Validate acceptance reader payloads

[HardlyDifficult]

Summary

• route stock, convertible, equity-compensation, and warrant acceptance readers through their correlated generated DAML wrapper decoders
• enforce exact template identity and lossless wrapper decoding before conversion
• validate generated acceptance context issuer and system_operator as Canton Party identifiers with exact diagnostic paths
• reuse canonical DAML-to-OCF converters and remove shallow guards and duplicated conversion logic
• reject empty write-side id and security_id values to match the pinned DAML rules
• prove direct and generic acceptance results are exact, cross-family-safe, and recursively free of any in both source and built declarations

Validation

• npm run test:ci — 97 suites / 5,612 tests passed
• npm run test:declarations
• npm run test:package-consumer
• npm run test:exact-public-config
• npm run typecheck
• npm run build
• npm run lint
• npm run format
• CI and OCP QuickStart pass on exact head 060cbf3cfc6005308ab75e7ac54fb5495e159aff

Stack

• stacked on Validate DAML map keys and values #428
• remains draft until its parent reaches the final review gate

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d07ead3a-f929-4c69-b7e8-c0b085120b96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/decoder-backed-acceptance-readers

---

_{Comment @coderabbitai help to get the list of available commands.}

[HardlyDifficult]

@coderabbitai pause

[coderabbitai]

✅ Action performed

Reviews paused.

[HardlyDifficult]

Prepared and independently audited exact head 24e71ee224436fd35e8db8463a805ae9c8c9e05a on the hardened #428 boundary using a normal merge; no history rewrite. All four acceptance families now share exact generated full-wrapper safe-JSON preflight, decode/encode losslessness, complete context enforcement, template/family correlation, dedicated/generic parity, wrapper/context/acceptance_data/nested extra rejection, and bounded hostile diagnostics. Independent validation is green: focused 196 tests; full 89 suites / 4,608 tests; 88.32% statements / 79.70% branches / 87.34% functions / 88.57% lines; build, source and built declarations, exact config, lint, formatting, deterministic 49-object inventory, and diff checks. The PR remains draft/unassigned pending exact-head CI and Copilot-first review.

[HardlyDifficult]

@copilot review

Please perform a formal review of exact current head 24e71ee224436fd35e8db8463a805ae9c8c9e05a. Independent audit confirmed all four acceptance families share exact generated full-wrapper safe preflight, decode/encode losslessness, complete context/template correlation, dedicated/generic parity, extra-field rejection, and bounded hostile diagnostics. Build-and-test, the 8m21s QuickStart run, 89 suites / 4,608 local tests, declarations, exact config, lint, formatting, deterministic inventory, mergeability, and all threads are clean. Copilot is being requested first for this material revision.

[Copilot]

@copilot review

Please perform a formal review of exact current head 24e71ee224436fd35e8db8463a805ae9c8c9e05a. Independent audit confirmed all four acceptance families share exact generated full-wr...

Formal review completed on head 24e71ee. I found no material issues requiring changes. The acceptance-reader hardening is consistent across all four families and does not introduce correctness, typing, or security regressions based on this review.

[HardlyDifficult]

cursor review

Copilot completed a no-findings formal review of exact current head 24e71ee224436fd35e8db8463a805ae9c8c9e05a. Please perform the next exact-head automated review, including all four acceptance-family full-wrapper lossless boundaries, context/template correlation, dedicated/generic parity, and bounded adversarial diagnostics.

[Copilot]

@copilot review

Please perform a formal review of exact current head 24e71ee224436fd35e8db8463a805ae9c8c9e05a. Independent audit confirmed all four acceptance families share exact generated full-wr...

Formal review completed for head 24e71ee. I found no material correctness, security, or regression issues in the acceptance-reader changes. I also verified branch CI status via workflow runs (latest CI and Test OCP CN-Quickstart Integration for codex/decoder-backed-acceptance-readers at this head are successful) and re-ran the focused acceptance-reader suite locally (85 passed). No code changes are needed.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 24e71ee. Configure here.}

[HardlyDifficult]

@copilot review

Please review exact current head 7fec848c6d9d180d6c3092f69719b1c10b949e37. Exact CI and the 9m09s LocalNet QuickStart are green; local validation passed 89 suites / 4,610 tests, build, declarations, exact config, lint, and formatting. GitHub reports CLEAN/MERGEABLE and all prior threads are resolved. Focus on the four decoder-backed acceptance families, full-wrapper losslessness, context enforcement, generic parity, and bounded hostile-input diagnostics before Cursor review.

