Repository navigation
Conversation
…tration route runs before inserting a row pcc-gateway stores an operator's measurement profile in its own append-only table keyed by (capabilityId, deviceId) (bus #2621), and composition's compiler takes the current row's digest from the server-re-read snapshot (bus #2238). This is the pure check the registration route calls; the route keeps authentication, the kernel-ownership predicate and storage. It refuses a profile that fails validation, names a different device than its row, is for another capability type, or has a term admission cannot evaluate (so every job under it would fail closed; better refused at registration than discovered at settlement). The digest is always computed server-side from the submitted profile; a client digest is only compared. Every problem is reported at once. unverifiableTerms in profile-admission.ts is exported as unverifiableProfileTerms so registration and admission share one definition. 11 tests; each of the five rules is mutation-checked. Spec 965/965, tsc clean, test files type-check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGXt1epJimheWaESMGBbXc
…rable; new fail-closed terms and unknown keys are refused #363 @48a69252 checks each version pin against its own evidence field (source.adapterVersion, source.firmwareVersion), so disjoint adapter and firmware lists are now registrable. The "pins can never both be met" test is replaced by a positive control. Registration refuses what admission would fail closed on: a pattern pin ("*"), a device kind no evidence source can carry, an inactive primitive id; and an unknown profile term is profile-invalid, so it can never be committed. Tests: registration 15 passed; spec 47 files, 1054 passed; tsc clean; the test files type-check.
LamaSu
added a commit
that referenced
this pull request
Sep 29, 2026
… profile, not the device adk's review of #431 (bus #3501): - F1: committed_profile now refuses a profile with a term TS admission fails closed on, whatever the evidence says. profile_admission_blockers mirrors the vocabulary-free part of unverifiableProfileTerms: a pattern version pin, a tolerance, maxIntervalMs, required calibration or witnesses, coverage other than one-shot with minFraction 1, and a device kind outside EVIDENCE_DEVICE_TYPES. A test keeps that list equal to the TS source. The docstring's promise is narrowed: two vocabulary-bound terms (window tokens, inactive primitive ids) are refused at registration (#384), before a digest exists. - F2: source_mismatches reports the profile's blockers first, so a pattern pin reads as the profile's problem, not the device's. - F3 (ordering): digest parity for floats below 1e-4 needs #429; land #429 before or with this. The pinned print pilot now correctly refuses observations (its firmware pin is a pattern); its digest golden stands. Observation tests use an admissible variant, and the TS event-hash golden was recomputed (Python and TS agree). Tests: 46 passed. pcc-node: the 2 failures are the pre-existing master ones. End to end, a Python-built signed bundle is still ADMITTED by TS admission.
…-data copy of the request The discipline astra required of admission (pack 39 round 2) applies here too. Registration validated request.profile and then read it again for the device, the capability type and the digest, so a getter or a caller mutation could split what was checked from what was stored. Every check now runs on one plainDataCopy of the request (each field read exactly once; anything JSON cannot carry is refused as profile-invalid), and the profile returned for storage is that copy. Tests: registration 18 passed (3 new: a copy is returned, a lying getter is read once, NaN is refused); spec 47 files, 1113 passed; tsc clean.
… astra packs 73/74 fixes)
…ototype copies; astra pack 125)
… plain-data boundary; astra pack 154)
…er the plain-data boundary (astra pack 154) The merged plain-data boundary refuses accessors through their descriptors, so the getter that once ran exactly once now never runs, and the request is profile-invalid. This is the stronger property the old test approximated.
… runtime proxy check, setter-free copy; astra packs 158/159)
LamaSu
added a commit
that referenced
this pull request
Oct 4, 2026
LamaSu
had a problem deploying
to
trusted-checks
October 4, 2026 05:28 — with 
GitHub Actions
Failure
GitHub Actions
Failure
LamaSu
added a commit
that referenced
this pull request
Oct 4, 2026
LamaSu
added a commit
that referenced
this pull request
Oct 4, 2026
LamaSu
had a problem deploying
to
trusted-checks
October 4, 2026 07:04 — with
GitHub Actions
Failure
GitHub Actions
Failure
LamaSu
had a problem deploying
to
trusted-checks
October 4, 2026 08:18 — with
GitHub Actions
Failure
GitHub Actions
Failure
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #363 (base
feat/sensors-profile-admission). One commit,9811ab7c. Merge after #363.Sensors lane 7a438686, goal
pcc-reconciliation. It answers pcc-gateway's request (bus #2621) to write the validation for its measurement-profile registration route.What it adds
checkProfileRegistration({capabilityType, deviceId, profile, claimedDigest?}): the pure check gateway's registration route runs before inserting a row into its append-onlycapability_measurement_profilestable. The route keeps authentication, the kernel-ownership predicate and storage.It refuses a profile that:
profile-invalid)device-mismatch)capability-type-mismatch)unverifiable-term). Every job under such a profile would fail closed, so it's refused at registration instead of discovered at settlement.The digest is always computed server-side from the submitted profile; a client-supplied digest is only compared (
digest-mismatch), never stored. Every problem is reported at once.unverifiableTermsis exported fromprofile-admission.tsasunverifiableProfileTerms, so registration and admission share one definition.Verified (DGX Spark)
168ec19a(spec 47 files, 1054 passed; tsc clean). Each of the five rules is mutation-checked.48a69252). Each version pin now reads its own evidence field, so disjoint adapter and firmware lists are registrable. Registration refuses what admission would fail closed on: a pattern pin (*), a device kind no evidence source can carry, and an inactive primitive id. A profile with an unknown term isprofile-invalid, so it can never be committed.@pcc/spec45 files, 965 passed;tsc --noEmitclean; the test files also type-check.Route-level test plan (for when gateway builds the route; the table is operator queue item 56)
checkProfileRegistrationproblem → 422, with every code returned.profileDigestis the server-computed one, and recomputes from the storedprofileJsonbytes.supersededAt. The old row is never edited.Draft; operator merges.
🤖 Generated with Claude Code
https://claude.ai/code/session_01PGXt1epJimheWaESMGBbXc