Type work order closure authority
This commit is contained in:
Meta Vens
parent
d1bcbae68f
commit
4094c2c71c
7 changed files with 207 additions and 37 deletions
|
|
@ -7468,89 +7468,79 @@ fn closure_family_assertions(
|
|||
);
|
||||
}
|
||||
"repo.work_order" => {
|
||||
let work_order = parse_repo_work_order(&content).ok();
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-schema-present",
|
||||
content.contains("schema_version = \"epiphany.repo_work_order.v0\""),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(RepoWorkOrder::has_canonical_identity),
|
||||
"Committed work order carries the schema version.".to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-family-present",
|
||||
content.contains("safe_action_family = \"repo.work_order\""),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(RepoWorkOrder::has_canonical_identity),
|
||||
"Committed work order carries the safe action family.".to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-summary-present",
|
||||
content.contains(&compact_summary),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(|value| value.summary == compact_summary),
|
||||
"Committed work order contains the accepted pressure summary.".to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-awaits-hands-review",
|
||||
content.contains("[work_order]")
|
||||
&& content.contains("status = \"awaiting-hands-review\"")
|
||||
&& content.contains("requested_owner = \"Hands\"")
|
||||
&& content.contains("requested_effect = \"branch-local-implementation\""),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(RepoWorkOrder::awaits_hands_review),
|
||||
"Committed work order waits for Hands review before implementation consequence."
|
||||
.to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-antecedents-present",
|
||||
content.contains("[antecedents]")
|
||||
&& content.contains("objective_draft_ref = ")
|
||||
&& content.contains("adoption_request_ref = ")
|
||||
&& content.contains("scheduling_request_ref = ")
|
||||
&& content.contains("mind_adoption_required = true")
|
||||
&& content.contains("self_queue_selection_required = true"),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(RepoWorkOrder::has_antecedent_contract),
|
||||
"Committed work order preserves adoption and scheduling antecedents.".to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-receipt-contract",
|
||||
content.contains("[required_receipts]")
|
||||
&& content.contains("substrate_gate = \"epiphany.substrate_gate.grant\"")
|
||||
&& content.contains("hands_intent = \"epiphany.hands.action_intent\"")
|
||||
&& content.contains("hands_review = \"epiphany.hands.action_review\"")
|
||||
&& content.contains("hands_patch = \"epiphany.hands.patch_receipt\"")
|
||||
&& content.contains("hands_command = \"epiphany.hands.command_receipt\"")
|
||||
&& content.contains("hands_commit = \"epiphany.hands.commit_receipt\"")
|
||||
&& content.contains("soul_verdict = \"epiphany.soul.verification_verdict\"")
|
||||
&& content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\""),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(RepoWorkOrder::has_receipt_contract),
|
||||
"Committed work order names the Substrate/Hands/Soul/Mind receipt chain."
|
||||
.to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-scope-bounded",
|
||||
content.contains("[scope]")
|
||||
&& content.contains("branch_required = true")
|
||||
&& content.contains("allowed_branch_prefix = \"epiphany/\"")
|
||||
&& content.contains("max_changed_paths = 3")
|
||||
&& content.contains("requires_reviewable_diff = true"),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(RepoWorkOrder::has_bounded_scope),
|
||||
"Committed work order scopes later action to bounded branch-local reviewable work."
|
||||
.to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-authority-seals",
|
||||
content.contains("[authority]")
|
||||
&& content.contains("substrate_access_authorized = false")
|
||||
&& content.contains("hands_action_authorized = false")
|
||||
&& content.contains("shell_command_authorized = false")
|
||||
&& content.contains("commit_authorized = false")
|
||||
&& content.contains("publication_authorized = false")
|
||||
&& content.contains("cross_body_mutation_authorized = false")
|
||||
&& content.contains("bifrost_publication_required = true"),
|
||||
work_order.as_ref().is_some_and(RepoWorkOrder::has_authority_seals),
|
||||
"Committed work order denies substrate/shell/commit/action/publication/cross-body authority."
