HAC-324: correct the observer principal at the producing layer - #35
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The traversal's own packet carries one field that is not true of the run it describes. `10-provision.sh` records `observerPrincipal` from `gcloud config get-value account` at provision time, so it names the human operator. The authoritative traversal did not authenticate as that human: it impersonated a dedicated keyless observer service account, because gcloud 580 refuses audience-scoped identity tokens for user accounts. Two available fixes were both wrong. Editing the emitted packet destroys the only verbatim record of what the run produced. Leaving it and explaining the discrepancy in prose elsewhere leaves two artifacts disagreeing about who performed OBSERVED, and the wrong one is the one that looks authoritative. So the emitted bytes stay untouched as filmed-run.raw.json, and build-filmed-run.mjs derives filmed-run.json from them, splitting one overloaded field into the two distinct facts it was conflating: operatorPrincipal who provisioned the environment observerPrincipal who performed the independently authenticated read-back The HAC-340 script that emitted the raw packet is the approved runtime source at ae6d0d3 and is deliberately not modified. Changing it would change the runtime source SHA and break the parity claim the run exists to make. The producing layer for HAC-324's own evidence is this script. verify-filmed-run.mjs proves the derivation rather than asserting it: the record is exactly what the producer rebuilds, all 13 execution facts are byte-identical to the emitted packet, no environment field other than the principal projection moved, the capture package names the same run and the same observer, and every frame still matches its recorded digest. That proof matters more than usual here. The raw packet sits committed beside the derived one, so a derivation that quietly changed an execution fact would look corroborated rather than contradicted. 13 negative proofs. Wired into `pnpm run check` and into CI as its own job, so the gate actually runs rather than only existing. No GCP rerun: this repairs incorrectly projected metadata using evidence already preserved. No execution fact changed, and the frames are untouched. pnpm run check exit 0, 658 tests, typecheck and build clean.
qmarcelle
force-pushed
the
hac/324-observer-principal-correction
branch
from
August 24, 2026 02:30
dc4d6ef to
933457b
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The traversal's own packet carries one field that is not true of the run it describes.
10-provision.shrecordsobserverPrincipalfromgcloud config get-value accountat provision time, so it names the human operator. The authoritative traversal did not authenticate as that human — it impersonated a dedicated keyless observer service account, because gcloud 580 refuses audience-scoped identity tokens for user accounts.Why not either obvious fix
OBSERVED, and the wrong one is the one that looks authoritative.What this does instead
The emitted bytes stay untouched as
filmed-run.raw.json.build-filmed-run.mjsderivesfilmed-run.jsonfrom them, splitting one overloaded field into the two distinct facts it was conflating:operatorPrincipaluser:qwynn@marcellelabs.io— who provisionedobserverPrincipalserviceAccount:interlock-hac340-observer@…— who observedThe HAC-340 script that emitted the raw packet is the approved runtime source at
ae6d0d3and is deliberately not modified — changing it would change the runtime source SHA and break the parity claim the run exists to make. The producing layer for HAC-324's own evidence is this script.The proof, not the assertion
verify-filmed-run.mjschecks that the record is exactly what the producer rebuilds, that all 13 execution facts are byte-identical to the emitted packet, that no environment field other than the principal projection moved, that the capture package names the same run and the same observer, and that every frame still matches its recorded digest.That matters more than usual here: the raw packet sits committed beside the derived one, so a derivation that quietly changed an execution fact would look corroborated rather than contradicted.
Coverage
13 negative proofs — altered decision, altered observation, relaxed control, hand-edited record, rewritten region, uncorrected principal, package/run drift, package/observer drift, frame digest mismatch, frame quality regression, incomplete teardown.
Wired into
pnpm run checkand into CI as its own job, so the gate actually runs rather than only existing.No GCP rerun. This repairs incorrectly projected metadata using evidence already preserved. No execution fact changed; the frames are untouched.
Gates
pnpm run checkexit 0 · 658 tests · typecheck · build — all clean.