SDK: restrict Object::set to an output nothing has pinned yet - #224
Open
robknight wants to merge 1 commit into
Open
SDK: restrict Object::set to an output nothing has pinned yet#224robknight wants to merge 1 commit into
robknight wants to merge 1 commit into
Conversation
`set` writes its literal initializer into the object's dict without advancing the object's ts, which is what makes it cheap: the initial state of a new object is one dict value asserted by DictContains, not a chain of transitions costing a wildcard per key. The cost is that a `set` is invisible to the ts machinery, so it can retroactively falsify what an earlier operation recorded, and the action then fails while proving with nothing pointing at the `set`. Reject the positions where it cannot hold: on an input or a mutate, where it would write into a pre-state the transaction proves against a state root, and on an output whose contents an update, a statement, an intro pod or `pow_obj_grind` already committed to. `pow_obj_grind` is the one operation that reads a dict while recording no Inst, so it now marks the var it read. Repeated sets stay allowed. A set only asserts containment, which survives later inserts, so several in a row are consistent -- `test_cross_read_into_set` covers that. This drops the README's "forbid multiple Object::set" item, which asked for something that would break working scripts.
robknight
force-pushed
the
sdk-set-guard
branch
from
August 21, 2026 09:09
9a3be5d to
ab15be5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SDK: only allow Object::set on an output nothing has used yet
setadds entries to an object's dict without advancing the object's ts. That is what makes it cheap: a new object's initial state is a single dict value, checked withDictContains, instead of a chain of transitions costing a wildcard per key.The catch is that the
tsmachinery cannot see the change. If an earlier operation already recorded the dict's exact contents, a latersetmakes that record wrong, and the action fails during proving with nothing to point at theset.So reject the two cases where a
setcannot work:pow_obj_grind. That last one reads a dict without recording anInst, so it now marks the var it read.Stack created with GitHub Stacks CLI • Give Feedback 💬