Validate QuPath registry entries and cached manifests to the shared Toolkit/Fiji contract #20

Failure mechanism

The QuPath registry reader LcRegistry.load() treats the JSON files it discovers as executable-app configuration, but currently checks only:

• that the interpreter file exists;
• that its lexical path lies under the declared prefix;
• that the registry JSON file is not group/world writable where POSIX attributes are available;
• that the loaded cached schema says protocol == 1.

It does not validate the types, shape or identifier constraints of entry.name, entry.module, entry.pythonpath, schema.tools, input names/types or result metadata. It does not check the cached schema file's ownership/writability, even though its contents build the form. It also does not apply the ownership and interpreter-directory checks in the Toolkit registry or the Fiji host registry.

For example, schema.tools: null or an input without an identifier can be accepted by load() and fail later during tool selection or form construction. A schema altered in a writable shared location can supply unexpected parameter types or names to UI and file-generation code. This is a manifest-validation and registry-trust inconsistency. Registered applications are executable programs, not sandboxed workloads; the proposed checks prevent accidentally accepting malformed or unexpectedly modifiable metadata, not malicious behavior by an application the user intentionally installed.

Proposed correction

Use the Toolkit's registry-entry validation and the Fiji host's schema validation as the shared minimum. Reject malformed entries and schemas before they enter the app selector. Apply consistent POSIX ownership and permissions checks to the registry file, cached schema, and executable paths (with documented Windows behavior). Preserve useful skip reasons per application rather than aborting discovery.

Acceptance criteria

• Reject malformed pythonpath, missing/invalid tools, unsafe parameter identifiers, unsupported types and invalid cached schema structures without crashing the form.
• Refuse unexpected changes to a cached schema file's ownership or writable permissions on POSIX.
• Valid applications from user, shared and system registry locations remain discoverable.
• Add regression fixtures equivalent to the Toolkit/Fiji trust and schema tests.
• State explicitly which trust checks are not available on Windows.

Priority: P2 — malformed or altered registry entries can reach the UI and worker boundary. Source comparison; tests not executed in this audit.