config set with a newline in a value writes unparseable TOML and breaks every later config read

[ilyeji]

Environment: Ubuntu 24.04.4, Python 3.12.3, cathedral-cli@a663cdb.

Reproduce:

export CATHEDRAL_HOME=$(mktemp -d)
./cathedral config set distill model 'x"
hotkey = "5EVILEVILEVILEVILEVILEVILEVILEVILEVILEVILEVILEVI'    # exit 0
./cathedral config show distill                                # exit 12

What lands on disk:

model = "x\"
hotkey = \"5EVILEVILEVILEVILEVILEVILEVILEVILEVILEVILEVILEVI"

$ python3 -c "import tomllib; tomllib.load(open(CONFIG,'rb'))"
TOMLDecodeError: Illegal character '\n' (at line 12, column 13)

The writer escapes " correctly but not the newline, and a raw newline is illegal inside a TOML basic string.

To be precise about severity — this is not key injection. The quote is escaped, so hotkey does not become a real key and config show never returns the attacker value. The problem is corruption: the file becomes unparseable, and every subsequent config read fails with exit 12. A single config set bricks the node's configuration, recoverable only by hand-editing or deleting the file.

Corresponds to gate 0 failures TestConfigInjection::test_no_payload_injects_a_key_or_corrupts_the_file (fails on the corruption assertion, not the injection one) and test_toml_rendering_escapes_control_characters.

Suggested fix: escape control characters when rendering TOML strings, or reject values containing them at config set.

[wallscaler]

Closing after independent reproduction on current main.

A Distill model value containing a literal newline is written as an escaped TOML string. Python tomllib parses the file and cathedral config get distill model returns the original value. The corruption reported here no longer reproduces.

[wallscaler]

Resolved by merged PR #3. TOML control characters now render safely, and the corruption regression coverage passes in draft PR #12's exact 366-test Ubuntu run. Closing this issue as completed.