security(storage): close leased raw SPARQL mutation routes

[Jurij89]

Summary

• Close both caller-authored mutating SPARQL routes on authentic ownership-leased stores: raw update() is categorically unavailable, while query() accepts only canonically recognized read-only programs.
• Make refusal happen before scheduler admission and network I/O, independent of admission state, managedByDkg, or atomicUpdates; capability probes now truthfully report leased raw updates unavailable while bounded structured mutations remain available.
• Preserve the canonical decorator-chain capability walk from refactor(storage): migrate exact managed mutations #2185: the leased HTTP adapter is the explicit semantic override, while transparent wrappers require no parallel forwarding hook.
• Recognize SPARQL PN_LOCAL_ESC punctuation around update-word text so valid escaped prefixed-name reads remain available, and trigger the raw-channel gate for every derived storage consumer package.
• Extend the live managed-Oxigraph gate and a workspace-derived, type-aware source inventory so the boundary is proven against a real server and new or changed first-party raw store calls require review. The scanner traces untyped and aliased store receivers and requires an explicit local annotation for legitimate untyped non-store APIs.

Related

• Fixes security(storage): close the raw update() route to reserved system-record state before activation #2162
• Part of Reconnect-triggered background sync amplification can starve foreground catch-up #2052
• Builds on merged refactor(storage): add bounded managed mutation capabilities #2186
• Stacked on refactor(storage): migrate exact managed mutations #2185

Diagrams

Ownership-leased raw SPARQL boundary

sequenceDiagram
    participant C as Caller
    participant D as Store decorators
    participant A as SparqlHttpStore
    participant S as Priority scheduler
    participant O as Managed Oxigraph
    C->>D: update or query with mutation syntax
    D->>A: Forward raw SPARQL
    A-->>C: Typed refusal and capability unavailable
    Note over A,S: Refusal occurs before admission or I/O
    C->>D: query with recognized read-only form
    D->>A: Forward read SPARQL
    A->>S: Admit read work
    S->>O: Send read query
    O-->>C: Query result

Loading

Files changed

File	What
packages/core/src/sparql-operation.ts	Distinguish executable update tokens from legal SPARQL names, expose the canonical recognized-read-only policy, and own shared keyword-boundary primitives.
packages/query/src/sparql-utils.ts	Re-export the core keyword-boundary primitives so query rewriting and admission share one lexical model.
packages/storage/src/adapters/sparql-http.ts	Apply one centralized lease-aware raw-channel policy before scheduling or I/O and report optional capabilities truthfully.
packages/storage/test/reserved-internal-graph-mutation-guard.test.ts	Cover split-prefix attacks, multi-operation programs, legal update-word identifiers, capability reporting, forged flags, staging cleanup, and unleased compatibility.
packages/storage/test/system-record-managed-mutation-admission-v1.test.ts	Prove raw refusals occur before scheduler admission under disabled, active, and saturated states.
packages/query/test/query-engine.test.ts	Pin legal update-word identifiers and the canonical read-then-update refusal policy.
scripts/check-managed-store-raw-channels.mjs	Derive every storage-dependent workspace package, inspect typed TripleStore calls, and fail on raw updates, static mutations, package-scope drift, or changes to the reviewed dynamic-query baseline without depending on generated core output.
package.json	Expose the source-based architecture gate through tsx.
devnet/issue-2052-managed-ownership/run.ts	Exercise the raw channels through an extracted table-driven probe against live ownership-leased Oxigraph.
devnet/issue-2052-managed-ownership/model.ts	Version and verify the new live raw-channel evidence.
.github/workflows/system-record-managed-ownership.yml	Run the architecture contract and document the expanded live-gate scope.

Test plan

• Build core, storage, query, and random-sampling packages
• Focused storage conformance after the final review fix: 89 passed
• Post-restack storage boundary suites: 105 passed, including the canonical capability-chain regression
• Escaped-prefixed-name and admission suites after the latest review fix: 91 passed
• Core SPARQL safety suite: 58 passed
• Full Query suite: 335 passed
• Post-restack Query engine suite: 128 passed
• pnpm check:managed-store-raw-channels: 288 typed calls across all five storage consumers; 287 reviewed dynamic call sites; zero violations; embedded fixtures cover any/unknown, variable, property, and destructured aliases
• pnpm typecheck:live:system-record-managed-ownership
• Live pinned Oxigraph 0.5.8 gate at the preceding head: 31 checks passed; raw mutation quad count remained zero
• Full storage suite at the preceding head: 975 passed, 26 skipped
• Latest full storage rerun: all changed suites passed; one unrelated 5 ms Blazegraph timing test failed both in-suite and in isolation
• node scripts/sparql-scale-lint.mjs --diff 2c7f33ca375a6f96994dbb9c31a5b682b5d69363 HEAD: zero new blocking findings