{"row":{"n":"0012","slug":"nep-0012-receipt-untrusted-input","file":"nep-0012-receipt-untrusted-input.md","headline":"The receipt is untrusted input","title":"The verifier is a fortress — decode bounds are spec constants, terminal output is escaped, malicious artifacts are recognized rather than repaired, and two independent decoders must agree","status":"Draft","type":"Standards Track","created":"2026-07-24","author":"Thibaut Melen (SuperNovae Studio)","lede":"The trace, the receipt and the seal exist to be VERIFIED — which means\nthe verifier is the one component guaranteed to parse attacker-supplied\nbytes.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Deferred (P2)","anchor":"deferred-p2"},{"title":"Copyright","anchor":"copyright"}],"words":849,"sha256":"ffd9b327a7f41cc72a74c9052062804ae01c2f1656329f94b11627b7ec8637ac"},"prev":{"n":"0011","slug":"nep-0011-run-lifecycle-attestation","file":"nep-0011-run-lifecycle-attestation.md","headline":"The run has an attested beginning and an attested end","title":"The run's lifecycle is attested — a boot manifest binds the run to its judgment, the teardown seal binds the outcome to its evidence, and an unterminated journal is the VERIFIER's finding, never the dying process's silence","status":"Draft","type":"Standards Track","created":"2026-07-24","author":"Thibaut Melen (SuperNovae Studio)","lede":"A trace can prove single frames, but the RUN as a whole has no attested\nlifecycle: nothing binds what nika check judged to what actually\nboots, the seal covers the journal but not the receipt it summarizes,\nand a run killed mid-flight simply stops — a silence a reader can\nmistake for success.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Deferred (P2)","anchor":"deferred-p2"},{"title":"Copyright","anchor":"copyright"}],"words":1438,"sha256":"0d0666b83e08d3b1164d782a531aa067ed7ea07928dfc8326fe11c61ffcbc186"},"next":{"n":"0013","slug":"nep-0013-approval-ticket","file":"nep-0013-approval-ticket.md","headline":"Human approval is a bounded, content-bound, attested ticket","title":"Human approval is a bounded, content-bound, attested ticket — the shown is the signed, scoped, TTL'd, rate-limited, and chained into the journal","status":"Draft","type":"Standards Track","created":"2026-07-24","author":"Thibaut Melen (SuperNovae Studio)","lede":"The human gate is the last unbounded authority surface in the engine:\nan approval is a bare answer to a prompt — nothing binds what was shown\nto what was signed, nothing bounds a burst, and nothing attests the\ndecision in the journal.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Deferred","anchor":"deferred"},{"title":"Copyright","anchor":"copyright"}],"words":930,"sha256":"b0e0aebdc9c2bd94d593e50ff6533e81d04140ee85ac22627cc7f2375f3260b4"},"total":18}

