Skip to content

Extend sealed result pickup window to seven days #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mark-e-deyoung merged 2 commits into from
Sep 15, 2026
Merged

Extend sealed result pickup window to seven days #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b1f849b
Extend sealed result retention to seven days
mark-e-deyoung Sep 14, 2026
507a275
Document seven-day sealed result pickup window
mark-e-deyoung Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/sealed-public-execution.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ jobs:
.sealed/result.age
.sealed/receipt.json
if-no-files-found: error
retention-days: 1
retention-days: 7
compression-level: 0

- name: Preserve task verdict
Expand Down
4 changes: 2 additions & 2 deletions docs/sealed-public-execution.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Public runner responsibilities:
3. capture task stdout/stderr into the private result bundle rather than Actions logs;
4. collect files written beneath `SEALED_RESULT_DIR`;
5. package and encrypt the result to the supplied age recipient;
6. upload only `result.age` plus a minimal `receipt.json` as a one-day Actions artifact;
6. upload only `result.age` plus a minimal `receipt.json` as a seven-day Actions artifact;
7. preserve task success/failure in the workflow verdict.

## Capsule contract
Expand Down Expand Up @@ -55,7 +55,7 @@ The public artifact contains only:
- `result.age` — age-encrypted gzip tar containing execution metadata, captured stdout/stderr, and result files;
- `receipt.json` — opaque assignment ID, completed/failed status, ciphertext SHA-256/size, public worker revision, and Actions run correlation.

Retention is set to one day. Private reconciliation should normally delete the artifact sooner after successful pickup/decryption.
Retention is set to seven days. This is a pickup/recovery window, not a durable evidence store. Trusted-side reconciliation should normally retrieve and delete the artifact sooner after successful pickup/decryption.

The artifact is transport, not durable project authority. Durable conclusions, accepted evidence, negative results, or follow-on decisions belong back in the originating private/project-native authority.

Expand Down
Loading