R2 engineering program: trust-chain PRs, profiles, holdout, and rc.1 docs - #14
Merged
Conversation
Establish the authoritative post-control-plane audit and the ordered sprint/PR execution plan for the v1.3.0-rc.1 candidate without re-attributing signed v1.2.1.
Point the adoption dashboard, roadmap, and doc index at the R2 audit/program so operators do not treat typed control-plane work as covered by signed v1.2.1.
Stop deriving size_bytes from digest hex length so material references remain honest under size regression checks and shadow/compiler bridges.
Inherit only allowlisted parent variables, always strip secrets, and reject non-positive wall-time budgets so workers fail closed instead of inheriting credentials or running unbounded.
Download and verify release assets in a token-bearing step, then evaluate without secrets so holdout aggregation cannot leak credentials or accept unverified corpora.
Badge and summary metrics may cite the measured commit without labeling skip-ci or incomplete workflow SHAs as verified source provenance.
Drop duration_ms from attempt digests and extend fallback/cache model types so equivalent runs share stable IDs while later PRs can carry provenance-preserving cache and cause-specific fallback policy.
Store CachedBackendExecution instead of result-only payloads so cache hits replay original attempts and tool provenance rather than re-inferring native execution from the current environment.
Reject unsupported coverage as required primaries and stop hardcoding coverage_requirements_met so router assessments reflect real material and backend support.
Block timeouts, tool errors, invalid output, and resource exhaustion from becoming accepted passing fallbacks under FallbackPolicy v2.
Replay stored cache attempts with intact provenance, surface fallback policy outcomes, and skip execution on compiler vs routing guarantee mismatches instead of silent rewrite.
Require explicit provenance policy before treating branch-protection metadata as trusted so current-state-only signals cannot authorize allow decisions.
Compile typed obligations before routing and share one routing_id across kernel, planner, and MCP so compat and typed paths cannot diverge.
Move pure evaluators behind a subprocess entrypoint with externally enforced wall-time and output limits so authoritative deterministic adapters cannot run in-process only.
Require the control-plane worker for authoritative deterministic runs so wall-time, env, and cancellation are enforced outside adapter process logic.
Share the externally enforced worker contract for OPA/Z3 paths and stop post-hoc soft timeout rewriting based only on elapsed wall time after return.
Use the single routing pipeline for enforced execution and fail closed when self-protection allow decisions lack trusted metadata provenance.
Cross-bind canonical material-set digests across evidence, provenance, and attestation so forged or incomplete control-plane traces fail closed under INV-021.
Lock fail-closed behavior for unmet coverage, blocked fallback terminations, and untrusted self-protection metadata before later routing and isolation layers.
Assert single-route identity, deterministic/native worker isolation, and v3 schema expectations on enforced lanes so trust-chain PRs 6-9 stay fail-closed.
Introduce explicit trusted source profiles for AST authorization, recursive Terraform, and controller-aware Kubernetes so stricter compilation is gated on profile evidence rather than implied by file presence.
Replace presence-only strict_eligible generation with semantic statuses so public claims require executed profile evidence rather than fixture or link existence.
Keep prediction generation free of protected labels and provide a digest helper so evaluation can stay separated from publication aggregates.
Update immutable-pin scaffolding and workflow evidence collection so external consumer gates target current typed-control-plane candidates instead of v1.2.1 alone.
Require correct benchmark vs verified-source terminology, signed artifacts, and workflow retention before promoting the release candidate.
Resolve holdout, worker isolation, and release-status conflicts by keeping the R2 trust/routing program while integrating main supply-chain and environment hardenings.
Normalize import blocks and blank lines so CI lint passes on the merged tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v1.3.0-rc.1candidate without re-attributing signedv1.2.1.Test plan
tests/test_trust_chain_r2_pr3_pr4_pr5.py,tests/test_routing_pipeline_r2_pr6.py,tests/test_deterministic_worker_r2_pr7.py,tests/test_adapter_isolation_r2_pr8.py,tests/test_evidence_v3_r2_pr9.pytests/test_verification_cache.py,tests/test_cache_worker_control_plane.pymainonly after required checks pass