HAC-324: the authoritative filmed run, captured while it happened - #34
Merged
Conversation
Run ilk-hac340-cloud-1787536029323 on disposable project interlock-film-260823,
executed from a worktree at the approved runtime source ae6d0d3 and captured
through the hardened Studio path as it ran.
Five provenance-bound frames, each carrying its own sha256 and each clearing the
HAC-313 artifact floor:
agent-traversal the live traversal, captured while executing
gemini-adk-attribution live Cloud Run config: gemini-3.5-flash and
the interlock-adk:ae6d0d3 image
cloud-run-topology the three services and revisions
cloud-logging-correlation Cloud Logging filtered to this run's id
receipt-mutation-observation receipt, EXECUTED and OBSERVED from the packet
scene 1's traversal emitted
The first frame is the execution, not a retelling of it: the command ran inside
the capture, and its stdout — correlation id, ALLOW, receipt digest, 403/401/403
— is what the frame shows.
Every material parity field matches the frozen HAC-340 packet: runtime source
SHA exactly, gemini-3.5-flash, ADK 1.35.1, region, Vertex location, ALLOW,
EXECUTED, identical before/after revision digests, identical observed state, and
all three fail-closed controls. Cloud Logging correlates to this run, and the
proxy log shows the agent service account calling the proxy, so the internal
trust boundary is unchanged.
Two discrepancies are recorded rather than smoothed over.
resources.observerPrincipal in the packet says user:qwynn@marcellelabs.io.
That is the provision-time caller; the traversal authenticated by impersonating
the dedicated keyless observer SA, because gcloud 580 refuses audience-scoped
ID tokens for user accounts. The packet was not edited — evidence is recorded as
emitted — and the correction lives in the capture package. Adjudicated
NON_MATERIAL, and the condition held: controls came back identical.
The raw `gcloud --format=json` dumps taken during preflight are excluded. Cloud
Run service descriptions embed INTERLOCK_SIGNING_KEY_PEM, the proxy's Ed25519
private key, verbatim in the env — and those dumps were taken with plain gcloud
before the redaction adapter existed. They were removed, not committed. Every
frame here went through the hardened path, whose redaction covers private-key
blocks, and none contains key material. The project is deleted, so the key is
dead regardless.
HAC-340 packet verifier: verified, all 19 assertions including teardown.
Teardown completed 2026-08-24T01:50:43Z; project DELETE_REQUESTED.
The frozen HAC-340 and HAC-342 packets are untouched. This is new evidence for a
new run and is labelled as such.
pnpm run check exit 0, 645 tests, typecheck and build clean.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Run
ilk-hac340-cloud-1787536029323on disposable projectinterlock-film-260823, executed from a worktree at the approved runtime sourceae6d0d3and captured through the hardened Studio path as it ran.Five provenance-bound frames
agent-traversal102cafb35c0c02f9gemini-adk-attributiongemini-3.5-flash,interlock-adk:ae6d0d3ee007e9c29c5fea3cloud-run-topologyae6bd02c7f4ebf0dcloud-logging-correlationccd916391f6a8f38receipt-mutation-observation381c629fa64bbafeAll five clear the HAC-313 artifact floor (467–523 distinct colours, σ 18.7–34.2).
The first frame is the execution, not a retelling of it. The command ran inside the capture, and its stdout — correlation id,
ALLOW, receipt digest,403/401/403— is what the frame shows.Parity — all material fields PASS
Runtime source SHA exactly,
gemini-3.5-flash, ADK 1.35.1, region, Vertex location,ALLOW,EXECUTED, identical before/after revision digests, identical observed state, and all three fail-closed controls. Cloud Logging correlates to this run, and the proxy log shows the agent service account calling the proxy — internal trust boundary unchanged.Two discrepancies recorded, not smoothed over
1.
resources.observerPrincipalsaysuser:qwynn@marcellelabs.io. That is the provision-time caller. The traversal authenticated by impersonating the dedicated keyless observer SA, because gcloud 580 refuses audience-scoped ID tokens for user accounts. The packet was not edited — evidence is recorded as emitted — and the correction lives incapture-package.json. Adjudicated NON_MATERIAL, and the condition held: controls came back identical.2. Raw preflight
gcloud --format=jsondumps are excluded. Cloud Run service descriptions embedINTERLOCK_SIGNING_KEY_PEM— the proxy's Ed25519 private key — verbatim in the service env, and those dumps were taken with plain gcloud before the redaction adapter existed. They were removed rather than committed. Every frame here went through the hardened path, whose redaction covers private-key blocks, and none contains key material. The project is deleted, so the key is dead regardless. This is a direct argument for the adapter's redaction existing at all.Verification and teardown
2026-08-24T01:50:43Z; projectDELETE_REQUESTED; services and service accounts deleted.Gates
pnpm run checkexit 0 · 645 tests · typecheck · build — all clean.