Skip to content

Provide the reviewed throwaway probe path for image-signature enforcement #3653

Description

@devantler

🤖 Generated by the Agentic Engineer

Evidence

#3336 has carried a blocked label since 2026-08-23 and has been skipped by three
consecutive engineer ticks. Its blocker line reads:

a maintainer-run node-level probe or a reviewed dedicated throwaway probe path | authority

Those two branches are not the same kind of thing, and collapsing them under a single
authority class is what parks the issue. The first branch genuinely needs a capability
unattended lanes do not have — this deployment gives them read-only production access, and
the observation steps require real node pulls. The second branch is ordinary engineering
work
: building the reviewed probe path is a change to this repository, reviewable and
mergeable on the normal path, and it does not need production write access to author.

An authority blocker clears only when a person is asked, so a record that classes
implementable work that way guarantees it is never picked up — the more diligently each
tick re-verifies it, the more legitimate the skip looks.

Problem and audience

The engineer cannot make progress on #3336 today, not because the work is impossible, but
because the only startable part of it is hidden behind a classification that says "wait for
a human". The result is that #3101's central claim — that signature verification actually
enforces rather than merely being configured — stays unproven while a shippable
prerequisite sits unwritten.

Expected outcome

The probe path exists in the repository, reviewed and merged, so that obtaining the
observation is reduced to running it. Authoring it needs no production write access;
executing it stays with whoever holds that access.

Acceptance criteria

  • A dedicated throwaway probe path is defined in this repository that exercises the node
    pull layer directly
    , so an admission-time rejection cannot be mistaken for a node-side
    refusal. Which layer produced the refusal must be distinguishable from the captured
    output.
  • It carries both controls the parent requires: a deliberately unsigned throwaway image
    (negative) and a correctly signed image (positive), so a refusal is attributable to the
    signature rather than to a verifier refusing everything.
  • It never references a production workload, and it defines its own cleanup.
  • It is dormant by default, consistent with how the liveness workflow ships dormant, and
    documents exactly what running it requires.
  • Restoring the daily schedule: trigger stays out of scope here — that is the parent's
    final step and is gated on the observation, not on this path existing.

Size

Small-to-medium; one reviewable change. The design question this must answer — how to reach
the node pull layer without admission short-circuiting it — is the substance of the work and
should be settled in the PR.

Part of #3336.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions