[mohsen1]

Select one literal file for local patch reviews.

[mohsen1]

CLI 0.1.7: what the Release receipts prove, and what root's 403 leaves unknown (operation M1-CLI017-published-native-evidence-versus-public403-diagnostic-20261030-2055; for relay to proofline#3248 / #5210)

• Session: session_015eE1s9qzoqUzY8pMe46tk5, claude-opus-5-5, effort high. ACK at 20:53:57 UTC, deadline 21:03:57 UTC.
• Sources read (read-only, through the GitHub API):
  • The source at 5ac9d8c9.
  • Release run 41123276320: job and step names and their results only, not raw logs.
  • The v0.1.7 release metadata.
  • The PR Select one literal file for local patch reviews #28 comments.
• Not done: no request to proofline.sh or any other distribution URL, and no use of CI credentials. No dispatch, re-run, build, test, install or edit.
• Existing explanation: no existing author receipt on this thread explains the 403, so there was nothing to adopt.

Contract: release.yml, scripts/publish-r2.sh, archive.py, release-version.py and src/update.rs are byte-identical between 7145592f (0.1.6) and 5ac9d8c9.

Proven by the native receipts

1. Source and tag:

   • Run 41123276320 (workflow_dispatch by mohsen1 on main, head 5ac9d8c9a0cb8af5d288a6c876a91e55a621aa93) ran 20:26:51–20:33:43 UTC and concluded success.
   • Release v0.1.7 (id 429463612) targets 5ac9d8c9, was published at 20:33:36 UTC, and is neither a draft nor a prerelease. GitHub marks it immutable: false.
   • The version job ran release-version.py, which admits only main, or a tag equal to Cargo's version, at a commit on main.

2. Checks: the reused ci.yml jobs (check / check 124295135222 and check / windows 124295134726) succeeded at 5ac9d8c9. That covers fmt, clippy, cargo test, cargo deny and the Windows package run.

3. Builds: five build jobs succeeded:

   • x86_64 Linux musl (124296766365)
   • aarch64 Linux musl (124296766134)
   • x86_64 macOS (124296766129)
   • aarch64 macOS (124296766397)
   • x86_64 Windows (124296766192)

   In each, the step that requires --version to print proofline 0.1.7 succeeded, and the archive was built and uploaded as an artifact.

4. Publish job 124298048997, all steps succeeded:

   • Step 4: exactly 5 archives, SHA256SUMS computed, latest set to 0.1.7, draft release reserved.
   • Step 5: artifact attestations created.
   • Step 6, publish-r2.sh, succeeded, which by its source means:
     • Before uploading, the runner's curl GET of /cli/download/0.1.7/SHA256SUMS returned 404.
     • Its GET of https://proofline.sh/cli/latest returned 200 with a version older than 0.1.7, or 404. Any other status, including 403, would have refused the step.
     • It then made signed, conditional R2 PUTs to the proofline-cli-releases bucket: the reservation, the 5 archives, SHA256SUMS, then latest (max-age=60).
   • Step 7: uploaded to GitHub Releases, published the release as latest, then read back each of the 5 archives with curl --fail from https://proofline.sh/cli/download/0.1.7/<name> and cmp'd them against the built artifacts. All five matched, from a GitHub-hosted ubuntu-24.04 runner between 20:33:33 and 20:33:41 UTC. With the default bash -e shell, any failed curl or cmp would have failed the step.

5. GitHub digests:

   • The release has 7 assets.
   • The x86_64 Linux musl archive is 3972282 bytes with digest sha256:fb13dbd429c1e61f9fb6d8974e3b17792f65b5882e4623a37a335590e000fe13.
   • SHA256SUMS has digest sha256:c5b9c6eb…c614c6.

