saymrwulf/ltl-accumulator-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/ltl-accumulator-verified.git synced 2026-09-04 20:03:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Runbook: B4 matches the real deploy anatomy; key + infra facts sharpened

Browse source 
The droplet serves a DERIVED log dir rebuilt from a published/ mirror
(PersonalCloudServer DEPLOY.md § 'The LTL service') — B4 now refreshes
published/ and runs reconstruct.py instead of a bare app pull. Facts:
signing key verified NOT on the droplet (server only serves); server
deployment now version-controlled in private PersonalCloudServer@a186bac
(md5-verified == droplet).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
mrwulf 2026-07-12 18:03:39 +02:00
parent 0f0cb403cd
commit 7d58fe52c7
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
ATTESTATION-RUNBOOK.md
View file

@ -44,8 +44,9 @@ Agent Appendix at the end. Every step ends in a mechanical check.
| pacta | github.com/saymrwulf/proof-aware-crypto-tooling-agent | `3d81d53` (change-frozen during paper processing) |
| Forgejo mirrors | `https://zkdefi.org/saymrwulf/<repo>.git` (anonymously readable) | pull-synced by server cron nightly 03:00 UTC (`/home/admin/cloud/bin/reconcile-mirrors.py`, log `.reconcile.log`); verify per step A5 |
| log public key | `lean-transparency-log/provider.ed25519.pub` (PEM) | fingerprint `874c8a00…a56a` in `log-metadata.json` |
| log PRIVATE key | **location not yet confirmed** | see step A3 — Phase B is blocked until confirmed |
| log PRIVATE key | **location not yet confirmed**, but verified NOT on the droplet (the server only serves; no key material under `~/cloud/ltl/`) — so it is laptop-side or on removable media | see step A3 — Phase B is blocked until confirmed |
| producer driver | **does not exist in version control** | see step A4 — Phase B is blocked until persisted |
| server deployment | private repo `PersonalCloudServer` (github, `master`) — since `a186bac` includes the ltl vhost/service/reconstruct.py, md5-verified == droplet | see its `DEPLOY.md` § "The LTL service" |
---
@ -173,9 +174,19 @@ advance the pin. **Check:** exit 0, pin now 13. This exercises the
exact theorems of the corpus one last time, on the real data.
### B4. Publish
The droplet serves the log from a DERIVED dir (`~/cloud/ltl/log`),
rebuilt from a content mirror (`~/cloud/ltl/published`) — a bare
`git pull` in `app/` is NOT enough (see PersonalCloudServer DEPLOY.md
§ "The LTL service" for the layout).
```
cd <log clone> && git add -A && git commit -m "log update: leaf 12 - attestation of ltl-accumulator-verified@2da0a79 (paper §6 mechanization)" && git push origin main
ssh admin@zkdefi.org 'cd /home/admin/cloud/ltl/app && git pull && cd /home/admin/cloud && docker compose restart ltl'
ssh admin@zkdefi.org
cd ~/cloud/ltl/app && git pull # code/paper (usually no-op here)
# refresh published/ with the new log content, e.g.:
git clone --depth 1 https://github.com/saymrwulf/lean-transparency-log /tmp/ltl-pub \
&& rsync -a --exclude .git /tmp/ltl-pub/ ~/cloud/ltl/published/ && rm -rf /tmp/ltl-pub
cd ~/cloud/ltl && python3 reconstruct.py # re-derive log/
cd ~/cloud && docker compose restart ltl
```
**Check:** `curl -s https://ltl.zkdefi.org/v1/sth` returns
`"tree_size": 13` and the same root the driver computed.