Repository navigation
Conversation
Port the remaining slice 2.3 resource-discovery change from #1262 at 122b786. Preserve the build facts already carried in #1435. Verify the three pure filesystem tests in development and release-build configurations with exact-name selection guards. CLI clippy, Rust formatting, domain lint and independent review pass.
Record Gate 1 for user approval: real A/B comparison and rebuild-check publication preserve Phase 1 identities while qualification remains closed. The narrower ordinary-release assurance claim requires explicit approval before implementation.
Port the closed producer primitives from #1262 at 122b786. Stage the manifest, error variants and fail-closed entrypoint; keep selection, signing and publication unavailable. Run 49 audited pure tests locally and wire full process tests and strict clippy into existing Linux CI jobs. Carry schemas unchanged with approved exact reference-host entries and rejection coverage. Document required shared dependency upgrades.
Record the approved merge activation, permanent companion profile contract, direct upload-action identity bridge, rerun rejection and read-only reusable-caller permissions before implementing the adapter.
Begin the separately approved Gate 1 adapter with strict observation shape, closed qualification claims and canonical/reproduction input/environment pairing. Keep the producer entrypoint closed while runtime pin, filesystem, transfer and equality stages remain pending. Verify red-green observation, root-alias and bounded-diagnostic regressions; 58 audited pure tests, strict producer clippy, formatting and domain lint pass. Independent review approves this staged unit with explicit runtime preconditions.
Extend the approved ordinary adapter with bounded full-byte equality after input pairing and observed digest/size checks. Retain bounded exact mismatch diagnostics without normalized or excluded regions; keep command assembly and qualified paths closed. Verify red-green equality coverage, custom-section and EOF differences, mutation-after-observation rejection, 62 audited pure tests and strict clippy. Independent review approves the staged comparison unit.
Reuse the reviewed ZIP32 primitive and negative fixtures from #1262 at 122b786 without moving collection authority into Phase 2. Enforce exact build/observation member sets and source-owned bounds before the original full integrity checks. Verify red-green profile admission, 71 audited pure tests, strict clippy and an exact-ID read-only probe of the current Fastly archive against its recorded GitHub digest. Independent/security review approves this structural unit; transfer authentication remains pending.
Preserve the incoming main integration, HTML EOF checks and corrected Axum bind diagnostics alongside the reviewed Phase 2 producer work. Resolve the compatibility audit by retaining the diagnostic correction and fresh-rehearsal requirement together with the approved rebuild-check profile and activation notes.
Carry the frozen inspection implementation from 122b786. Render the future recipe reference as inline code until its module lands. Keep release commands closed.
Carry the approved Phase 2 source and staged evidence-test splits from 122b786. Validate all seven ordinary cohort rows while preserving four closed controlled destination contracts. Keep qualified selectors and release execution closed.
Implement the approved Gate 1 canonical source recipe and consumed-output hashing. Use the reviewed Cargo message parser from 122b786 without constructing qualified receipts or enabling release commands.
Carry the reviewed preparation helpers from 122b786 while preserving fresh ordinary npm output. Keep the lifecycle observer unchanged at esbuild 0.27.3, document the current-lock gap, and visibly disable its full collector fixture with an enabling guard. Retain newer npm dependency versions and run subprocess fixtures only in CI.
Carry the remaining reviewed prose and formatting hunks from 122b786. Preserve current runtime changes and describe immutable release metadata without claiming a signed index. Cloudflare shell diagnostics remain identical to its pre-existing baseline.
Collaborator
Author
|
Rehearsal Implementation |
Collaborator
Author
|
Rehearsal Implementation |
Collaborator
Author
|
Rehearsal Implementation |
Collaborator
Author
|
Rehearsal First attempt and full release verification passed. Rerun-all attempt 2 passed all seven builds, the second Fastly build, real archive/current-attempt binding, byte comparison and signing. Publication then refused the existing immutable release before release mutations. This is a successful transfer/recovery check, not a second successful publication; the overall rerun ends red. Successful real comparison job. No ZIP rules, artifact names or duplicate checks were changed. A separate post-rerun online-SPDX check exposed a documentation uniqueness assumption: two valid pinned attestations now exist for the same binary; one equals the authenticated published SPDX. Their only predicate differences are creation timestamp and document namespace. Published-bundle verification remains valid. A proposed docs-only online example would accept a verified predicate exactly equal to the shipped SPDX, preserving every identity/source constraint; the docs-only correction is approved and prepared for the final documentation commit. Positive and one-byte-negative proof passed. No workflow or script change is claimed. Stack frames are omitted below; the command, record counts and assertion failure are retained. |
Collaborator
Author
|
Approved docs-only online-SBOM correction — live positive/negative proof At |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Docs-only since rehearsed 770a425 (v0.0.0-rehearsal.13).
