Proof Portal

Projects

jsonparser

ProbeLabs36 findings · 123 requirements
SYS-REQ-009SystemApproved

When Set is called with a provided path, the parser shall either replace the existing addressed value, create a type-consistent missing path and return the updated JSON document, or return KeyPathNotFoundError when the requested mutation path is not usable for the provided input.

PriorityshallTypeguaranteeCategoryfunctionalComponentparserAssuranceEFindingsnone open

Specification

The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.

Description

When Set is called with a provided path, the parser shall either replace the existing addressed value, create a type-consistent missing path and return the updated JSON document, or return KeyPathNotFoundError when the requested mutation path is not usable for the provided input. 'Type-consistent' means each path segment's kind matches its resolved parent container: object-key segments under object parents, array-index [N] segments under array parents. A path component whose kind mismatches its parent (e.g. [N] under an object, or an object-key under an array at a depth where the parent must be inferred) is 'not usable for the provided input' and shall surface KeyPathNotFoundError. (Cross-type mismatch currently produces malformed JSON output instead — tracked as DEFECT-260726-MFPA / KI-3.) SetString is the auto-quoting Set variant: SetString(data, val, keys...) is equivalent to Set(data, Escape(val), keys...) where Escape RFC-8259-encodes val as a JSON string literal including surrounding quotes, so callers can pass a Go string directly without manually quoting it.

FRETish formula
the parser shall always satisfy !set_path_is_provided | set_target_exists | set_creates_missing_path | set_returns_updated_document | set_returns_not_found_error

Rationale & tags

Why this requirement exists, and how it is categorised.

Set is the documented experimental mutation helper and must preserve defined behavior for addressed path updates and invalid mutation inputs.

Verification & provenance

How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).

Assurance levelE
Formalizationvalid
Realizabilityrealizable
Vacuitychecked_ok
Strategyfretish

Review

Status
approved
Reviewer
human:buger · lead_engineer
Reviewed
Jul 27, 2026, 06:53 UTC
Re-approved after scalar-array data-loss fix (DEFECT-260727-WWWY): parser.go:Set append-guard corrected from data[subObjOff]=='{' to != ']' so SYS-REQ-009's boundary obligation covers all array element types, not just object-first-element arrays.

History

Created
Apr 13, 2026, 17:15 UTC · human:cli
Modified
Jul 27, 2026, 06:53 UTC · human:buger

Obligations

What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.

4 obligations · 2 discharged · 2 not yet witnessed

Browse the catalogue
Not yet witnessed

Behavior at limits, thresholds, and edge-of-range values.

Worst case if violatedHigh

Set on an array-index path component [N] where N >= len(array) silently overwrites element 0 or another existing element the caller did not address, destroying data and returning a mutated document with no error (PR #286 regression class).

Discharging evidence0/0 required witnessed
    Discharged

    Applying the operation twice produces the same result as applying once.

    Worst case if violatedMedium

    Set on the same (input, path, value) tuple yields a different document on a second call (e.g. idempotency regression where repeated Set inserts the path twice), corrupting cache or diff layers.

    Discharging evidence1/1 required witnessed
    • nominalrequiredpresent
      Covered by 1 test
    Discharged

    Behavior when inputs are syntactically or structurally invalid.

    Worst case if violatedHigh

    Set with an array-index path component [N] whose parent in the addressed JSON is an OBJECT (or vice-versa) emits malformed JSON output and returns it with nil error (DEFECT-260726-MFPA / KI-3); the caller has no signal that the returned bytes are unparseable.

    Discharging evidence2/2 required witnessed
    • negativerequiredpresent
      Covered by 1 test
    • nominalrequiredpresent
      Covered by 1 test
    Not yet witnessed
    Worst case if violatedMedium

    Set on a multi-segment path drives createInsertComponent to emit array scaffolding at the wrong depth or offset; a regression overwrites a sibling element or builds malformed JSON, silently corrupting the nested structure (SYS-REQ-110 hazard class).

    Discharging evidence0/0 required witnessed

      Formula evidence

      The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).

