diff --git a/CURRENT_PRODUCT_STATE.md b/CURRENT_PRODUCT_STATE.md index 630a60d6..29769437 100644 --- a/CURRENT_PRODUCT_STATE.md +++ b/CURRENT_PRODUCT_STATE.md @@ -57,7 +57,7 @@ RELEASED / DEPLOYED = separately governed states | Restart-safe durable resume | **IMPLEMENTED / MERGED via PR #140** | | Runtime resume wiring | **IMPLEMENTED / MERGED via PR #140** | | G7 post-merge verification | **VERIFIED on `main@60bc9c268...` by CI #1015, D4 #202, E3 #193, E4B #189** | -| GitHub G0 governance | **UNKNOWN / fresh post-rename exact-main verification required** | +| Latest retained GitHub G0 evidence | **VERIFIED for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c` via run `34031128405`; current live G0 is query-only** | | Default provider runtime pack | **DISABLED / FAIL-CLOSED** | | Real canonical HTTP READ E2E using default G8 pack | **BLOCKED / NOT YET VERIFIED** | | Provider WRITE activation | **BLOCKED** | @@ -68,14 +68,44 @@ RELEASED / DEPLOYED = separately governed states | Deployment | **NOT PERFORMED** | | CyberCore | **BLOCKED pending product/release-governance hardening** | -## G0 GitHub governance — current vs historical evidence +## G0 GitHub governance — retained evidence vs live-derived truth -Current canonical repository identity is `eimyroot/Voodoo-One`. No fresh post-rename G0 run is yet -retained for the exact current `main` SHA, so current G0 state is deliberately `UNKNOWN` and the -release-candidate governance gate remains fail-closed until fresh live evidence exists. +Current canonical repository identity is `eimyroot/Voodoo-One`. The latest retained post-rename G0 +evidence independently verified repository identity, required-check provenance and live ruleset controls +for exactly the SHA that it observed. This versioned document records that immutable evidence scope; it +does not promote the repository's moving current `main` to PASS by self-reference. -The following retained artifact remains valid historical evidence for the repository identity and -source SHA that existed when it ran: +```text +workflow = g0-governance-verify +run = 34031128405 +event = workflow_dispatch +branch = main +source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +branch_head_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +verifier_source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +required_check = verify +required_workflow = ci +required_workflow_path = .github/workflows/ci.yml +artifact = g0-governance-evidence-34031128405-1 +artifact_id = 9988632821 +artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c +checksum_validation = PASS +retained_verdict = VERIFIED +verified_at = 2026-09-06T11:45:16.520493Z +``` + +The verifier observed PR-only main, required `verify` from GitHub Actions workflow `ci`, latest-head +strict checks, force-push disabled, branch deletion disabled, conversation resolution, no ordinary +admin/ruleset bypass, active rulesets and exact verifier-source binding. All required G0 checks were +true for that exact evidence scope. + +Current live G0 is deliberately not stored as a mutable-looking PASS/FAIL field in Git. It is derived +at decision time by comparing live `main` and live settings with fresh verifier evidence. Release-candidate +construction must run G0 against its exact checked-out `${GITHUB_SHA}` rather than reuse this retained +artifact as current authorization. + +The earlier retained artifact remains valid historical evidence for the repository identity and source +SHA that existed when it ran: ```text workflow = g0-governance-verify @@ -90,27 +120,18 @@ evidence_json_checksum = 11a99765485b63b70186037011d31c105dea8dd75b689e0036a8766 historical_verdict = VERIFIED ``` -That historical evidence verified PR-only main, required `verify` from workflow `ci`, latest-head -strict checks, force-push disabled, branch deletion disabled, conversation resolution, no ordinary -admin/ruleset bypass, active rulesets, and verifier source binding for its exact evidence scope. It -must not be reused as proof for the renamed current repository identity. +Historical evidence