Repository navigation
Finisher: independent fail-closed live verification collector (task 50135) - #44
Closed
echoomegaprime wants to merge 19 commits into
Closed
echoomegaprime wants to merge 19 commits into
echoomegaprime wants to merge 19 commits into
Conversation
Successful hostile acceptance reports omitted the completed_phase_gate field required by the master collector. Publish P4 only after every core check and cleanup succeeds, and keep exact-wrapper reports pending until enrichment returns. Failed verification, malformed capture, interruption and nonzero exit cannot leave a newly completed report for the master consumer. Keep master validation, exact-source and signing rules, release verdicts and historical acceptance reports unchanged. Add producer/wrapper/consumer integration coverage including pending publication and failure paths. Validation: 24 focused and adjacent tests pass; full suite 637 pass, 2 skip, 1 existing symlink test blocked by Windows privilege 1314. P1 acceptance passes all 3 scenarios using a byte-identical source copy outside historical artifacts. Hosted CI, dual certification and deployment remain pending.
…#22) Release hardening so the P4 hostile acceptance gate can seal again: - Bump the pinned python:3.12-alpine base for all six role images, the sandbox default image and the P4 gate to sha256:4c47124a8391cb7a9f571164147d154777cf012a4ece5f86097130d7a4478111 (Trivy: 0 HIGH/CRITICAL findings on the new base). - Bump the hash-locked cryptography pin to 50.0.0 (all PyPI wheel and sdist hashes locked). - deploy_forge.sh: the dispatcher unit uses Wants= instead of Requires= on the API service so an API restart no longer tears down in-flight runs; the source-fetch git credential helper is configurable (CERTFORGE_GIT_CREDENTIAL_HELPER); the trusted manifest default is the canonical-JSON digest that run_worker pins (08ba068c...), not the raw file-bytes digest. - Opt the repository into its own CertForge gate with a stdlib-only journey (scripts/certforge_journey.py) and pin tests (tests/test_release_pins.py). The worker environment identity digest is label-derived and does not change with this release (8e6466d2...). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
…space (#22) The fresh P4 hostile-acceptance run for bc1b8ad built and sealed all 12 images and passed the scans, the static and runtime attack matrices and the custody and anchor service probes. It then stopped as INFRA_FAILED: the worker container exited before /healthz answered. Cause: since P6 (bfc2159) the worker app opens its deployment ledger at import time. Its default path, <package root>/var/deployments.sqlite3, resolves to /opt/var on the read-only image root, so uvicorn died with "Read-only file system: '/opt/var'". The last green P4 (9c07eb7) predates P6, so no P6-era source could pass P4 until now. Fix: the hardened probe sets ECHO_CERTFORGE_DEPLOYMENT_LEDGER to /workspace/state/deployments.sqlite3, next to the other state paths. Only the harness changes; production and the image stay as they are. Reproduced with the sealed worker image: exit 1 without the variable, healthy with it. A new test pins every worker state path to the writable workspace; it fails without this change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
Owner
Author
|
Closing as superseded by PR #47 (hardened Finisher collector), merged 2026-11-11 as commit 5837030 into agent/certforge-security-release-20260924 (stacked on PR #25, merged as b809bd5). The collector source in this PR (36d44b0) was replaced by the focused/hardened line in #47 under FC task 50024 owner admission (Bob, 2026-11-11). No work is lost: the #47 line contains the collector with owner-route receipt binding and exact rollback identities. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Deliver an independent, fail-closed Finisher live-verification collector source for task 50135. This PR is the boundary-C collector source handoff; it is not a production deployment, administrative admission, or signed production-e2e verdict.
Source identity
agent/finisher-collector-50135-2026110736d44b03a36b7e8db21ff834b13c350c7295c3aadocs/FINISHER_COLLECTOR.mdVerification completed on QUENCH
python scripts/p1_acceptance.pypassedRelease readiness
UNSIGNED_CANDIDATE / NOT_READY. The preflight found 22 PASS, 8 BLOCKED: continuity.live; connector.authentication; connector.scopes; certforge.exact_sha; certification_app.exact_sha; github.repository_access; deployment.target; rollback.tested. GitHub access has now been restored for opening this PR, but that does not convert the release preflight into a live acceptance run.
Outstanding owner gates: independently reviewed/admitted collector runtime and signer, real authenticated eight-front native/Cloudflare acceptance, exact source/image/install and target/environment binding, negative controls, stability, rollback, external acceptance, signed envelope installation and a fresh CertForge release verdict. Do not merge or deploy merely on the strength of offline tests.
Safety
The source collector fails closed on missing evidence and may not self-authorize, self-sign, change owner grants, or substitute fixtures for live provider execution.