[tee8z]

Validate authenticated snapshot archives before a restore consumer writes files or imports Git packs. Raw tar iteration caps local PAX payloads before the tar crate can allocate extension bodies, rejects unsupported types and unsafe paths, checks declared files against the scanned manifest, and validates aggregate Git expansion and symlink chains.

This is the archive-plan foundation above terminal server #170. The filesystem restore consumer follows separately; this PR adds no user restore command. Full locally available scanned history remains in self-contained bundles, while copied working files follow checkpoint exclusions.

Validation: all 518 CLI unit tests pass; all-target Clippy, formatting, diff and lock metadata checks pass. Six guard mutations fail, including the original symlink/.. resolution defect. A real archive from the hardened packaged producer passes the explicit fixture test. The repository-wide just ci attempt is queued behind the terminal boundary fix and will be reported separately. Tests use real SHA-1/SHA-256 Git bundles and the checkpoint policy fixture, plus malformed types, paths, duplicate entries, oversized PAX, symlink cycles, gzip tails and cancellation. The layer is 1,030 changed lines: the raw reader, manifest/bundle/link validation and realistic fixtures form one security boundary. Splitting these checks would leave an incomplete archive contract. Draft remains pending completed independent review, the broad gate and human integrated testing; no deployment or review attestation.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Reviewed 589f4eea4. The published parser matches frozen SHA-256 1b27b0cdb862083f7f26cca2d3616be19eda32a725e95ac4ccbf0ac1426b308e.

The one concrete blocker found during static review is resolved: lexical .. normalization before symlink expansion could accept an escaping chain. The parser now expands raw link components before processing .., retains the originating repository boundary, and bounds substitutions and queued components. The exact pivot -> ., up -> pivot/.., escape -> up/../outside regression passes; restoring the former lexical resolver makes it fail.

I checked raw tar iteration before extension allocation, PAX byte/key limits, paths/types/duplicates, manifest and copied-file parity, aggregate packed-object budgets, symlink traversal, and gzip/EOA termination. This layer performs no filesystem extraction or Git import; those checks remain in the following consumer.

Independent validation: eight automatic archive tests pass, and the ignored exact packaged-producer fixture also passes independently. Author evidence reports 518 CLI tests, all-target Clippy, locked metadata, and six killed guard mutations. No remaining concrete blocker in this archive-plan layer.

Scores: minimalism 9/10, elegance 9/10, correctness 9/10. Keep this draft pending the remaining workflow and human confirmation requirements.