The dogfood principle now runs in BOTH directions. Agents already
verified signatures through the proven dalek path; now the provider
SIGNS with it too, and proves to itself that the signing code is in its
own log before every signature:
- dogfood binary gains a `sign` mode (seed over stdin, never argv;
ed25519_dalek::SigningKey from the same pinned merkleized workspace).
Honesty ledger unchanged: the library's VERIFY path is
certificate-covered; its signing path is declared trusted base - but
it is the ATTESTED artifact, not an un-attested third implementation.
- sign_payload_ed25519_detailed: signing dispatch mirroring the verify
dispatch; the backend that actually signed is recorded in every
attestation signature block and STH.
- THE SELF-REFERENTIAL CHECK: before signing any tree head, the
provider runs the SAME Merkle inclusion verification an agent runs -
against the very tree it is about to sign - for the newest leaf
attesting the signing library itself, and embeds the result in the
signature block:
signing_provenance:
signing_backend: verified-dalek-serial
signing_library_component: dalek-ed25519-verified
signing_library_source_commit: aa0f6ab...
self_inclusion: verified
signing_library_leaf_index: 4
signing_library_certificates_proven: 16/16
A root signature that names the leaf vouching for the code that
produced it. First-append chicken-and-egg is handled honestly
(self_inclusion: library_not_in_log).
- Evidence refreshed: all four receipts re-issued under dogfood-signed
STHs; the full agent verify loop re-run green.
50/50 tests (new signing roundtrip test, skip-safe where unbuilt).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The provider ran its full honest replay against the four verified
repositories on this machine - every Lean compile and axiom audit routed
through lean-guard (memory-capped, core-pinned, single-flight, ~30 min
per fork) - and the results are now shipped under evidence/:
- 16/16 certificates proven per fork, every axiom cone boundary-exact
(the four apex tiers carry their fork's documented SHA-512/wire
boundary axiom-for-axiom), each attestation pinned to the exact repo
commit (dalek 8ded7bc, anza 673c15e, risc0 98a13a6, betrusted
81f614a) and Ed25519-signed.
- All four appended to the persistent transparency log. The log holds
EIGHT leaves: the first four are the initial run's attestations,
which honestly recorded an AUDIT FAILURE (the two pacta bugs fixed in
e87f0e8) - an append-only trust ledger keeps its bad day, and the
fixed run's leaves sit beside it.
- Every receipt re-verified through the FULL stack: dogfood verifier
(backend verified-dalek-serial recorded), STH pin store, freshness
policy. Receipts are freshly issued against the final tree (a stale
mid-run receipt tripped the pin store's rollback defense exactly as
designed; the rollback diagnostic now hints at idempotent re-issue).
- The capstone consequence ran for real: pacta agent with trusted
provider + signature via the proven path + required receipt + pin
store + --require-verified-verifier built the R4-gated library
capsule from ATTESTED evidence (no local Lean replay needed by the
consuming agent).
Docs and teaching updated against the real artifacts: evidence/README
(inventory + re-verify instructions), README "Real Evidence" section,
lecture 5 now re-derives 16/16 verdicts from the REAL dalek attestation
(signature checked on the proven path, provider labels ignored), and
lecture 6 verifies all four REAL receipts and walks a fresh pin store
over them. Every changed notebook cell executed before commit. 49/49
tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