|
||||
.to_string(),
|
||||
);
|
||||
push_assertion(
|
||||
&mut assertions,
|
||||
"work-order-private-seal",
|
||||
content.contains("private_state_exposed = false"),
|
||||
work_order
|
||||
.as_ref()
|
||||
.is_some_and(|value| !value.private_state_exposed),
|
||||
"Committed work order preserves the private-state seal.".to_string(),
|
||||
);
|
||||
}
|
||||
|
|
@ -15380,6 +15370,7 @@ idunn_deployment_authority_required = true
|
|||
"repo.sync_request",
|
||||
"repo.pr_request",
|
||||
"repo.maintainer_review_request",
|
||||
"repo.work_order",
|
||||
"repo.verification_request",
|
||||
"repo.credit_request",
|
||||
"repo.artifact_acceptance_request",
|
||||
|
|
|
|||
|
|
@ -1,3 +1,116 @@
|
|||
#[derive(Debug, Deserialize)]
|
||||
pub(super) struct RepoWorkOrder {
|
||||
pub(super) schema_version: String,
|
||||
pub(super) safe_action_family: String,
|
||||
pub(super) summary: String,
|
||||
pub(super) private_state_exposed: bool,
|
||||
work_order: RepoWorkOrderBody,
|
||||
antecedents: RepoWorkOrderAntecedents,
|
||||
required_receipts: RepoWorkOrderReceipts,
|
||||
scope: RepoWorkOrderScope,
|
||||
authority: RepoWorkOrderAuthority,
|
||||
}
|
||||
|
||||
impl RepoWorkOrder {
|
||||
pub(super) fn has_canonical_identity(&self) -> bool {
|
||||
self.schema_version == "epiphany.repo_work_order.v0"
|
||||
&& self.safe_action_family == "repo.work_order"
|
||||
}
|
||||
|
||||
pub(super) fn awaits_hands_review(&self) -> bool {
|
||||
self.work_order.status == "awaiting-hands-review"
|
||||
&& self.work_order.requested_owner == "Hands"
|
||||
&& self.work_order.requested_effect == "branch-local-implementation"
|
||||
}
|
||||
|
||||
pub(super) fn has_antecedent_contract(&self) -> bool {
|
||||
!self.antecedents.objective_draft_ref.is_empty()
|
||||
&& !self.antecedents.adoption_request_ref.is_empty()
|
||||
&& !self.antecedents.scheduling_request_ref.is_empty()
|
||||
&& self.antecedents.mind_adoption_required
|
||||
&& self.antecedents.self_queue_selection_required
|
||||
}
|
||||
|
||||
pub(super) fn has_receipt_contract(&self) -> bool {
|
||||
let r = &self.required_receipts;
|
||||
r.substrate_gate == "epiphany.substrate_gate.grant"
|
||||
&& r.hands_intent == "epiphany.hands.action_intent"
|
||||
&& r.hands_review == "epiphany.hands.action_review"
|
||||
&& r.hands_patch == "epiphany.hands.patch_receipt"
|
||||
&& r.hands_command == "epiphany.hands.command_receipt"
|
||||
&& r.hands_commit == "epiphany.hands.commit_receipt"
|
||||
&& r.soul_verdict == "epiphany.soul.verification_verdict"
|
||||
&& r.mind_commit == "epiphany.mind.state_commit_receipt"
|
||||
}
|
||||
|
||||
pub(super) fn has_bounded_scope(&self) -> bool {
|
||||
self.scope.branch_required
|
||||
&& self.scope.allowed_branch_prefix == "epiphany/"
|
||||
&& self.scope.max_changed_paths == 3
|
||||
&& self.scope.requires_reviewable_diff
|
||||
}
|
||||
|
||||
pub(super) fn has_authority_seals(&self) -> bool {
|
||||
let a = &self.authority;
|
||||
a.branch_local_only
|
||||
&& !a.substrate_access_authorized
|
||||
&& !a.hands_action_authorized
|
||||
&& !a.shell_command_authorized
|
||||
&& !a.commit_authorized
|
||||
&& !a.publication_authorized
|
||||
&& !a.cross_body_mutation_authorized
|
||||
&& a.bifrost_publication_required
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
struct RepoWorkOrderBody {
|
||||
status: String,
|
||||
requested_owner: String,
|
||||
requested_effect: String,
|
||||
}
|
||||
#[derive(Debug, Deserialize)]
|
||||
struct RepoWorkOrderAntecedents {
|
||||
objective_draft_ref: String,
|
||||
adoption_request_ref: String,
|
||||
scheduling_request_ref: String,
|
||||
mind_adoption_required: bool,
|
||||
self_queue_selection_required: bool,
|
||||
}
|
||||
#[derive(Debug, Deserialize)]
|
||||
struct RepoWorkOrderReceipts {
|
||||
substrate_gate: String,
|
||||
hands_intent: String,
|
||||
hands_review: String,
|
||||
hands_patch: String,
|
||||
hands_command: String,
|
||||
hands_commit: String,
|
||||
soul_verdict: String,
|
||||
mind_commit: String,
|
||||
}
|
||||
#[derive(Debug, Deserialize)]
|
||||
struct RepoWorkOrderScope {
|
||||
branch_required: bool,
|
||||
allowed_branch_prefix: String,
|
||||
max_changed_paths: u64,
|
||||
requires_reviewable_diff: bool,
|
||||
}
|
||||
