Repository navigation
Reconcile measured runtime and admission; fix intake and deployment recovery - #31
Draft
echoomegaprime wants to merge 31 commits into
Draft
echoomegaprime wants to merge 31 commits into
echoomegaprime wants to merge 31 commits into
Conversation
Successful hostile acceptance reports omitted the completed_phase_gate field required by the master collector. Publish P4 only after every core check and cleanup succeeds, and keep exact-wrapper reports pending until enrichment returns. Failed verification, malformed capture, interruption and nonzero exit cannot leave a newly completed report for the master consumer. Keep master validation, exact-source and signing rules, release verdicts and historical acceptance reports unchanged. Add producer/wrapper/consumer integration coverage including pending publication and failure paths. Validation: 24 focused and adjacent tests pass; full suite 637 pass, 2 skip, 1 existing symlink test blocked by Windows privilege 1314. P1 acceptance passes all 3 scenarios using a byte-identical source copy outside historical artifacts. Hosted CI, dual certification and deployment remain pending.
…#22) Release hardening so the P4 hostile acceptance gate can seal again: - Bump the pinned python:3.12-alpine base for all six role images, the sandbox default image and the P4 gate to sha256:4c47124a8391cb7a9f571164147d154777cf012a4ece5f86097130d7a4478111 (Trivy: 0 HIGH/CRITICAL findings on the new base). - Bump the hash-locked cryptography pin to 50.0.0 (all PyPI wheel and sdist hashes locked). - deploy_forge.sh: the dispatcher unit uses Wants= instead of Requires= on the API service so an API restart no longer tears down in-flight runs; the source-fetch git credential helper is configurable (CERTFORGE_GIT_CREDENTIAL_HELPER); the trusted manifest default is the canonical-JSON digest that run_worker pins (08ba068c...), not the raw file-bytes digest. - Opt the repository into its own CertForge gate with a stdlib-only journey (scripts/certforge_journey.py) and pin tests (tests/test_release_pins.py). The worker environment identity digest is label-derived and does not change with this release (8e6466d2...). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
…space (#22) The fresh P4 hostile-acceptance run for bc1b8ad built and sealed all 12 images and passed the scans, the static and runtime attack matrices and the custody and anchor service probes. It then stopped as INFRA_FAILED: the worker container exited before /healthz answered. Cause: since P6 (bfc2159) the worker app opens its deployment ledger at import time. Its default path, <package root>/var/deployments.sqlite3, resolves to /opt/var on the read-only image root, so uvicorn died with "Read-only file system: '/opt/var'". The last green P4 (9c07eb7) predates P6, so no P6-era source could pass P4 until now. Fix: the hardened probe sets ECHO_CERTFORGE_DEPLOYMENT_LEDGER to /workspace/state/deployments.sqlite3, next to the other state paths. Only the harness changes; production and the image stay as they are. Reproduced with the sealed worker image: exit 1 without the variable, healthy with it. A new test pins every worker state path to the writable workspace; it fails without this change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
Replace fixed labels with measured image, journey, policy, harness and public runtime inputs. Share operator profiles across status, dispatcher and worker, and fence effective OCI overrides and measurement loss before execution. Validation: 697 tests passed, 1 Docker test skipped on Windows; P1 acceptance passed; independent 19-test review passed. Exact committed source ran the FOREMAN program journey in the constrained FORGE sandbox. Production E2E, certification and deployment remain pending. Based on measured deployed d8ad9fd; preserve its acquisition and production-E2E protections. Canonical main 4f7d99e diverges and must be reconciled before merge. Tested local commit be1714b74107e29ffe6495fdb611a99bfd6daed7 has the identical Git tree.
Resolve authenticated job argv without caller image control, fence declared identity before acquisition, package public harness declarations, and preserve explicit operator pins. Correct P7 fixture commitments and extend the generated read-only SDK surface. Refs #30.
echoomegaprime
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CertForge could not promote the combined measured-runtime and journey-image repairs, and its deployment smoke resolved the default environment instead of the submitted job argv. This branch reconciles PR28, PR29 and canonical main while preserving deployed acquisition limits, collector trust configuration and bounded readiness polling.
Smoke verifies actual job environments and tenant isolation. Intake recovery isolates malformed reserved rows, refunds once and preserves concurrently bound work. Exhausted job-specific retries terminate with compensation; persisted cooldowns let other tenants progress. Operator measurement failures halt dispatch without consuming an unexecuted retry. Shared argv validation covers compatibility and legacy paths. Rollback after API start preserves acknowledged writes and before/after snapshots; incompatible prior source requires forward recovery.
Journey qualification now supports exactly the ECF security-update pair Node 24.22.1/Python 3.12.16 alongside the unchanged legacy Node 24.19.0/Python 3.11.x pair. Cross-pairs and other 3.12 patches fail. The ECF pair requires exactly one nodejs and CPython SBOM entry. A golden vector measured from the original15a41b0 implementation confirms legacy qualification serialization. Exact image/material/source commitments, fresh security and independent-build evidence, existing owner trust, reviewed request digest and signing lifetime limits remain required. This change does not admit an image or create trust.
Validation at 1457419: Windows full suite 800 passed, 4 platform skips; P1 passed. Exact-source FORGE qualification suite 62/62 passed, including all POSIX custody tests. Build preflight passed; Gitleaks found zero leaks. Independent source review found no blocking/high issue; the concrete inventory/compatibility concerns were fixed and reviewer obligations for unauthenticated reports are explicit. Hosted CI 40464903427 passed the full Linux suite and P1/P6/P7 acceptance at this exact head. Earlier 15a41b0 hosted full-suite/P1/P6/P7 and isolated real HTTP/runtime/rollback acceptance are historical evidence for the unchanged prior repair.
Production remains unchanged. The previously issued exact 15a41b0 signed verdict was NOT_READY for missing production E2E; it is not a certificate for this head. Current readiness, existing-owner image admission, exact source/App certification, actual rollback and authenticated production/client acceptance remain release requirements. The corrected ECF image independently passes 459 checks and its security scan, but those results do not authorize this control-plane release. Original owner branches and unrelated worktrees are preserved; production custody and signing guards are unchanged.