Repository navigation
scientific(validation): require authenticated recovery evidence before commercial authority #637
Description
Activity
Organization owner path now has a concrete verifier foundation in ContextualWisdomLab/.github#2300. Current exact head
1359339713704e57a0a229ee213a409aa3641be8adds the sealed inert-data verifier, hostile substitution tests, doctoring/CHANGELOG, and an exact-head quality workflow requiring 100% owned line/branch and docstring coverage. It deliberately contains no signer/OIDC authority and does not close.github#2299; the credentialed signer remains gated on.github#2164and #2133.Do not start the TEPP consumer ACL against #2300's mutable branch. #637 still waits for a protected/released or immutable-pinned
.github#2299contract. The useful change this pass is that the expected predicate/evidence identity surface is no longer merely prose:.github#2300now has executable owner validation for repository/head/run, profile/chronology, exact-head receipt/artifact/status, seed manifest, grouped recovery evidence, ordered replication provenance, and per-replication execution artifacts.Owner-path refresh: the previous handoff's
#2133blocker is now stale —.github#2133is closed/completed on protected main. The reusable-workflow identity prerequisite.github#2164has been ordinary-forward reconciled against current protected.github/main@e6334e229581a918e2f22de18733b76fa65d7e71at exact heada20726c1c4a387bba30e5609d550e36d2b0b3087, without force push or destructive rebase. Its new exact-head security/review runs are still queued and there is no qualifying current-head approval, so it is not yet consumable owner authority.The product-performance sibling
.github#2166was separately non-force restacked onto that exact owner head at43aa19ac0518982aae56d9fd3f1978a6b9e87c78; fresh compare is ahead 52 / behind 0 with exactly 11 product-performance residual files. Keep it isolated from scientific-validation schema/predicate.Therefore #637 remains correctly blocked from implementation:
.github#2300stays the scientific verifier lane, but TEPP must wait for.github#2164normal landing and.github#2299/#2300immutable/pinned authenticated scientific-validation authority. Do not turn the current trusted-adapter chronology in #488 into a self-asserted commercial attestation.Owner-path update from
.github#2299/#2300: the unsigned scientific-validation verifier now has an additional filesystem-integrity repair tracked by.github#2301. Current.github#2300exact head is9e82de292772111dc4b4afa178150b9e10fe6cb4.The repair prevents verifier output from traversing symlinked/non-directory parents, prevents predicate/manifest path collision, and prevents verifier output from mutating the already-validated sealed evidence root. This strengthens the future signer boundary but does not create authenticated authority: #2300 remains unsigned and exact-head jobs are non-terminal.
TEPP #637 should therefore keep the same owner-first sequence:
.github#2164normal landing/pinned reusable-workflow identity →.github#2299credentialed signer/canary/verification over #2300's verifier → immutable/pinned owner authority → TEPP public RED and consumer ACL. Do not consume current.github#2300mutable source or treat #2301 hashes as an attestation.Fresh owner-path update:
.githubunsigned scientific-validation verifier #2300 advanced from9e82de29...to exact4efc51a6f82d45341b8888e53a1cc613ff63ac40after #2302 repaired a real hash/parse TOCTOU gap. The verifier now opens the sealed evidence leaf without following symlinks, reads one bounded byte snapshot, and derives both evidence SHA-256 and strict JSON semantics from those exact bytes; direct atomic-writer symlink refusal coverage is also present.This does not change #637's consumer acceptance order. #2300 is still unsigned local integrity only. TEPP must not copy or consume this mutable branch. The path remains: #2164 exact-head gates + qualifying review → normal protected landing/pin → .github #2299 credentialed signer/live artifact metadata/cross-repository canary/online+offline verification → immutable or pinned authenticated owner authority → #637 public RED + verified-attestation ACL. No TEPP leaf commit is justified yet.
Owner-path follow-up:
.github#2300 advanced again to exact0306e65c16d79ed9a08098011e0875f3c04bf11eunder #2303. After #2302 moved evidence intake to descriptor-firstO_NOFOLLOW, fresh review found that blockingO_RDONLYcould hang on a FIFO beforefstatreached the non-regular refusal. #2303 adds a deterministic source-level RED for required nonblocking flags and repair22a01802...now opens withO_NOFOLLOW | O_NONBLOCK, preserving the same bounded byte snapshot/hash/strict-JSON semantics.No TEPP consumer change is justified: #2300 remains unsigned mutable verifier source. #637 still waits for #2164 protected landing and #2299 credentialed signer/canary/online+offline verification to become immutable/released or pinned owner authority before its public RED/ACL.
Scientific-validation owner-path update:
.github#2300is now exact787d9a4f4f27eb5d81bb2cbb94d9e4a0a162cd07and includes #2304's sealed-root descriptor repair. The owner verifier now pins the evidence root through component-wiseO_DIRECTORY | O_NOFOLLOW, enumerates the pinned directory descriptor, and opens the sole evidence member relative to it, closing the ancestor/root path-swap gap left after #2302/#2303. Lineage: RED50edf085...→ causal repair85e2c07e...→ refusal/coverage7398c85c...→ doctoring/current787d9a4f....This does not change #637 acceptance ordering: TEPP must still wait for #2164 normal protected landing and #2299 credentialed signer/canary/online+offline verification to produce released or immutable-pinned authenticated authority. Do not copy the mutable
.githubverifier into TEPP and do not relabel the current trusted-adapter scientific hashes as verified attestations. Current owner checks are non-terminal, so no hosted GREEN is claimed.Owner-path update:
.github#2300found and repaired an output-parent authority TOCTOU as.github#2305. #2301 validated output ancestry but the predecessor later reopenedpath.parentfor temp creation/final replace; a same-host rename + symlink replacement could redirect predicate/manifest publication after validation.Current owner lineage is source RED
e56ab5735be195ce7b9016b7a69713521621170d→ descriptor-pinned publication repaird0e00074ef2a3ab52ba1bf2069143baec9116f3b→ cleanup/refusal coveraged755e8f9565a348e1a836f70b647b93d2551e98d→ removal of the path-based compatibility writer076fff5ec28481f350517e1d7b9ffa3b8c8ffc9d→ current doctoring/headec476c871ee524b6577375e4ed89be54911a4fd5.At
ec476c87..., evidence intake is bound to a pinned root descriptor + one leaf byte snapshot and predicate/manifest output is bound to pinned output-parent descriptors with descriptor-relative atomic replace. This is still unsigned local filesystem integrity, not authenticated provenance. Exact-head owner gates are non-terminal: Scientific Validation Evidence Quality35531068108is queued (job106131623335,runner_id=null,steps=[]); CodeQL/Semgrep/Security are queued and Python Security pending. #2164 remains Draft ata20726c1...with all exact-head gates queued and no submitted review.Therefore TEPP #637 should remain unchanged: no mutable
.githubdependency/source copy and no TEPP public RED until #2299 exposes protected/released-or-immutable-pinned authenticated authority. #488 remains the current trusted-adapter scientific lane; no wake/no-op commit is justified.Owner-path update only; TEPP source remains unchanged.
.github#2300is now exacteb86a8d1688d79d43dfa901f6d88b3aab94644d1and includes #2306, which refuses stale/concurrently created verifier receipt leaves instead of replacing them. This is still an unsigned local-integrity verifier foundation, not the authenticated owner contract required by this issue..github#2164remainsa20726c1...Draft/unlanded, and both owner lanes have non-terminal exact-head jobs. Therefore the acceptance order here remains unchanged: protected/pinned authenticated.github#2299authority first, then TEPP public RED and narrow consumer ACL. No mutable owner source was copied into TEPP.Owner status update:
.github#2300is now exact5ef30e11082b4540517ea0a068662595ac0f1070over protected.github/main@e6334e229581a918e2f22de18733b76fa65d7e71(ahead 48 / behind 0)..github#2307added a final-manifest commit marker withpredicate_sha256binding exact canonical predicate bytes;.github#2308reconciled deterministic-output and cleanup tests with the existing no-clobber publication contract. TEPP source was not changed in this run. #637 acceptance remains pending because #2300 is still unsigned local-integrity verification, #2164 has not yet become protected/pinned source-identity authority, and #2299 still needs credentialed OIDC signing plus independent artifact metadata and online/offline verification. Current #2300 exact-head checks are queued; verifier-quality job106148981734remains unassigned (runner_id=null,steps=[]).Organization-owner progression only; no TEPP source copy.
