test(agent-challenge): lock review ack on discovered Phala app_id - #2
Open
alpha1122x wants to merge 1 commit into
Open
Conversation
The live review ack returned 409 review_deployed_conflict because the server pinned receipt.app_id to the assignment app_identity. A non-operator deployer always mints a different app_id, so that pin rejected every multi-account deployment by construction. Cover the ack path through mark_review_deployed: a discovered app_id is accepted, an identical re-ack stays idempotent, and a rebound receipt or rebound compose_hash is still refused so the trust anchors hold.
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1.
Why
The live review ack returned
409 review_deployed_conflict. Diagnosed against the production DB (read-only) for assignmentra_hAVZdRfdxbU5VCr_3QRIQdmrOfbhefZS:current_assignment_iddeployed_at/deployed_receipt_jsonreview_queuedapp_identityf024ea2315…(operator pin)app_id49b6c172…(discovered)Live error:
review deployed acknowledgement receipt app_id mismatches assignment.A non-operator deployer always mints a different
app_id, so the server-side pin rejected every multi-account deployment by construction. The 409 is direct evidence that the multi-account change was necessary.What this PR does
Tests only — the production fix (dropping the
app_idpin) already landed in #1 (1b18bf71). The running master image is stale and still pins; it needs a redeploy.Locks four behaviours through
mark_review_deployed:app_id!= assignment pin is acceptedcompose_hashis still rejected — trust anchors (compose_hash+ KMS digest) preservedNot fixed here
report_generation_failedon the review guest. It is downstream of this 409 and needs a re-run after the master redeploy to confirm.Tests
57 failed, 3266 passed, 9 skipped, 6 errors— identical failure set to baseline (zero newly broken, +4 passes). Pre-existing failures/errors are unrelated. Blackbox17 failed / 19 passed. ruff clean.