mirror of
https://github.com/saymrwulf/proof-aware-crypto-tooling-agent.git
synced 2026-09-03 19:53:43 +00:00
mrwulf
2587cc018b
REAL DEFECT found by the operator-ordered doc-freshness audit:
published_assets.py still carried the PRE-HARDENING fail-open verify.py
and the pre-Tier-2 README as the templates that log-publish drops into
the mirror — the next publish would have silently overwritten the
round-13-hardened fail-closed verifier and the corrected README with
the old versions. Fixed:
- published_assets.py regenerated from the canonical mirror files
(byte-identity verified by round-trip exec), now also carrying
verify_selftest.py; SYNC RULE documented in the module docstring.
- transparency_log.publish() now writes verify_selftest.py too.
- NEW tests/test_published_assets.py pins the security-critical markers
(fail-closed FATAL, RECEIPT_TYPE, verify_receipt, --all receipt
coverage, required fingerprint) so template drift fails CI instead of
shipping.
- test_web_and_witness updated to the hardened verifier's markers —
the published test log now passes FULL signature mode end to end
('RESULT: OK [full]'), a stronger assertion than the old string.
Doc refresh in the same pass:
- llms.txt: thirteen leaves + entry-13 self-attestation + fail-closed
verifier; paper line -> new title, 23 pages, v0.2/v0.1 archives.
- Course (generator + generated 06b notebook): 'the git hash IS the
content hash' -> 'the commit pins the exact source tree';
'irrevocably part of the log every other agent sees' -> 'committed to
the log's signed view, which any agent can compare' (the two Tier-2
scope corrections had never reached the teaching material).
- test_paper_verifiers.py docstring rescoped: its 164k counts are the
archived v0.2 report's citation; the current paper cites the corpus
harness and makes no extensional-equality claim.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
35 lines
1.7 KiB
Python
35 lines
1.7 KiB
Python
"""The publish step overwrites the mirror's verify.py / verify_selftest.py /
|
|
README.md from the frozen constants in published_assets. A hardening
|
|
regression here silently fail-opens the PUBLIC verifier on the next publish
|
|
(exactly what the 2026-07-19 doc audit found: the constants still carried
|
|
the pre-hardening fail-open verify.py). These tests pin the
|
|
security-critical markers so that drift fails CI instead of shipping."""
|
|
|
|
from pacta_provider.published_assets import README_MD, VERIFY_PY, VERIFY_SELFTEST_PY
|
|
|
|
|
|
def test_verify_py_compiles_and_is_the_hardened_verifier():
|
|
compile(VERIFY_PY, "verify.py", "exec")
|
|
for marker in (
|
|
"FATAL: signature checking unavailable", # fail-closed exit 2
|
|
"RECEIPT_TYPE", # required type binding
|
|
"def verify_receipt", # full binding checks
|
|
"--structural-only", # explicit reduced mode
|
|
'glob("*.receipt.json")', # --all covers every receipt
|
|
"public_key_fingerprint_sha256", # required fingerprint
|
|
):
|
|
assert marker in VERIFY_PY, f"hardening marker missing: {marker}"
|
|
|
|
|
|
def test_selftest_compiles_and_covers_fail_closed():
|
|
compile(VERIFY_SELFTEST_PY, "verify_selftest.py", "exec")
|
|
for marker in ("FAIL CLOSED", "missing key fingerprint REJECTED",
|
|
"forged (unsigned) root REJECTED"):
|
|
assert marker in VERIFY_SELFTEST_PY, marker
|
|
|
|
|
|
def test_readme_is_the_corrected_template():
|
|
assert "identity anchor" in README_MD
|
|
assert "verify_selftest.py" in README_MD
|
|
assert "the git hash is the content hash" not in README_MD
|
|
assert "sole trust anchor" not in README_MD
|