Repository navigation
Conversation
…CHE-11) - restore refuses, rather than misses, a read-only snapshot of a secret-bearing writer (E711 secret_match, TM-12) and a stored blob that is missing, short or fails its digest (E711 blob_invalid, TM-15); both leave a cache.restore.refused row (entries.ResolveForRestore; Lookup and LookupForRestore keep their miss semantics for the remote plan) - artifact collect, commit (digest_mismatch, uncommitted) and get refusals write artifact.collect/commit/get.refused rows - the transfer receiver tells Refused about digest and short-blob refusals at publish, not only stale epochs; the coordinator audits a node's failed read-through re-hash as cache.restore.refused - release admission (Stash.Guard), release verify and the coordinator's signer client audit their refusals; node revocation writes one evidence.quarantined row per quarantined run (reason key_revoked)
…of 41 (P7-CACHE-11) - release-no-deps builds coordinator evidence with a failed dep; the old fixture flipped the result without the counts, which is evidence.invalid - release admission cases go through Stash.Guard, transit and read-through cases through the coordinator lease, sign-uncommitted through the coordinator signer client, each with the rig store as audit sink - results.json rerun on mm4 (darwin/arm64): 41 of 41 match
acamarata
added a commit
that referenced
this pull request
Oct 30, 2026
Contributor
Author
|
Folded into #543 (land/p7f-plugins) to land in one CI run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #553. Fixes the product so the P7-CACHE-11 security matrix passes as written.
matrix.yamlis unchanged.Result: 41 of 41 cases match on mm4 (darwin/arm64). Before this PR, 21 of 41 matched. The drill (
scripts/drill/cache-security/run) and--check-mappingboth pass.secret-snapshot(TM-12)entries.lookupturned an ineligible ro-snapshot into a silent missResolveForRestorenamessecret_match.specs.Engine.Restorerefuses with E711 and writes an audit rowpartial-local(TM-15)blob_invalidand writes an audit rowcorrupt-localdigest_mismatchcame back unwrapped, and the audit reason wasunreadableblob_invalid(E710 stays in the chain)release-no-depsresult/checksbut notcounts, so the evidence was inconsistent andevidence.invalidoutrankednot_passing<op>.refused reason=<key>, wired in production (run hooks, cmd) and in the rigRunner changes: the transit, read-through, admission and signer cases now run through the product paths that own the audit. Before, they called lower layers that have no audit sink.
Notes for review:
corrupt-local,partial-localandsecret-snapshot(restore-side refusals) stretches D20. P7-CACHE-01's acceptance also says a corrupt blob makes Lookup a miss.Lookupkeeps that behaviour; only Restore refuses. No ADR conflicts with this.sign-uncommitted: the signer process never writes the store (signing/source.go), so the coordinatorsigning.Clientaudits. The runner still delegates the signer check toTestSignerRefuses, then replays the signer's wire answer to the client.nself artifacts verifynow writes one audit row per refusal when a coordinator store exists. Its "writes nothing" comment is updated to say so.write_scope, so that ticket's scope-guard verification line fails for this diff.parity-with-core.sh. No argv changed.