Conflict file naming collision vulnerability

[montfort]

Severity: Low
Component: Conflict Resolver
Simulation: SIM-L4-005
Sprint: 6

Description

Conflict file naming (_conflict suffix) can collide with existing files.

Proposed Fix

Use timestamp + UUID in conflict file names.

Source

Imported from .straymark/02-design/risk-analysis/BACKLOG-simulation-issues.md on 2026-05-29.

---

Cross-referenced analysis: RISK-003-10

Risk ID: RISK-003 / LOSS-003
Severity: MEDIUM
Probability: Low
Impact: File Overwrite
Component: ConflictResolver

Description

When resolving conflicts with "keep-both" strategy, the system creates a renamed copy. If the naming scheme is predictable and a file with that name already exists, it may be overwritten.

Vulnerable Flow

Original: document.docx
Conflict: document.docx_conflict

If document.docx_conflict already exists:
  → OVERWRITTEN!

Safe Naming Strategy

1. Include timestamp in naming: YYYYMMDD_HHMMSS
2. Include short UUID (first 8 chars)
3. Separate with underscores for readability
4. Check for existing files before creation
5. Increment counter if collision detected

Example Output

document_conflict_20260131_143022_a1b2c3d4.docx

Extra Safety

Loop counter to ensure uniqueness:

document_conflict_20260131_143022_a1b2c3d4_1.docx
document_conflict_20260131_143022_a1b2c3d4_2.docx

Source

Imported from .straymark/02-design/risk-analysis/RISK-003-data-integrity.md on 2026-05-29.

[montfort]

Triage M0 — VIGENTE-POR-AUSENCIA; asignado a M6 ("no destruye datos"). Verificado 2026-07-04: no existe ninguna lógica de renombrado _conflict/keep-both sobre disco en el repo (solo el enum Resolution::KeepBoth, conflict.rs:80,90, que hoy no genera copia). El esquema de nombres vulnerable no puede ocurrir porque no está escrito. Al implementar KeepBoth en M6, nacer directamente con timestamp+UUID como recomienda este issue — así la vulnerabilidad nunca existe.