# public-two-component-domain-review

> Review a public two-input native digest lacking represented self binding and component default exclusion.

Canonical: https://nightshade.dicksonwu.xyz/rules/public-two-component-domain-review.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `public-two-component-domain-review` |
| Severity | info |
| Confidence | high |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Privacy and cryptographic derivations |
| Engine facts used | exact-native-preimage, canonical-self-provenance, all-successful-predicates, scalar-entry-input-identity |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors public-two-component-domain-review
./.nightshade/node_modules/.bin/nightshade detector show public-two-component-domain-review
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 6/6 | 5/5 | 3/4 | 4/5 | 1 |

Deviations recorded for this rule:

| Case | Kind | Expected to observed lines | Issue |
| --- | --- | --- | --- |
| manifest.json / publicTwoComponentDomainReview43/drafts/owner-domain43/lookalike.compact | lookalike | [15] to [15] | control hit |
| manifest.json / publicTwoComponentDomainReview43/drafts/owner-domain43/opaque-salt-guard.compact | negative | [] to [] | incomplete or unvalidated |

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/public-two-component-domain-review.md at v0.1.1.

Availability: **opt-in**, no policy required. Severity: **info**. Confidence: **high**
for the stated source relationship.

Select with `--detectors public-two-component-domain-review`.

This review observes a public ledger write containing a canonical native
`persistentHash` of exactly two distinct scalar entry parameters of type
`Bytes<32>`. The represented preimage lacks a canonical `kernel.self()` value,
and assigning both components their default bytes is compatible with supported
component-only scalar equality guards on a modeled successful history. Findings
identify the actual native hash span, the two parameter declarations and the
public write. An authorization consumer is unnecessary.

The scope deliberately excludes a history when either component's default is
excluded by a required supported equality guard. Thus both `salt != default`
and `owner != default` can be quiet, independently of self binding. This is a
narrower source surface, not a general repair of an owner/salt domain obligation:
an owner restriction may still admit default salt, and nonzero salt alone does
not establish uniqueness or instance separation. Late checks constrain complete
successful histories. Exclusive branches retain separate guards.

Canonical self must reach the actual preimage. A helper-returned self value or
its exact bytes projection qualifies; storing self separately does not. A known
single-component identifier, a single aggregate parameter, constant component,
repeated parameter or other fully represented shape is outside the two-scalar
scope. Other native hash/commitment primitives are outside this initial rule.
Opaque or transformed preimages, opaque component guard operands, missing exact
history evidence and exhausted preparation/proof budgets yield rule-scoped
incomplete diagnostics. Absence of a rejection check alone never supplies a
feasible-default claim. Baseline-incomplete entries withhold structural absence;
standalone preparation also requires a complete resolved callable closure.

Preparation, exact interpretation, traversal and retained certificates share the
existing limits: 40,000 steps per entry, 256 paths and 50,000 cumulative abstract
values. Instruction/reference and cached/uncached execution preserve the same
findings. Values measure cumulative abstract allocation units, not physical
memory. The ordinary scan remains independent of this opt-in observation pass.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line public-two-component-domain-review -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/public-two-component-domain-review.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#privacy-and-cryptographic-derivations)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)