Skip to content

D4.1: bind identity policy evidence to finalized builds - #293

Merged
omry merged 1 commit into
pr292from
pr293
Oct 28, 2026
Merged

omry merged 1 commit into
pr292from
pr293

Conversation

@omry

@omry omry commented Oct 27, 2026 •

Copy link
Copy Markdown
Owner

Collect verified identity evidence from the exact finalized image before lock assembly or publication. Persist the complete portable policy and image-bound evidence in an optional closed lock object, and reject stale policy, capability or executable-role bindings during loading, verification and reuse. Restaged desired blueprints take the fresh-evidence build path while retaining the old generation for publication cleanup. Public multi-identity execution remains inhibited.

Validation: focused identity/build/preparation regressions, affected vet, Linux CLI build, Docker-skipped CLI smoke and the qualified complete source suite passed. The known unchanged WSL tmpfs test is excluded. Fresh independent full Sol review is clean with zero findings. No live-engine or runtime qualification is claimed; exact-head CI and PR approval remain separate gates.


Collect verified identity evidence from the exact finalized image before lock assembly or publication. Persist the complete portable policy and image-bound evidence in an optional closed lock object, and reject stale policy, capability or executable-role bindings during loading, verification and reuse. Restaged desired blueprints take the fresh-evidence build path while retaining the old generation for publication cleanup. Public multi-identity execution remains inhibited.

Validation: focused identity/build/preparation regressions, affected vet, Linux CLI build, Docker-skipped CLI smoke and the qualified complete source suite passed. The known unchanged WSL tmpfs test is excluded. Fresh independent full Sol review is clean with zero findings. No live-engine or runtime qualification is claimed; exact-head CI and PR approval remain separate gates.
@omry
omry changed the base branch from main to pr292 October 27, 2026 18:39
@omry
omry added this pull request to stack #287 October 27, 2026 18:39
@gitar-bot

gitar-bot Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Code Review ✅ Approved

🔴 High risk · Binding identity-policy and capability-role evidence to finalized images changes build publication and reuse gates; faulty binding could permit stale privilege mappings.

Binds identity policy evidence to the exact finalized image before lock assembly or publication, persisting it in an optional closed lock object and rejecting stale policy, capability, or executable-role bindings on load, verification, and reuse. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Oct 27, 2026 •

