From 667750af2ef5d2ea14ec4e825e1bd54a57e771f5 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Mon, 7 Sep 2026 01:33:44 -0500 Subject: [PATCH 1/3] fix(conformance): classify report secret-scan failures --- .github/workflows/client-v1-conformance.yml | 4 ++-- docs/phase1-conformance.md | 2 +- scripts/phase1-schema-v2-producer.mjs | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/client-v1-conformance.yml b/.github/workflows/client-v1-conformance.yml index be5b78b1..14046183 100644 --- a/.github/workflows/client-v1-conformance.yml +++ b/.github/workflows/client-v1-conformance.yml @@ -8825,7 +8825,7 @@ jobs: @('scripts\phase1-macos-keychain.mjs', 5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4'), @('scripts\phase1-process-supervisor.mjs', 3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c'), @('scripts\phase1-schema-v2-evidence.mjs', 51642, 'a7cab994aa0ee97baceb4b2c475ec1ff253ae5681f39e2c3d15fb1035b2d2387'), - @('scripts\phase1-schema-v2-producer.mjs', 168581, '023b65fbf2a6b29dc8a85c14e0eb002f5e10751308f5af372505ba75273a8beb'), + @('scripts\phase1-schema-v2-producer.mjs', 168579, '9a419ac1e2c91865c811d67cfe44748f3548b88fb071a05ea82cc06bdf0607ad'), @('scripts\process-owned-artifact-root.mjs', 11205, '9ee158453044cd57b91c77c50262092a91993c6b1533b6584c61e1cbadfd794a'), @('scripts\supervised-exec.mjs', 2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b'), @('scripts\supervisor-status.mjs', 854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e') @@ -9517,7 +9517,7 @@ jobs: ['scripts/phase1-macos-keychain.mjs', [5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4']], ['scripts/phase1-process-supervisor.mjs', [3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c']], ['scripts/phase1-schema-v2-evidence.mjs', [51642, 'a7cab994aa0ee97baceb4b2c475ec1ff253ae5681f39e2c3d15fb1035b2d2387']], - ['scripts/phase1-schema-v2-producer.mjs', [168581, '023b65fbf2a6b29dc8a85c14e0eb002f5e10751308f5af372505ba75273a8beb']], + ['scripts/phase1-schema-v2-producer.mjs', [168579, '9a419ac1e2c91865c811d67cfe44748f3548b88fb071a05ea82cc06bdf0607ad']], ['scripts/process-owned-artifact-root.mjs', [11205, '9ee158453044cd57b91c77c50262092a91993c6b1533b6584c61e1cbadfd794a']], ['scripts/supervised-exec.mjs', [2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b']], ['scripts/supervisor-status.mjs', [854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e']], diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md index 74cfe0cf..0a523b60 100644 --- a/docs/phase1-conformance.md +++ b/docs/phase1-conformance.md @@ -1110,7 +1110,7 @@ The later SDK validator repin must use these exact committed file bytes: | `scripts/phase1-macos-keychain.mjs` | 5,091 | `ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4` | | `scripts/phase1-process-supervisor.mjs` | 3,820 | `16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c` | | `scripts/phase1-schema-v2-evidence.mjs` | 51,642 | `a7cab994aa0ee97baceb4b2c475ec1ff253ae5681f39e2c3d15fb1035b2d2387` | -| `scripts/phase1-schema-v2-producer.mjs` | 168,581 | `023b65fbf2a6b29dc8a85c14e0eb002f5e10751308f5af372505ba75273a8beb` | +| `scripts/phase1-schema-v2-producer.mjs` | 168,579 | `9a419ac1e2c91865c811d67cfe44748f3548b88fb071a05ea82cc06bdf0607ad` | | `scripts/process-owned-artifact-root.mjs` | 11,205 | `9ee158453044cd57b91c77c50262092a91993c6b1533b6584c61e1cbadfd794a` | | `scripts/supervised-exec.mjs` | 2,875 | `a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b` | | `scripts/supervisor-status.mjs` | 854 | `ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e` | diff --git a/scripts/phase1-schema-v2-producer.mjs b/scripts/phase1-schema-v2-producer.mjs index 9ecfe457..074b4f80 100644 --- a/scripts/phase1-schema-v2-producer.mjs +++ b/scripts/phase1-schema-v2-producer.mjs @@ -4844,7 +4844,7 @@ export async function runSchemaV2Conformance(options, lock, harnessAuthorityVeri }, }), ); - runSchemaV2PreflightStage('phase1.stage.evidence-authority.report.failed', () => + runSchemaV2PreflightStage('phase1.stage.evidence-authority.scan.failed', () => scanPhase1ArtifactText(`${JSON.stringify(completedReport)}\n`), ); From afc9afaf5b5af091eb3f8ecd993116d4307c551f Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Mon, 