Story-2869 · EPIC-2834 T3e-a
Hostile channel input stops before Blake
The ingestion boundary now has explicit adversarial CI proofs. A signed provider envelope still cannot choose a firm, matter, user, binding, sender, or reply recipient; an attacker cannot enlarge the deployment's media-size cap; and one user's confirmation code cannot select another user's pending document.
The three guards
Forged metadata. The test injects false scope and sender
fields at the provider, message, and media levels. The webhook passes only
the independently resolved live binding and the verified provider sender
to confirmation.
Oversize bytes. The test asks for a cap above the configured
maximum and serves an object one byte over that maximum. Acquisition
returns a permanent integrity refusal and writes no S3 object.
Wrong-scope confirmation. The database test opens pending
rows on two live bindings, omits the second binding from the verified
claim set, then presents its
C-XXXXXXXX code. Both rows remain
pending, no document or S3 copy is created, and the response reveals no
out-of-scope state.
Red-capable proof
- Forwarding any hostile scope field breaks the exact webhook seam assertion.
- Trusting the caller's larger size cap turns the 422 into an S3 write.
- Loading confirmation candidates outside the verified binding set changes the other user's row or files a document.
This Story changes no runtime mechanism, schema, cloud capability, or compatibility path. It makes the boundaries shipped by Stories 2865 and 2867 permanently executable in CI.