# membership-identity-binding-review

> Keyed mutation digest/key equality and required Set membership use independent witness snapshots.

Canonical: https://nightshade.dicksonwu.xyz/rules/membership-identity-binding-review.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `membership-identity-binding-review` |
| Severity | info |
| Confidence | varies |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Authorization, identity and membership |
| Engine facts used | all-predicates, digest-inputs, collection-operations, original-write-history |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors membership-identity-binding-review
./.nightshade/node_modules/.bin/nightshade detector show membership-identity-binding-review
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 4/4 | 3/3 | 2/3 | 5/5 | 0 |

Deviations recorded for this rule:

| Case | Kind | Expected to observed lines | Issue |
| --- | --- | --- | --- |
| manifest.json / independentMembershipIdentity54/drafts/memo-identity44-boundaries/intentional-admin.compact | lookalike | [20] to [20] | control hit |

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/membership-identity-binding-review.md at v0.1.1.

Availability: **opt-in** with `--detectors membership-identity-binding-review`.
Findings are informational policy questions, with high confidence limited to the
observed source relationship.

The rule observes a canonical `Map<Bytes<32>, List<Bytes<32>>>` mutation at an exact
key. Imported aliases and nominal container aliases are admitted only when
canonical native identity and recursively resolved argument shapes agree. Required scalar equalities connect that key to a canonical `persistentHash`
of one raw, declared `Bytes<32>` witness snapshot. A required canonical
`Set<Bytes<32>>.member` predicate tests an independent raw witness snapshot in the
same completed atomic history. No required scalar equality connects the digest
or its input to the membership input. A public key parameter is not trusted ledger
data; this equality alone does not establish authentication policy.

One report groups a digest/key snapshot, membership predicate and nested Map root,
retaining a representative mutation and the observed source sites. Different
roots, membership snapshots and digest snapshots remain separate questions.
Source sites can occur on different complete histories; their effects are never
combined into a single executable history. Zero-iteration histories supply no
mutation. Optional membership in an alternative successful history at the same
mutation site suppresses the mandatory composition question. Required Boolean
facts are intersected; exclusive checks never donate equality or membership.

Direct, transitive, aliased and late atomic scalar equalities bind snapshots.
Repeated invocations of one witness declaration remain independent. Equal hash
outputs never establish equal preimages. Query identities retain the exact Set
receiver, operand and ledger revision. Wildcard mutation paths cannot supply exact
key evidence. Unavailable histories, predicate structure, snapshot identities,
checkpoints and exhausted budgets produce diagnostics and incomplete coverage.

The initial boundary excludes other represented container shapes, aggregate or
transformed witness inputs, user collection lookalikes, and cross-entry policy
comparison. Preparation, execution, additional collection retention, matching and
report construction share 40,000 steps per entry, 256 paths per entry and 50,000
cumulative abstract values per selected rule; no retry budget applies.

An application may intentionally use one supplied identity for a stored map key
and an independent witness for membership. That source relationship is an
informational review question, not proof of an authorization defect; confirm the
intended identity-binding policy before changing it.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line membership-identity-binding-review -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/membership-identity-binding-review.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#authorization-identity-and-membership)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)