Still unknown

1. /cli/latest after the upload: the only receipt of /cli/latest predates the latest PUT. No receipt shows any client receiving 0.1.7 from it after publication. A successful PUT proves the write to R2, not that proofline.sh serves the new value.
2. SHA256SUMS and the installer: no receipt reads /cli/download/0.1.7/SHA256SUMS after upload or reads the /cli installer. Only the five archives were read back.
3. Cause of root's 403: unidentified. The recorded facts differ from root's request on client (the runner used curl; root used Python urllib), on network origin (GitHub-hosted runner versus root's host) and on time (the runner's /cli/latest probe was about 20:33:2x, before the latest PUT). Nothing recorded links any of these to the 403. I'm not labelling it a WAF, client-identity, authentication or origin problem.
4. Installed 0.1.7: unproven. No installer ran, and ci: add dispatch-only hosted installer check for CLI 0.1.6 #25's check is pinned to 0.1.6.
5. Source-to-binary provenance beyond the attestation step: not evaluated here.

Custodians and next step

• Release and publisher: mohsen1 (the Release run actor) with the release environment. The R2 bucket proofline-cli-releases is reached through the CLI_RELEASE_R2_CREDENTIALS environment secret and the CLOUDFLARE_ACCOUNT_ID variable; I didn't read either.
• proofline.sh: the edge and routing in front of proofline.sh/cli, and the /cli installer (proofline apps/marketing/public/cli/install.sh), are not defined in this repo. Their owner is the proofline.sh distribution owner in the main proofline repo, and the CLI source can't narrow that further.
• Smallest next step: that distribution owner checks their own edge or origin records for root's 403 request (its timestamp and status reason). No new client probe is needed.
• Exit condition: an owner-recorded reason for the 403. Alternatively, a separately authorized readback on the normal admitted route that records /cli/latest = 0.1.7 and a SHA256SUMS match. That would need its own root reservation, and the ci: add dispatch-only hosted installer check for CLI 0.1.6 #25 workflow would need a reviewed pin change before it could read 0.1.7.

Nothing here counts as a public-readback pass, publication clearance or installed-0.1.7 acceptance. Released within the 10-minute bound.

---

Generated by Claude Code

[mohsen1]

CLI 0.1.7 diagnosis: an existing installed-0.1.7 receipt already exists (run 41129555691). Adopted; no duplicate. (Service-side read-only diagnosis; for relay to proofline#3248 / #3140 / #5210)

• Session: session_015eE1s9qzoqUzY8pMe46tk5, claude-opus-5-5, effort high. ACK at 00:15:43 UTC on 2026-10-31, deadline 00:35:43 UTC.
• Sources read (read-only, GitHub API and git):
  • The PR Select one literal file for local patch reviews #28 comments (nothing new since my comment 6533266827).
  • Open PRs: 0.
  • The Release and Hosted install check run lists.
  • main = ea52d4b7156550e7954de541db8b917b31e476d5.
  • Job and step results for run 41129555691, not raw logs.
• Not done: no proofline.sh request, no dispatch, re-run, install, build or edit. I did not read or use any credential value.

1. Service-side control path: none authorized in this context

• This container has generic AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY variables. ~/.aws/config holds only an S3 payload-signing setting, with no endpoint, account or bucket. No wrangler, aws or rclone binary is installed.
• Nothing ties these to Cloudflare R2, the proofline-cli-releases bucket or the release. I treated them as not authorized for this distribution and didn't use them, since doing so would be falling back to another identity.
• The release's real R2 credential is the GitHub release environment secret CLI_RELEASE_R2_CREDENTIALS, which only the approved publish job can use. It is not available to this session.
• So I read no R2 object metadata (ETag, last-modified), routes or Cloudflare audit records. Root's relayed Cloudflare record is not something I can verify.

2. Existing normal 0.1.7 install receipt (adopted)

• PR Verify hosted installation of CLI 0.1.7 #29 (a8de4a54, "Verify the published 0.1.7 installer and release metadata", merged as ea52d4b7) updated hosted-install.yml:
  • VERSION=0.1.7
  • ARCHIVE_SHA256=fb13dbd429c1e61f9fb6d8974e3b17792f65b5882e4623a37a335590e000fe13
  • new CHECKSUMS_SHA256=c5b9c6ebb2cf7729fefe29ee3137655e757a01685501374afbd3da094ac614c6
  • unchanged INSTALLER_SHA256=da5e9d49eaa193a9f98d002b799c7b432129ac1f9c746295abf19ca1f613f567
  • New checks: /cli/latest must equal $VERSION; SHA256SUMS must match its pinned digest and contain the exact archive line.
• Run 41129555691: workflow_dispatch by mohsen1 at ea52d4b7. Job install 124316709593 on a GitHub-hosted ubuntu-24.04 runner ran its single set -euo pipefail step from 21:14:49 to 21:14:51 UTC on 2026-10-30, and concluded success.
• What that success proves (by that workflow source): from that runner at 21:14:49–51 UTC:
  • https://proofline.sh/cli/latest returned exactly 0.1.7.
  • /cli/download/0.1.7/SHA256SUMS had SHA-256 c5b9c6eb…c614c6 and listed fb13dbd4…fe13 proofline-x86_64-unknown-linux-musl.tar.gz.
  • The x86_64 Linux archive had SHA-256 fb13dbd4…fe13 and exactly one proofline entry.
  • The /cli installer had SHA-256 da5e9d49…f567, checked before it ran.
  • The installer, run with PROOFLINE_NO_UPDATE_CHECK=1 PROOFLINE_VERSION=0.1.7 into a throwaway PROOFLINE_INSTALL_DIR, installed a regular file. Its --version printed exactly proofline 0.1.7, and it was byte-identical (cmp) to the binary in the pinned archive.
• Not read: the workflow writes the installed binary's own SHA-256 to that job's summary, which I didn't read (raw logs and summaries are out of scope). By cmp it equals the proofline entry of archive fb13dbd4…fe13.

3. Four separate facts

Fact	Status
R2 object state	Not read directly; there's no authorized path here. The public readback in §2 shows proofline.sh served latest=0.1.7 plus the pinned SHA256SUMS and archive at 21:14 UTC, matching the Release 41123276320 writes and GitHub asset digests. Direct ETag and last-modified need the R2 custodian (below).
Edge admission (Ray)	Root's relayed record (20:50:13 UTC, /cli/latest, Browser Integrity Check BLOCK, Ray a52d4a84dac5d963, client Python-urllib/3.14) isn't verifiable from here. Recorded curl requests from GitHub-hosted runners were admitted (Release step 6 around 20:33, step 7 at 20:33:33–41, and §2 at 21:14). I don't infer any cause beyond the owner's record.
Remedy for the 403	The proofline.sh/Cloudflare owner decides. It isn't needed to close the installed-0.1.7 gap, and this turn changes no security setting.
Installed 0.1.7	Proven for x86_64 Linux on a GitHub-hosted ubuntu-24.04 runner by run 41129555691. Not proven: aarch64 Linux, macOS (Intel or Apple silicon), Windows, root's own host, or any editor integration.

4. Custodians and remaining read-only steps

• Release, R2 and installed-version receipts: mohsen1, the actor on Release 41123276320, on PR Verify hosted installation of CLI 0.1.7 #29's merge and on run 41129555691, using the release environment and Cloudflare account vars.CLOUDFLARE_ACCOUNT_ID.
  • If R2 object metadata is still wanted, that custodian reads proofline-cli-releases/0.1.7/{RELEASE.json,SHA256SUMS,proofline-*.tar.gz} and latest (ETag, size, last-modified) through their own authorized Cloudflare access.
  • That would confirm the stored objects directly rather than through public readback. It isn't needed for x86_64 Linux installed acceptance.
• Edge admission: the proofline.sh Cloudflare zone owner holds the Ray a52d4a84dac5d963 record. Any change to Browser Integrity Check for non-browser clients is their decision.
• Binary digest: if a digest of the installed binary itself is needed, the run owner reads the job summary of 41129555691 / 124316709593.

No new distribution request, install, or claim beyond the adopted receipt. Released within the 20-minute bound.

---

Generated by Claude Code