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:4629c0b6ee6f445fcaedd4dd3292108de98c7bb473104d2e30abaf56ff4156db",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:146b305ae1732ad14e8c5eef04d4f5ec47db383706172645f8cf324fde970166",
          "closure_identity": "sha256:011638844ac9b5872e75cbb0da6258abf9d1b47928a1e3f50f9ad6cf1ca1998a",
          "document_identity": "sha256:fee62dbad94f6815fdccc1920a7180864dfef8e5ad9238e0fdee689a87db5573",
          "sidecar_identity": "sha256:ef591acea1e1d83645b8d05a175752075b4284d750a5cf289cfa7e1ff8f1180c"
        },
        {
          "baseline_identity": "sha256:779702b5fa170b026d6a04df2aeaa97ce006b96bcba41897ca39babd8b956e83",
          "closure_identity": "sha256:011638844ac9b5872e75cbb0da6258abf9d1b47928a1e3f50f9ad6cf1ca1998a",
          "document_identity": "sha256:0339661e75fd610092b903a1352c65ef98de35c4963c613923f0c9852193c597",
          "sidecar_identity": "sha256:4dfd0c546d6d2e562cc7a566336696f9064ebe740c2ec04774e9a9fdceef5437"
        },
        {
          "baseline_identity": "sha256:a68d5bec4bca25c403f41460bd202236954d42c9524b3fe50a7210e0af055387",
          "closure_identity": "sha256:011638844ac9b5872e75cbb0da6258abf9d1b47928a1e3f50f9ad6cf1ca1998a",
          "document_identity": "sha256:ba63be4406185d978f1794a3c22b2598a80288a0cff47ce018ff1e8ef745870c",
          "sidecar_identity": "sha256:7e9de65c8d26ece8f101b0f61307340bf736ab67be0f959e23d611a3492566f4"
        },
        {
          "closure_identity": "sha256:011638844ac9b5872e75cbb0da6258abf9d1b47928a1e3f50f9ad6cf1ca1998a",
          "document_identity": "sha256:779702b5fa170b026d6a04df2aeaa97ce006b96bcba41897ca39babd8b956e83",
          "sidecar_identity": "sha256:63430091146b6ed1c3c6db0e08608fc1d94e0a09e176adeedb8c3a2d5da56bbf"
        }
      ],
      "candidate_revision_fingerprint": "sha256:4629c0b6ee6f445fcaedd4dd3292108de98c7bb473104d2e30abaf56ff4156db",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122403658485
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122393308235
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122393299942
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122393300683
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122393301751
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122393300484
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122393300847
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122393300732
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122393300502
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:856be419f654438ea05f328915eaf454c3d0d5180e4e67b88ecd748eff399923",
      "review_request": {
        "body_digest": "sha256:71cc1ae5442fc87c4ad716e2a46499dcb3262474b53255325cb029e71b101351",
        "id": 6450763212
      },
      "review_result": {
        "body_digest": "sha256:ad16bc52016c3fe3da999049a65474d9e51d0cdf3f52393a248743301b561b65",
        "id": 6453565819
      }
    },
    "evidence_fingerprint": "sha256:49709522fb38e7834c39bbe24ff2809ec81b85006066078f5bf4f10bd070ffe3",
    "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
    "operation_identity": "sha256:856be419f654438ea05f328915eaf454c3d0d5180e4e67b88ecd748eff399923",
    "review_request_id": 6450763212,
    "review_result_id": 6453565819,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:4629c0b6ee6f445fcaedd4dd3292108de98c7bb473104d2e30abaf56ff4156db",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 122403658485
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 122393308235
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 122393299942
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 122393300683
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 122393301751
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 122393300484
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 122393300847
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 122393300732
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 122393300502
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122403658485,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122403658485"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122393308235,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122393308235"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122393299942,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393299942"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122393300683,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393300683"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122393301751,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393301751"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122393300484,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393300484"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122393300847,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393300847"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122393300732,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393300732"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122393300502,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40562025061/job/122393300502"
        }
      ],
      "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "id": "sha256:4b7f8f49fbd0a8d159b2b7df8645b15171876a9208d8a9b67b03f9d91faef916",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr292",
    "base_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
    "body_digest": "sha256:c23b09942480bba4fac2e2a287e22aa84f1844cfdd165b7cdcb086ad6e2a27ae",
    "body_identity_version": 2,
    "diff_digest": "sha256:30bf64c110c88510f34affdd764b93641b01c07b1fc1eadd1cd3e945d4eb4086",
    "head_ref": "pr293",
    "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
