NQ1 prospective original-parser regression vectors
Status: UNRUN; declarative vectors for #1643 CA03/CA04/CA06 and NQ1. No executable test driver, parser acceptance, native receipt or qualification is claimed. Each future test must invoke the actual implemented native parser/factory and retain its original native observations; a model repeating a predicate is insufficient. Existing protected gates stay intact. Current R4 selects the ORIGINAL same-Core V8 constructor/test backend with genuine original primitive string/context/source owners; prior compressed-port experiments are retained historical counterevidence. These prospective cases now require whole original backend owner hooks, actual retained heap/cache/body/stack/IO history and physical phase closure under the unchanged parser/stream domain.
Fixture construction and independent assertions
Start from a separately admitted source tuple with all four original raw assets, complete expected inventory, original canonical policy and immutable baseline manifest. Source selection is external authority; adversarial fixtures never enroll a tuple. Build a complete valid authored inventory using only permitted fields/config and generated closed6 provenance. Encode a ZIP independently of the decoder, with little-endian local+central records, UTF8 flag0800, 100644 attrs, method0 or actual RFC1951 method8 and independent CRC32. Record exact original declaration and whole bytes. Give the future Core factory its genuine CoreStageSnapshot produced by the existing authenticated23 READ_STAGE adapter, retaining actual response windows, header sequence, final receipt, metadata and EOF. The companion stage writer/read object stays with its actor; it does not transfer an FD/HANDLE into Core or create a mock eof:true.
Success asserts every returned path/mode/raw byte/length/hash independently against the source fixture, sorted inventory and existing TS digest definition, all original native read borrowers and zero-byte EOF, complete source association, and no emitted effect before qualification. Capture original allocator/copy owners; observe actual later ended controls before any FREE assertion. Failure checks no qualified result, original failure classification and retained unresolved owner/resources; merely catching an exception is insufficient. All corruptions update outer CRC/SHA/declaration when necessary so the intended inner predicate is reached.
ZIP and deflate
| ID | Original input construction | Required outcome |
|---|---|---|
| NQ-Z01 | Entire inventory with stored zero-byte and nonempty files; repeat with fixed/dynamic deflate and independent expected bytes | Complete equal inventory and digests; all three block kinds exercised |
| NQ-Z02 | Valid deflate stream with overlapping distance1 copies, cross-block history and non-byte-aligned terminal code | Exact output/CRC and consumed input, no duplicate expanded envelope |
| NQ-Z03 | Max allowed compressed/expanded/entry/count/ratio/depth at each current actual owner boundary; one unit above in a separate fixture | Bound accepted; above rejected at original tighter bound |
| NQ-Z04a | Generic native capacity fixture with full64MiB inventory and per-entry<=8MiB; original128MiB owner, genuine native read/byte owners and capsule framing | Complete capacity/framing/chunk emission supported without duplicate expanded envelope; NOT an owner-authorized catalog/ZIP/authoring positive and returns no semantic-qualified namespace |
| NQ-Z04b | Complete actual independently admitted canonical tuple with all current source assets and only permitted authored changes, at its real owner bounds | Complete semantic positive only after genuine source authority and full actual policy validation; native64MiB support is a separate obligation, no owner caps changed |
| NQ-Z05 | Same fixture has early genuine zero read, nonzero read at declared end, changed held object, declared SHA mismatch or late original read | Deny and retain the original read/failure associations, no manufactured terminal EOF |
| NQ-Z06 | EOCD truncated, moved before a tail byte, comment, split disk, mismatched counts or overflowing central offsets | Unsafe rejection before out-of-range access |
| NQ-Z07 | Needed21, flags0/0808/encrypted, method9, extra/comment/disk, directory/symlink/special/0755 attrs | Unsafe rejection; executable source final mode never authorizes ZIP0755 |
| NQ-Z08 | Central/local independent mismatch in name/needed/flags/method/CRC/sizes/nameLength/extra | Unsafe at correspondence predicate despite rehashed whole archive |
