smallest practical fix direction:

• Add adapter-level tests that construct and cover all five HolonNode entry-op forms:
  • StoreEntry create
  • StoreEntry update
  • RegisterUpdate
  • StoreRecord create
  • StoreRecord update
• Assert that each form reaches the single public adapter seam and selects the correct stored inner app-entry bytes.
• Include a StoreRecord update case that proves an oversized payload is rejected before later dependency work.

What I checked:

• PR 602 against issue #600
• CI on the latest PR head SHA 15baf727b051283c2a0a94114b141e830a127594: ci_pass, fmt, and test are passing
• Local branch 600-pvl-pr-2-holonnode-envelope-validation-vertical-slice is up to date after git fetch origin and git pull --ff-only

Manual verification recorded:

• build:happ: passed
• build:host: passed
• npm test: nominal
• npm start: nominal

[owleyeview]

Added the requested adapter coverage:

• All five HolonNode op forms exercise the public envelope seam and raw-byte extraction.
• Oversized payload rejection is covered across all five forms.
• StoreRecord update proves rejection occurs before dependency lookup.
• Additionally, non-HolonNode and non-entry ops are confirmed NotApplicable.

All targeted tests and formatting checks pass.