.github#2300now has #2309's independent versioned unsigned receipt-manifest contract (scientific-validation-manifest/v1, schema1.0) plus strictvalidate_receipt_manifestthat re-hashes the exact predicate bytes, and #2310's bounded temporary-name/typed-creation-error repair. Current owner exact head is8ac4fd80bf9f823f32e59ab4bcd4f644c2c851dc, ordinary-forward over protected.github/main@e6334e22...(ahead 57 / behind 0, merge base exact main), Ready/open/mergeable. It is still mutable and unsigned. Keep #637 acceptance ordering unchanged: #2164 protected identity prerequisite → #2300 exact-head gates/review → #2299 credentialed signer + live artifact metadata/OIDC/immutable attest pin + online/offline verification → released or immutable-pinned owner authority → only then TEPP public RED and narrow verified-attestation ACL. Do not relabel current TEPP trusted-adapter hashes as cryptographically verified evidence.Owner-path update only; TEPP source remains unchanged.
.github#2311repairs an ambiguity in the unsigned #2300 receipt pair: the versioned manifest could previously carry syntactically valid repository/run/artifact/execution identities that contradicted the exact predicate bytes while keeping a correctpredicate_sha256. RED924fcf99...→ causal repairb8b3cb1d...+ coverage05f0d4f4...now strictly parse the predicate, preserve the non-scientific claim boundary, and cross-bind all duplicated manifest/predicate identities. This does not authenticate provenance. Keep #637 ordering unchanged: #2164 protected authority → #2300 exact-head gates/review → #2299 credentialed OIDC signer/live artifact metadata/immutable attestation verification → released or immutable-pinned owner contract → only then TEPP public RED and narrow verified-attestation ACL.Owner-path handoff only; TEPP source remains unchanged.
.github#2300fresh review found and repaired #2312: predecessora78873c6...still asserted the obsolete.out.json.*temporary namespace after #2310 switched production to bounded.scientific-validation-<uuid>.tmpnames. Minimal test-only repaird62649880e298a425bcef94b4375ce21194b2600, CHANGELOG129e6c8f..., and doctoring/current head6b956ca43f54d716f66164d0d63e4383edf7b75fnow align the exact-head quality contract without weakening production..github#2300remains unsigned, open/Ready/mergeable, ahead 65 / behind 0 from protected.github/main, with 17 current-head checks queued and no qualifying APPROVED review..github#2164is still the signer/OIDC prerequisite. Therefore #637 acceptance is unchanged: no mutable owner dependency or source copy; wait for protected/released-or-immutable-pinned authenticated owner authority before TEPP public RED/ACL.Owner-path update only; no TEPP source change.
.github#2300is now exactd4a68892bfddfc5b9623eee8a3136b188eeaf530, ordinary-forward ahead 70 / behind 0 from protected.github/main@e6334e229581a918e2f22de18733b76fa65d7e71. New.github#2313closes a shared strict-JSON fail-closed gap for over-limit integer conversion and excessive nesting: source RED71801e8...→ causal repair14159dde...→ realistic nesting-fixture correctionef73ac2...; CHANGELOG/doctoring are current atd4a68892....This remains an unsigned verifier foundation. Exact-head quality/security workflows are still queued and verifier-quality has no runner assigned, while
.github#2164has not yet become protected/pinned signer identity authority. Therefore #637 must continue to wait: do not copy mutable.githubsource, do not add a leaf-local signature shim, and do not relabel current trusted-adapter hashes as verified attestation. The consumer sequence remains released/immutable-pinned owner authority → TEPP public RED → narrow verified-attestation ACL.Owner-path update only; TEPP consumer source remains unchanged.