7 Sep 2026 01:37:02 -0500 Subject: [PATCH 2/3] test(conformance): bind corrected report scan authority --- phase1-conformance.lock.json | 14 +++++++------- src/phase1-conformance-lock.test.ts | 12 ++++++------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json index 00e998b4..b9ede87c 100644 --- a/phase1-conformance.lock.json +++ b/phase1-conformance.lock.json @@ -18,11 +18,11 @@ }, "harness": { "repository": "OpenCoven/chat", - "revision": "50ad59966d9ebdae3a97459bc21670e461bd6dd9" + "revision": "667750af2ef5d2ea14ec4e825e1bd54a57e771f5" }, "harnessAuthority": { - "revision": "50ad59966d9ebdae3a97459bc21670e461bd6dd9", - "tree": "0883076e180169216be4d6e339bb9f4bb225c422", + "revision": "667750af2ef5d2ea14ec4e825e1bd54a57e771f5", + "tree": "3f2fdc4db32f793cb7aec2b51938d0f838ef5454", "files": [ { "path": "scripts/phase1-conformance.mjs", @@ -81,8 +81,8 @@ }, { "path": "scripts/phase1-schema-v2-producer.mjs", - "blob": "9ecfe45795c83d1bd5a11b0053972bb912909ea5", - "sha256": "023b65fbf2a6b29dc8a85c14e0eb002f5e10751308f5af372505ba75273a8beb" + "blob": "074b4f80b8987b05eee3871e44634f58cf022433", + "sha256": "9a419ac1e2c91865c811d67cfe44748f3548b88fb071a05ea82cc06bdf0607ad" }, { "path": "scripts/phase1-linux-secret-service.mjs", @@ -146,8 +146,8 @@ }, { "path": ".github/workflows/client-v1-conformance.yml", - "blob": "be5b78b10dc756acd370e72967f82ad79f1bf343", - "sha256": "e76c4361fb94c0b9525680f2aac176ca377174665b0323b5aefaf219fa452d02" + "blob": "140461830a547ed02659fffbe5ee0041892020e3", + "sha256": "0054e517a3c9a099bb7fd2cc509ddaaa206d90d60c3c677f611c991ce3a79374" } ], "productionDeltas": [ diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts index 5d034df5..e9ac5e81 100644 --- a/src/phase1-conformance-lock.test.ts +++ b/src/phase1-conformance-lock.test.ts @@ -79,8 +79,8 @@ const committedHarnessAuthority = JSON.parse( readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'), ).harnessAuthority; const expectedBehaviorAuthority = { - revision: '50ad59966d9ebdae3a97459bc21670e461bd6dd9', - tree: '0883076e180169216be4d6e339bb9f4bb225c422', + revision: '667750af2ef5d2ea14ec4e825e1bd54a57e771f5', + tree: '3f2fdc4db32f793cb7aec2b51938d0f838ef5454', files: [ { path: 'scripts/phase1-conformance.mjs', @@ -99,8 +99,8 @@ const expectedBehaviorAuthority = { }, { path: 'scripts/phase1-schema-v2-producer.mjs', - blob: '9ecfe45795c83d1bd5a11b0053972bb912909ea5', - sha256: '023b65fbf2a6b29dc8a85c14e0eb002f5e10751308f5af372505ba75273a8beb', + blob: '074b4f80b8987b05eee3871e44634f58cf022433', + sha256: '9a419ac1e2c91865c811d67cfe44748f3548b88fb071a05ea82cc06bdf0607ad', }, { path: 'scripts/unix-producer-supervisor.sh', @@ -124,8 +124,8 @@ const expectedBehaviorAuthority = { }, { path: '.github/workflows/client-v1-conformance.yml', - blob: 'be5b78b10dc756acd370e72967f82ad79f1bf343', - sha256: 'e76c4361fb94c0b9525680f2aac176ca377174665b0323b5aefaf219fa452d02', + blob: '140461830a547ed02659fffbe5ee0041892020e3', + sha256: '0054e517a3c9a099bb7fd2cc509ddaaa206d90d60c3c677f611c991ce3a79374', }, ], } as const; From f75a75b275aa2f08508191275bb60813bb4f5391 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Mon, 7 Sep 2026 01:40:05 -0500 Subject: [PATCH 3/3] docs(conformance): refresh report scan workflow digest --- docs/phase1-conformance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md index 0a523b60..e4f879d9 100644 --- a/docs/phase1-conformance.md +++ b/docs/phase1-conformance.md @@ -1097,7 +1097,7 @@ The later SDK validator repin must use these exact committed file bytes: | File | Bytes | SHA-256 | | --- | ---: | --- | -| `.github/workflows/client-v1-conformance.yml` | 463,033 | `e76c4361fb94c0b9525680f2aac176ca377174665b0323b5aefaf219fa452d02` | +| `.github/workflows/client-v1-conformance.yml` | 463,033 | `0054e517a3c9a099bb7fd2cc509ddaaa206d90d60c3c677f611c991ce3a79374` | | `scripts/contract-canary.mjs` | 39,346 | `63b2a95c8563143d0d748d36ef2bdbae656e7babdb23b986efca97bbbc9b8d83` | | `scripts/executable-resolution.mjs` | 9,154 | `31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430` | | `scripts/owned-temp-directory.mjs` | 6,965 | `a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095` |