stays historical. Neither retained run is silently promoted to proof for a later +`main` SHA. ```text REPO_ENFORCEMENT_CONTRACT = IMPLEMENTED -GITHUB_SETTINGS_ENFORCED = UNKNOWN -MAIN_PR_ONLY = UNKNOWN_CURRENT_G0 -REQUIRED_CI = UNKNOWN_CURRENT_G0 -FORCE_PUSH_DISABLED = UNKNOWN_CURRENT_G0 -BRANCH_DELETE_DISABLED = UNKNOWN_CURRENT_G0 -CONVERSATION_RESOLUTION = UNKNOWN_CURRENT_G0 -ORDINARY_ADMIN_BYPASS_DISABLED = UNKNOWN_CURRENT_G0 -P0_GITHUB_GOVERNANCE = BLOCKED_PENDING_FRESH_G0 -G0 = UNKNOWN +LATEST_RETAINED_G0_VERDICT = VERIFIED +LATEST_RETAINED_G0_SOURCE_SHA = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +CURRENT_LIVE_G0 = DERIVED_QUERY_ONLY +P0_GITHUB_GOVERNANCE = QUERY_LIVE_FOR_DECISION ``` -A fresh G0 PASS on the exact post-repair `main` SHA may promote these current governance fields back to -`VERIFIED`; documentation, CI success, or the historical artifact cannot do so by inference. G0 PASS -does not authorize release or deployment. +G0 evidence does not authorize provider runtime, release, deployment or production effects. ## Canonical shared authority/execution prefix @@ -328,13 +349,17 @@ This historical evidence does not authorize or prove any new provider mutation. - Historical PR #125 technical merge/post-state is VERIFIED; separate pre-merge merge-authorization provenance remains **NOT VERIFIED** and is not rewritten. - ADR-0018 records the R2 terminal-profile correction instead of silently rewriting older history. - PR #128 reconciliation remains historical provenance; later G7 evidence does not rewrite it. -- Historical G0 run `32553113424` remains retained evidence for its original repository identity and exact source SHA; it is not current post-rename proof. +- Historical G0 run `32553113424` remains retained evidence for its original repository identity and exact source SHA. +- Latest retained G0 run `34031128405` VERIFIED the renamed canonical repository at exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`; current live G0 remains derived/query-only. ## Current release truth ```text VOODOO_ALLOW_PRODUCTION_EFFECTS=false -G0_GITHUB_GOVERNANCE=UNKNOWN +LATEST_RETAINED_G0_VERDICT=VERIFIED +LATEST_RETAINED_G0_SOURCE_SHA=a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +CURRENT_LIVE_G0=DERIVED_QUERY_ONLY +RELEASE_CANDIDATE_G0=FRESH_EXACT_CHECKOUT_REQUIRED G7_CANONICAL_READ_API=MERGED G7_RESTART_SAFE_RESUME=MERGED G8_DEFAULT_READ_RUNTIME=OFF diff --git a/README.md b/README.md index 710456b9..01a99b05 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ OperationProof != OperationCell | Canonical public READ operation API | IMPLEMENTED / MERGED via PR #137; reconciled with resume/runtime via PR #140 | | Read-only `/api/v1/control-room` dashboard projection | IMPLEMENTED / targeted tested | | Restart-safe durable READ resume | IMPLEMENTED / MERGED via PR #140 | -| GitHub main governance enforcement | UNKNOWN / fresh post-rename G0 required; historical VERIFIED evidence retained | +| GitHub governance evidence | latest retained G0 evidence VERIFIED for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`; current live G0 is derived/query-only | | Default provider runtime pack | BLOCKED / disabled until G8 | | Real canonical HTTP READ E2E through default G8 pack | BLOCKED / not yet verified | | Provider WRITE activation | BLOCKED pending repeated READ E2E + restart-safe verification gate | @@ -164,8 +164,36 @@ runtime activation. ## G0 governance evidence -The repository retains historical live G0 evidence for the repository identity that was current when -the run executed: +The repository records immutable G0 evidence scopes, not a self-updating `current main = PASS` claim. +The latest retained G0 evidence is: + +```text +workflow = g0-governance-verify +run = 34031128405 +source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +artifact = g0-governance-evidence-34031128405-1 +artifact_id = 9988632821 +artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c +checksum_validation = PASS +retained_verdict = VERIFIED +``` + +That run independently verified the renamed `eimyroot/Voodoo-One` repository, exact source binding, +PR-only main, required `verify` from workflow `ci`, latest-head strict checks, force-push and deletion +disabled, conversation resolution, active rulesets and no ordinary bypass for that exact SHA. + +```text +LATEST_RETAINED_G0_VERDICT=VERIFIED +LATEST_RETAINED_G0_SOURCE_SHA=a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +CURRENT_LIVE_G0=DERIVED_QUERY_ONLY +RELEASE_CANDIDATE_G0=FRESH_EXACT_CHECKOUT_REQUIRED +``` + +`CURRENT_LIVE_G0` must be derived from live GitHub state at decision time. A later commit changes +`main`, so this retained artifact cannot be reused as exact-current proof. The release-candidate +workflow therefore performs fresh G0 verification against its exact checked-out `${GITHUB_SHA}`. + +The repository also retains the earlier G0 artifact for its original evidence scope: ```text workflow = g0-governance-verify @@ -173,14 +201,11 @@ run = 32553113424 source_sha = 76d74d2ed62b6e78f027728c456c22da0b4a95bd artifact = g0-governance-evidence-32553113424-1 artifact_digest = sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50eff7dc4f5f -verdict = VERIFIED +historical_verdict = VERIFIED ``` -That artifact remains valid historical evidence only. The canonical repository is now -`eimyroot/Voodoo-One`; current G0 governance is therefore `UNKNOWN` until a fresh -`g0-governance-verify` run executes on the exact post-repair `main` SHA and independently verifies the -current repository identity and live ruleset. Historical G0 PASS never authorizes provider runtime, -release, or deployment. +Historical evidence stays historical. G0 evidence never authorizes provider runtime, release or +deployment by itself. ## READ before WRITE @@ -228,7 +253,7 @@ a new provider mutation is authorized. - default G8 provider runtime and real product HTTP READ E2E remain blocked/unverified; - provider WRITE remains blocked behind READ-before-WRITE evidence and separate effect authorization; - no release/deployment inferred from CI, merge, Proof or Cell; -- historical G0 VERIFIED evidence is retained, while current post-rename GitHub governance remains UNKNOWN until fresh exact-main verification. +- latest retained G0 evidence is exact-SHA scoped; current live GitHub governance is queried/derived rather than versioned as PASS. ## Documentation diff --git a/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md b/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md index 7fdd60bd..5bc8d41d 100644 --- a/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md +++ b/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md @@ -1,12 +1,12 @@ # GitHub Main Governance Baseline v1 -Status: PREPARED — repository-side contract repaired for `eimyroot/Voodoo-One`; fresh live G0 verification required +Status: ACTIVE CONTRACT — latest retained exact-main G0 evidence is recorded separately from current live truth ## Purpose Define the minimum GitHub repository enforcement required before higher-impact V-One authority, Grant Issuer, Runner, release, or production-capable work may rely on GitHub as a governance boundary. -This document does not claim that GitHub Settings are already enforced. Remote enforcement must be verified independently against the live repository configuration. +This document defines the contract and records immutable evidence scopes. It does not store a self-updating claim that the moving current `main` is VERIFIED. Current live G0 is derived by querying live GitHub state at decision time. ## Canonical protected branch @@ -47,7 +47,7 @@ Product/runtime rule `no requester self-approval` remains a separate V-One autho ## Required verification evidence -P0 is complete only when live GitHub configuration evidence proves the desired state. Acceptable evidence must include: +P0 is complete for a decision scope only when live GitHub configuration evidence proves the desired state on the exact SHA being evaluated. Acceptable evidence must include: ```text repository = eimyroot/Voodoo-One @@ -73,7 +73,44 @@ verified_at = source = GitHub live repository settings/API ``` -A repository document, CI pass, issue, PR description or previous observation is not sufficient evidence of GitHub-side enforcement. A repository rename or transfer changes the identity being verified: a historical G0 PASS for a different repository identity remains historical evidence and is not reusable as current G0 proof. +A repository document, CI pass, issue, PR description or previous observation is not sufficient evidence of GitHub-side enforcement. A repository rename, transfer, new commit, ruleset change or required-check change can make older evidence non-current without invalidating its historical scope. + +## Latest retained G0 evidence + +The latest retained G0 evidence is immutable evidence for exactly the SHA it observed: + +```text +workflow = g0-governance-verify +run = 34031128405 +repository = eimyroot/Voodoo-One +branch = main +branch_head_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +verifier_source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +required_status_check = verify +observed_required_workflow = ci +observed_required_workflow_path = .github/workflows/ci.yml +artifact = g0-governance-evidence-34031128405-1 +artifact_id = 9988632821 +artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c +checksum_validation = PASS +retained_verdict = VERIFIED +verified_at = 2026-09-06T11:45:16.520493Z +``` + +The evidence reported every required G0 check as true, including PR-only main, strict/latest-head +required checks, GitHub Actions provider/workflow identity, force-push and branch deletion disabled, +conversation resolution, complete bypass evidence with no ordinary bypass actor, active rulesets and +exact verifier-source binding for that exact SHA. + +This is intentionally **not** serialized as `current main = PASS` because committing such a statement +would change `main` and immediately make its own exact-SHA proof stale. + +```text +LATEST_RETAINED_G0_VERDICT = VERIFIED +LATEST_RETAINED_G0_SOURCE_SHA = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +CURRENT_LIVE_G0 = DERIVED / QUERY_ONLY +RELEASE_CANDIDATE_G0 = FRESH_EXACT_CHECKOUT_REQUIRED +``` ## Machine verification @@ -152,7 +189,7 @@ Examples that are `BLOCKED` when evidence is otherwise complete: - PR-only flow, force-push blocking, deletion blocking or thread resolution is absent; - any bypass actor is configured. -Only `VERIFIED` exits successfully. `BLOCKED` and `UNKNOWN` fail closed. A historical PASS is not reusable proof after GitHub ruleset/settings configuration changes or repository-identity changes. +Only `VERIFIED` exits successfully. `BLOCKED` and `UNKNOWN` fail closed. A retained or historical PASS is not reusable proof for a different exact SHA or changed governance state. ## Credential boundary @@ -164,7 +201,7 @@ The dedicated token exists only because GitHub may omit sensitive `bypass_actors A release-candidate workflow is not allowed to produce an RC artifact unless the exact checked-out `main` SHA first produces G0 `VERIFIED`. The resulting `g0-governance-evidence.json` is included in the RC artifact and covered by `SHA256SUMS.txt` alongside the source archive and SBOM. -This gate does not itself authorize release or deployment. It only prevents release-candidate artifact construction from bypassing repository-governance evidence. +This gate does not reuse `LATEST_RETAINED_G0_VERDICT` as current authorization. It performs fresh exact-checkout verification. The gate does not itself authorize release or deployment. ## Failure semantics @@ -182,7 +219,7 @@ GITHUB_SETTINGS_ENFORCED = BLOCKED P0 = BLOCKED ``` -Never convert `UNKNOWN` or `BLOCKED` into `PASS` from documentation intent, CI success or branch metadata alone. +Never convert `UNKNOWN` or `BLOCKED` into `PASS` from documentation intent, CI success, retained evidence or branch metadata alone. ## Change path @@ -190,6 +227,8 @@ Changes to this baseline use a PR and must not reduce the controls above without ## Exit gate +For any specific evaluated SHA, a fresh G0 `VERIFIED` result requires: + ```text REPO_ENFORCEMENT_CONTRACT = VERIFIED GITHUB_SETTINGS_ENFORCED = VERIFIED @@ -207,4 +246,4 @@ ORDINARY_ADMIN_BYPASS_DISABLED = VERIFIED P0_GITHUB_GOVERNANCE = PASS ``` -Until all fields are proven, authority/Runner work may be designed or prepared but must not treat GitHub enforcement as a trusted completed boundary. +The latest retained evidence satisfies that exit gate for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`. Whether a later current `main` satisfies it is a live-derived question and requires fresh exact-SHA evidence. diff --git a/docs/product/CURRENT_CAPABILITIES.md b/docs/product/CURRENT_CAPABILITIES.md index b06fab27..9e195739 100644 --- a/docs/product/CURRENT_CAPABILITIES.md +++ b/docs/product/CURRENT_CAPABILITIES.md @@ -86,19 +86,19 @@ Is it released/deployed? | OperationProof/v2 | VERIFIED | current contract/tests + historical F6b digest | mutation-only post-verification lineage | | OperationCell/v1 | VERIFIED | current contract/tests + historical F6b digest | mutation-only stable operation atom | | Unified authority→profile runtime composition | IMPLEMENTED | ProductComposition + canonical runtime tests + PR #140 | public READ API merged; default provider pack still off | -| Receipt/audit hash-chain integrity | VERIFIED | ledger verification tests | chain integrity != independent provider verification | +| Receipt/audit hash-chain integrity | VERIFIED | ledger verification tests | chain integrity != independent verification | | SQLite migrations | VERIFIED | migrations 0001–0014 + integrity tests | single-node backend | | PostgreSQL backend | BLOCKED | fail-closed startup contract | adapter/concurrency/operations gates not released | | OIDC identity provider | BLOCKED | fail-closed configuration tests | no released external identity runtime | | Security Intelligence R-SI1.1 | IMPLEMENTED | metadata + tests | intelligence-only; no execution/proof authority | | Security Intelligence R-SI1.2 normalization | IMPLEMENTED | merged PR #135 | descriptive/context-only; no authority/runtime/effect widening | | CyberCore integration | BLOCKED | product/release-governance hardening | cannot bypass V-One gates | -| Main GitHub governance policy | UNKNOWN | historical G0 run `32553113424` remains VERIFIED for its original evidence scope | fresh exact-main G0 is required for current `eimyroot/Voodoo-One` identity | -| Main required latest-head enforcement | UNKNOWN | historical G0 verified PR-only main, required `verify`, latest-head strict checks and no ordinary bypass for its then-current repository identity | current post-rename enforcement must be re-verified live | +| Main GitHub governance evidence | VERIFIED | latest retained G0 run `34031128405` for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`; artifact digest `sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c` | evidence is exact-SHA scoped; current live G0 is derived/query-only | +| Main required latest-head enforcement evidence | VERIFIED | retained G0 observed PR-only main, required `verify` from `ci`, latest-head strict checks, no ordinary bypass, force-push/deletion disabled | later `main` or governance changes require fresh live exact-SHA verification | | G8 default READ provider runtime | BLOCKED | G8 gate defined; no default runtime activation yet | must be READ-only, explicit, separate Runner/Verifier credentials, fail-closed | | Real canonical HTTP READ E2E + restart resume | BLOCKED | G7 components merged; G8 runtime not yet active | must prove HTTP→Runner→independent `VerificationResult/v1` plus no duplicate authority/effect after restart | | Provider WRITE activation | BLOCKED | ADR-0019 safety decision is under governed adoption | not eligible before verified repeated READ E2E + restart-safe continuity | -| Release-candidate build | VERIFIED | fail-closed workflow + historical image/SBOM checks | build candidate != deployment; current RC construction is additionally blocked until fresh current G0 succeeds | +| Release-candidate build | VERIFIED | fail-closed workflow + historical image/SBOM checks | every RC attempt must perform fresh G0 against its exact checked-out `${GITHUB_SHA}`; build candidate != deployment | | Unrestricted production release | BLOCKED | production effects default disabled | G8 + real READ E2E + security/legal/ops/release gates remain | | Public commercial distribution | BLOCKED | no distribution authorization | licensing/EULA/privacy/support and production gates remain separate | @@ -176,13 +176,43 @@ The runtime factory must share the exact ProductService database and permission- Without an explicit provider/runtime pack the default composition remains fail-closed. Workspace membership is a scope check, not activation of the separately PROPOSED Solo/Team/Regulated policy. -## G0 governance evidence — current vs historical +## G0 governance evidence — retained vs live-derived -Current canonical repository identity is `eimyroot/Voodoo-One`. A fresh post-rename G0 observation on -the exact current `main` SHA has not yet been retained, so current GitHub governance status is -`UNKNOWN` and must fail closed for release-candidate promotion. +Current canonical repository identity is `eimyroot/Voodoo-One`. The repository records retained G0 +evidence only for the exact SHA that was observed; it does not serialize a moving `current main = PASS` +claim. -The following retained artifact remains VERIFIED historical evidence for the exact repository identity +```text +workflow = g0-governance-verify +run = 34031128405 +event = workflow_dispatch +source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +branch_head_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +verifier_source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +artifact = g0-governance-evidence-34031128405-1 +artifact_id = 9988632821 +artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c +checksum_validation = PASS +retained_verdict = VERIFIED +verified_at = 2026-09-06T11:45:16.520493Z +``` + +The retained evidence verifies PR-only main, required `verify` from GitHub Actions workflow `ci`, exact +workflow path `.github/workflows/ci.yml`, latest-head strict checks, force-push and deletion disabled, +conversation resolution, no ordinary bypass, active rulesets and exact source binding for that SHA. + +```text +LATEST_RETAINED_G0_VERDICT=VERIFIED +LATEST_RETAINED_G0_SOURCE_SHA=a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +CURRENT_LIVE_G0=DERIVED_QUERY_ONLY +RELEASE_CANDIDATE_G0=FRESH_EXACT_CHECKOUT_REQUIRED +``` + +A later commit changes the exact current `main` identity. Therefore current G0 is derived from live +GitHub state at decision time, and release-candidate construction must run fresh G0 against its exact +checkout rather than infer current PASS from retained evidence. + +The earlier retained artifact remains VERIFIED historical evidence for the exact repository identity and source SHA that existed when it ran: ```text @@ -197,11 +227,7 @@ evidence_json_checksum = 11a99765485b63b70186037011d31c105dea8dd75b689e0036a8766 historical_verdict = VERIFIED ``` -That historical evidence verified PR-only main, required `verify` from workflow `ci`, latest-head -strict checks, force-push and deletion disabled, conversation resolution, no ordinary bypass, active -rulesets, and source binding for its exact evidence scope. It is not current post-rename proof. A fresh -G0 PASS on the exact repaired `main` may promote current GitHub governance back to `VERIFIED`; G0 never -authorizes release/deploy by itself. +Historical evidence stays historical. G0 never authorizes release/deploy by itself. ## Verified historical complete operation atom @@ -233,7 +259,10 @@ This is historical evidence for one real atom. It does not execute or authorize VOODOO_ALLOW_PRODUCTION_EFFECTS=false NEW_G7_PROVIDER_WRITE=NO NEW_A09_PROVIDER_MUTATION=NO -G0_LIVE_ENFORCEMENT_VERIFIED=UNKNOWN_CURRENT +LATEST_RETAINED_G0_VERDICT=VERIFIED +LATEST_RETAINED_G0_SOURCE_SHA=a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c +CURRENT_LIVE_G0=DERIVED_QUERY_ONLY +RELEASE_CANDIDATE_G0=FRESH_EXACT_CHECKOUT_REQUIRED G8_DEFAULT_PROVIDER_RUNTIME=OFF REAL_CANONICAL_READ_E2E_VERIFIED=NO WRITE_RUNTIME_GATE=BLOCKED diff --git a/tests/system/test_pr01_repository_identity_truth.py b/tests/system/test_pr01_repository_identity_truth.py index aff71f02..5dd31c3d 100644 --- a/tests/system/test_pr01_repository_identity_truth.py +++ b/tests/system/test_pr01_repository_identity_truth.py @@ -29,6 +29,11 @@ def _load_script(relative: str, module_name: str): CANONICAL_REPOSITORY = "eimyroot/Voodoo-One" CANONICAL_REPOSITORY_URL = "https://github.com/eimyroot/Voodoo-One.git" +LATEST_RETAINED_G0_SOURCE_SHA = "a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c" +LATEST_RETAINED_G0_RUN = "34031128405" +LATEST_RETAINED_G0_ARTIFACT_DIGEST = ( + "sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c" +) LEGACY_FETCH_ALIASES = frozenset( { "https://github.com/eimyroot/V-One.git", @@ -99,7 +104,11 @@ def test_governance_and_publication_docs_bind_current_repository_identity() -> N assert "repository = eimyroot/Voodoo-One" in governance assert "repository = nulleimy/V-One" not in governance - assert "fresh live G0 verification required" in governance + assert "latest retained g0 evidence" in governance.lower() + assert "CURRENT_LIVE_G0 = DERIVED / QUERY_ONLY" in governance + assert LATEST_RETAINED_G0_RUN in governance + assert LATEST_RETAINED_G0_SOURCE_SHA in governance + assert LATEST_RETAINED_G0_ARTIFACT_DIGEST in governance assert CANONICAL_REPOSITORY_URL in publication assert "fetch-only legacy alias" in publication @@ -119,24 +128,49 @@ def test_operations_runbook_uses_current_repo_and_artifact_derived_schema_truth( assert "current expected schema is 14" in runbook -def test_current_truth_does_not_promote_historical_g0_after_rename() -> None: +def test_versioned_truth_uses_retained_g0_evidence_without_self_invalidating_current_pass() -> None: state = _read("CURRENT_PRODUCT_STATE.md") capabilities = _read("docs/product/CURRENT_CAPABILITIES.md") readme = _read("README.md") assert "CANONICAL_REPOSITORY: eimyroot/Voodoo-One" in state - assert "G0_GITHUB_GOVERNANCE=UNKNOWN" in state - assert "G0 = UNKNOWN" in state + assert "LATEST_RETAINED_G0_VERDICT=VERIFIED" in state + assert "CURRENT_LIVE_G0=DERIVED_QUERY_ONLY" in state + assert LATEST_RETAINED_G0_RUN in state + assert LATEST_RETAINED_G0_SOURCE_SHA in state + assert LATEST_RETAINED_G0_ARTIFACT_DIGEST in state assert "historical_verdict = VERIFIED" in state assert "| Canonical repository | `eimyroot/Voodoo-One` |" in capabilities - assert "| Main GitHub governance policy | UNKNOWN |" in capabilities - assert "G0_LIVE_ENFORCEMENT_VERIFIED=UNKNOWN_CURRENT" in capabilities + assert "LATEST_RETAINED_G0_VERDICT=VERIFIED" in capabilities + assert "CURRENT_LIVE_G0=DERIVED_QUERY_ONLY" in capabilities + assert LATEST_RETAINED_G0_RUN in capabilities + assert LATEST_RETAINED_G0_SOURCE_SHA in capabilities + assert LATEST_RETAINED_G0_ARTIFACT_DIGEST in capabilities assert "historical_verdict = VERIFIED" in capabilities - assert ( - "| GitHub main governance enforcement | UNKNOWN / fresh post-rename G0 required; " - "historical VERIFIED evidence retained |" - ) in readme - assert "current G0 governance is therefore `UNKNOWN`" in readme - assert "historical G0 VERIFIED evidence is retained" in readme + assert "latest retained g0 evidence" in readme.lower() + assert "CURRENT_LIVE_G0=DERIVED_QUERY_ONLY" in readme + assert LATEST_RETAINED_G0_RUN in readme + assert LATEST_RETAINED_G0_SOURCE_SHA in readme + assert LATEST_RETAINED_G0_ARTIFACT_DIGEST in readme + assert "historical_verdict = VERIFIED" in readme + + forbidden_current_pass_claims = ( + "G0_GITHUB_GOVERNANCE=PASS", + "G0_LIVE_ENFORCEMENT_VERIFIED=YES", + "G0 = PASS", + "current G0 is PASS", + "Current G0 is VERIFIED", + ) + for claim in forbidden_current_pass_claims: + assert claim not in state + assert claim not in capabilities + assert claim not in readme + + +def test_release_candidate_requires_fresh_exact_checkout_g0() -> None: + workflow = _read(".github/workflows/release-candidate.yml") + assert "verify_github_main_governance.py" in workflow + assert "--expected-source-sha" in workflow + assert '"${GITHUB_SHA}"' in workflow