From 2b1ce8956f016c6023ae0911bc80a5e04f56edf3 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:21:02 +0200 Subject: [PATCH 01/12] fix(governance): use canonical Voodoo-One repository identity --- .github/governance/main-branch-baseline.v1.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/governance/main-branch-baseline.v1.json b/.github/governance/main-branch-baseline.v1.json index b04e05d2..f051148a 100644 --- a/.github/governance/main-branch-baseline.v1.json +++ b/.github/governance/main-branch-baseline.v1.json @@ -1,6 +1,6 @@ { "schema": "vone.github-main-governance/v1", - "repository": "eimyroot/V-One", + "repository": "eimyroot/Voodoo-One", "branch": "main", "desired": { "pull_request_required": true, From b0de7f5ebb3355aa9b7dc124a7f35a46850104e2 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:22:15 +0200 Subject: [PATCH 02/12] docs(ops): repair repository and schema truth --- docs/product/OPERATIONS_RUNBOOK.md | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/docs/product/OPERATIONS_RUNBOOK.md b/docs/product/OPERATIONS_RUNBOOK.md index 937d816d..a0f7d089 100644 --- a/docs/product/OPERATIONS_RUNBOOK.md +++ b/docs/product/OPERATIONS_RUNBOOK.md @@ -93,7 +93,7 @@ or enable production effects. From any authenticated GitHub CLI working director current candidate with: ```bash -gh workflow run release-candidate.yml --repo nulleimy/V-One --ref main \ +gh workflow run release-candidate.yml --repo eimyroot/Voodoo-One --ref main \ -f version=0.9.0-rc2 -f confirmation=BUILD_RC ``` @@ -103,7 +103,7 @@ directory. Replace `RUN_ID` with the successful workflow run ID: ```bash mkdir -p /tmp/v-one-rc-verify cd /tmp/v-one-rc-verify -gh run download RUN_ID --repo nulleimy/V-One --name v-one-0.9.0-rc2 --dir . +gh run download RUN_ID --repo eimyroot/Voodoo-One --name v-one-0.9.0-rc2 --dir . sha256sum --check SHA256SUMS.txt ``` @@ -114,10 +114,15 @@ attestations are generated and independently verified. ## Database migrations SQLite migrations run automatically and atomically before the application starts accepting traffic. -The health response must report `database_backend: sqlite` and `schema_version: 9`. Never edit an -applied migration: its SHA-256 checksum is part of the database history and drift blocks startup. -Database unavailability or migration-history drift returns HTTP `503`, which makes the container -healthcheck fail instead of reporting a false-positive HTTP success. +The health response must report `database_backend: sqlite` and a `schema_version` equal to the highest +contiguous migration version bundled in the exact deployed artifact. Do not hard-code an expected +schema number in operational automation: derive or verify it from the artifact's +`voodoo_product/migrations/sqlite` set and reconcile it with `docs/product/DATABASE_MIGRATIONS.md`. +For the current source tree the highest bundled migration is `0014_workspace_memberships.sql`, so the +current expected schema is 14. Never edit an applied migration: its SHA-256 checksum is part of the +database history and drift blocks startup. Database unavailability or migration-history drift returns +HTTP `503`, which makes the container healthcheck fail instead of reporting a false-positive HTTP +success. For an upgrade: @@ -128,8 +133,8 @@ For an upgrade: 4. Copy the database, `-wal` and `-shm` files as one consistent backup set. 5. Deploy the new immutable application artifact while keeping production effects disabled. 6. Start exactly one instance and wait for migration completion. -7. Verify `/api/v1/health` reports `HEALTHY`, `sqlite`, schema version `9`, and production effects - `DISABLED`. +7. Verify `/api/v1/health` reports `HEALTHY`, `sqlite`, the highest contiguous migration version + bundled in that exact artifact, and production effects `DISABLED`. 8. Run the authenticated `/api/v1/evidence/verify` operation again, then start the remaining instances. From a45b14aa79c4eba8e5863f84d5f9603432015cc9 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:22:40 +0200 Subject: [PATCH 03/12] docs(governance): bind review publication to Voodoo-One --- docs/governance/REVIEW_BRANCH_PUBLICATION.