From d27fe99d6d75f94962ddff1a3c24d1a0b21e56c2 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Thu, 10 Sep 2026 02:24:05 -0500 Subject: [PATCH 1/3] conformance: identify Windows status writer operations Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/client-v1-conformance.yml | 8 ++--- scripts/phase1-conformance.mjs | 29 +++++++++++---- scripts/phase1-schema-v2-producer.mjs | 39 ++++++++++++++------ src/phase1-conformance.test.ts | 40 +++++++++++++++++++++ 4 files changed, 96 insertions(+), 20 deletions(-) diff --git a/.github/workflows/client-v1-conformance.yml b/.github/workflows/client-v1-conformance.yml index a4e609df..34a22f9d 100644 --- a/.github/workflows/client-v1-conformance.yml +++ b/.github/workflows/client-v1-conformance.yml @@ -8829,14 +8829,14 @@ jobs: @('scripts\owned-temp-directory.mjs', 6965, 'a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095'), @('scripts\phase1-artifact-secret-scan.mjs', 21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a'), @('scripts\phase1-conformance-lock.mjs', 48961, '54c960fac12737013ebf2490c9cae121e7e77c027138eba9e4e3a882bd48c389'), - @('scripts\phase1-conformance.mjs', 204500, 'f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5'), + @('scripts\phase1-conformance.mjs', 204949, 'c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41'), @('scripts\phase1-evidence-contract.mjs', 15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f'), @('scripts\phase1-evidence-runtime.mjs', 6078, '3d227c354e6d908c5912d2b8244336e3b79c3bbd4dec79b0ad219ed65b8cb159'), @('scripts\phase1-linux-secret-service.mjs', 4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92'), @('scripts\phase1-macos-keychain.mjs', 5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4'), @('scripts\phase1-process-supervisor.mjs', 3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c'), @('scripts\phase1-schema-v2-evidence.mjs', 52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8'), - @('scripts\phase1-schema-v2-producer.mjs', 185403, '5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e'), + @('scripts\phase1-schema-v2-producer.mjs', 186184, '0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce'), @('scripts\process-owned-artifact-root.mjs', 11788, '426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624'), @('scripts\supervised-exec.mjs', 2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b'), @('scripts\supervisor-status.mjs', 854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e') @@ -9557,14 +9557,14 @@ jobs: ['scripts/owned-temp-directory.mjs', [6965, 'a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095']], ['scripts/phase1-artifact-secret-scan.mjs', [21183, 'be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a']], ['scripts/phase1-conformance-lock.mjs', [48961, '54c960fac12737013ebf2490c9cae121e7e77c027138eba9e4e3a882bd48c389']], - ['scripts/phase1-conformance.mjs', [204500, 'f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5']], + ['scripts/phase1-conformance.mjs', [204949, 'c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41']], ['scripts/phase1-evidence-contract.mjs', [15088, '24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f']], ['scripts/phase1-evidence-runtime.mjs', [6078, '3d227c354e6d908c5912d2b8244336e3b79c3bbd4dec79b0ad219ed65b8cb159']], ['scripts/phase1-linux-secret-service.mjs', [4270, 'ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92']], ['scripts/phase1-macos-keychain.mjs', [5091, 'ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4']], ['scripts/phase1-process-supervisor.mjs', [3820, '16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c']], ['scripts/phase1-schema-v2-evidence.mjs', [52505, '0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8']], - ['scripts/phase1-schema-v2-producer.mjs', [185403, '5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e']], + ['scripts/phase1-schema-v2-producer.mjs', [186184, '0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce']], ['scripts/process-owned-artifact-root.mjs', [11788, '426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624']], ['scripts/supervised-exec.mjs', [2875, 