| NQ-Z09 | Local records overlap, gap, prefix, duplicate offset, central gap or unreferenced extra local record | Exact contiguous complete region predicate denies |
| NQ-Z10 | Deflate invalid block3, missing EOB, bad LEN/NLEN, oversubscribed alphabets, illegal repeat16 first, reserved length/distance, beyond-window distance | Native decoder denies actual malformed stream |
| NQ-Z11 | Output expected length reached before end code, exact stream followed by junk, extra unused full byte, CRC mismatch or output overrun | No length-only/CRC-only acceptance; complete stream consumption required |
| NQ-Z12 | Every truncation boundary in separately encoded fixed/dynamic/stored blocks and repeat/copy tokens | Every incomplete original denies without unintended allocation growth |
Gzip, TAR and four-asset associations
| ID | Original input construction | Required outcome |
|---|---|---|
| NQ-A01 | Original gzip with each optional header combination and correct FHCRC; exact canonical TAR including first PAX/directory/policy members | Equal complete baseline and raw policy asset |
| NQ-A02 | Bad optional length/NUL/headerCRC, reserved gzip flags, changed trailer CRC/ISIZE, concatenated stream/trailing byte | Deny under existing single original gzip profile |
| NQ-A03 | Bad octal/header checksum, nonzero bytes after cString NUL, invalid UTF8, special/link record, wrong PAX commit/order/mode | Original canonical TAR rejection |
| NQ-A04 | Omit or duplicate a file/directory/policy; incorrect exact mode/length/hash; nonzero block padding; one terminator block; unaligned/nonzero tail | Complete inventory and original terminal predicate deny |
| NQ-A05 | Correct raw hashes with wrong asset order/name/descriptor tuple/tag/kind or policy contract semantic digest; wrong sums whitespace/order | Actual raw/semantic predicates deny despite outer hash agreement |
| NQ-A06 | Foreign/missing source/publication association with matching catalog row/asset bytes/native OS owner/provider MAC | No source qualification or parser-positive authority |
Ordered JSON, patterns and authoring
| ID | Original input construction | Required outcome |
|---|---|---|
| NQ-J01 | Pretty member order intentionally differs from lexicographic order; numeric keys2/10/01 mixed with insertion keys; nested arrays and empty containers | Match exact ECMAScript pretty and canonical byte rules separately |
| NQ-J02 | Finite numeric spellings1e0/-0/1.00/1e-7/1e21/subnormal/rounding tie; normalized canonical pretty counterpart | Reader Number conversion and serializer match actual TS; raw pretty equality selects exact bytes |
| NQ-J03 | BOM/invalidUTF8/lone surrogates/decoded duplicate id and \u0069d/trailing JSON/depth/token/member/string-byte limits | Actual original strict bounds and duplicate predicate deny |
| NQ-J04 | Current policy regex with Unicode escape/property class, lookaround/backreference, casefold and multiline anchors; exact valid and invalid counterparts | Match existing u/iu/imu semantics, no ASCII/std::regex substitute |
| NQ-J05 | Expensive legal pattern/match reaches original deadline, changed source engine/Unicode association or allocator uncertainty | Preserve original end/ownership; no renewed end or uncharged matcher |
| NQ-J06 | Edit exactly allowed id/name/description/version/enabled/developers/tags; local origin and github-derived repository counterparts | Accept only exact typed owner pattern/byte/shape rules |
| NQ-J07 | Change locked command/provider/isolation/artifact/secret/url/container or add/remove locked key; coherently rehash manifest/ZIP | template_difference_forbidden contract reached; no authoredBytes shortcut |
| NQ-J08 | Forbidden config filename/value with mixed case/Unicode/multiline, invalidUTF8, config aggregate bound/above, unknown config path | Exact complete owner patterns/path set and quota enforced |
| NQ-J09 | Provenance7th field/wrong tuple/repository/archiveSHA; local origin with repository; derived origin with archiveSHA; wrong derived URL | Existing closed6/origin/repository equality rejection |
| NQ-J10 | Correct authored manifest but declared serviceId/version/manifestSHA differs independently | Actual declaration correspondence denies; declaration never rewritten |
Original optimized source and physical-owner regressions
All cases below remain UNRUN and require a separately admitted original source/build/flags/Unicode reference and genuine native owner, not a supplied profile row. Independent expected traces use the original reference after new execution admission; this proposal has evaluated no pattern.
