Repository navigation
Conversation
Port the remaining slice 2.3 resource-discovery change from #1262 at 122b786. Preserve the build facts already carried in #1435. Verify the three pure filesystem tests in development and release-build configurations with exact-name selection guards. CLI clippy, Rust formatting, domain lint and independent review pass.
Record Gate 1 for user approval: real A/B comparison and rebuild-check publication preserve Phase 1 identities while qualification remains closed. The narrower ordinary-release assurance claim requires explicit approval before implementation.
Port the closed producer primitives from #1262 at 122b786. Stage the manifest, error variants and fail-closed entrypoint; keep selection, signing and publication unavailable. Run 49 audited pure tests locally and wire full process tests and strict clippy into existing Linux CI jobs. Carry schemas unchanged with approved exact reference-host entries and rejection coverage. Document required shared dependency upgrades.
Record the approved merge activation, permanent companion profile contract, direct upload-action identity bridge, rerun rejection and read-only reusable-caller permissions before implementing the adapter.
Begin the separately approved Gate 1 adapter with strict observation shape, closed qualification claims and canonical/reproduction input/environment pairing. Keep the producer entrypoint closed while runtime pin, filesystem, transfer and equality stages remain pending. Verify red-green observation, root-alias and bounded-diagnostic regressions; 58 audited pure tests, strict producer clippy, formatting and domain lint pass. Independent review approves this staged unit with explicit runtime preconditions.
Extend the approved ordinary adapter with bounded full-byte equality after input pairing and observed digest/size checks. Retain bounded exact mismatch diagnostics without normalized or excluded regions; keep command assembly and qualified paths closed. Verify red-green equality coverage, custom-section and EOF differences, mutation-after-observation rejection, 62 audited pure tests and strict clippy. Independent review approves the staged comparison unit.
Reuse the reviewed ZIP32 primitive and negative fixtures from #1262 at 122b786 without moving collection authority into Phase 2. Enforce exact build/observation member sets and source-owned bounds before the original full integrity checks. Verify red-green profile admission, 71 audited pure tests, strict clippy and an exact-ID read-only probe of the current Fastly archive against its recorded GitHub digest. Independent/security review approves this structural unit; transfer authentication remains pending.
Preserve the incoming main integration, HTML EOF checks and corrected Axum bind diagnostics alongside the reviewed Phase 2 producer work. Resolve the compatibility audit by retaining the diagnostic correction and fresh-rehearsal requirement together with the approved rebuild-check profile and activation notes.
Carry the frozen inspection implementation from 122b786. Render the future recipe reference as inline code until its module lands. Keep release commands closed.
Carry the approved Phase 2 source and staged evidence-test splits from 122b786. Validate all seven ordinary cohort rows while preserving four closed controlled destination contracts. Keep qualified selectors and release execution closed.
Implement the approved Gate 1 canonical source recipe and consumed-output hashing. Use the reviewed Cargo message parser from 122b786 without constructing qualified receipts or enabling release commands.
Carry the reviewed preparation helpers from 122b786 while preserving fresh ordinary npm output. Keep the lifecycle observer unchanged at esbuild 0.27.3, document the current-lock gap, and visibly disable its full collector fixture with an enabling guard. Retain newer npm dependency versions and run subprocess fixtures only in CI.
Carry the remaining reviewed prose and formatting hunks from 122b786. Preserve current runtime changes and describe immutable release metadata without claiming a signed index. Cloudflare shell diagnostics remain identical to its pre-existing baseline.
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Docs-only since rehearsed 770a425 (v0.0.0-rehearsal.13).
…-attestations-phase2 # Conflicts: # docs/superpowers/plans/binary-attestations-phase1-compatibility.md
…binary-attestations-phase2 # Conflicts: # crates/trusted-server-cli/src/prebid_bundle.rs
9 of 12 tasks
Collaborator
Author
|
Phase 2 current-input rehearsal Source The first independent release download hit a connection timeout; 28 local assets already matched the API and the two missing files were recovered with bounded read-only download retries. The immutable release and workflow were not rerun. This closes the later-application-input and structured-diagnostic rehearsal gap at this exact source. Historical |
Collaborator
Author
|
Phase 2 current-input rehearsal Source The first independent release download hit a connection timeout; 28 local assets already matched the API and the two missing files were recovered with bounded read-only download retries. The immutable release and workflow were not rerun. This closes the later-application-input and structured-diagnostic rehearsal gap at this exact source. Historical |
Collaborator
Author
|
Phase 2 current-input rehearsal Source The first independent release download hit a connection timeout; 28 local assets already matched the API and the two missing files were recovered with bounded read-only download retries. The immutable release and workflow were not rerun. This closes the later-application-input and structured-diagnostic rehearsal gap at this exact source. Historical |
Collaborator
Author
|
Supplement to rehearsal .16: exact published Fastly runtime evidence — PASS The original three transcript parts established packaging/validation and byte equality, but did not contain this required runtime check. This supplement closes that historical evidence gap without changing the .16 release or attributing it to another source commit. PASS — exact rehearsal.16 Fastly WASM runtime/source-header/log check (local Viceroy 0.21.0; no deployment).
Scope: exact published Fastly WASM in local Viceroy with a controlled origin; deployed Fastly behavior and browser execution were not tested. Completed 2026-10-28T14:09:43.853Z. Detector sensitivity control also passed: the no-build-facts assertion rejected an in-memory copy of the captured log with one synthetic Authentication and launch commands (private paths represented by variables): COMMIT=5fa3843364f247fdc261c438ab9257323637a42c
TAG=v0.0.0-rehearsal.16
gh release verify-asset "$TAG" "$ASSETS/trusted-server-fastly.wasm" --repo prk-Jr/trusted-server
gh attestation verify "$ASSETS/trusted-server-fastly.wasm" \
--repo prk-Jr/trusted-server --source-ref "refs/tags/$TAG" \
--source-digest "$COMMIT" --signer-digest "$COMMIT" \
--deny-self-hosted-runners --predicate-type https://slsa.dev/provenance/v1 \
--bundle "$ASSETS/trusted-server-fastly.wasm.provenance.sigstore.json" \
--custom-trusted-root "$ASSETS/trusted_root.jsonl" \
--cert-identity "https://github.com/prk-Jr/trusted-server/.github/workflows/release-build.yml@refs/tags/$TAG" \
--format json
"$ASSETS/ts-aarch64-apple-darwin" config init --app-config "$WORKSPACE/trusted-server.toml"
# After configuring only private loopback stores and fictional secrets:
"$ASSETS/ts-aarch64-apple-darwin" config push --adapter fastly --local \
--manifest "$WORKSPACE/edgezero.toml" --app-config "$WORKSPACE/trusted-server.toml" \
--yes --no-diff --no-env
"$VICEROY_0_21_0" --config "$WORKSPACE/fastly.toml" \
--addr 127.0.0.1:19450 --log-stdout --log-stderr \
"$ASSETS/trusted-server-fastly.wasm"Explicit results: The official Viceroy 0.21.0 Darwin ARM64 archive was checksum-verified against GitHub asset 529469175: |
Collaborator
Author
|
Rehearsal .17 — infrastructure failure; source unchanged Tag
The next attempt uses fresh lightweight |
Collaborator
Author
|
Rehearsal .18 — repeated ARM64 hosted-runner acquisition failure The source rehearsed by both tags is 36454c5 on Phase 1 base 4940928. The later documentation-only PR head 5163241 records the open gate; these tag runs do not attest that later head. All four IAB workflow runs for source 36454c5 completed successfully: 29 successful checks and four expected skips. Hosted macOS producer supervision passed all 45 selected tests; Linux producer unit tests passed 952 with nine explicitly ignored tests, boundary integration passed three, command integration passed 18, and the explicit comparison-failure sentinel passed. Fresh fork rehearsals v0.0.0-rehearsal.17 (https://github.com/prk-Jr/trusted-server/actions/runs/40710926728) and v0.0.0-rehearsal.18 (https://github.com/prk-Jr/trusted-server/actions/runs/40714430928) both hit the same external blocker: the ARM macOS CLI job never acquired a hosted runner. The check annotations report “The job was not acquired by Runner of type hosted even after multiple attempts” and macOS arm64 capacity constraints. No steps ran for those ARM jobs. Rehearsal .17 settled with nine successful jobs, one cancelled job, and two expected skips for signing and release. Rehearsal .18 settled with the same nine successful jobs, one cancelled job, and two skips for signing and release. Neither tag has a published or draft release. Both lightweight tags remain at the reviewed source commit. No workflow rerun, tag reuse, deletion, retargeting, or settings change was performed. Fresh immutable-publication, attestation and exact-release runtime verification remains pending a successful new rehearsal; the earlier .16 evidence remains historical and is not evidence for the new process cleanup change. The PR remains draft. No .19 attempt is queued. A fresh successful seven-binary rehearsal remains the release-readiness gate once hosted ARM64 capacity is available; no cohort or verification requirement is waived. The original .16 exact-runtime evidence gap is separately closed: #1449 (comment) |
Collaborator
Author
|
Rehearsal .19 — hosted ARM64 runner acquisition failure Exact reviewed source: Final fork run 40726649596: 9 successful jobs, 1 cancelled job, 2 skipped jobs. Six binary builds, the second Fastly build and complete-byte comparison passed. The ARM64 macOS CLI job executed zero steps and never acquired a runner. Its annotations say “The job was not acquired by Runner of type hosted even after multiple attempts” and cite macOS ARM64 capacity constraints. Signing and publication were skipped. Read-only checks found no draft or published .19 release and no leftover drafts. Consequently, published-asset, attestation and exact-release runtime verification could not run; no successful rehearsal is claimed. The lightweight .19 tag remains at the exact source above, untouched. No source, runner, cohort or settings changes were made. The .16 runtime supplement remains historical evidence for |
Collaborator
Author
|
Phase 2 exact-head rehearsal .20 — transcript 1/3 Source Rehearsal Verification summary:
Tool archive checksum validation (recomputed while preparing this record): Exact published inventory (30 files): The following is the actual command/output transcript; private temporary roots are replaced with shell-style placeholders. JSON-formatted verification results were retained privately; the transcript includes their explicit boolean policy/equality results. |
Collaborator
Author
|
Phase 2 exact-head rehearsal .20 — transcript 2/3 Source Continued actual verification transcript; full source/tag pins are unchanged. |
Collaborator
Author
|
Phase 2 exact-head rehearsal .20 — transcript 3/3 Source Continued actual verification transcript; full source/tag pins are unchanged. Raw runtime log excerpt (three requests and three successful responses; each was also echoed to stdout): Runtime check: PASS at the exact published digest above; all owned listeners stopped. The release verifier’s earlier “runtime remains separate” line precedes the subsequently successful runtime supplement. |
11 of 14 tasks
8 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
trusted-server-fastly.wasm.rebuild-check.json, with current-run transfer binding. Preserve the seven binary names, reusable signer and existing binary/SPDX verification commands; publication grows to 30 files.Changes
crates/trusted-server-release/**; workspace manifests/lockcrates/trusted-server-js/**; CLI resource discovery.github/workflows/{release,release-build,test,format}.yml;scripts/release/phase1*;AGENTS.md0f89eae size versus Phase 1
4940928e8: 266 new files (one binary fixture), 87,690 new text lines; 42 existing files +4,757/−614. Rust: 79,259 new lines +311 existing additions. Workflow/script/non-Rust test support, including its manifests/fixtures: 6,147 new lines +2,349 existing additions. Remaining text is docs, schemas and lockfile. Frozen source:122b78664b1235c717e9208fd200f9a9b0c335df.Closes
Part of #1235. This parent issue tracks the phased work; no separate tracking issue is pending. This PR does not close its remaining maintainer settings/approval requirements.
Spec / Plan
Phase 2 spec with its own two-round review log · Approved Gate 1 design · implementation and normalization plan · phase assignment · compatibility/evidence record.
Test plan
Rehearsed source
5163241b947b1aa335987bd832b9205e4364e4bb: PASS. Fresh lightweightv0.0.0-rehearsal.20passed all 18 jobs. Full independent verification: transcript 1, 2, 3.5163241b95163241b9CI: 29 successful checks, four expected skips. Binary, Tests, Format, Integration. Hosted coverage includes 952 Linux producer tests / nine existing ignores, three boundary tests, 18 command tests, 38 JS fixtures and 45 macOS process tests / zero ignores. Independent implementation/security and follow-up reviews found no remaining actionable findings; review limits remain documented. Local pure regressions, strict host checks/clippy and applicable formatting/domain/workflow/shell checks passed.Current head
0f89eae6932b8aa5b8c514de72c2d154dd1097ae: docs-only since rehearsed5163241b9. Signed and GitHub-Verified; five Markdown evidence records only. Independent evidence review, pinned-Node docs lint/Prettier/site build, outside-docs Markdown formatting, Rust format, domain lint and whitespace checks passed. Hosted CI on this docs-only head passed: 29 successful checks and four expected skips — Format, Tests, Integration, Binary attestations. The merge-test source tree equals this head. No release machinery or binary changed after the rehearsed source.5163241b9observed cost: reproduction 282s plus comparison 122s, overlapping native builds. Canonical/reproduction Wasm SHA-2564fe7204f17df07a392f4e4b64f31eebf3b02179e57abee689ab0094990d0a572. Different checkout/target roots, job counts, umasks and start times; UID/locale/timezone stayed equal. Controlled qualification remains closed.Historical evidence keeps its source: .16/runtime supplement at
5fa384336; .17/.18 capacity failures at36454c526; .19 capacity failure at5163241b9, no releases for those failed attempts. .10 rerun-all recovery remains at3ccfe2971; .13 remains at770a425df. Tags are preserved.Checklist
36454c526exact-head CI passed; qualifications/later gates remain closed.0f89eae69hosted CI green (29 success, four expected skips)..20current-source release rehearsal and full published-asset/attestation/runtime verification at5163241b9; keep draft, request no reviewers.Human gates and limits
Merging Phase 2 activates the equality gate on the next eligible tag: a second Fastly build plus comparison, no release on mismatch. Native release CI builds each asset once; controlled qualification, later index/SPDX/consumer gates and GNU masking remain closed. Keep draft; request no reviewers. No IAB tags, releases or settings changes.
Allowlist changes needing maintainer review: exact
json-schema.organdspdx.orgentries, with justification and rejection tests; four per-lineapi.github.comsuppressions, no wildcard/global API-host entry.Outside-scope CI fix (mirrors main #1454): separate
886cf333apins only the browser runner to Ubuntu 24.04 with the same comment; later merges retain the upstream fix.