'a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b']], ['scripts/supervisor-status.mjs', [854, 'ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e']], diff --git a/scripts/phase1-conformance.mjs b/scripts/phase1-conformance.mjs index 82dc4672..d6dfbf23 100644 --- a/scripts/phase1-conformance.mjs +++ b/scripts/phase1-conformance.mjs @@ -83,6 +83,25 @@ const caveBuildNodeOptions = '--max-old-space-size=6144'; const caveBuildReportedCpuTotal = '2'; const rpcTimeoutMs = 10_000; const caveConformanceTimeoutMs = 15 * 60_000; +const statusWriterFailureStages = [ + 'create-temporary-file', + 'write-contents', + 'write-newline', + 'sync-temporary-file', + 'convert-security-descriptor', + 'open-process-token', + 'read-process-token', + 'apply-owner-only-security', + 'replace-status-file', +]; +const statusWriterErrorCategories = [ + 'access-denied', + 'sharing-violation', + 'privilege-not-held', + 'invalid-owner', + 'file-not-found', + 'path-not-found', +]; const approvedCommandFailureReasons = new Set([ 'spawn', 'tracking', @@ -562,12 +581,10 @@ const publicPhase1DiagnosticIds = new Set([ 'result-timeout', 'result-disconnected', 'writer-error', - 'writer-error.access-denied', - 'writer-error.sharing-violation', - 'writer-error.privilege-not-held', - 'writer-error.invalid-owner', - 'writer-error.file-not-found', - 'writer-error.path-not-found', + ...statusWriterErrorCategories.map((category) => `writer-error.${category}`), + ...statusWriterFailureStages.flatMap((stage) => + statusWriterErrorCategories.map((category) => `writer-error.${stage}.${category}`), + ), 'writer-join', 'readback', 'content', diff --git a/scripts/phase1-schema-v2-producer.mjs b/scripts/phase1-schema-v2-producer.mjs index 67814e32..6c392ec4 100644 --- a/scripts/phase1-schema-v2-producer.mjs +++ b/scripts/phase1-schema-v2-producer.mjs @@ -112,6 +112,25 @@ const schemaV2NativeFailureStages = new Set([ 'isolation-proof', ]); const boundedSpawnErrorCodes = ['ENOENT', 'EACCES', 'EPERM', 'EINVAL', 'E2BIG', 'ENOMEM']; +const statusWriterFailureStages = [ + 'create-temporary-file', + 'write-contents', + 'write-newline', + 'sync-temporary-file', + 'convert-security-descriptor', + 'open-process-token', + 'read-process-token', + 'apply-owner-only-security', + 'replace-status-file', +]; +const statusWriterErrorCategories = [ + 'access-denied', + 'sharing-violation', + 'privilege-not-held', + 'invalid-owner', + 'file-not-found', + 'path-not-found', +]; const cargoBuildFailureCategories = [ 'timeout', 'output-limit', @@ -314,12 +333,10 @@ const publicFailureDiagnosticSet = new Set([ 'result-timeout', 'result-disconnected', 'writer-error', - 'writer-error.access-denied', - 'writer-error.sharing-violation', - 'writer-error.privilege-not-held', - 'writer-error.invalid-owner', - 'writer-error.file-not-found', - 'writer-error.path-not-found', + ...statusWriterErrorCategories.map((category) => `writer-error.${category}`), + ...statusWriterFailureStages.flatMap((stage) => + statusWriterErrorCategories.map((category) => `writer-error.${stage}.${category}`), + ), 'writer-join', 'readback', 'content', @@ -1182,16 +1199,17 @@ export function schemaV2FailureDiagnostic(error, activeStage) { // Inspect only the structured OS code at the start of this exact writer error. // The localized message and any private trailing output never become diagnostics. const writerRecord = - /^replace status after reader closes: Io \{ operation: "failed to write owner-only Windows daemon status", source: Os \{ code: (2|3|5|32|1307|1314), kind: [A-Za-z]+, message: "((?:[^"\\\r\n]|\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{[0-9a-fA-F]{1,6}\}))*)" \} \}$/u.exec( + /^replace status after reader closes: Io \{ operation: "failed to write owner-only Windows daemon status(?:: (create-temporary-file|write-contents|write-newline|sync-temporary-file|convert-security-descriptor|open-process-token|read-process-token|apply-owner-only-security|replace-status-file))?", source: Os \{ code: (2|3|5|32|1307|1314), kind: [A-Za-z]+, message: "((?:[^"\\\r\n]|\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{[0-9a-fA-F]{1,6}\}))*)" \} \}$/u.exec( message, ); - const writerCode = writerRecord?.