From f9a276a903cbc0b2d3b8b04c71b1118f96ac91c6 Mon Sep 17 00:00:00 2001 From: mrwulf Date: Thu, 16 Jul 2026 18:59:46 +0200 Subject: [PATCH] Runbook B0/B3: corrected against the LIVE log during entry-13 execution MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two defects found in the first minutes of Phase B, both in my own check text, both would have misfired on a PRISTINE log: - B0 'exactly 12 entries under entries/' counted 16 (the live log has 12 numbered leaves + 4 per-component .attestation.json convenience pointers). Now counts entries/[0-9]*.json and trusts the STH tree_size. - B3 'exactly 4 changed paths, receipts unchanged' was WRONG: publish regenerates every component's inclusion-proof receipt against the new head (correct CT behavior). Empirically captured on a throwaway publish over the real published clone: 9 changed paths (3 new + STH + history + 4 recomputed receipts); numbered leaves 0..11 and existing attestation pointers byte-identical; provider.ed25519.pub unchanged under the real key. The old check would have falsely aborted a correct append. Neither is a log problem — the log is pristine (12 leaves, bcd15f9d). The rehearsal missed both because it checked only numbered-leaf immutability; live-state execution caught them, as B0 is designed to. Co-Authored-By: Claude Fable 5 --- ATTESTATION-RUNBOOK.md | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/ATTESTATION-RUNBOOK.md b/ATTESTATION-RUNBOOK.md index 4aaf027..9c46833 100644 --- a/ATTESTATION-RUNBOOK.md +++ b/ATTESTATION-RUNBOOK.md @@ -230,7 +230,11 @@ EXPECTED_OLD_ROOT=bcd15f9d7ea1c9e5bd0a9e64fa8d846208b1e29ee167d4f1eac19b30e6913e ### B0. Preflight the live predecessor state (NEW — round-6 GPT §10) An append-only system must re-read its actual predecessor, not trust a Facts table. Fresh clone of `lean-transparency-log`; verify ALL of: -- exactly `$EXPECTED_OLD_SIZE` entries under `entries/`; +- exactly `$EXPECTED_OLD_SIZE` NUMBERED leaves `entries/[0-9]*.json` + (NOT `ls entries/ | wc -l` — `entries/` also holds per-component + `.attestation.json` convenience pointers; the live log has + 12 numbered leaves + 4 named pointers = 16 files. The tree size is the + numbered count and the STH's `tree_size`, never the file count); - `latest-sth.json` tree_size == `$EXPECTED_OLD_SIZE`; - its full `root_hash` == `$EXPECTED_OLD_ROOT`; - the STH signature verifies under `provider.ed25519.pub` @@ -316,19 +320,33 @@ Any failure: STOP (do not append a leaf you could not inspect). with the inspected candidate; then `log-publish --git-dir `. Produces `entries/000012.json`, updated `latest-sth.json` (tree_size 13), one new `sth-history.jsonl` line, one new receipt. -**Check (exact-path + prefix immutability — round-6 GPT §11):** the -publish clone's `git status` shows EXACTLY: +**Check (exact-path + prefix immutability — corrected empirically on +the live-state clone 2026-07-16; the round-6 "exactly 4 paths" was +WRONG — `publish` regenerates every component's inclusion-proof receipt +against the NEW head, which is correct CT behavior, not tampering):** +the publish clone's `git status --porcelain` shows EXACTLY these, and +nothing else: ``` -entries/000012.json (new) -latest-sth.json (modified) -sth-history.jsonl (modified) -receipts/ (new) +?? entries/000012.json # the new leaf +?? entries/ltl-accumulator-verified.attestation.json # new component pointer +?? receipts/ltl-accumulator-verified.receipt.json # new component receipt + M latest-sth.json # tree_size 12→13 + M sth-history.jsonl # one line appended + M receipts/anza-ed25519-verified.receipt.json # ) inclusion proofs + M receipts/betrusted-ed25519-verified.receipt.json # ) recomputed vs the + M receipts/dalek-ed25519-verified.receipt.json # ) size-13 head — + M receipts/risc0-ed25519-verified.receipt.json # ) EXPECTED, correct ``` -and nothing else; `entries/000000.json`..`000011.json` byte-identical -to the pre-run clone; all prior `sth-history.jsonl` lines unchanged -with exactly one line appended; the new head's root == the root the -append computed; `pacta witness-audit` on the clone exits 0 (real key — -full history verifies). +INVARIANTS (any violation = STOP): +- `entries/000000.json`..`000011.json` byte-identical to the pre-run clone; +- the 4 existing `entries/.attestation.json` byte-identical + (their attestation content is stable; only receipts move with the head); +- `provider.ed25519.pub` UNCHANGED (the real key is the same key — if this + shows M, the WRONG key signed: STOP); +- `sth-history.jsonl`: all prior lines unchanged, exactly one appended; +- the new head's root == the root the append computed; +- `pacta witness-audit` on the clone exits 0 (real key — full history, + incl. every historical STH signature, verifies). ### B3b. Consumer's-eye 12→13 (round-6: independent pin advance) From a DIFFERENT directory holding the OLD pin (size 12, root