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/governance/REVIEW_BRANCH_PUBLICATION.md b/docs/governance/REVIEW_BRANCH_PUBLICATION.md index 895612ec..4385474e 100644 --- a/docs/governance/REVIEW_BRANCH_PUBLICATION.md +++ b/docs/governance/REVIEW_BRANCH_PUBLICATION.md @@ -13,7 +13,7 @@ Skript odmítne pokračovat, pokud: - pracovní strom není čistý, - `HEAD` neodpovídá explicitnímu úplnému SHA, - neprojde SHA-256 kontrola obou kanonických ústav, -- publication target URL není přesně `https://github.com/eimyroot/V-One.git`, nebo `origin` fetch URL není canonical URL ani explicitně povolený legacy alias `https://github.com/nulleimy/V-One.git`, +- publication target URL není přesně `https://github.com/eimyroot/Voodoo-One.git`, nebo `origin` fetch URL není canonical URL ani explicitně povolený fetch-only legacy alias `https://github.com/eimyroot/V-One.git` / `https://github.com/nulleimy/V-One.git`, - cílová větev nezačíná `review/`, - cílová větev je chráněná nebo má neplatný Git ref, - `HEAD` není potomkem zadaného base refu, @@ -25,7 +25,9 @@ Skript odmítne pokračovat, pokud: - chybí přesná autorizační věta, - vzdálené SHA po publikaci neodpovídá publikovanému `HEAD`. -Skript nepoužívá force push a nemění konfiguraci repozitáře. +Skript nepoužívá force push a nemění konfiguraci repozitáře. Legacy URL jsou přijatelné pouze jako +zdrojová `origin` fetch identita pro existující managed worktrees; nikdy nejsou povoleným publication +targetem. Publikace aktuálně podporuje přesně base ref `origin/main`. Jiná hodnota `--base-ref` je odmítnuta před freshness fetch. From 98717230fe1b23521b3935466f7ca6af9ce01492 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:23:46 +0200 Subject: [PATCH 04/12] fix(governance): publish only to canonical Voodoo-One --- scripts/publish_review_branch.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/publish_review_branch.py b/scripts/publish_review_branch.py index 1bee32da..ef2e9e88 100755 --- a/scripts/publish_review_branch.py +++ b/scripts/publish_review_branch.py @@ -17,9 +17,12 @@ from datetime import UTC, datetime from pathlib import Path -ALLOWED_GITHUB_REPOSITORY = "https://github.com/eimyroot/V-One.git" +ALLOWED_GITHUB_REPOSITORY = "https://github.com/eimyroot/Voodoo-One.git" LEGACY_GITHUB_REPOSITORY_ALIASES = frozenset( - {"https://github.com/nulleimy/V-One.git"} + { + "https://github.com/eimyroot/V-One.git", + "https://github.com/nulleimy/V-One.git", + } ) CANONICAL_EVIDENCE_ROOT = Path("/Users/eimyna/00_DEV/V-ONE-EVIDENCE") DEFAULT_BASE_REF = "origin/main" @@ -526,4 +529,4 @@ def main(argv: Sequence[str] | None = None) -> int: if __name__ == "__main__": - raise SystemExit(main()) + raise SystemExit(main()) \ No newline at end of file From edae4a52e835c330a00644b29bb65ebdd736d88d Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:24:29 +0200 Subject: [PATCH 05/12] docs(governance): require fresh post-rename G0 evidence --- docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md b/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md index fa4a6979..7fdd60bd 100644 --- a/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md +++ b/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md @@ -1,6 +1,6 @@ # GitHub Main Governance Baseline v1 -Status: PREPARED — repository-side contract with fail-closed live verifier +Status: PREPARED — repository-side contract repaired for `eimyroot/Voodoo-One`; fresh live G0 verification required ## Purpose @@ -50,7 +50,7 @@ Product/runtime rule `no requester self-approval` remains a separate V-One autho P0 is complete only when live GitHub configuration evidence proves the desired state. Acceptable evidence must include: ```text -repository = nulleimy/V-One +repository = eimyroot/Voodoo-One branch = main branch_head_sha = verifier_source_sha = @@ -73,7 +73,7 @@ verified_at = source = GitHub live repository settings/API ``` -A repository document, CI pass, issue, PR description or previous observation is not sufficient evidence of GitHub-side enforcement. +A repository document, CI pass, issue, PR description or previous observation is not sufficient evidence of GitHub-side enforcement. A repository rename or transfer changes the identity being verified: a historical G0 PASS for a different repository identity remains historical evidence and is not reusable as current G0 proof. ## Machine verification @@ -152,7 +152,7 @@ Examples that are `BLOCKED` when evidence is otherwise complete: - PR-only flow, force-push blocking, deletion blocking or thread resolution is absent; - any bypass actor is configured. -Only `VERIFIED` exits successfully. `BLOCKED` and `UNKNOWN` fail closed. A historical PASS is not reusable proof after GitHub ruleset/settings configuration changes. +Only `VERIFIED` exits successfully. `BLOCKED` and `UNKNOWN` fail closed. A historical PASS is not reusable proof after GitHub ruleset/settings configuration changes or repository-identity changes. ## Credential boundary From 440147d2932ed1a6f89f05c11a8033c50d183c24 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:25:10 +0200 Subject: [PATCH 06/12] docs: mark post-rename G0 current state unknown --- README.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 50415f7b..5d486cc5 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ OperationProof != OperationCell | Canonical FastAPI ProductComposition runtime seam | IMPLEMENTED / MERGED; explicit runtime factory required, default provider pack disabled | | Canonical public READ operation API | IMPLEMENTED / MERGED via PR #137; reconciled with resume/runtime via PR #140 | | Restart-safe durable READ resume | IMPLEMENTED / MERGED via PR #140 | -| GitHub main governance enforcement | VERIFIED / G0 PASS from retained live verifier evidence | +| GitHub main governance enforcement | UNKNOWN / fresh post-rename G0 required; historical VERIFIED evidence retained | | Default provider runtime pack | BLOCKED / disabled until G8 | | Real canonical HTTP READ E2E through default G8 pack | BLOCKED / not yet verified | | Provider WRITE activation | BLOCKED pending repeated READ E2E + restart-safe verification gate | @@ -157,8 +157,8 @@ deployment, or release. ## G0 governance evidence -The former GitHub-governance blocker is closed by retained live verifier evidence, not by documentation -or ordinary CI inference: +The repository retains historical live G0 evidence for the repository identity that was current when +the run executed: ```text workflow = g0-governance-verify @@ -169,8 +169,11 @@ artifact_digest = sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50e verdict = VERIFIED ``` -This evidence established the G0 PASS controls in the current-state documents. G0 PASS remains separate -from provider runtime, release, and deployment authorization. +That artifact remains valid historical evidence only. The canonical repository is now +`eimyroot/Voodoo-One`; current G0 governance is therefore `UNKNOWN` until a fresh +`g0-governance-verify` run executes on the exact post-repair `main` SHA and independently verifies the +current repository identity and live ruleset. Historical G0 PASS never authorizes provider runtime, +release, or deployment. ## READ before WRITE @@ -218,7 +221,7 @@ a new provider mutation is authorized. - default G8 provider runtime and real product HTTP READ E2E remain blocked/unverified; - provider WRITE remains blocked behind READ-before-WRITE evidence and separate effect authorization; - no release/deployment inferred from CI, merge, Proof or Cell; -- GitHub main governance enforcement has retained live G0 VERIFIED evidence. +- historical G0 VERIFIED evidence is retained, while current post-rename GitHub governance remains UNKNOWN until fresh exact-main verification. ## Documentation From 8e88b4dcffd0fbeb54a7a4c74fa99e3168029ad2 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:25:47 +0200 Subject: [PATCH 07/12] docs(state): separate historical G0 from current post-rename truth --- CURRENT_PRODUCT_STATE.md | 48 +++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 18 deletions(-) diff --git a/CURRENT_PRODUCT_STATE.md b/CURRENT_PRODUCT_STATE.md index a05b5e22..2129744a 100644 --- a/CURRENT_PRODUCT_STATE.md +++ b/CURRENT_PRODUCT_STATE.md @@ -5,8 +5,9 @@ ## Snapshot identity ```text -AS_OF: 2026-08-24 +AS_OF: 2026-09-06 EXACT_LIVE_GIT_IDENTITY: QUERY_LIVE_GIT_DIRECTLY +CANONICAL_REPOSITORY: eimyroot/Voodoo-One RECONCILIATION_INPUT_HEAD: 3106ba95125a13adb8e0ee867fbf341d2d2e776e RECONCILIATION_BASE_MAIN: 3106ba95125a13adb8e0ee867fbf341d2d2e776e RECONCILIATION_MERGE: PR #140 / 60bc9c26813ee23c73bac194a9adb27714e8a1e8 @@ -55,7 +56,7 @@ RELEASED / DEPLOYED = separately governed states | Restart-safe durable resume | **IMPLEMENTED / MERGED via PR #140** | | Runtime resume wiring | **IMPLEMENTED / MERGED via PR #140** | | G7 post-merge verification | **VERIFIED on `main@60bc9c268...` by CI #1015, D4 #202, E3 #193, E4B #189** | -| GitHub G0 governance | **VERIFIED / PASS** | +| GitHub G0 governance | **UNKNOWN / fresh post-rename exact-main verification required** | | Default provider runtime pack | **DISABLED / FAIL-CLOSED** | | Real canonical HTTP READ E2E using default G8 pack | **BLOCKED / NOT YET VERIFIED** | | Provider WRITE activation | **BLOCKED** | @@ -66,9 +67,14 @@ RELEASED / DEPLOYED = separately governed states | Deployment | **NOT PERFORMED** | | CyberCore | **BLOCKED pending product/release-governance hardening** | -## G0 live GitHub governance +## G0 GitHub governance — current vs historical evidence -G0 is no longer an unresolved blocker. The exit gate is tied to identifiable live evidence: +Current canonical repository identity is `eimyroot/Voodoo-One`. No fresh post-rename G0 run is yet +retained for the exact current `main` SHA, so current G0 state is deliberately `UNKNOWN` and the +release-candidate governance gate remains fail-closed until fresh live evidence exists. + +The following retained artifact remains valid historical evidence for the repository identity and +source SHA that existed when it ran: ```text workflow = g0-governance-verify @@ -80,25 +86,30 @@ artifact = g0-governance-evidence-32553113424-1 artifact_id = 9470619984 artifact_digest = sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50eff7dc4f5f evidence_json_checksum = 11a99765485b63b70186037011d31c105dea8dd75b689e0036a8766d05e8137d -verdict = VERIFIED +historical_verdict = VERIFIED ``` -The retained evidence verifies PR-only main, required `verify` from workflow `ci`, latest-head strict checks, force-push disabled, branch deletion disabled, conversation resolution, no ordinary admin/ruleset bypass, active rulesets, and verifier source binding. +That historical evidence verified PR-only main, required `verify` from workflow `ci`, latest-head +strict checks, force-push disabled, branch deletion disabled, conversation resolution, no ordinary +admin/ruleset bypass, active rulesets, and verifier source binding for its exact evidence scope. It +must not be reused as proof for the renamed current repository identity. ```text -REPO_ENFORCEMENT_CONTRACT = VERIFIED -GITHUB_SETTINGS_ENFORCED = VERIFIED -MAIN_PR_ONLY = VERIFIED -REQUIRED_CI = VERIFIED -FORCE_PUSH_DISABLED = VERIFIED -BRANCH_DELETE_DISABLED = VERIFIED -CONVERSATION_RESOLUTION = VERIFIED -ORDINARY_ADMIN_BYPASS_DISABLED = VERIFIED -P0_GITHUB_GOVERNANCE = PASS -G0 = PASS +REPO_ENFORCEMENT_CONTRACT = IMPLEMENTED +GITHUB_SETTINGS_ENFORCED = UNKNOWN +MAIN_PR_ONLY = UNKNOWN_CURRENT_G0 +REQUIRED_CI = UNKNOWN_CURRENT_G0 +FORCE_PUSH_DISABLED = UNKNOWN_CURRENT_G0 +BRANCH_DELETE_DISABLED = UNKNOWN_CURRENT_G0 +CONVERSATION_RESOLUTION = UNKNOWN_CURRENT_G0 +ORDINARY_ADMIN_BYPASS_DISABLED = UNKNOWN_CURRENT_G0 +P0_GITHUB_GOVERNANCE = BLOCKED_PENDING_FRESH_G0 +G0 = UNKNOWN ``` -G0 PASS does not authorize release or deployment. +A fresh G0 PASS on the exact post-repair `main` SHA may promote these current governance fields back to +`VERIFIED`; documentation, CI success, or the historical artifact cannot do so by inference. G0 PASS +does not authorize release or deployment. ## Canonical shared authority/execution prefix @@ -294,12 +305,13 @@ This historical evidence does not authorize or prove any new provider mutation. - Historical PR #125 technical merge/post-state is VERIFIED; separate pre-merge merge-authorization provenance remains **NOT VERIFIED** and is not rewritten. - ADR-0018 records the R2 terminal-profile correction instead of silently rewriting older history. - PR #128 reconciliation remains historical provenance; later G7 evidence does not rewrite it. +- Historical G0 run `32553113424` remains retained evidence for its original repository identity and exact source SHA; it is not current post-rename proof. ## Current release truth ```text VOODOO_ALLOW_PRODUCTION_EFFECTS=false -G0_GITHUB_GOVERNANCE=PASS +G0_GITHUB_GOVERNANCE=UNKNOWN G7_CANONICAL_READ_API=MERGED G7_RESTART_SAFE_RESUME=MERGED G8_DEFAULT_READ_RUNTIME=OFF From 5af7907dc26648c1ec26a89185cf6944c67d7e72 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:26:30 +0200 Subject: [PATCH 08/12] docs(capabilities): mark current G0 unknown after repository rename --- docs/product/CURRENT_CAPABILITIES.md | 30 ++++++++++++++++++---------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/docs/product/CURRENT_CAPABILITIES.md b/docs/product/CURRENT_CAPABILITIES.md index b46ee0e3..e9aa9ca1 100644 --- a/docs/product/CURRENT_CAPABILITIES.md +++ b/docs/product/CURRENT_CAPABILITIES.md @@ -3,7 +3,8 @@ | Field | Value | |---|---| | Document status | Current-state inventory | -| Inventory audit date | `2026-08-24` | +| Inventory audit date | `2026-09-06` | +| Canonical repository | `eimyroot/Voodoo-One` | | Canonical post-G7 merge | PR #140 / `60bc9c26813ee23c73bac194a9adb27714e8a1e8` | | Exact live Git identity | Query live Git directly; never self-embed a commit as "current" | | Historical reconciliation merge | PR #128 / `d9e27ff17b76f29daba4a3421b11cc396826fe12` | @@ -91,12 +92,12 @@ Is it released/deployed? | Security Intelligence R-SI1.1 | IMPLEMENTED | metadata + tests | intelligence-only; no execution/proof authority | | Security Intelligence R-SI1.2 normalization | IMPLEMENTED | merged PR #135 | descriptive/context-only; no authority/runtime/effect widening | | CyberCore integration | BLOCKED | product/release-governance hardening | cannot bypass V-One gates | -| Main GitHub governance policy | VERIFIED | G0 live run `32553113424`, artifact digest `sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50eff7dc4f5f` | release/deploy remain separate gates | -| Main required latest-head enforcement | VERIFIED | G0 live evidence: PR-only main, required `verify`, latest-head strict checks, no ordinary bypass | later repository changes still require the live rules to remain enforced | +| Main GitHub governance policy | UNKNOWN | historical G0 run `32553113424` remains VERIFIED for its original evidence scope | fresh exact-main G0 is required for current `eimyroot/Voodoo-One` identity | +| Main required latest-head enforcement | UNKNOWN | historical G0 verified PR-only main, required `verify`, latest-head strict checks and no ordinary bypass for its then-current repository identity | current post-rename enforcement must be re-verified live | | G8 default READ provider runtime | BLOCKED | G8 gate defined; no default runtime activation yet | must be READ-only, explicit, separate Runner/Verifier credentials, fail-closed | | Real canonical HTTP READ E2E + restart resume | BLOCKED | G7 components merged; G8 runtime not yet active | must prove HTTP→Runner→independent `VerificationResult/v1` plus no duplicate authority/effect after restart | | Provider WRITE activation | BLOCKED | ADR-0019 safety decision is under governed adoption | not eligible before verified repeated READ E2E + restart-safe continuity | -| Release-candidate build | VERIFIED | fail-closed workflow + historical image/SBOM checks | build candidate != deployment | +| Release-candidate build | VERIFIED | fail-closed workflow + historical image/SBOM checks | build candidate != deployment; current RC construction is additionally blocked until fresh current G0 succeeds | | Unrestricted production release | BLOCKED | production effects default disabled | G8 + real READ E2E + security/legal/ops/release gates remain | | Public commercial distribution | BLOCKED | no distribution authorization | licensing/EULA/privacy/support and production gates remain separate | @@ -174,9 +175,14 @@ The runtime factory must share the exact ProductService database and permission- Without an explicit provider/runtime pack the default composition remains fail-closed. Workspace membership is a scope check, not activation of the separately PROPOSED Solo/Team/Regulated policy. -## G0 live governance evidence +## G0 governance evidence — current vs historical -The former G0 blocker is closed by identifiable live evidence: +Current canonical repository identity is `eimyroot/Voodoo-One`. A fresh post-rename G0 observation on +the exact current `main` SHA has not yet been retained, so current GitHub governance status is +`UNKNOWN` and must fail closed for release-candidate promotion. + +The following retained artifact remains VERIFIED historical evidence for the exact repository identity +and source SHA that existed when it ran: ```text workflow = g0-governance-verify @@ -187,12 +193,14 @@ artifact = g0-governance-evidence-32553113424-1 artifact_id = 9470619984 artifact_digest = sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50eff7dc4f5f evidence_json_checksum = 11a99765485b63b70186037011d31c105dea8dd75b689e0036a8766d05e8137d -verdict = VERIFIED +historical_verdict = VERIFIED ``` -That evidence verified PR-only main, required `verify` from workflow `ci`, latest-head strict checks, -force-push and deletion disabled, conversation resolution, no ordinary bypass, active rulesets, and -source binding to the then-current main. G0 PASS is not release/deploy authorization. +That historical evidence verified PR-only main, required `verify` from workflow `ci`, latest-head +strict checks, force-push and deletion disabled, conversation resolution, no ordinary bypass, active +rulesets, and source binding for its exact evidence scope. It is not current post-rename proof. A fresh +G0 PASS on the exact repaired `main` may promote current GitHub governance back to `VERIFIED`; G0 never +authorizes release/deploy by itself. ## Verified historical complete operation atom @@ -224,7 +232,7 @@ This is historical evidence for one real atom. It does not execute or authorize VOODOO_ALLOW_PRODUCTION_EFFECTS=false NEW_G7_PROVIDER_WRITE=NO NEW_A09_PROVIDER_MUTATION=NO -G0_LIVE_ENFORCEMENT_VERIFIED=YES +G0_LIVE_ENFORCEMENT_VERIFIED=UNKNOWN_CURRENT G8_DEFAULT_PROVIDER_RUNTIME=OFF REAL_CANONICAL_READ_E2E_VERIFIED=NO WRITE_RUNTIME_GATE=BLOCKED From 57a3ca470ff1d0654a4e0eb5a4c5ced37645cd39 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:27:28 +0200 Subject: [PATCH 09/12] test(governance): prevent repository identity and G0 truth drift --- .../test_pr01_repository_identity_truth.py | 142 ++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 tests/system/test_pr01_repository_identity_truth.py diff --git a/tests/system/test_pr01_repository_identity_truth.py b/tests/system/test_pr01_repository_identity_truth.py new file mode 100644 index 00000000..a1534a70 --- /dev/null +++ b/tests/system/test_pr01_repository_identity_truth.py @@ -0,0 +1,142 @@ +from __future__ import annotations + +import importlib.util +import json +import sys +from pathlib import Path + +import pytest + +ROOT = Path(__file__).resolve().parents[2] + + +def _load_script(relative: str, module_name: str): + path = ROOT / relative + spec = importlib.util.spec_from_file_location(module_name, path) + assert spec is not None + assert spec.loader is not None + module = importlib.util.module_from_spec(spec) + sys.modules[spec.name] = module + spec.loader.exec_module(module) + return module + + +PUBLISHER = _load_script("scripts/publish_review_branch.py", "pr01_publish_review_branch") +GOVERNANCE = _load_script( + "scripts/verify_github_main_governance.py", + "pr01_verify_github_main_governance", +) + +CANONICAL_REPOSITORY = "eimyroot/Voodoo-One" +CANONICAL_REPOSITORY_URL = "https://github.com/eimyroot/Voodoo-One.git" +LEGACY_FETCH_ALIASES = frozenset( + { + "https://github.com/eimyroot/V-One.git", + "https://github.com/nulleimy/V-One.git", + } +) + + +def _read(relative: str) -> str: + return (ROOT / relative).read_text(encoding="utf-8") + + +def test_machine_governance_baseline_uses_canonical_repository_identity() -> None: + baseline = json.loads( + _read(".github/governance/main-branch-baseline.v1.json") + ) + assert baseline["repository"] == CANONICAL_REPOSITORY + assert baseline["desired"]["required_status_checks"] == ["verify"] + assert baseline["desired"]["workflow"] == "ci" + assert baseline["desired"]["workflow_path"] == ".github/workflows/ci.yml" + + +def test_g0_actions_run_identity_rejects_pre_rename_repository_paths() -> None: + current = "https://github.com/eimyroot/Voodoo-One/actions/runs/123456" + assert ( + GOVERNANCE._actions_run_id(current, "eimyroot", "Voodoo-One") # noqa: SLF001 + == 123456 + ) + + for historical in ( + "https://github.com/eimyroot/V-One/actions/runs/123456", + "https://github.com/nulleimy/V-One/actions/runs/123456", + ): + with pytest.raises( + GOVERNANCE.GitHubEvidenceError, + match="does not identify an Actions run", + ): + GOVERNANCE._actions_run_id( # noqa: SLF001 + historical, + "eimyroot", + "Voodoo-One", + ) + + +def test_review_publisher_has_one_current_target_and_fetch_only_legacy_aliases() -> None: + assert PUBLISHER.ALLOWED_GITHUB_REPOSITORY == CANONICAL_REPOSITORY_URL + assert PUBLISHER.LEGACY_GITHUB_REPOSITORY_ALIASES == LEGACY_FETCH_ALIASES + + policy = PUBLISHER.PublicationPolicy() + policy.validate_repository_url(CANONICAL_REPOSITORY_URL) + policy.validate_origin_fetch_url(CANONICAL_REPOSITORY_URL, CANONICAL_REPOSITORY_URL) + + for legacy in sorted(LEGACY_FETCH_ALIASES): + policy.validate_origin_fetch_url(legacy, CANONICAL_REPOSITORY_URL) + with pytest.raises(PUBLISHER.PublicationError, match="not allowlisted"): + policy.validate_repository_url(legacy) + + with pytest.raises(PUBLISHER.PublicationError, match="origin fetch URL"): + policy.validate_origin_fetch_url( + "https://github.com/example/not-voodoo-one.git", + CANONICAL_REPOSITORY_URL, + ) + + +def test_governance_and_publication_docs_bind_current_repository_identity() -> None: + governance = _read("docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md") + publication = _read("docs/governance/REVIEW_BRANCH_PUBLICATION.md") + + assert "repository = eimyroot/Voodoo-One" in governance + assert "repository = nulleimy/V-One" not in governance + assert "fresh live G0 verification required" in governance + + assert CANONICAL_REPOSITORY_URL in publication + assert "fetch-only legacy alias" in publication + assert "never are permitted" not in publication + assert "nikdy nejsou povoleným publication\ntargetem" in publication + + +def test_operations_runbook_uses_current_repo_and_artifact_derived_schema_truth() -> None: + runbook = _read("docs/product/OPERATIONS_RUNBOOK.md") + + assert "--repo eimyroot/Voodoo-One" in runbook + assert "--repo nulleimy/V-One" not in runbook + assert "schema_version: 9" not in runbook + assert "schema version `9`" not in runbook + assert "highest contiguous migration version bundled" in runbook + assert "0014_workspace_memberships.sql" in runbook + assert "current expected schema is 14" in runbook + + +def test_current_truth_does_not_promote_historical_g0_after_rename() -> None: + state = _read("CURRENT_PRODUCT_STATE.md") + capabilities = _read("docs/product/CURRENT_CAPABILITIES.md") + readme = _read("README.md") + + assert "CANONICAL_REPOSITORY: eimyroot/Voodoo-One" in state + assert "G0_GITHUB_GOVERNANCE=UNKNOWN" in state + assert "G0 = UNKNOWN" in state + assert "historical_verdict = VERIFIED" in state + + assert "| Canonical repository | `eimyroot/Voodoo-One` |" in capabilities + assert "| Main GitHub governance policy | UNKNOWN |" in capabilities + assert "G0_LIVE_ENFORCEMENT_VERIFIED=UNKNOWN_CURRENT" in capabilities + assert "historical_verdict = VERIFIED" in capabilities + + assert ( + "| GitHub main governance enforcement | UNKNOWN / fresh post-rename G0 required; " + "historical VERIFIED evidence retained |" + ) in readme + assert "current G0 governance is therefore `UNKNOWN`" in readme + assert "historical G0 VERIFIED evidence is retained" in readme From 077d12e42ac4739afd730b8eae3f7fc2333a8de3 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:29:17 +0200 Subject: [PATCH 10/12] test(governance): update review publication identity expectations --- tests/system/test_publish_review_branch.py | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/tests/system/test_publish_review_branch.py b/tests/system/test_publish_review_branch.py index 23552313..a6efc09b 100644 --- a/tests/system/test_publish_review_branch.py +++ b/tests/system/test_publish_review_branch.py @@ -105,20 +105,24 @@ def test_policy_accepts_only_review_branches() -> None: policy.validate_target_branch(invalid) -def test_canonical_repository_identity_allows_only_explicit_legacy_origin_alias() -> None: +def test_canonical_repository_identity_allows_only_explicit_legacy_origin_aliases() -> None: policy = MODULE.PublicationPolicy() - canonical = "https://github.com/eimyroot/V-One.git" - legacy = "https://github.com/nulleimy/V-One.git" + canonical = "https://github.com/eimyroot/Voodoo-One.git" + legacy_aliases = ( + "https://github.com/eimyroot/V-One.git", + "https://github.com/nulleimy/V-One.git", + ) assert canonical == MODULE.ALLOWED_GITHUB_REPOSITORY + assert frozenset(legacy_aliases) == MODULE.LEGACY_GITHUB_REPOSITORY_ALIASES policy.validate_repository_url(canonical) policy.validate_origin_fetch_url(canonical, canonical) - policy.validate_origin_fetch_url(legacy, canonical) - - with pytest.raises(MODULE.PublicationError, match="not allowlisted"): - policy.validate_repository_url(legacy) + for legacy in legacy_aliases: + policy.validate_origin_fetch_url(legacy, canonical) + with pytest.raises(MODULE.PublicationError, match="not allowlisted"): + policy.validate_repository_url(legacy) with pytest.raises(MODULE.PublicationError, match="origin fetch URL"): policy.validate_origin_fetch_url( @@ -842,4 +846,4 @@ def fail_after_validation(**_: object) -> None: assert len(sidecars) == 1 assert '"status": "BLOCKED"' in evidence_files[0].read_text(encoding="utf-8") assert evidence_files[0].is_relative_to(evidence_root) - assert sidecars[0].is_relative_to(evidence_root) + assert sidecars[0].is_relative_to(evidence_root) \ No newline at end of file From 639bcda974a2879dbf9a87fd88d863c6e05dfa8b Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:30:26 +0200 Subject: [PATCH 11/12] test(governance): bind verifier fixtures to Voodoo-One identity --- .../test_github_main_governance_verifier.py | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/tests/system/test_github_main_governance_verifier.py b/tests/system/test_github_main_governance_verifier.py index 1e415b6e..3458e736 100644 --- a/tests/system/test_github_main_governance_verifier.py +++ b/tests/system/test_github_main_governance_verifier.py @@ -20,7 +20,7 @@ def baseline() -> dict[str, object]: return { "schema": "vone.github-main-governance/v1", - "repository": "eimyroot/V-One", + "repository": "eimyroot/Voodoo-One", "branch": "main", "desired": { "pull_request_required": True, @@ -42,14 +42,14 @@ def passing_rules() -> list[dict[str, object]]: { "type": "pull_request", "ruleset_source_type": "Repository", - "ruleset_source": "nulleimy/V-One", + "ruleset_source": "eimyroot/Voodoo-One", "ruleset_id": 17, "parameters": {"required_review_thread_resolution": True}, }, { "type": "required_status_checks", "ruleset_source_type": "Repository", - "ruleset_source": "nulleimy/V-One", + "ruleset_source": "eimyroot/Voodoo-One", "ruleset_id": 17, "parameters": { "strict_required_status_checks_policy": True, @@ -61,13 +61,13 @@ def passing_rules() -> list[dict[str, object]]: { "type": "non_fast_forward", "ruleset_source_type": "Repository", - "ruleset_source": "nulleimy/V-One", + "ruleset_source": "eimyroot/Voodoo-One", "ruleset_id": 17, }, { "type": "deletion", "ruleset_source_type": "Repository", - "ruleset_source": "nulleimy/V-One", + "ruleset_source": "eimyroot/Voodoo-One", "ruleset_id": 17, }, ] @@ -431,7 +431,7 @@ def fake_get(url: str, *, token: str | None, api_version: str) -> object: monkeypatch.setattr(verifier, "github_get", fake_get) items, sources = verifier.github_get_list_pages( - "https://api.github.com/repos/nulleimy/V-One/rules/branches/main", + "https://api.github.com/repos/eimyroot/Voodoo-One/rules/branches/main", token=None, api_version="2022-11-28", ) @@ -457,7 +457,7 @@ def fake_get(url: str, *, token: str | None, api_version: str) -> object: monkeypatch.setattr(verifier, "github_get", fake_get) items, sources = verifier.github_get_check_run_pages( - "https://api.github.com/repos/nulleimy/V-One/commits/abc/check-runs?check_name=verify&filter=all", + "https://api.github.com/repos/eimyroot/Voodoo-One/commits/abc/check-runs?check_name=verify&filter=all", token=None, api_version="2022-11-28", ) @@ -479,9 +479,9 @@ def test_provider_collection_requests_all_matching_check_runs() -> None: "url", [ "file:///etc/passwd", - "http://api.github.com/repos/nulleimy/V-One", - "https://api.github.com.evil.example/repos/nulleimy/V-One", - "https://user@example.com@api.github.com/repos/nulleimy/V-One", + "http://api.github.com/repos/eimyroot/Voodoo-One", + "https://api.github.com.evil.example/repos/eimyroot/Voodoo-One", + "https://user@example.com@api.github.com/repos/eimyroot/Voodoo-One", ], ) def test_live_verifier_rejects_noncanonical_github_urls(url: str) -> None: @@ -493,6 +493,15 @@ def test_actions_details_url_must_name_expected_repository() -> None: with pytest.raises(verifier.GitHubEvidenceError, match="does not identify"): verifier._actions_run_id( "https://github.com/other/repo/actions/runs/123/job/456", - "nulleimy", - "V-One", + "eimyroot", + "Voodoo-One", ) + + +def test_actions_details_url_rejects_historical_repository_identity() -> None: + for historical in ( + "https://github.com/eimyroot/V-One/actions/runs/123/job/456", + "https://github.com/nulleimy/V-One/actions/runs/123/job/456", + ): + with pytest.raises(verifier.GitHubEvidenceError, match="does not identify"): + verifier._actions_run_id(historical, "eimyroot", "Voodoo-One") From 5ab24d7e5f2368154b59016230fc0bf544d8b3c1 Mon Sep 17 00:00:00 2001 From: eimyroot Date: Sun, 6 Sep 2026 13:34:35 +0200 Subject: [PATCH 12/12] test(governance): make runbook schema assertion line-wrap safe --- tests/system/test_pr01_repository_identity_truth.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/system/test_pr01_repository_identity_truth.py b/tests/system/test_pr01_repository_identity_truth.py index a1534a70..aff71f02 100644 --- a/tests/system/test_pr01_repository_identity_truth.py +++ b/tests/system/test_pr01_repository_identity_truth.py @@ -114,7 +114,7 @@ def test_operations_runbook_uses_current_repo_and_artifact_derived_schema_truth( assert "--repo nulleimy/V-One" not in runbook assert "schema_version: 9" not in runbook assert "schema version `9`" not in runbook - assert "highest contiguous migration version bundled" in runbook + assert "contiguous migration version bundled in the exact deployed artifact" in runbook assert "0014_workspace_memberships.sql" in runbook assert "current expected schema is 14" in runbook