      FRETish formula

      the parser shall always satisfy !set_path_is_provided | set_target_exists | set_creates_missing_path | set_returns_updated_document | set_returns_not_found_error

      Variables

      NameTypeDirectionDescription
      set_path_is_providedTrue when Set is called with at least one mutation path segment.
      set_target_existsTrue when the full addressed Set path already exists in the input JSON.
      set_creates_missing_pathTrue when Set creates the missing addressed path inside a valid target container.
      set_returns_updated_documentTrue when Set returns the updated JSON document for the addressed mutation case.
      set_returns_not_found_errorTrue when Set returns `KeyPathNotFoundError` because the requested mutation path is not usable for the provided input.

      Witnesses· 6 scenarios total

      • TestSetEmptyKeyPathComponent
        empty_key_path_test.go:175
      • FuzzSetNative
        fuzz_native_test.go:136
      • TestCodeMCDC_CreateInsertComponentEmptyKey
        mcdc_code_supplement_test.go:128
      • TestCodeMCDC_CalcAllocateSpaceEmptyKey
        mcdc_code_supplement_test.go:139
      • TestCodeMCDC_LastTokenNewline
        mcdc_code_supplement_test.go:60
      • TestCodeMCDC_LastTokenCarriageReturn
        mcdc_code_supplement_test.go:69
      • TestCodeMCDC_LastTokenTab
        mcdc_code_supplement_test.go:76
      • TestCodeMCDC_LastTokenSpace
        mcdc_code_supplement_test.go:83
      • TestMCDC_SYS_REQ_009_Row1_TriggerFalse
        mcdc_spec_witnesses_test.go:227exercises 1 condition scenario
      • TestSetSupplementalArrayInsertionCoverage
        mcdc_supplement_test.go:337
      • TestObligation_SYS_REQ_009
        obligation_evidence_test.go:159
      • TestPropertySetRoundTrip
        property_test.go:523
      • TestPropertySameTreeEquivalence
        property_test.go:797
      • TestPropertyBufferOpsPure
        property_test.go:841
      • TestOracleSetRoundTrip
        reference_oracle_test.go:508
      • TestOracleSetPr286Regression
        reference_oracle_test.go:609
      • TestSetAutoCoerce_KI3
        set_spec_test.go:109
      • TestSetCreatesMissingEntryInExistingArray
        set_spec_test.go:36exercises 1 condition scenario
      • TestFuzzSetHarnessCoverage
        set_spec_test.go:54
      • TestSetArrayIndexUnderObjectMalformedJSON_KI3
        set_spec_test.go:65
      • TestSet
        set_spec_test.go:9exercises 4 condition scenarios
      • TestSetDoesNotMutateInputBackingArrayWhenGrowing
        v131_regression_test.go:29

      Its place

      This requirement shown inside its trace neighbourhood — the parents it satisfies, the code and tests attached to it, and its findings.

      Loading graph…

      Trace evidence

      The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.

      Impact

      Blast radius — if you change this requirement, what else may need re-checking, and what it in turn depends on.

      If you change this

      Requirements
      0
      Files
      5
      Tests
      13
      At-risk contracts
      0

      Files to re-check (5)

      • append.goappend.go
      • escape.goescape.go
      • fuzz.gofuzz.go
      • parser.goparser.go
      • path_compiler.gopath_compiler.go

      Tests to re-run (13)

      • empty_key_path_test.goempty_key_path_test.go
      • escape_test.goescape_test.go
      • fuzz_native_test.gofuzz_native_test.go
      • issues_56_107_229_test.goissues_56_107_229_test.go
      • mcdc_code_supplement_test.gomcdc_code_supplement_test.go
      • mcdc_spec_witnesses_test.gomcdc_spec_witnesses_test.go
      • mcdc_supplement_test.gomcdc_supplement_test.go
      • obligation_evidence_test.goobligation_evidence_test.go
      • path_compiler_test.gopath_compiler_test.go
      • property_test.goproperty_test.go
      • reference_oracle_test.goreference_oracle_test.go
      • set_spec_test.goset_spec_test.go
      • v131_regression_test.gov131_regression_test.go

      What this rests on

      Discussions

      Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

      Sign in to discuss this with the proof team.Sign in