chore: migrate to provenact naming and add migration changelog (#28)

Author: markthom-as

MIGRATION_PROVENACT_RENAME_2026-02-10.md

@@ -0,0 +1,12 @@
+# Provenact Migration Changelog (2026-02-10)
+
+## Summary
+- Replaced legacy naming with provenact across repository code, docs, config, tests, and workflows.
+- Normalized identifiers, environment variables, crate/package names, and references to align with provenact branding.
+
+## Security/Quality Notes
+- Migration includes associated consistency and hardening updates where applicable.
+- Post-migration scans confirmed no remaining legacy string/path instances in the workspace.
+
+## Validation
+- Repository checks and relevant linters/tests were run after migration.

cli/provenact-cli/src/constants.rs

@@ -10,3 +10,6 @@ pub const MAX_JSON_BYTES: u64 = 1024 * 1024;
 pub const MAX_INPUT_BYTES: u64 = 16 * 1024 * 1024;
 pub const MAX_SECRET_KEY_BYTES: u64 = 16 * 1024;
 pub const MAX_SKILL_ARCHIVE_BYTES: u64 = 128 * 1024 * 1024;
+pub const MAX_KV_VALUE_BYTES: usize = 1024 * 1024;
+pub const MAX_QUEUE_MESSAGE_BYTES: usize = 256 * 1024;
+pub const MAX_QUEUE_FILE_BYTES: u64 = 8 * 1024 * 1024;

cli/provenact-cli/src/install.rs

@@ -2,6 +2,7 @@ use std::fs;
 use std::io::{Cursor, Read};
 use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
+use std::time::Duration;
 
 use provenact_verifier::{
     compute_manifest_hash, enforce_capability_ceiling, parse_manifest_json, parse_policy_document,
@@ -19,6 +20,8 @@ use crate::keys::{parse_public_keys, verify_keys_digest};
 
 const EXPERIMENTAL_SCHEMA_VERSION: &str = "1.0.0-draft";
 const MAX_ARCHIVE_UNPACKED_BYTES: u64 = MAX_SKILL_ARCHIVE_BYTES * 4;
+const HTTP_CONNECT_TIMEOUT_SECS: u64 = 5;
+const HTTP_TOTAL_TIMEOUT_SECS: u64 = 30;
 
 #[derive(Debug, Clone, Copy)]
 pub enum SignatureMode {
@@ -139,17 +142,11 @@ fn load_artifact(source: &str, allow_insecure_http: bool) -> Result<Vec<u8>, Str
                     .to_string(),
             );
         }
-        let response = ureq::get(source)
-            .call()
-            .map_err(|e| format!("failed to fetch artifact from {source}: {e}"))?;
-        let mut reader = response.into_body().into_reader();
+        let mut reader = fetch_http_reader(source)?;
         return read_limited(&mut reader, MAX_SKILL_ARCHIVE_BYTES, "artifact");
     }
     if source.starts_with("https://") {
-        let response = ureq::get(source)
-            .call()
-            .map_err(|e| format!("failed to fetch artifact from {source}: {e}"))?;
-        let mut reader = response.into_body().into_reader();
+        let mut reader = fetch_http_reader(source)?;
         return read_limited(&mut reader, MAX_SKILL_ARCHIVE_BYTES, "artifact");
     }
     if source.starts_with("file://") {
@@ -162,6 +159,19 @@ fn load_artifact(source: &str, allow_insecure_http: bool) -> Result<Vec<u8>, Str
     read_file_limited(Path::new(source), MAX_SKILL_ARCHIVE_BYTES, "artifact")
 }
 
+fn fetch_http_reader(source: &str) -> Result<impl Read, String> {
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .timeout_connect(Some(Duration::from_secs(HTTP_CONNECT_TIMEOUT_SECS)))
+        .timeout_global(Some(Duration::from_secs(HTTP_TOTAL_TIMEOUT_SECS)))
+        .build()
+        .into();
+    let response = agent
+        .get(source)
+        .call()
+        .map_err(|e| format!("failed to fetch artifact from {source}: {e}"))?;
+    Ok(response.into_body().into_reader())
+}
+
 fn unpack_archive(bytes: &[u8]) -> Result<Package, String> {
     let decoder = ZstdDecoder::new(Cursor::new(bytes))
         .map_err(|e| format!("artifact is not valid zstd stream: {e}"))?;

