saymrwulf/ltl-accumulator-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/ltl-accumulator-verified.git synced 2026-09-04 20:03:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Runbook B1b: producer is the operator's working tree (key + dogfood binary), not a bare clone

Browse source 
Execution found: the append signs with the verified-dalek-serial
dogfood backend, which needs BOTH the built binary (dogfood/state/) and
the key (provider/state/local-provider/) — neither exists in a fresh
clone (a fresh clone fails the wallet dogfood-signer test, orthogonal
to the log path). B1b now verifies the operator's working tree is at
PACTA_COMMIT, tracked-clean, binary present, suite green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
mrwulf 2026-07-16 19:03:45 +02:00
parent f9a276a903
commit 576a2d1e5c
1 changed files with 18 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
ATTESTATION-RUNBOOK.md
View file

@ -270,21 +270,29 @@ cd verification && ./check.sh ; echo "exit=$?"
`SELF-TEST GREEN`, `exit=0`. Archive the check transcript; record its `SELF-TEST GREEN`, `exit=0`. Archive the check transcript; record its
sha256 (bound into evidence per B6). Any other outcome: STOP. sha256 (bound into evidence per B6). Any other outcome: STOP.
### B1b. Pin the producer (NEW — round-6 GPT §4) ### B1b. Pin the producer (NEW — round-6 GPT §4; corrected during execution)
The leaf is generated by pacta; pin the exact producer: The leaf is generated by pacta AND signed by the verified-dalek-serial
dogfood binary using the private key — BOTH the built binary
(`dogfood/state/`) and the key (`provider/state/local-provider/`) live
only in the operator's working tree, NOT in a bare clone. So the
producer for B2/B3 is the operator's pacta WORKING TREE, verified to be:
``` ```
git clone https://github.com/saymrwulf/proof-aware-crypto-tooling-agent /tmp/pacta-13 git -C <pacta working tree> rev-parse HEAD # == $PACTA_COMMIT
cd /tmp/pacta-13 && git checkout $PACTA_COMMIT git -C <pacta working tree> status --porcelain | grep -v '^??' | wc -l # == 0 (tracked clean)
test -z "$(git status --porcelain)" ls dogfood/state/*.provenance.json # dogfood binary present
python3 scripts/mini_pytest.py # require the full green count python3 scripts/mini_pytest.py # full green (needs the binary)
``` ```
**Check:** clean tree; suite all-green. This is the ONLY pacta used **Check:** HEAD == `$PACTA_COMMIT`; no tracked modifications; dogfood
for B2. Do not run the ambient working tree. binary present; suite green. (A fresh clone will FAIL the wallet
dogfood-signer test — that test needs the built binary; it is
orthogonal to the log path. Verify the log-relevant modules explicitly
if in doubt: `test_lean.py`, `test_provider.py`, `test_web_and_witness.py`.)
### B2. Generate the candidate attestation (do NOT append yet) ### B2. Generate the candidate attestation (do NOT append yet)
Using the pinned producer (`/tmp/pacta-13`) and its Using the pinned producer (the operator's pacta working tree at
`$PACTA_COMMIT`, verified in B1b) and its
`examples/repos.yaml` entry `ltl-accumulator-verified`, run `examples/repos.yaml` entry `ltl-accumulator-verified`, run
`pacta_provider check` against the clean-room subject `/tmp/attest-13` `pacta_provider check` against the clean-room subject `/tmp/entry13/attest-13`
(A4's rehearsed invocation, real key/pub from A3's notes). NOTE: the (A4's rehearsed invocation, real key/pub from A3's notes). NOTE: the
candidate emerges PROVIDER-SIGNED (check signs at generation — that is candidate emerges PROVIDER-SIGNED (check signs at generation — that is
fine and reversible); what must not happen before inspection is the fine and reversible); what must not happen before inspection is the