[Copilot]

@copilot review

Please review exact current head 7fec848c6d9d180d6c3092f69719b1c10b949e37. Exact CI and the 9m09s LocalNet QuickStart are green; local validation passed 89 suites / 4,610 tests, bui...

Formal review of exact head 7fec848 is complete. I found no material correctness, security, or regression issues in the four decoder-backed acceptance families, including full-wrapper losslessness, context/template correlation, dedicated/generic parity, and bounded hostile-input diagnostics. I also verified GitHub Actions for this head on codex/decoder-backed-acceptance-readers: both CI and Test OCP CN-Quickstart Integration are successful.

[HardlyDifficult]

@cursor review

Please review exact current head 7fec848c6d9d180d6c3092f69719b1c10b949e37. Copilot completed an explicit exact-head no-findings response; exact CI and LocalNet QuickStart are green, GitHub reports CLEAN/MERGEABLE, and all prior threads are resolved. Focus on decoder-backed acceptance families, full-wrapper losslessness, context enforcement, and generic parity.

[Copilot]

Pull request overview

This PR tightens ledger-boundary parsing for the four acceptance readers (stock, convertible, equity-compensation, warrant) by decoding the full generated DAML create-argument wrapper, validating template identity up-front, and reusing the canonical DAML→OCF converters to ensure exact, non-any result types.

Changes:

• Enforce expectedTemplateId in acceptance readers and decode acceptance payloads via generated DAML decoders (full wrapper, not just acceptance_data).
• Route acceptance entity decoding through a shared acceptanceContractData path and reuse daml*AcceptanceToNative converters.
• Add runtime reader tests plus compile-time (source and dist) type-contract tests ensuring exact/non-cross-assignable acceptance result families.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/types/acceptanceReaders.types.ts	Source type-level contracts proving exact acceptance reader result types (no any, not cross-assignable).
test/functions/acceptanceReaders.test.ts	Parameterized runtime tests for decoding, malformed payloads, hostile JSON shapes, and wrong-template/package cases.
test/declarations/acceptanceReaders.types.ts	Built-declaration type-level contracts mirroring the source contracts for dist output.
test/batch/damlToOcfDispatcher.test.ts	Regression ensuring generic acceptance reads enforce the full generated wrapper (incl. context).
src/functions/OpenCapTable/warrantAcceptance/getWarrantAcceptanceAsOcf.ts	Switch to template-id enforcement + shared decode path + canonical DAML→native conversion.
src/functions/OpenCapTable/stockAcceptance/getStockAcceptanceAsOcf.ts	Same as above for stock acceptance.
src/functions/OpenCapTable/equityCompensationAcceptance/getEquityCompensationAcceptanceAsOcf.ts	Same as above for equity-compensation acceptance.
src/functions/OpenCapTable/convertibleAcceptance/getConvertibleAcceptanceAsOcf.ts	Same as above for convertible acceptance.
src/functions/OpenCapTable/capTable/damlEntityData.ts	Route acceptance entity types through the new acceptance wrapper decoder.
src/functions/OpenCapTable/capTable/acceptanceContractData.ts	New shared decoder enforcing safe JSON preflight + lossless round-trip for acceptance create arguments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HardlyDifficult]

Addressed Copilot’s single-invocation test finding in 63f009f.

The extra-field loop now captures one rejection from each reader invocation, then asserts both the OcpParseError runtime type and the complete structured lossy-decode diagnostics on that same value.

Validation:

• acceptanceReaders.test.ts: 85/85 passing
• full unit suite: 90 suites, 4,689 tests passing
• build and declaration checks passing
• typecheck, lint, and format checks passing

The PR remains draft and unassigned while exact-head CI reruns.

[HardlyDifficult]

Material parent propagation complete at exact head 2ad6848, incorporating #428 at 5394ea3. The single-invocation acceptance failure test fix is byte-for-byte stable: test/functions/acceptanceReaders.test.ts retains its exact pre-merge blob. Source typecheck and the focused acceptance-reader suite passed (1 suite / 85 tests) on canton-node-sdk 0.0.227. The PR remains draft and unassigned while CI runs.

