feat(evidence): repo-scoped session evidence verb - #181
Merged
Merged
Conversation
Add gds evidence record and gds evidence verify: a signed, canonical artifact scoped to exactly the repository the agent ran in, including every Git module inside its boundary. Records bind the repository anchor identity, HEAD/upstream position, change counts and sorted changed paths, and per-submodule gitlink/checked-out OIDs; each record links the newest prior artifact for the same repository through previous_evidence_digest. Artifacts are private (they name working-tree paths), so they are written under the device state root mode 0600 and never into the repository. Signatures use Ed25519 under the gds-session-evidence/v1 domain with the session-evidence trust role; verify needs only the artifact and a trust policy. New session-evidence schema with valid and invalid fixtures, ADR 0039, and CLI contract documentation.
GDS_PLAN_ENABLEMENT_REQUIRED checked eight bindings behind one generic message, so a session-id mismatch between enable and apply produced an error that did not say why. The error now names the failing binding and, for the common session mismatch, states the required relationship.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
gds evidence record/gds evidence verify: signed, repo-scoped session evidence for the repository the agent ran in, including every Git module inside its boundary — the remaining program itemsession-evidence-collector.core/sessionevidence— canonical payload, Ed25519Signunder domaingds-session-evidence/v1(rolesession-evidence), and an independentVerifier(schema, digest, signature, structural invariants).core/app/session_evidence.go— record binds the.gds/repository.yamlidentity, HEAD/upstream position, change counts and sorted changed paths (porcelain v2), and per-submodule gitlink/checked-out OIDs; links each artifact to the previous one for the same repository viaprevious_evidence_digest. Artifacts are private: written under the device state root, mode 0600, never into the repository.gds evidence verifyneeds only the artifact + trust policy — not the session, harness, or repository.session-evidenceschema (v1) with valid + invalid fixtures;evidenceregistered in the capability registry; ADR 0039; CLI contract docs; CHANGELOG.Design follows the audited consensus for agent audit trails (in-toto-style subject/predicate/envelope separation, canonical signed manifests, hash chaining) and states honestly what the artifact does not prove: that the named session produced the state, or that the work was correct.
Test plan
go test ./...— all packages greenpytest— 70 passed (schema fixtures incl. new session-evidence cases)scripts/validate_shell.sh— shellcheck 0.11.0, 8 scriptsscripts/validate_go_core.sh— fullscripts/validate_assurance.sh— GDS integrated assurance: PASSGenerated with Devin