    "pr": 293,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:fe188bb8a80f7f235e99b023283749a3a9e3172e4adf70b70b495d80e50e9218",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:3a986e145d5e7995258df9277ce045ea52e30dcf6791c9360380cdca5cbbfd1b"
  },
  "record_version": 8,
  "review_observations": [
    {
      "base_ref": "pr292",
      "base_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "evidence_digest": "sha256:06cea4c251dc02af5a80a4ffdbb5d0c06e27bed251846149ed902a6eebc3404f",
      "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "id": "sha256:2859cac8b8fc23afcd265a6eab4dbc1a78e9967f96cdd9df668ceefd8cf44add",
      "poll": {
        "completed_at": "2026-10-27T19:34:06.415Z",
        "elapsed_seconds": 2704.967,
        "observations": 81,
        "started_at": "2026-10-27T18:49:01.597Z"
      },
      "request_comment_id": 6450763212,
      "status": "timeout"
    },
    {
      "base_ref": "pr292",
      "base_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "evidence_digest": "sha256:70b9bb9316fdc3e007438fc97e008684783703aa350991a3c32d92b1d0fbf8b3",
      "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "id": "sha256:892bca1d66123dd7d925c2afc00ca9abfe7da9d72afe6b272b68a886c9b9a3b0",
      "poll": {
        "completed_at": "2026-10-27T21:02:07.690Z",
        "elapsed_seconds": 47.616,
        "observations": 2,
        "started_at": "2026-10-27T21:01:20.076Z"
      },
      "request_comment_id": 6451749633,
      "status": "timeout"
    }
  ],
  "review_requests": [
    {
      "base_established_at": "2026-10-27T18:39:37Z",
      "base_ref": "pr292",
      "base_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "body_digest": "sha256:71cc1ae5442fc87c4ad716e2a46499dcb3262474b53255325cb029e71b101351",
      "created_at": "2026-10-27T18:49:46Z",
      "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "id": 6450763212,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-27T18:39:37Z",
      "base_ref": "pr292",
      "base_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "body_digest": "sha256:71cc1ae5442fc87c4ad716e2a46499dcb3262474b53255325cb029e71b101351",
      "created_at": "2026-10-27T19:38:11Z",
      "head_sha": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "id": 6451749633,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr292",
      "base_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "body_digest": "sha256:ad16bc52016c3fe3da999049a65474d9e51d0cdf3f52393a248743301b561b65",
      "commit_id": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "id": 6453565819,
      "inline_message_ids": [],
      "request_comment_id": 6450763212,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-27T21:06:36Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:4629c0b6ee6f445fcaedd4dd3292108de98c7bb473104d2e30abaf56ff4156db",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:30bf64c110c88510f34affdd764b93641b01c07b1fc1eadd1cd3e945d4eb4086",
      "finding_ids": [],
      "invariants": [
        "Exact head and base unchanged; no completed attributable regular-review result."
      ],
      "outcome": "timeout",
      "proposed_fix_paths": [],
      "resulting_head": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "review_observation_id": "sha256:2859cac8b8fc23afcd265a6eab4dbc1a78e9967f96cdd9df668ceefd8cf44add",
      "review_request_id": 6450763212,
      "review_result_id": null,
      "reviewed_head": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "root_cause": "Trusted clean comment6450807301 omits reviewed commit identity; bounded helper returned pending-timeout.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:30bf64c110c88510f34affdd764b93641b01c07b1fc1eadd1cd3e945d4eb4086",
      "finding_ids": [],
      "invariants": [
        "Exact head and base unchanged; no completed attributable regular-review result."
      ],
      "outcome": "timeout",
      "proposed_fix_paths": [],
      "resulting_head": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "review_observation_id": "sha256:892bca1d66123dd7d925c2afc00ca9abfe7da9d72afe6b272b68a886c9b9a3b0",
      "review_request_id": 6451749633,
      "review_result_id": null,
      "reviewed_head": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "root_cause": "Original recovery wait cancelled by T3 server restart after deadline; read-only reattachment found no attributable result.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:30bf64c110c88510f34affdd764b93641b01c07b1fc1eadd1cd3e945d4eb4086",
      "finding_ids": [],
      "invariants": [
        "Exact finalized-image identity policy binding; public mapped execution remains inhibited.",
        "All exact-head ci.yml jobs, complete qualified local validation and attributable regular review passed."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "review_observation_id": null,
      "review_request_id": 6450763212,
      "review_result_id": 6453565819,
      "reviewed_head": "9eae266dd705cd536e9d7c0995ae4d205b1c1505",
      "root_cause": null,
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 27, 2026 18:46
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-27T21:06:37.338606Z 9eae266 Manual request
🔒 Security Review ✅ Completed 2026-10-27T18:49:04.717825Z 9eae266 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: 9eae266

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry

omry commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: 9eae266

1 similar comment
@omry

omry commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: 9eae266

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 9eae266dd7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved PR reviewed and approved label Oct 27, 2026
@omry
omry merged commit a01d235 into main Oct 28, 2026
9 checks passed
@omry
omry deleted the pr293 branch October 28, 2026 04:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved PR reviewed and approved

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant