Proof Portal

Projects

jsonparser

ProbeLabs36 findings · 123 requirements
SYS-REQ-110SystemApproved

When Set targets an array-index path component [N] where N >= the current length of the addressed array, the parser shall append the value at the end of the array (index becomes len(array)) and return the mutated document, rather than overwriting existing elements or panicking.

PriorityshallTypeguaranteeCategoryfunctionalComponentparserAssuranceBFindingsnone open

Specification

The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.

Description

When Set targets an array-index path component [N] where N >= the current length of the addressed array, the parser shall append the value at the end of the array (index becomes len(array)) and return the mutated document, rather than overwriting existing elements or panicking. This contract applies regardless of the existing array's element types (scalars, objects, nested arrays, mixed); the previous implementation only honored it when the first element was an object, silently replacing scalar arrays — fixed (DEFECT-260727-WWWY).

FRETish formula
the parser shall always satisfy !set_targets_array_index_beyond_length | set_appends_value_at_array_end

Rationale & tags

Why this requirement exists, and how it is categorised.

Set on an array-index beyond current length was underspecified; PR #286 found it silently overwrites element 0, destroying data the caller did not address. The append-at-end contract must be explicit so the overwrite path can never regress.

setarray_indexboundarybeyond_length

Verification & provenance

How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).

Assurance levelB
Formalizationvalid
Realizabilityrealizable
Vacuitychecked_ok
Strategyfretish

Review

Status
approved
Reviewer
human:buger · lead_engineer
Reviewed
Jul 27, 2026, 06:53 UTC
Re-approved noting open design gap (DEFECT-260727-T7P7): top-level array-index beyond-length still returns KeyPathNotFoundError. The scalar-array fix (DEFECT-260727-WWWY) is also tracked in motivation_history. element_type_partition obligation added and locked by regression test.

History

Created
Jul 26, 2026, 17:12 UTC · human:cli
Modified
Jul 27, 2026, 06:53 UTC · human:buger

Obligations

What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.

3 obligations · 2 discharged · 1 delegated

Browse the catalogue
Delegated

Behavior at limits, thresholds, and edge-of-range values.

Worst case if violatedHigh

Set on [len(array)] or beyond silently overwrites element 0 (or another existing element the caller did not address), destroying data and returning a mutated document with no error — silent corruption of unaddressed state.

Carried bySYS-REQ-009

SYS-REQ-110 is a leaf contract partition; the boundary implementation lives in parser.go:Set / parser.go:createInsertComponent which SYS-REQ-009 already carries implemented_by traces for (source_native autolink). Delegating avoids weakening SYS-REQ-110 by removing the obligation.

Byhuman:bugerAt2026-07-26T18:09:59Z
Discharging evidence1/1 required witnessed
  • nominalrequiredpresent
    Covered by 1 test
  • negativerecommendedpresent
    Covered by 1 test
Discharged
Worst case if violatedMedium

Set on a beyond-length array index inside a nested container drives createInsertComponent to emit array scaffolding at the wrong offset; a regression overwrites a sibling element or builds malformed JSON, silently corrupting the nested structure.

Discharging evidence1/1 required witnessed
  • nominalrequiredpresent
    Covered by 1 test
Discharged
Worst case if violatedHigh

Set on a beyond-length array index under a nested key whose existing array contains SCALAR first elements (numbers, strings, bools, nulls, nested arrays — anything where the first element byte is not '{') silently replaces the entire array with a single-element [value], destroying all existing data. The append-at-end code path's guard previously required data[subObjOff]=='{' , so only object-first-element arrays took the append branch; scalar arrays fell through to the replace-container branch. Fixed in DEFECT-260727-WWWY; regression test TestSetBeyondLengthScalarArrayPreservesElements_SYS110 locks all scalar element-type partitions.

Discharging evidence1/1 required witnessed
  • nominalrequiredpresent
    Covered by 1 test

Formula evidence

The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).

FRETish formula

the parser shall always satisfy !set_targets_array_index_beyond_length | set_appends_value_at_array_end

Variables

NameTypeDirectionDescription
set_targets_array_index_beyond_lengthTrue when Set addresses an array-index path component [N] where N >= the current length of the addressed array (the beyond-length partition of array_index).
set_appends_value_at_array_endTrue when Set appends the value at the end of the addressed array (the new element's index becomes len(array)) and returns the mutated document, rather than overwriting an existing element or panicking.

Witnesses· 3 scenarios total

  • TestSetSupplementalArrayInsertionCoverage
    mcdc_supplement_test.go:337
  • TestSetTopLevelArrayAppend_KI4
    parser_test.go:2454
  • TestSetBeyondLengthScalarArrayPreservesElements_SYS110
    parser_test.go:2483
  • TestMCDC_SYS_REQ_110_Row1_InRangeNoAppend
    sys_req_110_111_witness_test.go:32exercises 1 condition scenario
  • TestMCDC_SYS_REQ_110_Row2_InvariantViolation
    sys_req_110_111_witness_test.go:59exercises 1 condition scenario
  • TestMCDC_SYS_REQ_110_Row3_BeyondLengthAppendsAtEnd
    sys_req_110_111_witness_test.go:80exercises 1 condition scenario

Its place

This requirement shown inside its trace neighbourhood — the parents it satisfies, the code and tests attached to it, and its findings.

Loading graph…

Trace evidence

The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.

Impact

Blast radius — if you change this requirement, what else may need re-checking, and what it in turn depends on.

If you change this

Requirements
0
Files
2
Tests
7
At-risk contracts
0

Files to re-check (2)

  • append.goappend.go
  • parser.goparser.go

Tests to re-run (7)

  • append_test.goappend_test.go
  • fuzz_native_test.gofuzz_native_test.go
  • mcdc_supplement_test.gomcdc_supplement_test.go
  • parser_test.goparser_test.go
  • reference_oracle_test.goreference_oracle_test.go
  • set_spec_test.goset_spec_test.go
  • sys_req_110_111_witness_test.gosys_req_110_111_witness_test.go

What this rests on

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in