Disallow self-referencing nodes except bootstrap #12

New Issue

2026-05-18T14:50:23Z

xiaoju commented

2026-05-18 14:50:23 +00:00

Summary

store.put(null, payload) creates a self-referencing node (type === hash). This should only be allowed for the meta-schema bootstrap.

Problem

Any caller can accidentally create untyped self-referencing nodes by passing null as typeHash. This defeats the purpose of CAS type safety.

Proposal

Remove null from the typeHash parameter of put(). Make bootstrap() the only way to create the self-referencing meta-schema node (it can use an internal/private code path).

// Before
put(typeHash: Hash | null, payload: unknown): Promise<Hash>;

// After
put(typeHash: Hash, payload: unknown): Promise<Hash>;

## Summary `store.put(null, payload)` creates a self-referencing node (`type === hash`). This should only be allowed for the meta-schema bootstrap. ## Problem Any caller can accidentally create untyped self-referencing nodes by passing `null` as typeHash. This defeats the purpose of CAS type safety. ## Proposal Remove `null` from the `typeHash` parameter of `put()`. Make `bootstrap()` the only way to create the self-referencing meta-schema node (it can use an internal/private code path). ```typescript // Before put(typeHash: Hash | null, payload: unknown): Promise<Hash>; // After put(typeHash: Hash, payload: unknown): Promise<Hash>; ```

xiaoju referenced this issue from uncaged/workflow

2026-05-18 14:50:34 +00:00

uwf-agent-kit: detail storage uses null type (self-referencing node) #336

xiaoju referenced a pull request that will close this issue

2026-05-18 14:55:23 +00:00

feat: disallow self-referencing nodes except via bootstrap() #13

xiaomo closed this issue

2026-05-18 14:59:18 +00:00

xiaoju commented

2026-05-18 16:20:43 +00:00