[1]; + const writerStage = writerRecord?.[1]; + const writerCode = writerRecord?.[2]; // Scan complete escape tokens so a literal backslash before "u" is not // mistaken for a Unicode escape. Rust strings exclude surrogate scalars. const validScalars = writerRecord && [ - ...writerRecord[2].matchAll( + ...writerRecord[3].matchAll( /\\(?:[\\"nrt0]|x[0-7][0-9a-fA-F]|u\{([0-9a-fA-F]{1,6})\})/gu, ), ].every((escapeToken) => { @@ -1208,7 +1226,8 @@ export function schemaV2FailureDiagnostic(error, activeStage) { 1314: 'privilege-not-held', }; if (writerCode && validScalars) { - return `${base}.assertion.writer-error.${writerCategories[writerCode]}`; + const stageCategory = writerStage ? `.${writerStage}` : ''; + return `${base}.assertion.writer-error${stageCategory}.${writerCategories[writerCode]}`; } const categories = [ [/^(?:create status replacement home|write current status):/u, 'setup'], diff --git a/src/phase1-conformance.test.ts b/src/phase1-conformance.test.ts index 0a299e45..ebd2b5d2 100644 --- a/src/phase1-conformance.test.ts +++ b/src/phase1-conformance.test.ts @@ -5412,6 +5412,46 @@ describe('Phase 1 real-authority conformance harness', () => { 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status", source: Os { code: 5, kind: Other, message: "private message" } }', 'writer-error.access-denied', ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: create-temporary-file", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.create-temporary-file.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: write-contents", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.write-contents.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: write-newline", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.write-newline.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: sync-temporary-file", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.sync-temporary-file.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: convert-security-descriptor", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.convert-security-descriptor.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: open-process-token", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.open-process-token.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: read-process-token", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.read-process-token.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: apply-owner-only-security", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error.apply-owner-only-security.access-denied', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: replace-status-file", source: Os { code: 32, kind: Other, message: "private message" } }', + 'writer-error.replace-status-file.sharing-violation', + ], + [ + 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status: unsupported-stage", source: Os { code: 5, kind: PermissionDenied, message: "private message" } }', + 'writer-error', + ], [ 'replace status after reader closes: Io { operation: "failed to write owner-only Windows daemon status", source: Os { code: 32, kind: Other, message: "private message" } }', 'writer-error.sharing-violation', From f166c12c51dca9ae7525c7c50dae357402259b63 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Thu, 10 Sep 2026 02:59:05 -0500 Subject: [PATCH 2/3] conformance: bind status writer operation authority Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/phase1-conformance.md | 35 ++++++++++++++++------------- docs/roadmap.md | 24 ++++++++++---------- phase1-conformance.lock.json | 20 ++++++++--------- src/phase1-conformance-lock.test.ts | 18 +++++++-------- 4 files changed, 50 insertions(+), 47 deletions(-) diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md index 14e929e6..74153f40 100644 --- a/docs/phase1-conformance.md +++ b/docs/phase1-conformance.md @@ -15,19 +15,22 @@ the final bytes. ## Latest protected result -[Run 34431068139](https://github.com/OpenCoven/chat/actions/runs/34431068139) -used Chat #198 at `83518c85605a69089ef96fe31206cfa25741d5e4` and SDK #195 -validator `c02993c468808c84e39255caa185f2399db16ba0`. Linux