fix(tls): reject punctuation-only trust bundle identifiers

[seonghobae]

Buyer/security gap

Protected main accepted punctuation-only TrustBundleIdentifier values such as --- as meaningful TLS trust-policy labels. That admits identifiers with no human- or machine-distinguishing alphanumeric content into credential-free evidence and policy metadata.

TDD lineage

This branch starts directly from protected main 0c376acf059be9ddddddfbde1d0189e4f39ef014.

The test-first head added --- to the existing public policy-contract regression before changing production behavior. The smallest production remedy then required at least one ASCII alphanumeric while preserving the existing 1–128 byte bound and allowed punctuation set (., _, :, -).

Current implementation

Exact head bd34717585546c6989d10ff6c2be3dc1232ad638:

• rejects empty, overlong, non-ASCII, unsupported-character, and punctuation-only trust-bundle identifiers;
• accepts existing identifiers such as enterprise_roots:v1;
• preserves the existing punctuation allow-list and all trust-root, TLS, and evidence semantics; and
• records the strengthened identifier shape in CHANGELOG.md.

The exact diff is limited to the identifier validator, its existing focused policy test, and one canonical changelog line.

Exact-head verification

On unchanged exact head bd34717585546c6989d10ff6c2be3dc1232ad638 against exact protected main 0c376acf059be9ddddddfbde1d0189e4f39ef014:

• CI 31866474943: success;
• Rust contracts job 94968267890: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success;
• Production coverage job 94968267875: exact owned-production function, line, region, and branch coverage enforcement success;
• SAST Semgrep 31866475016: success;
• Security Scan 31866474985: success;
• no formal review or unresolved inline thread is currently returned; and
• GitHub reports the PR open, Ready, and mergeable.

No predecessor-head, queued, skipped, synthetic, or model-only result is promoted as current proof.

Scope boundary

This changes no trust roots, credentials, certificate validation, network authority, workflow policy, persistence, or release behavior. Passing automation is not independent approval; protected integration remains subject to the live ruleset and unchanged-head review evidence.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f36de67-558f-4d47-b919-1a9611532a3e

📥 Commits

Reviewing files that changed from the base of the PR and between bd34717 and 37de483.

📒 Files selected for processing (2)

• CHANGELOG.md
• crates/originweave-tls/src/trust.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 304315a2-7f6d-4794-a924-c923bd45fe86

📥 Commits

Reviewing files that changed from the base of the PR and between 28062bb and bd34717.

📒 Files selected for processing (1)

• CHANGELOG.md

---

📝 Walkthrough

Walkthrough

신뢰 번들 식별자는 하나 이상의 ASCII 영숫자를 포함해야 합니다. 구두점만 포함한 식별자는 거부됩니다. 계약 테스트와 변경 로그를 이 정책에 맞게 업데이트했습니다.

Changes

신뢰 번들 식별자 검증

Layer / File(s)	Summary
식별자 검증 및 계약 테스트 crates/originweave-tls/src/trust.rs, crates/originweave-tls/tests/policy_contract.rs, CHANGELOG.md	TrustBundleIdentifier::parse가 ASCII 영숫자 포함 여부를 확인합니다. 계약 테스트는 "---"를 무효 입력으로 검증합니다. 변경 로그는 새 검증 규칙을 기록합니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to bd347

This localized validation-contract change has no actionable merge-blocking risk identified at the current head and is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 구두점만으로 구성된 TLS trust bundle 식별자를 거부하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/tls-trust-bundle-identifier-shape

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.