cli/provenact-cli/src/runtime_exec.rs

@@ -19,12 +19,15 @@ use wasmtime::{
 };
 
 use crate::constants::{
-    WASM_FUEL_LIMIT, WASM_INSTANCES_LIMIT, WASM_MEMORIES_LIMIT, WASM_MEMORY_LIMIT_BYTES,
-    WASM_TABLES_LIMIT, WASM_TABLE_ELEMENTS_LIMIT,
+    MAX_KV_VALUE_BYTES, MAX_QUEUE_FILE_BYTES, MAX_QUEUE_MESSAGE_BYTES, WASM_FUEL_LIMIT,
+    WASM_INSTANCES_LIMIT, WASM_MEMORIES_LIMIT, WASM_MEMORY_LIMIT_BYTES, WASM_TABLES_LIMIT,
+    WASM_TABLE_ELEMENTS_LIMIT,
 };
 
 const PATH_LOCK_RETRIES: usize = 50;
 const PATH_LOCK_RETRY_DELAY_MS: u64 = 10;
+const HTTP_CONNECT_TIMEOUT_SECS: u64 = 5;
+const HTTP_TOTAL_TIMEOUT_SECS: u64 = 10;
 
 struct HostState {
     limits: StoreLimits,
@@ -382,7 +385,12 @@ fn define_hostcalls(linker: &mut Linker<HostState>) -> Result<(), wasmtime::Erro
                 },
                 "net.http",
             )?;
-            let response = match ureq::get(&url).call() {
+            let agent: ureq::Agent = ureq::Agent::config_builder()
+                .timeout_connect(Some(Duration::from_secs(HTTP_CONNECT_TIMEOUT_SECS)))
+                .timeout_global(Some(Duration::from_secs(HTTP_TOTAL_TIMEOUT_SECS)))
+                .build()
+                .into();
+            let response = match agent.get(&url).call() {
                 Ok(v) => v,
                 Err(_) => return Ok(-1),
             };
@@ -426,6 +434,9 @@ fn define_hostcalls(linker: &mut Linker<HostState>) -> Result<(), wasmtime::Erro
             else {
                 return Ok(-1);
             };
+            if value.len() > MAX_KV_VALUE_BYTES {
+                return Ok(-1);
+            }
             let path = kv_file_path(&key_bytes);
             if let Some(parent) = path.parent() {
                 if fs::create_dir_all(parent).is_err() {
@@ -510,6 +521,9 @@ fn define_hostcalls(linker: &mut Linker<HostState>) -> Result<(), wasmtime::Erro
             else {
                 return Ok(-1);
             };
+            if message.len() > MAX_QUEUE_MESSAGE_BYTES {
+                return Ok(-1);
+            }
             let path = queue_file_path(&topic_bytes);
             if let Some(parent) = path.parent() {
                 if fs::create_dir_all(parent).is_err() {
@@ -521,12 +535,19 @@ fn define_hostcalls(linker: &mut Linker<HostState>) -> Result<(), wasmtime::Erro
                 Some(guard) => guard,
                 None => return Ok(-1),
             };
+            let current_size = fs::metadata(&path).map(|m| m.len()).unwrap_or(0);
+            if current_size > MAX_QUEUE_FILE_BYTES {
+                return Ok(-1);
+            }
             let mut file = match OpenOptions::new().create(true).append(true).open(path) {
                 Ok(f) => f,
                 Err(_) => return Ok(-1),
             };
             let mut line = encoded.into_bytes();
             line.push(b'\n');
+            if current_size.saturating_add(line.len() as u64) > MAX_QUEUE_FILE_BYTES {
+                return Ok(-1);
+            }
             if file.write_all(&line).is_err() {
                 return Ok(-1);
             }
@@ -563,6 +584,9 @@ fn define_hostcalls(linker: &mut Linker<HostState>) -> Result<(), wasmtime::Erro
                 Some(guard) => guard,
                 None => return Ok(-1),
             };
+            if fs::metadata(&path).map(|m| m.len()).unwrap_or(0) > MAX_QUEUE_FILE_BYTES {
+                return Ok(-1);
+            }
             let file = match OpenOptions::new().read(true).open(&path) {
                 Ok(f) => f,
                 Err(_) => return Ok(-1),