fix(policy): confine compiled scope construction to validated registry

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinysecurity-policy/src/path_registry.rs

@@ -48,7 +48,11 @@ impl PathPolicyRegistry {
         {
             return Err(Error::InvalidArguments);
         }
-        if let Some((id, _)) = self.scopes.iter().find(|(_, scope)| scope.0 == policy) {
+        if let Some((id, _)) = self
+            .scopes
+            .iter()
+            .find(|(_, scope)| scope.policy() == &policy)
+        {
             return Ok(id.clone());
         }
         if self.scopes.len() >= 1024 {
@@ -71,7 +75,8 @@ impl PathPolicyRegistry {
             if self.scopes.iter().any(|(existing, _)| *existing == id) {
                 continue;
             }
-            self.scopes.push((id.clone(), Arc::new(PathScope(policy))));
+            self.scopes
+                .push((id.clone(), Arc::new(PathScope::registered(policy))));
             return Ok(id);
         }
         Err(Error::Unavailable)

crates/tinysecurity-policy/src/path_scope.rs

@@ -125,16 +125,29 @@ fn candidate(path: &Path) -> Option<PathBuf> {
         .ok()
         .filter(|resolved| !protected_path(resolved))
 }
-/// Compiled immutable filesystem scope.
+/// Compiled immutable filesystem scope issued by [`crate::PathPolicyRegistry`].
+/// Direct external construction is intentionally unavailable:
+/// ```compile_fail
+/// use tinysecurity_policy::{PathScope, PathPolicy};
+/// fn bypass_registration(policy: PathPolicy) -> PathScope { PathScope(policy) }
+/// ```
 #[derive(Clone, Debug)]
-pub struct PathScope(pub PathPolicy);
+pub struct PathScope(PathPolicy);
 impl std::ops::Deref for PathScope {
     type Target = PathPolicy;
     fn deref(&self) -> &Self::Target {
         &self.0
     }
 }
 impl PathScope {
+    /// Construct only after the registry has admitted every configured root.
+    pub(crate) fn registered(policy: PathPolicy) -> Self {
+        Self(policy)
+    }
+    pub(crate) fn policy(&self) -> &PathPolicy {
+        &self.0
+    }
+
     /// Whether the path is under a host state reservation, including aliased/missing descendants.
     #[must_use]
     pub fn internal(&self, path: &Path) -> bool {
@@ -347,3 +360,7 @@ impl PathScope {
 #[cfg(test)]
 #[path = "path_scope_tests.rs"]
 mod tests;
+
+#[cfg(test)]
+#[path = "path_scope_contract_tests.rs"]
+mod contract_tests;

crates/tinysecurity-policy/src/path_scope_contract_tests.rs

@@ -0,0 +1,86 @@
+use super::*;
+fn scope(root: &Path) -> Result<std::sync::Arc<PathScope>, tinysecurity_bus::Error> {
+    let mut registry = crate::PathPolicyRegistry::default();
+    let policy = PathPolicy {
+        enabled: false,
+        workspace_only: false,
+        workspace_dir: root.into(),
+        action_dir: root.into(),
+        home_dir: None,
+        forbidden_paths: vec![],
+        trusted_roots: vec![],
+        reserved_paths: vec![],
+        reserved_prefixes: vec![],
+        readonly_paths: vec![],
+        reserved_names: vec![],
+    };
+    let id = registry.register(policy)?;
+    registry.get_owned(&id)
+}
+/// Native critical-system targets fail before any filesystem read or write.
+#[test]
+fn platform_native_protected_target_is_denied_before_resolution()
+-> Result<(), Box<dyn std::error::Error>> {
+    let root = tempfile::tempdir()?;
+    #[cfg(windows)]
+    let native = PathBuf::from(
+        std::env::var_os("SystemRoot")
+            .ok_or_else(|| std::io::Error::other("Windows SystemRoot is absent"))?,
+    )
+    .join("System32");
+    #[cfg(not(windows))]
+    let native = PathBuf::from("/etc");
+    assert!(native.is_absolute());
+    assert!(protected_path(&native));
+    let scope = scope(root.path())?;
+    for write in [false, true] {
+        assert_eq!(
+            scope.validate(&native.to_string_lossy(), write),
+            PathValidationResult::Denied {
+                category: Rejection::Protected
+            }
+        );
+    }
+    Ok(())
+}
+/// Windows-looking namespace prefixes do not change native POSIX path meaning.
+#[cfg(unix)]
+#[test]
+fn posix_question_mark_directory_is_not_a_windows_root_or_action_relative_path() {
+    use std::path::Component;
+    let path = Path::new("//?/etc/passwd");
+    assert!(path.is_absolute());
+    let components: Vec<_> = path.components().collect();
+    assert_eq!(
+        components,
+        vec![
+            Component::RootDir,
+            Component::Normal("?".as_ref()),
+            Component::Normal("etc".as_ref()),
+            Component::Normal("passwd".as_ref())
+        ]
+    );
+    // The normalized spelling is used for floor classification only. It is
+    // never used to construct the filesystem target passed to canonicalize.
+    assert!(!protected_path(path));
+    let root = Path::new("/acting-root");
+    let policy = PathPolicy {
+        enabled: false,
+        workspace_only: false,
+        workspace_dir: root.into(),
+        action_dir: root.into(),
+        home_dir: None,
+        forbidden_paths: vec![],
+        trusted_roots: vec![],
+        reserved_paths: vec![],
+        reserved_prefixes: vec![],
+        readonly_paths: vec![],
+        reserved_names: vec![],
+    };
+    let scope = PathScope::registered(policy);
+    assert_eq!(
+        scope.absolute("//?/etc/passwd"),
+        PathBuf::from("//?/etc/passwd")
+    );
+    assert!(protected_path(Path::new("/etc/passwd")));
+}

docs/specs/immutable-path-scopes.md

@@ -62,6 +62,13 @@ atomic: a host still needs an execution sandbox to bound filesystem races.
 Acceptance coverage includes missing targets, aliased reserved state, disabled
 policy floors, home expansion, relative forbidden roots, independent registry
 identities, registry exhaustion, read-only grants and existing/broken symlinks.
+The compiled scope constructor is private; production handles are issued only
+after registry validation. A compile-fail API test pins that boundary. The
+Windows alias normalization is a floor classifier, never a filesystem path
+rewrite: on POSIX, `//?/etc/passwd` names the `?` directory beneath `/`, not
+`/etc/passwd`, and is never rebased beneath the action directory. Validation
+checks the original native path and repeats the floor on its resolved target.
+Native critical-system fixtures supplement cross-platform Windows-spelling tests.
 The real native loader verifier calls every new member and verifies that a scope
 survives an accepted SDK reinitialization. This completes filesystem capability
 migration support; command policy, redaction, approvals, egress, audit and crypto