Fresh
.github#2299/#2300review found one missing authenticated-metadata dimension: artifact ID/name/digest were represented but GitHub artifactsize_in_byteswas not..github#2314now owns that gap. Canonical #2300 exact73d64a726d31acee8fba200220640702b53f8608requires positive-decimal artifact size, commits it in predicate + completion manifest, and cross-validates the pair. Source-level RED is2a8d86c4895419d24389dd36da051bed9fd0bae8; causal production repair isa0c75c0eeb4bae31fd1dbeece902d90354901b3c.This does not change #637 acceptance: mutable
.githubsource is still not a TEPP authority. Current #2300 exact checks are queued and #2164 signer/OIDC prerequisite remains unlanded. Keep TEPP #488 unchanged and add the public verified-attestation RED/ACL only after.github#2299exposes protected/released-or-immutable-pinned authenticated authority. Artifact size must be checked as owner live metadata, not as the extracted scientific evidence JSON byte length.Owner-path handoff:
.github#2300advanced by ordinary fast-forward to exact18123738410ea5c3bbec1103e5ddaa2606f54b2dfor.github#2315.The owner foundation now bounds the future signer handoff receipt files themselves before semantic validation: each manifest/predicate file is capped at 4 MiB, parent directories are descriptor-pinned without symlink traversal, leaves are opened once with
O_NOFOLLOW | O_NONBLOCKand required regular by descriptor, paths must be distinct, and the exact bytes go unchanged into the versioned receipt validator. This is still unsigned/uncredentialed and does not change TEPP psychometric semantics.TEPP should therefore remain unchanged: do not copy the mutable
.githubreader/source, do not reinterpret trusted-adapter hashes as authenticated evidence, and do not start the #637 public consumer RED until #2299 has protected/released-or-immutable-pinned authenticated authority. Current.github#2300exact-head checks are non-terminal and #2164 remains the reusable-workflow OIDC prerequisite.Owner-path handoff update:
.github#2300advanced ordinary-forward to exact2beaea8754d8d8fd1e3766ece1904fdbc86001ccafter #2316. #2316 is a signer-handoff filesystem-identity repair, not TEPP psychometric logic: source REDdc9a4da2...proves distinct hard-link pathnames can name one inode; causal repair6ff0149810...captures(st_dev, st_ino)from the already-open bounded-read descriptors and rejects the same inode in manifest/predicate roles before semantic validation. The owner reader remains uncredentialed, and.github#2164is still the OIDC reusable-workflow prerequisite. Exact-head.github#2300gates are newly queued, so this does not create released/pinned authenticated authority. Keep TEPP consumer work behind the existing acceptance sequence: released/immutable-pinned.github#2299authority → TEPP public RED → narrow verified-attestation ACL. Do not copy #2300 source or reinterpret current trusted-adapter hashes as cryptographically verified evidence.Owner-path handoff update:
.github#2300advanced ordinary-forward to exacteac665ec7b215c2b760e76d7f3b5b15e3fb77456under new owner finding.github#2317. The signer-facing receipt reader now pins both manifest/predicate parent-directory authorities before either leaf is read, reusing one descriptor for a shared parent and acquiring both first for distinct parents. This closes a local paired-read directory-generation TOCTOU without adding signer/OIDC authority or changing TEPP psychometric semantics.Keep #637 acceptance unchanged: do not consume the mutable
.github#2300source and do not relabel trusted-adapter hashes as authenticated evidence. TEPP should add its public RED/verified-attestation ACL only after #2164 and #2299 land as protected/released-or-immutable-pinned owner authority. Current.github#2300exact-head quality/security generation is non-terminal, so no GREEN/release handoff exists yet.Fresh owner-path handoff:
.github#2300advanced ordinary-forward to exact91dc1849efb5ca9e98118056d96acf401166692bwith new owner issue.github#2323. The source-level RED475b6bd83a016d45131f7f49434038c93ac3f926injects a post-open sealed-evidence readOSError; causal repaire630dc6bc2d42c9aa69fad60667121def6314d8ckeeps explicitEvidenceErroroutcomes intact while normalizing post-openfstat/read I/O faults to the deterministic verifier rejection boundary. CHANGELOGc1454588..., doctoringe725382f..., current quality-path authority91dc1849.... This is still mutable/unsigned owner source, not TEPP-consumable authenticated authority.- Current
.github#2300@91dc1849...Scientific Validation Evidence Quality run35571062142/ job106242616064is queued with no assigned runner andsteps=[]; CodeQL35571062163, Semgrep35571062111, Security35571062082, and Python Security35571062034are likewise queued. No hosted GREEN transfers from predecessor heads. .github#2164@a20726c1...changed state materially: Agent Review Runtime Quality, Semgrep, and Security Scan are now success; Python Security run35519874290is terminal failure because pip-audit job106174761864reproduced protected-baseanyio==4.14.0vulnerabilities CVE-2026-63374 / CVE-2026-64847 / CVE-2026-63349. #2164 changes no dependency lock. Existing canonical dependency single-writer.github#2278@8a5251bf...owns the4.14.0 -> 4.14.2repair; its exact-head four security workflows are currently terminal cancelled, so it has no landing authority yet. CodeQL on #2164 remains queued and independent approval is still absent.