[{"k":"h","depth":1,"text":"NEP-0012 · The receipt is untrusted input","id":"nep-0012--the-receipt-is-untrusted-input"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"NEP"},{"k":"text","text":": 0012 (next free integer · 0011 the attested run lifecycle)"}],[{"k":"strong","text":"Title"},{"k":"text","text":": The verifier is a fortress — decode bounds are spec constants, terminal output is escaped, malicious artifacts are recognized rather than repaired, and two independent decoders must agree"}],[{"k":"strong","text":"Author"},{"k":"text","text":": Thibaut Melen (SuperNovae Studio)"}],[{"k":"strong","text":"Status"},{"k":"text","text":": Draft"}],[{"k":"strong","text":"Type"},{"k":"text","text":": Standards Track"}],[{"k":"strong","text":"Created"},{"k":"text","text":": 2026-07-24"}]]},{"k":"h","depth":2,"text":"Abstract","id":"abstract"},{"k":"p","inline":[{"k":"text","text":"The trace, the receipt and the seal exist to be VERIFIED — which means\nthe verifier is the one component guaranteed to parse attacker-supplied\nbytes. This NEP hardens the reading side with four laws: (a) decode\nbounds are NORMATIVE SPEC CONSTANTS (input size · line length · nesting\ndepth · proof-node count · identifier length), refused with a typed\nfinding, never silently truncated; (b) every artifact-derived field\nprinted to a terminal is escaped (C0/C1/DEL/OSC) — the TTY surface\nonly, the machine JSON stays byte-exact; (c) malicious artifacts are\nRECOGNIZED against a golden corpus, never sanitized into acceptability\n(the langsec law); (d) the reference decoder and the engine decoder\nrender the SAME verdict on the same artifact (the differential twin),\nand the decode surface carries its own fuzz target."}]},{"k":"h","depth":2,"text":"Motivation","id":"motivation"},{"k":"p","inline":[{"k":"text","text":"The 2026 H1 parser CVEs are the anchor set: unbounded recursion at\ndecode (CVE-2026-26209 — the direct ancestor of the depth bound),\nbounds carried by assertions compiled out in release (CVE-2026-29013 —\nbounds must be code), deserializers that instantiate\n(CVE-2026-31072). LangSec's shotgun-parser diagnosis remains the\nframe: a verifier that partially repairs hostile input becomes the\nvulnerability. Nika's three anchor surfaces (tier ladder · Rekor\nsidecar · RFC 3161 token) already parse fail-closed — this NEP\ngeneralizes that discipline into constants and laws so the NEXT reader\n(and the second implementation) inherits it, instead of re-deriving it."}]},{"k":"h","depth":2,"text":"Specification","id":"specification"},{"k":"p","inline":[{"k":"text","text":"The law (MUST):"}]},{"k":"list","ordered":true,"items":[[{"k":"strong","text":"Bounds are constants."},{"k":"text","text":" The verifier refuses, with a typed\nfinding, any artifact exceeding the spec's decode bounds — input\nsize, journal line length, JSON nesting depth, proof-node count,\nidentifier length. The bounds are named here, normatively (input\n1 MiB · journal line 1 MiB · journal total 256 MiB · JSON nesting\ndepth 32 · proof-node count 64 · identifier 256 bytes), and the\nreference engine carries exactly these values as public, semver-\npinned constants ("},{"k":"code","text":"nika-dap"},{"k":"text","text":" · one source, no duplication); refusal\nis total —\nno partial decode, no truncation-and-continue. Bounds are enforced\nby code on every build profile, never by debug assertions."}],[{"k":"strong","text":"Terminal hygiene."},{"k":"text","text":" Every artifact-derived string rendered to a\nTTY is escaped: C0 controls, C1, DEL, and OSC/CSI sequences cannot\nreach the terminal raw. The machine surfaces ("},{"k":"code","text":"--json"},{"k":"text","text":", non-TTY\nstdout) stay byte-exact — pipelines read the truth, humans read the\nescaped rendering."