[HardlyDifficult]

Fresh acceptance-reader audit hardening is pushed at exact head b271db139c91b3305bfb35620f34d5dd1a57f866.

All four acceptance families now reject zero-length generated id and security_id values at exact damlToOcf.<entity>.createArgument.acceptance_data.<field> paths; all four writers symmetrically reject zero-length security_id. Whitespace/padded identifiers remain unchanged, matching the SDK’s existing branded nonempty policy.

Dedicated and generic success/failure tests now assert exactly one ledger fetch. Malformed-date and wrong-template cases capture one rejection rather than invoking readers twice, and the preserved extra-field test also proves single invocation. Contract-ID correlation is intentionally parent-resolved by #427 and must remain intact during restacking.

Validation: focused reader/converter/dispatcher 236 tests; full 90 suites / 4,713 tests; build; typecheck; declarations; exact public-config; lint; format; diff check. No other blocker was found in #429’s own delta. The PR remains draft/unassigned; no parent merge or reviews were requested.

[HardlyDifficult]

Corrected parent stack propagated through PR #429 at exact head 21f8572. The acceptance-specific full-wrapper decoder remains correlated across all four families, identifier validation remains symmetric with writers, and direct/generic reads retain one ledger fetch plus exact template and contract-ID correlation. I also updated one stale generic-reader fixture so it reaches the intended wrapper-decoder assertion under the stricter parent contract-ID gate.

Local validation: focused acceptance/dispatcher/single-contract/generated-boundary/sorter suite 6 suites / 396 tests; full coverage suite 95 suites / 5,521 tests; clean build and declaration checks; exact public-config checks; built cardinality; package-consumer declarations; TypeScript; ESLint; Prettier; diff checks; canonical inventory 55 variants / 0 ingestion aliases (56 reachable objects, 160 resources). The worktree is clean and local/remote heads match. PR remains draft, unassigned, with no review requests while fresh CI runs.

[HardlyDifficult]

@copilot review

Please review exact current head 21f8572d5ed1a7b6e4ca14e38f2d0994c605b67a. Pre-review gate: both required checks are successful, GitHub is CLEAN/MERGEABLE, the PR is unassigned, and zero review threads are unresolved. Focus on acceptance readers, canonical event discriminators, lossless payload conversion, direct/dispatcher parity, and public output types. Report every actionable current-head issue before the other reviewers.

[Copilot]

@copilot review

Please review exact current head 21f8572d5ed1a7b6e4ca14e38f2d0994c605b67a. Pre-review gate: both required checks are successful, GitHub is CLEAN/MERGEABLE, the PR is unassigned, and...

Formal review completed for exact head 21f8572d5ed1a7b6e4ca14e38f2d0994c605b67a. I found no actionable correctness, security, or regression issues in the acceptance readers, canonical event discriminators, lossless payload conversion, direct/dispatcher parity, or public output typing.

I also verified current workflow state for this head on codex/decoder-backed-acceptance-readers: CI and Test OCP CN-Quickstart Integration are both successful.

[HardlyDifficult]

@cursor review

Please review exact current head 21f8572d5ed1a7b6e4ca14e38f2d0994c605b67a. Copilot completed its required exact-head pass with no actionable findings: #429 (comment). Both required checks are green, GitHub is CLEAN/MERGEABLE, and zero review threads are unresolved. Focus on acceptance readers, canonical event discriminators, lossless payload conversion, direct/dispatcher parity, and public output types.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 21f8572. Configure here.}

[HardlyDifficult]

Parent propagation is complete at exact head 0f8d00b via a normal conflict-free merge of #428 c45265e. The parent and child file sets do not overlap and both layers remain byte-identical. Validation passes: 13 focused suites / 1,012 tests, full 95 suites / 5,526 tests, typecheck, lint, formatting, declarations, exact-public/cardinality, and package-consumer gates. Independent inspection found no issue. Keeping this PR in draft until fresh remote CI is green.

[HardlyDifficult]

Restacked onto audited #428 and pushed at exact head 060cbf3cfc6005308ab75e7ac54fb5495e159aff. Full validation passes: 97 suites / 5,612 tests, declarations, build, package-consumer, exact-public-config, lint, and formatting. Hosted CI and OCP QuickStart are running.