Consumer order therefore narrows to
.github#2278 normal security landing -> #2164 ordinary protected-main reconciliation + fresh GREEN/review -> #2299/#2300 authenticated immutable authority -> TEPP public RED/ACL. Do not copy either mutable.githubimplementation or treat the current trusted-adapter hashes as authenticated evidence.
Validation Evidence finding
#623–#636 ordinary-forward repaired the scientific-recovery semantics and represented provenance inside canonical Draft #488. The current
ScientificRecoveryProfileChronologyV1and exact-head / replication receipt types intentionally stop at a trusted-adapter boundary: canonical SHA-256 identities, registration/execution ordering, profile/seed/payload correspondence, and terminal states are validated, but the exact-head artifact/status, execution-artifact identities, and owner-ledger entry identities are not authenticated by a signature or independently verified attestation.That distinction matters for commercial authority. A caller that can manufacture a self-consistent trusted-adapter ledger/artifact set can satisfy the represented contracts without proving that GitHub CI, a trusted execution producer, or an immutable owner ledger actually issued those claims. Adding another leaf-local content hash cannot close that authenticity boundary.
Correct owner split
The signature/OIDC/Sigstore/reusable-workflow machinery belongs to the organization control plane, not
validation_core.ContextualWisdomLab/.github#2299owns the reusable scientific-validation evidence attestation contract. It depends on the cross-repository reusable-workflow identity repair in.github#2164;.github#2166is the performance-specific sibling pattern and must not be copied into TEPP or have its predicate overloaded for psychometric evidence.The current uncredentialed verifier/signer-handoff foundation is
.github#2300@91dc1849efb5ca9e98118056d96acf401166692b. #2322 remains the signer-intake predecessor repair for post-open receipt I/O failure. The current follow-up #2323 closes the symmetric sealed-evidence verifier gap: source-level RED475b6bd83a016d45131f7f49434038c93ac3f926injects post-open evidence-read failure; causal repaire630dc6bc2d42c9aa69fad60667121def6314d8cnormalizes post-openfstat/bounded-readOSErrorto the stableEvidenceErrorfail-closed boundary while preserving pinned-root, one-open/one-snapshot, 16 MiB+1 bounded intake and exact-byte digest/semantic validation. This remains mutable, unsigned owner-source work, not TEPP-consumable authenticated authority. No current-head hosted GREEN is claimed.TEPP remains the owner of numerical/scientific meaning. Owner attestation may authenticate origin and integrity only; it must never decide RMSE, Monte Carlo uncertainty, failure denominators, estimator validity, or claim promotion.
Required TEPP consumer repair after owner authority exists
After
.github#2299lands through protected review and exposes an immutable released/pinned verifier contract, extend the Validation Evidence boundary with a narrow ACL/value object representing a verified scientific-validation attestation receipt. The consumer must bind, at minimum, the exact candidate Git SHA and the same profile, profile chronology, exact-head receipt, seed manifest, grouped recovery evidence, ordered replication provenance, and execution-artifact identities already used by #488.Commercial/exported
ScientificallySupportedrecovery authority must fail closed when that verified receipt is absent, bound to a predecessor/wrong repository or source SHA, uses the wrong predicate/signer/workflow identity, or its authenticated evidence identities differ from the locally recomputed #488 identities. Do not let a caller construct the verified state from booleans or detached digests.Preserve a lower-level pure scientific/numerical decision boundary if necessary for deterministic unit/scientific testing, but the product authority exported to buyer/release paths must make the authenticity distinction explicit in type/API naming and traceability. Do not silently reinterpret today's trusted-adapter
ScientificRecoveryPromotionV1as a cryptographically verified attestation.RED / acceptance
Before implementation, add a public RED against the released owner verifier contract proving that a numerically perfect recovery with current represented chronology still cannot enter commercial scientific authority with: no attestation; wrong repository; predecessor/wrong candidate head; wrong central signer workflow; wrong predicate; substituted profile/chronology/exact-head receipt; reordered or substituted replication provenance; or execution-artifact mismatch. The same exact valid represented evidence plus a verified owner attestation must promote.
