#4575 software-factory: a work item whose slug extends another's reads the other's records

Classified automatically when this issue was filed.

• Source: Extensions

If you feel this classification is incorrect, add a ripple to tell us so.

Patch for the suggested fix, against swamp-club/swamp-extensions main at 2b12cfd. It checks ownership in loadRunView before parsing, and adds a regression test in run_data_test.ts. With it applied: 180 tests pass, and deno task check, lint and fmt --check are clean.

diff --git a/software-factory/extensions/models/_lib/run_data.ts b/software-factory/extensions/models/_lib/run_data.ts
index 78c2344..c3c42f4 100644
--- a/software-factory/extensions/models/_lib/run_data.ts
+++ b/software-factory/extensions/models/_lib/run_data.ts
@@ -238,6 +238,24 @@ function decode(content: Uint8Array): Record<string, unknown> {
   >;
 }
 
+/**
+ * True when `instanceName` is exactly `prefix` + the record's own logical
+ * name (`record[key]`). A prefix match alone is not ownership: the slug
+ * "x-revert" starts with "x-", so "evidence-x-revert-plan" also matches the
+ * prefix "evidence-x-" but belongs to "x-revert". Checked before schema
+ * parsing so a foreign record can neither shadow this run's record nor fail
+ * this run's load.
+ */
+function ownsInstance(
+  instanceName: string,
+  prefix: string,
+  record: Record<string, unknown>,
+  key: string,
+): boolean {
+  const logical = record[key];
+  return typeof logical === "string" && instanceName === prefix + logical;
+}
+
 export async function loadRunView(
   repo: DataRepositoryLike,
   modelType: unknown,
@@ -301,8 +319,9 @@ export async function loadRunView(
         name,
         latestVersion,
       );
-      if (content !== null) {
-        const envelope = ArtifactEnvelopeSchema.parse(decode(content));
+      const raw = content === null ? null : decode(content);
+      if (raw !== null && ownsInstance(name, artifactPrefix, raw, "name")) {
+        const envelope = ArtifactEnvelopeSchema.parse(raw);
         view.artifacts.set(envelope.name, {
           latest: envelope,
           version: latestVersion,
@@ -318,8 +337,9 @@ export async function loadRunView(
         name,
         latestVersion,
       );
-      if (content !== null) {
-        const envelope = EvidenceEnvelopeSchema.parse(decode(content));
+      const raw = content === null ? null : decode(content);
+      if (raw !== null && ownsInstance(name, evidencePrefix, raw, "name")) {
+        const envelope = EvidenceEnvelopeSchema.parse(raw);
         view.evidence.set(envelope.name, {
           latest: envelope,
           version: latestVersion,
@@ -335,8 +355,9 @@ export async function loadRunView(
         name,
         latestVersion,
       );
-      if (content !== null) {
-        const envelope = ValidationEnvelopeSchema.parse(decode(content));
+      const raw = content === null ? null : decode(content);
+      if (raw !== null && ownsInstance(name, validationPrefix, raw, "target")) {
+        const envelope = ValidationEnvelopeSchema.parse(raw);
         view.validations.set(envelope.target, {
           latest: envelope,
           version: latestVersion,
@@ -362,8 +383,9 @@ export async function loadRunView(
           name,
           version,
         );
-        if (content !== null) {
-          records.push(ApprovalRecordSchema.parse(decode(content)));
+        const raw = content === null ? null : decode(content);
+        if (raw !== null && ownsInstance(name, approvalPrefix, raw, "gateId")) {
+          records.push(ApprovalRecordSchema.parse(raw));
         }
       }
       if (records.length > 0) {
diff --git a/software-factory/extensions/models/_lib/run_data_test.ts b/software-factory/extensions/models/_lib/run_data_test.ts
index 598a6cf..cc4adf7 100644
--- a/software-factory/extensions/models/_lib/run_data_test.ts
+++ b/software-factory/extensions/models/_lib/run_data_test.ts
@@ -174,6 +174,83 @@ Deno.test("loadRunView: scoped to one work item's slug-namespaced records", asyn
   assertEquals(other.approvals.size, 0);
 });
 
+Deno.test("loadRunView: a work item whose slug extends another's does not shadow it", async () => {
+  // "wi-revert" starts with "wi-", so its
+  // records also match the shorter item's name prefixes. They must not be
+  // read as the shorter item's records.
+  const evidence = (workItem: string, cycle: number, at: string) => ({
+    name: "live-result",
+    workItem,
+    stageId: "live",
+    cycle,
+    payload: { driftClean: true },
+    recordedAt: at,
+  });
+  const approval = (workItem: string, cycle: number, at: string) => ({
+    gateId: "live-signoff",
+    workItem,
+    decision: "approved",
+    actor: "owner",
+    stageId: "live",
+    cycle,
+    decidedAt: at,
+  });
+  const repo = memoryRepository({
+    "state-wi": [state("wi", { stageId: "live", cycles: { live: 2 } })],
+    "state-wi-revert": [
+      state("wi-revert", { stageId: "live", cycles: { live: 1 } }),
+    ],
+    "evidence-wi-live-result": [
+      evidence("wi", 1, "2026-06-11T10:01:00.000Z"),
+      evidence("wi", 2, "2026-06-11T10:02:00.000Z"),
+    ],
+    "evidence-wi-revert-live-result": [
+      evidence("wi-revert", 1, "2026-06-11T10:03:00.000Z"),
+    ],
+    "approval-wi-live-signoff": [approval("wi", 2, "2026-06-11T10:04:00.000Z")],
+    "approval-wi-revert-live-signoff": [
+      approval("wi-revert", 1, "2026-06-11T10:05:00.000Z"),
+    ],
+    "artifact-wi-revert-plan": [
+      artifact("wi-revert", "plan", 1, { v: "revert" }),
+    ],
+    "validation-wi-revert-plan": [
+      {
+        target: "plan",
+        targetKind: "artifact",
+        workItem: "wi-revert",
+        stageId: "live",
+        cycle: 1,
+        attempt: 1,
+        cleared: false,
+        errors: ["x"],
+        recordedAt: "2026-06-11T10:06:00.000Z",
+      },
+    ],
+  });
+
+  const view = await loadRunView(repo, "type", "id", "wi");
+  assertEquals(view.evidence.get("live-result")?.latest.workItem, "wi");
+  assertEquals(view.evidence.get("live-result")?.latest.cycle, 2);
+  assertEquals(view.evidence.get("live-result")?.version, 2);
+  const approvals = view.approvals.get("live-signoff");
+  assertEquals(approvals?.length, 1);
+  assertEquals(approvals?.[0].workItem, "wi");
+  assertEquals(approvals?.[0].cycle, 2);
+  assertEquals(view.artifacts.size, 0);
+  assertEquals(view.validations.size, 0);
+
+  // The longer slug still sees exactly its own records.
+  const revert = await loadRunView(repo, "type", "id", "wi-revert");
+  assertEquals(
+    revert.evidence.get("live-result")?.latest.workItem,
+    "wi-revert",
+  );
+  assertEquals(revert.approvals.get("live-signoff")?.[0].workItem, "wi-revert");
+  assertEquals(revert.artifacts.get("plan")?.latest.payload, { v: "revert" });
+  assertEquals(revert.validations.size, 1);
+});
+
 Deno.test("loadRunView: era filtering hides records from before a reset", async () => {
   const repo = memoryRepository({
     // startedAt is AFTER the artifact and the first approval were recorded