…-attestations-phase2 # Conflicts: # docs/superpowers/plans/binary-attestations-phase1-compatibility.md
…binary-attestations-phase2 # Conflicts: # crates/trusted-server-cli/src/prebid_bundle.rs
8 of 11 tasks
Collaborator
Author
|
Phase 2 current-input rehearsal Source The first independent release download hit a connection timeout; 28 local assets already matched the API and the two missing files were recovered with bounded read-only download retries. The immutable release and workflow were not rerun. This closes the later-application-input and structured-diagnostic rehearsal gap at this exact source. Historical |
Collaborator
Author
|
Phase 2 current-input rehearsal Source The first independent release download hit a connection timeout; 28 local assets already matched the API and the two missing files were recovered with bounded read-only download retries. The immutable release and workflow were not rerun. This closes the later-application-input and structured-diagnostic rehearsal gap at this exact source. Historical |
Collaborator
Author
|
Phase 2 current-input rehearsal Source The first independent release download hit a connection timeout; 28 local assets already matched the API and the two missing files were recovered with bounded read-only download retries. The immutable release and workflow were not rerun. This closes the later-application-input and structured-diagnostic rehearsal gap at this exact source. Historical |
Collaborator
Author
|
Supplement to rehearsal .16: exact published Fastly runtime evidence — PASS The original three transcript parts established packaging/validation and byte equality, but did not contain this required runtime check. This supplement closes that historical evidence gap without changing the .16 release or attributing it to another source commit. PASS — exact rehearsal.16 Fastly WASM runtime/source-header/log check (local Viceroy 0.21.0; no deployment).
Scope: exact published Fastly WASM in local Viceroy with a controlled origin; deployed Fastly behavior and browser execution were not tested. Completed 2026-10-28T14:09:43.853Z. Detector sensitivity control also passed: the no-build-facts assertion rejected an in-memory copy of the captured log with one synthetic Authentication and launch commands (private paths represented by variables): COMMIT=5fa3843364f247fdc261c438ab9257323637a42c
TAG=v0.0.0-rehearsal.16
gh release verify-asset "$TAG" "$ASSETS/trusted-server-fastly.wasm" --repo prk-Jr/trusted-server
gh attestation verify "$ASSETS/trusted-server-fastly.wasm" \
--repo prk-Jr/trusted-server --source-ref "refs/tags/$TAG" \
--source-digest "$COMMIT" --signer-digest "$COMMIT" \
--deny-self-hosted-runners --predicate-type https://slsa.dev/provenance/v1 \
--bundle "$ASSETS/trusted-server-fastly.wasm.provenance.sigstore.json" \
--custom-trusted-root "$ASSETS/trusted_root.jsonl" \
--cert-identity "https://github.com/prk-Jr/trusted-server/.github/workflows/release-build.yml@refs/tags/$TAG" \
--format json
"$ASSETS/ts-aarch64-apple-darwin" config init --app-config "$WORKSPACE/trusted-server.toml"
# After configuring only private loopback stores and fictional secrets:
"$ASSETS/ts-aarch64-apple-darwin" config push --adapter fastly --local \
--manifest "$WORKSPACE/edgezero.toml" --app-config "$WORKSPACE/trusted-server.toml" \
--yes --no-diff --no-env
"$VICEROY_0_21_0" --config "$WORKSPACE/fastly.toml" \
--addr 127.0.0.1:19450 --log-stdout --log-stderr \
"$ASSETS/trusted-server-fastly.wasm"Explicit results: The official Viceroy 0.21.0 Darwin ARM64 archive was checksum-verified against GitHub asset 529469175: |
Collaborator
Author
|
Rehearsal .17 — infrastructure failure; source unchanged Tag
The next attempt uses fresh lightweight |
Collaborator
Author
|
Rehearsal .18 — repeated ARM64 hosted-runner acquisition failure The source rehearsed by both tags is 36454c5 on Phase 1 base 4940928. The later documentation-only PR head 5163241 records the open gate; these tag runs do not attest that later head. All four IAB workflow runs for source 36454c5 completed successfully: 29 successful checks and four expected skips. Hosted macOS producer supervision passed all 45 selected tests; Linux producer unit tests passed 952 with nine explicitly ignored tests, boundary integration passed three, command integration passed 18, and the explicit comparison-failure sentinel passed. Fresh fork rehearsals v0.0.0-rehearsal.17 (https://github.com/prk-Jr/trusted-server/actions/runs/40710926728) and v0.0.0-rehearsal.18 (https://github.com/prk-Jr/trusted-server/actions/runs/40714430928) both hit the same external blocker: the ARM macOS CLI job never acquired a hosted runner. The check annotations report “The job was not acquired by Runner of type hosted even after multiple attempts” and macOS arm64 capacity constraints. No steps ran for those ARM jobs. Rehearsal .17 settled with nine successful jobs, one cancelled job, and two expected skips for signing and release. Rehearsal .18 settled with the same nine successful jobs, one cancelled job, and two skips for signing and release. Neither tag has a published or draft release. Both lightweight tags remain at the reviewed source commit. No workflow rerun, tag reuse, deletion, retargeting, or settings change was performed. Fresh immutable-publication, attestation and exact-release runtime verification remains pending a successful new rehearsal; the earlier .16 evidence remains historical and is not evidence for the new process cleanup change. The PR remains draft. No .19 attempt is queued. A fresh successful seven-binary rehearsal remains the release-readiness gate once hosted ARM64 capacity is available; no cohort or verification requirement is waived. The original .16 exact-runtime evidence gap is separately closed: #1449 (comment) |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
trusted-server-fastly.wasm.rebuild-check.json, with current-run transfer binding. Preserve the seven binary names, reusable signer and existing binary/SPDX verification commands; publication grows to 30 files.Changes
crates/trusted-server-release/**; workspace manifests/lockcrates/trusted-server-js/**; CLI resource discovery.github/workflows/{release,release-build,test,format}.yml;scripts/release/phase1*;AGENTS.md5163241 size versus Phase 1
4940928e8: 266 new files (one binary fixture), 87,680 new text lines; 42 existing files +4,755/−614. Rust: 79,259 new lines +311 existing additions. Workflow/script/non-Rust test support, including its manifests/fixtures: 6,147 new lines +2,349 existing additions. Remaining text is docs, schemas and lockfile. Frozen source:122b78664b1235c717e9208fd200f9a9b0c335df.Closes
Part of #1235. This parent issue tracks the phased work; no separate tracking issue is pending. This PR does not close its remaining maintainer settings/approval requirements.
