Repository navigation
fix(ci): lease network scope and evidence context checked end to end (D-1331, D-1299) - #562
Merged
Merged
Conversation
…ivery and on the node (D-1331) The scheduler admission rule was the only thing refusing lan or privileged to an untrusted job on a remote node: nothing called netscope.Effective at run time and the lease carried its trust class only when it carried secret refs. - netscope.RunScope: Effective's refusal for a declared scope; an undeclared scope runs as none (what the executor already did), never the class default. - The coordinator refuses to deliver a lease that fails RunScope (E679) and every lease now carries the class the job was placed at. - The agent passes the lease's class into the exec spec and fails the attempt with E679 before the executor runs when RunScope refuses it. - TestInvariant_I07 now also runs against the agent's lease path.
…ote evidence verifies (D-1299) The agent built its evidence with its own run id, repo_id "unknown", source untrusted and no policy digest, and the job named "job". attest.RunnerVerifier compares each of these with what the coordinator recorded for the attempt, so every signed result was refused (context_mismatch): safe, but no signing node could satisfy a gate. - protocol.Lease gains an optional evidence context (run id, repo id, source trust, policy digest, selection mode, job name); schema regenerated. - The run's transport adapter fills it from store.AttestLedger.AttemptFacts, the same read the verifier compares with (run.LeaseEvidence). - The agent names those facts in its evidence and keeps the coordinator's repo id after the builder completes the document, before it is signed. - End-to-end test: coordinator context, agent run on a real checkout, node key signature over the frame bytes, attest.VerifyFrame with the real store ledger. A lease without the context and an altered context are refused.
acamarata
added a commit
that referenced
this pull request
Oct 30, 2026
…#562 trust gate + lease evidence store)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes two high TRUST debt rows that block P7-TRUST-99. Both change the lease the coordinator sends and what the agent does with it, so they share files and ship together.
D-1331: network scope checked at run time
Root cause: only the scheduler's admission rule refused
lan/privilegedto an untrusted job. Nothing callednetscope.Effectiveat run time, and a lease carried its trust class only when it carried secret refs.netscope.RunScope: Effective's refusal for a declared scope. An undeclared scope runs asnone(what the executor and the local path already do), so the class default never widens a job.trust.TestInvariant_I07now also runs against the agent's lease path (cmd/agent).D-1299: signed remote evidence verifies
Root cause: the agent's evidence named its own run id,
repo_id: unknown, sourceuntrusted, no policy digest and jobjob.attest.RunnerVerifiercompares each of these with the coordinator's record, so every signed result was refused (context_mismatch).protocol.Lease.evidence(optional) carries run id, repo id, source trust, policy digest, selection mode and job name. The runner-protocol schema is regenerated.store.AttestLedger.AttemptFacts, the same read the verifier compares against (run.LeaseEvidence).Tests (run on mm4, darwin/arm64)
TestRunScope,TestDeliverRefusesALANScopeForAnUntrustedJobAndCarriesTheClass,TestInvariant_I07(cmd/agent),TestDeliveredLeaseCarriesTheAttemptsEvidenceContext,TestSignedRemoteEvidenceVerifiesAgainstTheCoordinatorRecord(end to end: coordinator context, agent run on a real checkout, node-key signature over the frame bytes,attest.VerifyFramewith the real store ledger; it also checks that a lease without the context, and an altered context, are refused).remote_await_test.go,dispatch/deliver_test.go).go test ./...in free/ci: all new and touched packages pass. The failures left are the same tests that fail on pristine origin/main 3d7da3f on mm4: internal/attest TestProfile_* (IPv6), internal/gates/truth TestDrill*, internal/nodes/registry TestNodeReportCannotSetHostedOrProviderLabels, cloudvm TestCloudVMFullCycle (nil deref), internal/run TestInfraPostsError, and with -tags security test/security TestApproval*/TestCotenancy*/TestRecordedForkPR* (network.lan_for_untrusted) and redteam TestC37/TestC38. None is in a file this PR touches. architecture (layers, file sizes) passes.Docs: the trust guide's network-scope limits and signing handoff are updated.