| ID | Original scenario | Required independent observation |
|---|---|---|
| NQ-R01 | Repeated nontrivial visits with equal trace fields reach the original tenth visit; assertions and single unguarded choices appear on continuation paths | Original visit counters/flush/undo targets preserved; equal fields do not suppress visits and no universal ten-root bound is assumed |
| NQ-R02 | Original greedy text loop near the101-node constructor boundary and ordinary loop counterpart; full stack with the overflow-observation push | Original compressed CP/unwind trace, original int32 counter and append-before-overflow failure order, with real charged full64MiB backing and overflow slot |
| NQ-R03 | Postfold/postnegation class range counts around32, including partial/full surrogate leads and lone guards | Original alternative order/preload/current-character/undo behavior, no dropped branches or narrower language; physical original class operand/cache/runtime owner charges observed |
| NQ-R04 | Original class masks retaining high uint32 bits are merged with atom/other-class details; backward text follows a quick-check path | Original perfect-check decision and no fabricated forward check; no premature16bit mask narrowing |
| NQ-R05 | Same V8version with distinct genuine ICU source/build closures; original full/simple closure consumers and legacy generated sets | Each actual original result/rejection belongs to its held source closure; version equality and fabricated generated-set hashes provide no authority |
| NQ-R06 | Default staged-disabled grammar and independently source-approved enabled grammar associations; forged decoded flag row | Actual original scoped-modifier/duplicate-name acceptance and rejection retained; decoded flags cannot supply the association |
| NQ-R07 | Original raw10MiB read/EOF path later exceeds owner ZIP262144; separately a raw-valid authored expansion26214400 reaches config pattern checks before aggregate65536 check | Exact source rejection order; no matcher in the oversized raw branch, no early config aggregate rejection in the expansion branch, original end/stack failures retained |
| NQ-R08 | Native expanded entry borrowers remain across emission/readback, then genuine byte comparison and physical retirement/transfer precede Windows67195929 signer backing | Real borrower end and retained capsule/root/immutable observations under the same owner; no GC/null/function-return credit and no duplicate64MiB inventory during sign |
| NQ-R09 | Existing23 native snapshot batching followed by later ordinary commands, with actual final response/EOF and failed native read | One genuine header sequence/work/clock relation across phases, actual ended response windows, retained failed IO; no supplied sequence or fabricated receipt |
| NQ-R10 independently compares a genuine owner u atom pattern and an ignore-case/low-alphabet Irregexp counterpart on one-byte and two-byte subjects, including original search strategy changes and match indices. It observes the atom3032-byte raw tables and actual controls without allocating a spurious64MiB matcher stack. A separate unflagged4096-byte manifest constructor case validates original syntax/metadata failure order without eagerly lowering a match program. NQ-R11 retains genuine cold/warm original reference cache and optimization-counter observations at the real compile point; supplied decoded cache/counter/locale rows cannot replace original source/runtime association. Both remain UNRUN. |
Complete general manifest validation and integration
For each frozen validateServiceManifest helper, retain a valid full baseline counterpart and construct an independently schema-invalid baseline (outer catalog and policy hashes recomputed only as adversarial data, never source approval). Exercise healthcheck alternatives and IDs; env maps; outputvarregex compile; safe log paths and unique IDs; stdin; all hook phases; monitoring/restart/doctor; setup steps/outputs/creates/fingerprint/rerun/provider dependencies; files root IDs/path/mode; isolation exact keys/limits; endpoint kinds/forbidden env blocks/ports; actions modes/command requirement/payload recursive shape/schedules/cron/workflow steps; broker imports/aliases/buckets/exports/generated-secret uniqueness/access grants/writeback/collision; artifact archive/platform/checksum XOR; updates active artifact/install window/running-service dependencies; top schedules prohibition; root execservice declared dependency. Also exercise properties that the actual general validator ignores: native repetition must not invent global closed-object rejection.
NQ-I01 emits chunks from the returned retained inventory, seals an actual native capsule, verifies every accepted entry with authoredBytes=false, then changes one allowed authored raw byte after qualification without changing baseline authority. Readback/association must deny; old authoring permission cannot qualify new bytes. NQ-I02 rotates/transfers catalog/source/native object between qualification/emission/seal and verifies retained original association failure. NQ-I03 fails every allocation/read/parser/inflate/emission/flush/native-close boundary and independently observes retained failure carrier/control/charge; no response receipt invents closure. NQ-I04 verifies real later/restarted engine original stage lookup/parse/binding/capsule association plus original native receipt/Audit/recovery effects. These are required future real integration cases, not proof supplied by this proposal.
NQ-R12 (prospective UNRUN): original u matching source with consecutive word-boundary assertions separated by nested unchanged-flag noncapturing groups, including a suffix that makes original next-word information UNKNOWN. Bind the original AST grouping, AssertionSequenceRewriter input boundaries, transparent RegExpGroup::ToNode conversion, both BacktrackIfPrevious successor-emission branches, original downstream visit counters and generic/flush target chronology. Compare actual original compile failure/interrupt/control order and all retained owner lifetimes; do not assume direct adjacent-assertion deduplication applies across grouping, collapse visits by equal trace fields or pre-reject under a new program quota. No example pattern was parsed, compiled or matched here. NQ-R13 (prospective UNRUN): bind genuine configuration raw bytes with leading and noninitial UTF8 BOMs, invalid UTF8 at the final byte, a name that the original forbidden-name regex would reject, and raw size above the eventual configuration aggregate quota. Preserve complete fatal decoding before either regex, original role-specific ignoreBOM setting, raw byte-count versus UTF16 subject offsets, actual original string representation and later aggregate-quota order. Strict JSON uses its distinct ignoreBOM:true source call. No fixture bytes were decoded and no patterns executed here.
NQ-R14 (prospective UNRUN): bind the actual original same-image Core runtime lease before linked binding/environment loading and retain its genuine owning-thread counter/cache observations. Compare a cache hit, constructor miss followed by first-width compilation, later opposite-width compilation, and original eviction/recompilation history. Bind original post-peephole heap ByteArray size/rounding and code-generated counter increments in the actual selected original V8 backend and its genuine same-owner object/cache history. Include existing nonzero committed-executable memory, realm loss/physical borrower end, attempted companion/async-worker pointer substitution and supplied decoded-counter data. Preserve original TooMuchRegExpCode conjunction and constructor/match failure order; no jitless-zero assumption, fake heap code, reset counter, callback receipt or approval. No runtime object, regex compiler or fixture was executed here.
NQ-R15 (prospective UNRUN): bind the native-owned fixed original ctor/test closure and its genuine same-Core primitive strings/source/context/intrinsic identities. Compare actual new RegExp(...).test(...) fast/slow paths, syntax-only constructor and original exception/capture/result/heap allocations; an Exec API plus boolean conversion must not be substituted. Include source/context drift and a caller-supplied function or code-string substitution, while retaining original fatal UTF8/JSON width/internalization and first-reached constructor order. Observe actual closure/string/cache/body borrower end and retained failure history; no V8 handle dropping or GC reachability is credited as physical FREE. No closure, constructor, matcher, codec or native fixture was executed here.
NQ-R16 (prospective UNRUN): bind an original compressed stage whose first configuration would reject on a reached forbidden pattern, but a later central record has independently varied malformed local/name/mode/duplicate/CRC/inflate-consumption/expanded-length/region-gap or final central-cursor failure. Complete original ZIP validation must produce its original archive failure before any policy constructor/test. Pair with a complete-valid original stage, then inject loss/read/inflate/allocation/EOF/identity/member-boundary/cancellation failure at each replay after validation; first-pass CRC/SHA must not grant later use or manufacture a receipt. Observe all actual extra replay attempts/hash/reread windows, original end and failed IO/O2/archive borrowers. No ZIP, inflater, matcher or native fixture was executed here.
NQ-R17 (prospective UNRUN): use an independently admitted actual Core context to observe a successful forbidden configuration match that ends validation, retaining its original lastSubject/lastInput and match-info capacity. A later original work invocation on that same actual retained context reaches a false match on another decoded body; observe current and retained prior original String/heap/capture/cache/stack ownership and physical overlap. Compare genuine context-generation termination under the source owner, with no fabricated match-info reset or GC credit. Within a single call the successful forbidden match must end authoring immediately; it cannot be used to invent a continued second configuration success. Bind actual original atom and Irregexp/runtime capture-growth paths and false-test retention. No context, body decoding, constructor, matcher or fixture was executed here.
NQ-R18 (prospective UNRUN): independently source-approve the exact private segmented interpreter patch/build and test original integer push/pop/peek/sp/set_sp across each65536-byte segment and existing64MiB maximum. Observe every actual directory/generation/control/rounded backing, retained allocated segments after reduced sp, and genuine invocation-end/native/O2 retirement. Maximum-plus-one follows original CallOrigin-specific overflow continuation while preserving the explicitly changed allocation/over-limit-element chronology; required segment acquisition failure retains actual FatalOOM disposition instead of recoverable Denied. Pair with retained original96/192MiB SmallVector growth source counterevidence and complete concurrent original String/cache/capture/body/history owners. No private patch, pattern, compiler, native allocation or test was executed here.
NQ-R19 (prospective UNRUN): bind exact original Node-carried zlib source/build and compare raw-inflate zero output, one slice, multiple16384-byte chunks, exact full-chunk spare, final concat, declared max output overflow, trailing compressed bytes and truncated Z_FINISH with actual avail_out. Independently inject real original state/window zalloc null, output chunk allocation failure, final concat failure and native close/readback loss, preserving Z_MEM_ERROR/Nodegenericerror/ZIParchive_unsafe versus actual fatal allocation distinctions and live partial owners. Compare selected replay bank allocation chronology and repeated source identity/fullSHA/EOF/cancellation work before/after validation. No system zlib, version row, CRC or supplied status grants original source/native equivalence. No inflate stream, parser, allocation or fixture was executed here.