}],[{"k":"strong","text":"Recognize, don't sanitize."},{"k":"text","text":" A malicious artifact is classified\nand refused; the verifier never repairs input into acceptability.\nThe golden corpus ("},{"k":"code","text":"receipts/malicious/"},{"k":"text","text":" · the lane's classes:\ndeep · truncated · trailing · proof-flood · id-overflow ·\nduplicate-keys · escape-bearing · plus the golden) lives WITH the\nengine's tests and is born with this law\n(ratchet NEP-0000). A crash, hang or overflow on the corpus is a P0\nengine bug by definition."}],[{"k":"strong","text":"The differential twin."},{"k":"text","text":" The reference decoder ("},{"k":"code","text":"proof_core"},{"k":"text","text":" ·\nPython) and the engine decoder MUST render the same verdict over\nthe corpus — the mirror discipline "},{"k":"code","text":"nika.lock"},{"k":"text","text":" already lives by. A\ndivergence is a spec bug until proven otherwise."}],[{"k":"strong","text":"The fuzz floor."},{"k":"text","text":" The receipt/journal decode surface carries its\nown fuzz target beside the existing four (parse · CEL · capability\n· permits), exercised in CI on the golden corpus seeds."}]]},{"k":"h","depth":2,"text":"Rationale","id":"rationale"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"Constants over folklore."},{"k":"text","text":" The three disciplined surfaces got\ntheir bounds by craft; constants make the discipline portable to the\nsecond implementation (the weekend-doable rule) and auditable."}],[{"k":"strong","text":"TTY-only escaping."},{"k":"text","text":" Escaping the machine surface would break\nbyte-exact pipelines; the terminal is where escape sequences become\nan attack (title injection · clipboard writes · hidden text)."}],[{"k":"strong","text":"Corpus with the engine."},{"k":"text","text":" The fixture is born with the law and\nruns on every engine change — a conformance-repo corpus would gate\nonly at pin bumps."}]]},{"k":"h","depth":2,"text":"Backwards Compatibility","id":"backwards-compatibility"},{"k":"p","inline":[{"k":"text","text":"Verification-side only: artifacts within bounds verify exactly as\nbefore. Artifacts beyond bounds previously produced undefined behavior\n(unbounded work · raw terminal bytes); they now produce a typed\nrefusal — naming behavior that was never a promise."}]},{"k":"h","depth":2,"text":"Reference Implementation","id":"reference-implementation"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"The engine lane (F-P1): bounds before "},{"k":"code","text":"serde_json::from_str"},{"k":"text","text":" on the\nreceipt read, a line cap on the journal walk, the golden corpus\nunder the forensics crate's tests — and, landed with the lot-1\nreview fixpack: the promoted terminal-escape law at the render\nsites (the OSC52 class, "},{"k":"code","text":"escape_tty"},{"k":"text","text":" born at birth), the 5th fuzz\ntarget in the nightly matrix with its seed corpus, and the\njournal's whole-file bound (256 MiB). The Rust-vs-Python\ndifferential over the corpus (law 4) is the named remainder — the\nclaim lands with its delivery, never before."}]]},{"k":"h","depth":2,"text":"Deferred (P2)","id":"deferred-p2"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Always-escape (non-TTY included) — rejected for v1: it breaks\nbyte-exact pipelines; revisit only with evidence."}],[{"k":"text","text":"Corpus sub-classes beyond the lane's set; sub-cause taxonomy of\nrefusals."}]]},{"k":"h","depth":2,"text":"Copyright","id":"copyright"},{"k":"p","inline":[{"k":"text","text":"This document is placed in the public domain under CC0-1.0, as every NEP."}]}]