No mutable
.githubbranch dependency, repository-local signing key, copied OIDC/Sigstore verifier, cross-service SQL, caller timestamp, self-assertedpassed=true, or LLM judgment is permitted.Acceptance remains: released/pinned
.github#2299owner contract → TEPP public RED → minimal consumer ACL → exact-head Rust/rustdoc/owned line+branch+edge/security/CodeQL evidence → qualifying independent current-head review → ordinary reconciliation with #492 and #488 prerequisites → protected-main integration → immutable release/recovery evidence. Predecessor receipts do not transfer.Current lane
Canonical #488 is exact
31d55fdb29d8141031a8da1529b48fa96355b1c0, Draft/open/mergeable. Its exact-head Rust Foundation35552031854, Bias SE Exact-Proof Budget35552031892, Documentation Quality35552031905, Semgrep35552031850, CodeQL PR35552031865, and Security Scan35552031824remain non-terminal. Do not issue a wake/no-op commit or transfer predecessor receipts.The owner path now has an explicit dependency-security prerequisite.
.github#2164@a20726c1c4a387bba30e5609d550e36d2b0b3087has Agent Review Runtime Quality, Semgrep, and Security Scan success, but Python Security35519874290is a real terminal failure because sharedrequirements-strix-ci-hashes.txtstill resolvesanyio==4.14.0, reported vulnerable as CVE-2026-63374 / CVE-2026-64847 / CVE-2026-63349 with 4.14.2 as the fixed version; CodeQL remains queued and no qualifying independent approval exists. #2164 does not own that lock.Canonical dependency owner
.github#2278@8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5carries the one-file AnyIO4.14.0 → 4.14.2repair. Its current exact-head Python Security35480337856, Semgrep35480337863, Security Scan35480337869, and CodeQL35480337885are all terminalcancelled; predecessor approval does not transfer to this head. Do not duplicate the lock repair in #2164. The central cancellation/admission lifecycle remains owned by.github#712with the event-order-independent repair lineage in #2283/#2289; cancelled evidence is not GREEN..github#2300@91dc1849efb5ca9e98118056d96acf401166692bis open/Ready/mergeable and ordinary-forward from protected.github/main@e6334e229581a918e2f22de18733b76fa65d7e71, but remains uncredentialed. Scientific Validation Evidence Quality run35571062142has verifier-quality job106242616064queued on the exact head withrunner_id=0, empty runner name andsteps=[]; Python Security35571062034, Semgrep35571062111, Security35571062082, and CodeQL35571062163are also non-terminal. No hosted GREEN or qualifying current-head approval exists.Current causal order is therefore
.github#712/#2283/#2289cancellation/admission settlement →.github#2278exact-head security GREEN + current approval + normal protected landing →.github#2164ordinary reconciliation with protected main + fresh Python Security/CodeQL GREEN + independent approval → protected/released-or-immutable-pinned.github#2299/#2300authenticated authority → this TEPP public RED/ACL. Until those owner prerequisites settle through normal protected governance, #637 remains an open consumer gap and #636 remains valid predecessor lineage rather than something to close.Refs #488 #627 #630 #631 #633 #634 #635 #636 #492 ContextualWisdomLab/.github#2299 ContextualWisdomLab/.github#2300 ContextualWisdomLab/.github#2318 ContextualWisdomLab/.github#2319 ContextualWisdomLab/.github#2320 ContextualWisdomLab/.github#2322 ContextualWisdomLab/.github#2323 ContextualWisdomLab/.github#2164 ContextualWisdomLab/.github#2166 ContextualWisdomLab/.github#2278 ContextualWisdomLab/.github#712 ContextualWisdomLab/.github#2283 ContextualWisdomLab/.github#2289.