trusted: true (ADR-365)Open and answer this issue on GitHub.
compiler, ready · opened 2026-10-18 · updated 2026-10-18 · 0 comments
The owner asked what happens to an assert on input data (stdin, sockets, files). Tried with the binary of 2026-10-17:
let n = text::parse_i64(io::read_to_string().trim()) ?? 0 then assert(n > 0) builds; with input 0 the program stops with exit 101 (assertion failed, n is 0).process::run’s output (and a socket) is refused: NK1202 a claim about data from outside the program, with a guard as help (test data_from_outside_is_checked_by_a_guard_and_not_asserted in prove.rs).provenance in std.contracts: io::read, io::lines, io::read_to_string, fs::read, fs::read_to_string, fs::map, fs::walk, cli::args are trusted (ADR-010 D2: the operator chose the bytes); only process::run and net::Connection::read are untrusted.fs::map(path; trusted: false), is not built: NK1109, has no option called trusted.The owner wants NK1202 for stdin and for files nobody vouches for.
ADR-365: standard input and every file read while the program runs are untrusted; a source marked trusted: true is trusted; the project’s own assets (asset("…"), read while building) are trusted without a marker. ADR-010 D2/D3 changed (Changed by notes), Part III 14.2 and 17.1. Rejected: keep both trusted with trusted: false (fails open), stdin untrusted and files trusted (a path does not say who wrote the file). Not decided: cli::args and the environment (trusted as before; main’s parameters are checked by ADR-360).
Consequence the owner accepted: maps keyed by file data get the keyed hash unless the read says trusted: true; benches/brc writes the marker where needed.
trusted: option on every source in std.contracts (io::read, io::read_to_string, io::lines, the fs reads, fs::map, fs::walk, fs::read_dir; and trusted: false/true on the untrusted ones as ADR-010 D3 has it), recorded in the ledger with its place. Test: fs::read_to_string(p, fs::Root::Anywhere; trusted: true) builds; an unknown value is refused.provenance = "untrusted" for those entries. Tests: assert on stdin data is NK1202 with the guard help; after throw … if !(…) it is proved; with trusted: true it is a runtime check again.trusted: true; --trust prints the marker’s place (Part III 17.1’s example). Test with --trust output.benches/brc (and any bench that reads its own fixture) gets trusted: true; rerun benches/brc/brc.sh and confirm the instruction count is unchanged; examples/ and tools/*.nika that now meet NK1202 or a keyed hash get the marker where they read their own data (the toolchain reads source files the user wrote: trusted is right there).test reads are trusted (they read what the package holds) and note it here if it needs the owner.Related: #579 (the question came from the converter round), ADR-010, ADR-269 D6.