and Darwin records +[Run 34435223248](https://github.com/OpenCoven/chat/actions/runs/34435223248) +used Chat #199 at `724690e64c4be820bdf4e0e1f8c568db516ba490` and SDK #196 +validator `a5c7e38ecc905a6fdb9c9a3e704c6395ec2df02a`. Linux and Darwin records passed identity, digest, timing, scan, and all 197 assertion checks. Windows -failed at `phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error`. -The repaired Coven test preserves the writer result; this category establishes -an error, but does not identify its OS code or the failing writer operation. -Final validation, attestation, and aggregation were skipped. No aggregate is accepted. - -The staged diagnostic change classifies six fixed Windows OS codes from an -attributed, structurally valid writer panic. Unsupported codes or string forms -retain the generic category. Raw error messages are never emitted. A matching -SDK binding and fresh protected run remain required before acceptance. +failed at +`phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error.access-denied`. +The bounded result identifies Windows OS code 5 but not the failing writer +operation. Final validation, attestation, and aggregation were skipped. No +aggregate is accepted. + +Coven #985 merged operation-specific fixed labels at +`c0c979cdee96327bf24218bc7c7ecb90d719cb27` after native Windows and Linux +checks passed. The staged Chat classifier combines one of those nine labels +with the six reviewed OS-code categories. Unsupported operations, codes, or +string forms retain the generic category, and raw messages are never emitted. +A matching SDK binding and fresh protected run remain required before acceptance. ## Exact inputs @@ -39,7 +42,7 @@ SDK binding and fresh protected run remain required before acceptance. - SDK package candidate `1597835325cf3762b51408ff0a565037eeb25f64`; - Cave authority `d20d83c46ba0c32433ce8dc6a358fb14b6bd0e45`, tree `7ff358ac42a9d94ae5feb1f08e2af64a5513e78e`, release `0.3.12`; -- Coven daemon and observation-test source `705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4`; +- Coven daemon and observation-test source `c0c979cdee96327bf24218bc7c7ecb90d719cb27`; - Chat native client remains at `721437b84026c042e431b0882dcd14fdb29ac07d` in its frozen Cargo manifest and lock; - Chat conformance driver support at the exact `harness.revision` and @@ -1209,20 +1212,20 @@ The later SDK validator repin must use these exact committed file bytes: | File | Bytes | SHA-256 | | --- | ---: | --- | -| `.github/workflows/client-v1-conformance.yml` | 465,045 | `6f1eebccd436914523fc6fe7f7ef97e34da65b4e313bb3aa37626218ce199fef` | +| `.github/workflows/client-v1-conformance.yml` | 465,045 | `da836653133fde665d886ea1d049c53c7d128c92660a8983d098f6b28de41275` | | `scripts/contract-canary.mjs` | 40,116 | `1683e2484a228b89ee241b9b434f277895bb6113fa1c2f7051267563b2582380` | | `scripts/executable-resolution.mjs` | 9,154 | `31e3c412ff8c835f14522f36a59e91f4a4ba82913210ae8e3b4455217503f430` | | `scripts/owned-temp-directory.mjs` | 6,965 | `a9c55c85cf2b7d70310d278bafd2c8e7695d66f4ae38b9c3f1f12fce0b442095` | | `scripts/phase1-artifact-secret-scan.mjs` | 21,183 | `be0ec302b9c4372f232d6bd1efcba873fd3380cc5de7f756cd0b9eeeec07222a` | | `scripts/phase1-conformance-lock.mjs` | 48,961 | `54c960fac12737013ebf2490c9cae121e7e77c027138eba9e4e3a882bd48c389` | -| `scripts/phase1-conformance.mjs` | 204,500 | `f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5` | +| `scripts/phase1-conformance.mjs` | 204,949 | `c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41` | | `scripts/phase1-evidence-contract.mjs` | 15,088 | `24180ae03835fa6aac45559682adb3c1e626bab76466eddc55b9e2300f0a2b7f` | | `scripts/phase1-evidence-runtime.mjs` | 6,078 | `3d227c354e6d908c5912d2b8244336e3b79c3bbd4dec79b0ad219ed65b8cb159` | | `scripts/phase1-linux-secret-service.mjs` | 4,270 | `ddf834c6f57853c5116b4b1f345952a218ff0687c5d741737c68e20bc2ecda92` | | `scripts/phase1-macos-keychain.mjs` | 5,091 | `ab0c2dd08cf606d9502f5da206175707d471d99f484e8c8c79b5b08a5772b9a4` | | `scripts/phase1-process-supervisor.mjs` | 3,820 | `16b51fb1a33b4bfef98daca549aacf5dc2d2c098cfbd664753b69c940d1e6f6c` | | `scripts/phase1-schema-v2-evidence.mjs` | 52,505 | `0aede2ab3abd76fabf5ac61d64d2dbaaffa497c8647b82236403de16a47751c8` | -| `scripts/phase1-schema-v2-producer.mjs` | 185,403 | `5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e` | +| `scripts/phase1-schema-v2-producer.mjs` | 186,184 | `0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce` | | `scripts/process-owned-artifact-root.mjs` | 11,788 | `426c2c8e36dc3bffddb35a565c07a60998b010660f6248ebc4264d9c4b502624` | | `scripts/supervised-exec.mjs` | 2,875 | `a5edfd985b934d3b46247a0da3141682c411d30bb582edf87ae7b29791dad65b` | | `scripts/supervisor-status.mjs` | 854 | `ac332ca7b6b040ecc846088bb3a6ad5e7112a0454eb3ea71d2a819d55e64254e` | diff --git a/docs/roadmap.md b/docs/roadmap.md index ab1c0b29..eb3158b7 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -2,24 +2,24 @@ ## Protected validation checkpoint, 2026-09-10 UTC -[Run 34431068139](https://github.com/OpenCoven/chat/actions/runs/34431068139), -attempt 1, used merged Chat #198 at `83518c85605a69089ef96fe31206cfa25741d5e4` -and SDK #195 validator `c02993c468808c84e39255caa185f2399db16ba0`. Both validator +[Run 34435223248](https://github.com/OpenCoven/chat/actions/runs/34435223248), +attempt 1, used merged Chat #199 at `724690e64c4be820bdf4e0e1f8c568db516ba490` +and SDK #196 validator `a5c7e38ecc905a6fdb9c9a3e704c6395ec2df02a`. Both validator scopes matched before protected approval. Coven daemon and observation source was `705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4`, including Coven #982's test repair. The frozen Chat native client remains at Coven `721437b8`. Linux artifact `10134896616` and Darwin artifact `10135000700` were downloaded and verified against this attempt: all 110 Cave, 46 SDK, and 41 Chat assertions -passed with matching identities, digests, timing, and clean scans. Windows failed -at `phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error`. -This identifies a returned writer error, superseding the earlier timing-assertion -failure. The underlying OS error and operation remain unclassified. - -Bounded OS-code diagnostics are being prepared without changing the status -writer, observation selection, resource limits, or dependency settings. They -require updated harness authority, workflow digests, and a matching SDK validator -before fresh protected validation. Ordinary CI is not protected acceptance. +passed with matching identities, digests, timing, and clean scans. Windows failed at +`phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error.access-denied`. +This identifies Windows OS code 5 while preserving the writer operation as the +remaining unknown. Coven #985 merged nine fixed operation labels at +`c0c979cdee96327bf24218bc7c7ecb90d719cb27`; native Windows and the retried +Linux suite passed. The staged Chat binding selects that source and classifies +only the reviewed operation/code combinations without exposing raw output. +Updated harness authority and a matching SDK validator are required before +fresh protected validation. Ordinary CI is not protected acceptance. The run is terminal failed. Validation, attestation, and aggregation were skipped; publishing remains disabled and [SDK #38](https://github.com/OpenCoven/sdk/issues/38) diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json index 407f6bc6..37d126c2 100644 --- a/phase1-conformance.lock.json +++ b/phase1-conformance.lock.json @@ -14,20 +14,20 @@ }, "coven": { "repository": "OpenCoven/coven", - "revision": "705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4" + "revision": "c0c979cdee96327bf24218bc7c7ecb90d719cb27" }, "harness": { "repository": "OpenCoven/chat", - "revision": "1063456c397dea3b871862d3cc3a70a0b8e2392a" + "revision": "d27fe99d6d75f94962ddff1a3c24d1a0b21e56c2" }, "harnessAuthority": { - "revision": "1063456c397dea3b871862d3cc3a70a0b8e2392a", - "tree": "01d77e5cb856c4ce05f55f260d78563df924d2be", + "revision": "d27fe99d6d75f94962ddff1a3c24d1a0b21e56c2", + "tree": "141c35fbd37f252d5b274f91963227c0b946e857", "files": [ { "path": "scripts/phase1-conformance.mjs", - "blob": "82dc46726a7d10f23ec435d7ed81cd7065aad1bc", - "sha256": "f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5" + "blob": "d6dfbf230fda3dd5a1734d9369b72a35f4e77804", + "sha256": "c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41" }, { "path": "scripts/phase1-conformance-launcher.sh", @@ -81,8 +81,8 @@ }, { "path": "scripts/phase1-schema-v2-producer.mjs", - "blob": "67814e324dcd7f71f43b809ef057dff57765c9f2", - "sha256": "5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e" + "blob": "6c392ec4c76c4bee091ffe7a5f7b44f4bc9500e7", + "sha256": "0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce" }, { "path": "scripts/phase1-linux-secret-service.mjs", @@ -146,8 +146,8 @@ }, { "path": ".github/workflows/client-v1-conformance.yml", - "blob": "a4e609df4c31ec1360d5229c03c618f7b6f865b3", - "sha256": "6f1eebccd436914523fc6fe7f7ef97e34da65b4e313bb3aa37626218ce199fef" + "blob": "34a22f9d7caf9244cd31315d0b6066a133aed744", + "sha256": "da836653133fde665d886ea1d049c53c7d128c92660a8983d098f6b28de41275" } ], "productionDeltas": [ diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts index af718e99..3bc48e4c 100644 --- a/src/phase1-conformance-lock.test.ts +++ b/src/phase1-conformance-lock.test.ts @@ -80,13 +80,13 @@ const committedHarnessAuthority = JSON.parse( readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'), ).harnessAuthority; const expectedBehaviorAuthority = { - revision: '1063456c397dea3b871862d3cc3a70a0b8e2392a', - tree: '01d77e5cb856c4ce05f55f260d78563df924d2be', + revision: 'd27fe99d6d75f94962ddff1a3c24d1a0b21e56c2', + tree: '141c35fbd37f252d5b274f91963227c0b946e857', files: [ { path: 'scripts/phase1-conformance.mjs', - blob: '82dc46726a7d10f23ec435d7ed81cd7065aad1bc', - sha256: 'f93b5720b105c06655158646137cad559b9b289983bd94939f055f29bdf48fa5', + blob: 'd6dfbf230fda3dd5a1734d9369b72a35f4e77804', + sha256: 'c565651117dc4104a1e0229af69662a86164e2b277092462ae38676dd7746b41', }, { path: 'scripts/phase1-conformance-lock.mjs', @@ -100,8 +100,8 @@ const expectedBehaviorAuthority = { }, { path: 'scripts/phase1-schema-v2-producer.mjs', - blob: '67814e324dcd7f71f43b809ef057dff57765c9f2', - sha256: '5721d71f99b4abcee7cd02d007e2c344db5512c138fbc912c15124117261f59e', + blob: '6c392ec4c76c4bee091ffe7a5f7b44f4bc9500e7', + sha256: '0351d8e992e143f71e7ac5d44cf00c76d04ad024bf7a0bccb6e7d5490875d6ce', }, { path: 'scripts/unix-producer-supervisor.sh', @@ -125,8 +125,8 @@ const expectedBehaviorAuthority = { }, { path: '.github/workflows/client-v1-conformance.yml', - blob: 'a4e609df4c31ec1360d5229c03c618f7b6f865b3', - sha256: '6f1eebccd436914523fc6fe7f7ef97e34da65b4e313bb3aa37626218ce199fef', + blob: '34a22f9d7caf9244cd31315d0b6066a133aed744', + sha256: 'da836653133fde665d886ea1d049c53c7d128c92660a8983d098f6b28de41275', }, { path: 'scripts/process-owned-artifact-root.mjs', @@ -151,7 +151,7 @@ const expectedEntries = { }, coven: { repository: 'OpenCoven/coven', - revision: '705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4', + revision: 'c0c979cdee96327bf24218bc7c7ecb90d719cb27', }, harness: { repository: 'OpenCoven/chat', From e15208e05a34d33483f4c727e9b2e2c77b529fb1 Mon Sep 17 00:00:00 2001 From: Val Alexander Date: Thu, 10 Sep 2026 03:17:35 -0500 Subject: [PATCH 3/3] docs: correct protected artifact identities Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/roadmap.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index eb3158b7..8f4ccd20 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -9,7 +9,7 @@ scopes matched before protected approval. Coven daemon and observation source was `705623e9cf2dfa9ee2d52973b2a6eb194a4cf7c4`, including Coven #982's test repair. The frozen Chat native client remains at Coven `721437b8`. -Linux artifact `10134896616` and Darwin artifact `10135000700` were downloaded +Linux artifact `10136315804` and Darwin artifact `10136396539` were downloaded and verified against this attempt: all 110 Cave, 46 SDK, and 41 Chat assertions passed with matching identities, digests, timing, and clean scans. Windows failed at `phase1.runtime-observations.coven-rust-tests.status-replacement.assertion.writer-error.access-denied`.