Repository navigation
Harden ACB diagnostic collector with production signing boundaries - #26
Closed
echo-fleet-builder[bot] wants to merge 18 commits into
Closed
echo-fleet-builder[bot] wants to merge 18 commits into
echo-fleet-builder[bot] wants to merge 18 commits into
Conversation
Successful hostile acceptance reports omitted the completed_phase_gate field required by the master collector. Publish P4 only after every core check and cleanup succeeds, and keep exact-wrapper reports pending until enrichment returns. Failed verification, malformed capture, interruption and nonzero exit cannot leave a newly completed report for the master consumer. Keep master validation, exact-source and signing rules, release verdicts and historical acceptance reports unchanged. Add producer/wrapper/consumer integration coverage including pending publication and failure paths. Validation: 24 focused and adjacent tests pass; full suite 637 pass, 2 skip, 1 existing symlink test blocked by Windows privilege 1314. P1 acceptance passes all 3 scenarios using a byte-identical source copy outside historical artifacts. Hosted CI, dual certification and deployment remain pending.
…#22) Release hardening so the P4 hostile acceptance gate can seal again: - Bump the pinned python:3.12-alpine base for all six role images, the sandbox default image and the P4 gate to sha256:4c47124a8391cb7a9f571164147d154777cf012a4ece5f86097130d7a4478111 (Trivy: 0 HIGH/CRITICAL findings on the new base). - Bump the hash-locked cryptography pin to 50.0.0 (all PyPI wheel and sdist hashes locked). - deploy_forge.sh: the dispatcher unit uses Wants= instead of Requires= on the API service so an API restart no longer tears down in-flight runs; the source-fetch git credential helper is configurable (CERTFORGE_GIT_CREDENTIAL_HELPER); the trusted manifest default is the canonical-JSON digest that run_worker pins (08ba068c...), not the raw file-bytes digest. - Opt the repository into its own CertForge gate with a stdlib-only journey (scripts/certforge_journey.py) and pin tests (tests/test_release_pins.py). The worker environment identity digest is label-derived and does not change with this release (8e6466d2...). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
…space (#22) The fresh P4 hostile-acceptance run for bc1b8ad built and sealed all 12 images and passed the scans, the static and runtime attack matrices and the custody and anchor service probes. It then stopped as INFRA_FAILED: the worker container exited before /healthz answered. Cause: since P6 (bfc2159) the worker app opens its deployment ledger at import time. Its default path, <package root>/var/deployments.sqlite3, resolves to /opt/var on the read-only image root, so uvicorn died with "Read-only file system: '/opt/var'". The last green P4 (9c07eb7) predates P6, so no P6-era source could pass P4 until now. Fix: the hardened probe sets ECHO_CERTFORGE_DEPLOYMENT_LEDGER to /workspace/state/deployments.sqlite3, next to the other state paths. Only the harness changes; production and the image stay as they are. Reproduced with the sealed worker image: exit 1 without the variable, healthy with it. A new test pins every worker state path to the writable workspace; it fails without this change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152mN1wMwj9vE2YmV2xZF4F
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Superseded by #27, which contains only the three collector files on canonical main. This draft exposed unrelated deployed-base ancestry and is closed without merge; its branch and history are preserved.
The Account Continuity Bridge production collector lived only in a historical HAMMER owner workspace and hard-coded a September release. This places its hash-verified source under canonical CertForge ownership with explicit candidate identity, current test and native-tool inventory checks, caller-pinned evidence bytes, and meaningful acceptance regressions.
Production signing now requires measured
productioninstallation evidence. A realisolated_canaryinstallation remains unsigned diagnostic evidence and is rejected before production collection or key access. Scope, evidence custody and nested timestamps are rechecked immediately before signing, so long source tests cannot refresh stale observations. Existing signer identity and strict CertForge policy remain unchanged.Validation: 714 pytest tests passed, one skipped; 36 collector regressions passed;
scripts/p1_acceptance.pypassed;git diff --checkpassed; staged secret scan found zero leaks. Independent reviews covered the source and production-scope/freshness boundary. A negative control removing the final timestamp check fails before key access as intended. Build preflight is READY; release preflight remains NOT_READY.This draft is diagnostic source, not a release or certification claim. Its pinned ACB candidate
def1828001c354bcf89f7d32bc987d6eba520cb6subsequently failed a genuine installed Windows router-state rename stability run and is being repaired separately. Current pins must be reviewed again against the successor before use. The hosted Certification Forge App receiver is stopped and its exact revision receipt is unavailable. No production signing, private-key read, new key, trust change, service deployment or production plugin promotion was performed.