Spec / Plan
Phase 2 spec with its own two-round review log · Approved Gate 1 design · implementation and normalization plan · phase assignment · compatibility/evidence record.
Test plan
Fresh rehearsal .19 in progress: fork run 40726649596, exact reviewed source
5163241b947b1aa335987bd832b9205e4364e4bb, fresh lightweight tag. No source or settings changes; readiness remains pending successful seven-binary publication, full attestation/membership checks and exact published-byte runtime verification.Current head
5163241b947b1aa335987bd832b9205e4364e4bbis docs-only since implementation36454c526. All three follow-up commits are signed and GitHub-Verified. Current-head hosted CI passed: 29 successful checks and four expected skips; documentation lint, Prettier/site build, domain lint and whitespace checks passed locally. The five records now preserve historical source attribution and leave successful fresh rehearsal explicitly pending.Implementation
36454c526: 29 hosted checks passed; four expected skips. Local locked host all-target check/strict all-feature clippy passed. The signal-zero regression first failed on the old signal 9; all five pure tests then passed. Independent source/permissions review found no blocking findings. Actual PGID recycling was not reproduced; the regression proves confirmation cannot request a destructive signal. Real process tests ran only in hosted CI.36454c526Current docs-head checks: Binary, Tests, Format, Integration (all four workflows passed at
5163241b947b1aa335987bd832b9205e4364e4bb).Required published-byte runtime proof: .16 supplement, exclusively source
5fa3843364f247fdc261c438ab9257323637a42c. Authenticated unchanged Wasm ran under pinned Viceroy 0.21.0: three publisher responses and the injected JS route returned 200 with the full source header; actual request/response logs were visible with zero build-facts lines. Wrong-source/log-sensitivity controls passed; owned listeners stopped. Local Viceroy scope only, no deployment/browser claim. This closes the original evidence gap; it does not rehearse the later code correction.Prior fresh-attempt capacity failures: .17 and .18, both source
36454c526, lost their queued ARM64 macOS jobs before acquiring any runner. Annotations cite hosted capacity constraints; Fastly reproduction/comparison passed. Final .17 record: 9 successful jobs, one cancellation, signing/release skipped, no draft/published release. Final .18 record: identical 9-success / 1-runner-cancellation / 2-skip result; no release or draft. Tags are preserved; no runner/cohort/setting change or verification waiver.Historical publication proof: .16 at
5fa384336passed 18 jobs, 30 immutable prerelease assets, 29 checksums, all online/offline binary predicates/identities, SPDX equality, companion joins/provenance and native/packaging checks. Transcripts 1, 2, 3. An initial download timeout was recovered read-only. Reproduction 269s; comparison 86s. .13 stays at770a425df; rerun-all recovery and online-SBOM negative control remain historical3ccfe2971evidence.Checklist
36454c526exact-head CI passed; qualifications/later gates remain closed.5163241b9hosted CI passed (29 success, four expected skips).Human gates and limits
Merging Phase 2 activates the equality gate on the next eligible tag: a second Fastly build plus comparison, no release on mismatch. Native release CI builds each asset once; controlled qualification, later index/SPDX/consumer gates and GNU masking remain closed. Keep draft; request no reviewers. No IAB tags, releases or settings changes.
Allowlist changes needing maintainer review: exact
json-schema.organdspdx.orgentries, with justification and rejection tests; four per-lineapi.github.comsuppressions, no wildcard/global API-host entry.Outside-scope CI fix (mirrors main #1454): separate
886cf333apins only the browser runner to Ubuntu 24.04 with the same comment; later merges retain the upstream fix.