Repository navigation
Bind dependency-complete runners to exact project source - #33
Draft
echoomegaprime wants to merge 23 commits into
Draft
echoomegaprime wants to merge 23 commits into
echoomegaprime wants to merge 23 commits into
Conversation
Successful hostile acceptance reports omitted the completed_phase_gate field required by the master collector. Publish P4 only after every core check and cleanup succeeds, and keep exact-wrapper reports pending until enrichment returns. Failed verification, malformed capture, interruption and nonzero exit cannot leave a newly completed report for the master consumer. Keep master validation, exact-source and signing rules, release verdicts and historical acceptance reports unchanged. Add producer/wrapper/consumer integration coverage including pending publication and failure paths. Validation: 24 focused and adjacent tests pass; full suite 637 pass, 2 skip, 1 existing symlink test blocked by Windows privilege 1314. P1 acceptance passes all 3 scenarios using a byte-identical source copy outside historical artifacts. Hosted CI, dual certification and deployment remain pending.
…#22) Release hardening so the P4 hostile acceptance gate can seal again: - Bump the pinned python:3.12-alpine base for all six role images, the sandbox default image and the P4 gate to sha256:4c47124a8391cb7a9f571164147d154777cf012a4ece5f86097130d7a4478111 (Trivy: 0 HIGH/CRITICAL findings on the new base). - Bump the hash-locked cryptography pin to 50.0.0 (all PyPI wheel and sdist hashes locked). - deploy_forge.sh: the dispatcher unit uses Wants= instead of Requires= on the API service so an API restart no longer tears down in-flight runs; the source-fetch git credential helper is configurable (CERTFORGE_GIT_CREDENTIAL_HELPER); the trusted manifest default is the canonical-JSON digest that run_worker pins (08ba068c...), not the raw file-bytes digest. - Opt the repository into its own CertForge gate with a stdlib-only journey (scripts/certforge_journey.py) and pin tests (tests/test_release_pins.py). The worker environment identity digest is label-derived and does not change with this release (8e6466d2...). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
…space (#22) The fresh P4 hostile-acceptance run for bc1b8ad built and sealed all 12 images and passed the scans, the static and runtime attack matrices and the custody and anchor service probes. It then stopped as INFRA_FAILED: the worker container exited before /healthz answered. Cause: since P6 (bfc2159) the worker app opens its deployment ledger at import time. Its default path, <package root>/var/deployments.sqlite3, resolves to /opt/var on the read-only image root, so uvicorn died with "Read-only file system: '/opt/var'". The last green P4 (9c07eb7) predates P6, so no P6-era source could pass P4 until now. Fix: the hardened probe sets ECHO_CERTFORGE_DEPLOYMENT_LEDGER to /workspace/state/deployments.sqlite3, next to the other state paths. Only the harness changes; production and the image stay as they are. Reproduced with the sealed worker image: exit 1 without the variable, healthy with it. A new test pins every worker state path to the writable workspace; it fails without this change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
Replace fixed labels with measured image, journey, policy, harness and public runtime inputs. Share operator profiles across status, dispatcher and worker, and fence effective OCI overrides and measurement loss before execution. Validation: 697 tests passed, 1 Docker test skipped on Windows; P1 acceptance passed; independent 19-test review passed. Exact committed source ran the FOREMAN program journey in the constrained FORGE sandbox. Production E2E, certification and deployment remain pending. Based on measured deployed d8ad9fd; preserve its acquisition and production-E2E protections. Canonical main 4f7d99e diverges and must be reconciled before merge. Tested local commit be1714b74107e29ffe6495fdb611a99bfd6daed7 has the identical Git tree.
Resolve authenticated job argv without caller image control, fence declared identity before acquisition, package public harness declarations, and preserve explicit operator pins. Correct P7 fixture commitments and extend the generated read-only SDK surface. Refs #30.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FieldDesk's exact-source certification failed because the shared minimal Python runner lacks Node and the application dependencies. This candidate lets an operator bind a pinned image, bounded resources, exact journey and dependency hashes to one tenant, project, repository and source revision. Other repositories retain the default sandbox. The API resolves the same environment the worker selects from persisted run identity; changed dependencies fail before target execution. Callers cannot select images or isolation settings.
The candidate reconciles canonical main's readiness timeout with the installed d8ad9fd security baseline and reuses the existing measured-runtime/job-binding implementation through 690ea5b. It preserves deployed acquisition, production-E2E and subscriber governance guards; replacing installed code with older main would lose those protections. The new source-bound selection is commit39dc90b. Paired App candidate: agent/fielddesk-runtime-resolution-20261027 in echo-certification-forge-app.
Validation: full repository suite743passed/1skipped; required P1acceptance passed; generated62-capability SDK contract and whitespace checks passed. New behavioral cases cover runtime selection, wrong revision, other tenant/project/repository, invalid profile fields, dependency tampering, API/worker agreement and preserved NOT_READY gates. Exact FieldDesk sourcee4aa9b6 passed all4 journey steps including122backend cases in40.479s through the new selected profile on FORGE. Docker inspection verified pinned image85be3ef1,2GiB memory+swap,1CPU,128PIDs,64MiB noexec/nosuid tmpfs,networknone,nonroot,read-only source/root,all capabilities dropped and no-new-privileges. Owned container cleanup verified.
Release remains held. This is source and disposable execution evidence, not issuer admission or production certification. Independent review, image qualification, authentic issuer-readiness renewal, paired SDK/App rollout and trusted production-E2E collector evidence remain required. No installed service, key, trust root, readiness timestamp, queue owner, customer data or public deployment was changed. Roll back the candidate branch or, after an independently admitted rollout, restore the preserved prior release and public profile; do not rewrite queued environment commitments. Evidence:/home/forge/fielddesk-staging/runtime-repair-20261027/bound-journey-result.json.