NEP-0012

The receipt is untrusted input

Draft · Standards Track · opened 2026-07-24 · 849 words

NEP-0012 · The receipt is untrusted input #

NEP: 0012 (next free integer · 0011 the attested run lifecycle)
Title: The verifier is a fortress — decode bounds are spec constants, terminal output is escaped, malicious artifacts are recognized rather than repaired, and two independent decoders must agree
Author: Thibaut Melen (SuperNovae Studio)
Status: Draft
Type: Standards Track
Created: 2026-07-24

Abstract #

The trace, the receipt and the seal exist to be VERIFIED — which means the verifier is the one component guaranteed to parse attacker-supplied bytes. This NEP hardens the reading side with four laws: (a) decode bounds are NORMATIVE SPEC CONSTANTS (input size · line length · nesting depth · proof-node count · identifier length), refused with a typed finding, never silently truncated; (b) every artifact-derived field printed to a terminal is escaped (C0/C1/DEL/OSC) — the TTY surface only, the machine JSON stays byte-exact; (c) malicious artifacts are RECOGNIZED against a golden corpus, never sanitized into acceptability (the langsec law); (d) the reference decoder and the engine decoder render the SAME verdict on the same artifact (the differential twin), and the decode surface carries its own fuzz target.

Motivation #

The 2026 H1 parser CVEs are the anchor set: unbounded recursion at decode (CVE-2026-26209 — the direct ancestor of the depth bound), bounds carried by assertions compiled out in release (CVE-2026-29013 — bounds must be code), deserializers that instantiate (CVE-2026-31072). LangSec's shotgun-parser diagnosis remains the frame: a verifier that partially repairs hostile input becomes the vulnerability. Nika's three anchor surfaces (tier ladder · Rekor sidecar · RFC 3161 token) already parse fail-closed — this NEP generalizes that discipline into constants and laws so the NEXT reader (and the second implementation) inherits it, instead of re-deriving it.

Specification #

The law (MUST):

Bounds are constants. The verifier refuses, with a typed finding, any artifact exceeding the spec's decode bounds — input size, journal line length, JSON nesting depth, proof-node count, identifier length. The bounds are named here, normatively (input 1 MiB · journal line 1 MiB · journal total 256 MiB · JSON nesting depth 32 · proof-node count 64 · identifier 256 bytes), and the reference engine carries exactly these values as public, semver- pinned constants (nika-dap · one source, no duplication); refusal is total — no partial decode, no truncation-and-continue. Bounds are enforced by code on every build profile, never by debug assertions.
Terminal hygiene. Every artifact-derived string rendered to a TTY is escaped: C0 controls, C1, DEL, and OSC/CSI sequences cannot reach the terminal raw. The machine surfaces (--json, non-TTY stdout) stay byte-exact — pipelines read the truth, humans read the escaped rendering.
Recognize, don't sanitize. A malicious artifact is classified and refused; the verifier never repairs input into acceptability. The golden corpus (receipts/malicious/ · the lane's classes: deep · truncated · trailing · proof-flood · id-overflow · duplicate-keys · escape-bearing · plus the golden) lives WITH the engine's tests and is born with this law (ratchet NEP-0000). A crash, hang or overflow on the corpus is a P0 engine bug by definition.
The differential twin. The reference decoder (proof_core · Python) and the engine decoder MUST render the same verdict over the corpus — the mirror discipline nika.lock already lives by. A divergence is a spec bug until proven otherwise.
The fuzz floor. The receipt/journal decode surface carries its own fuzz target beside the existing four (parse · CEL · capability · permits), exercised in CI on the golden corpus seeds.

Rationale #

Constants over folklore. The three disciplined surfaces got their bounds by craft; constants make the discipline portable to the second implementation (the weekend-doable rule) and auditable.
TTY-only escaping. Escaping the machine surface would break byte-exact pipelines; the terminal is where escape sequences become an attack (title injection · clipboard writes · hidden text).
Corpus with the engine. The fixture is born with the law and runs on every engine change — a conformance-repo corpus would gate only at pin bumps.

Backwards Compatibility #

Verification-side only: artifacts within bounds verify exactly as before. Artifacts beyond bounds previously produced undefined behavior (unbounded work · raw terminal bytes); they now produce a typed refusal — naming behavior that was never a promise.

Reference Implementation #

The engine lane (F-P1): bounds before serde_json::from_str on the receipt read, a line cap on the journal walk, the golden corpus under the forensics crate's tests — and, landed with the lot-1 review fixpack: the promoted terminal-escape law at the render sites (the OSC52 class, escape_tty born at birth), the 5th fuzz target in the nightly matrix with its seed corpus, and the journal's whole-file bound (256 MiB). The Rust-vs-Python differential over the corpus (law 4) is the named remainder — the claim lands with its delivery, never before.

Deferred (P2) #

Always-escape (non-TTY included) — rejected for v1: it breaks byte-exact pipelines; revisit only with evidence.
Corpus sub-classes beyond the lane's set; sub-cause taxonomy of refusals.

Copyright #

This document is placed in the public domain under CC0-1.0, as every NEP.

This proposal in the spec repo The specification it amends