#[derive(Debug, Deserialize)]
|
||||
struct RepoWorkOrderAuthority {
|
||||
branch_local_only: bool,
|
||||
substrate_access_authorized: bool,
|
||||
hands_action_authorized: bool,
|
||||
shell_command_authorized: bool,
|
||||
commit_authorized: bool,
|
||||
publication_authorized: bool,
|
||||
cross_body_mutation_authorized: bool,
|
||||
bifrost_publication_required: bool,
|
||||
}
|
||||
|
||||
pub(super) fn parse_repo_work_order(text: &str) -> Result<RepoWorkOrder> {
|
||||
toml::from_str(text).context("work order is not valid typed TOML")
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub(super) struct RepoVerificationRequest {
|
||||
pub(super) schema_version: String,
|
||||
|
|
|
|||
|
|
@ -2,6 +2,52 @@
|
|||
mod workflow_tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn work_order_comment_cannot_counterfeit_hands_authority_seal() {
|
||||
let text = r#"
|
||||
schema_version = "epiphany.repo_work_order.v0"
|
||||
safe_action_family = "repo.work_order"
|
||||
summary = "summary"
|
||||
private_state_exposed = false
|
||||
[work_order]
|
||||
status = "awaiting-hands-review"
|
||||
requested_owner = "Hands"
|
||||
requested_effect = "branch-local-implementation"
|
||||
[antecedents]
|
||||
objective_draft_ref = "objective"
|
||||
adoption_request_ref = "adoption"
|
||||
scheduling_request_ref = "schedule"
|
||||
mind_adoption_required = true
|
||||
self_queue_selection_required = true
|
||||
[required_receipts]
|
||||
substrate_gate = "epiphany.substrate_gate.grant"
|
||||
hands_intent = "epiphany.hands.action_intent"
|
||||
hands_review = "epiphany.hands.action_review"
|
||||
hands_patch = "epiphany.hands.patch_receipt"
|
||||
hands_command = "epiphany.hands.command_receipt"
|
||||
hands_commit = "epiphany.hands.commit_receipt"
|
||||
soul_verdict = "epiphany.soul.verification_verdict"
|
||||
mind_commit = "epiphany.mind.state_commit_receipt"
|
||||
[scope]
|
||||
branch_required = true
|
||||
allowed_branch_prefix = "epiphany/"
|
||||
max_changed_paths = 3
|
||||
requires_reviewable_diff = true
|
||||
[authority]
|
||||
branch_local_only = true
|
||||
substrate_access_authorized = false
|
||||
# hands_action_authorized = false
|
||||
hands_action_authorized = true
|
||||
shell_command_authorized = false
|
||||
commit_authorized = false
|
||||
publication_authorized = false
|
||||
cross_body_mutation_authorized = false
|
||||
bifrost_publication_required = true
|
||||
"#;
|
||||
let work_order = parse_repo_work_order(text).expect("fixture is typed TOML");
|
||||
assert!(!work_order.has_authority_seals());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn verification_comment_cannot_counterfeit_soul_verdict_seal() {
|
||||
let text = r#"
|
||||
|
|
|
|||
|
|
@ -1028,6 +1028,19 @@ walk does not discover these lexically included modules. Expanded line counts
|
|||
therefore measure readable source, not architectural growth. Ownership and
|
||||
imports remain the useful measures.
|
||||
|
||||
## Presentation text as work-order authority
|
||||
|
||||
`repo.work_order` closure previously inferred schema, antecedents, receipt
|
||||
chain, bounded scope, and authority denials with `content.contains`. A comment
|
||||
containing `hands_action_authorized = false` could therefore conceal a real
|
||||
grant. Work-order closure now parses typed TOML inside the workflow owner and
|
||||
checks the actual fields. Its malicious fixture proves the counterfeit comment
|
||||
cannot bless Hands authority, and the class guard prevents the family from
|
||||
regaining substring authority.
|
||||
|
||||
Fourteen high-authority closure families are typed; 507 substring assertions
|
||||
remain. Adoption and scheduling are the next workflow-shaped candidates.
|
||||
|
||||
The same inspection found 33 consecutive duplicate `#[cfg(test)]` attributes
|
||||
on provider constructors/writers and their re-exports. One gate already makes
|
||||
each item test-only; the second owned nothing. The duplicates are removed.
|
||||
|
|
|
|||
|
|
@ -322,6 +322,13 @@ workflow rather than feeding the external drawer. External governance should
|
|||
converge on tooling plus publication/accounting; operations retains
|
||||
policy/deployment.
|
||||
|
||||
Work-order closure is now typed inside that workflow owner. The old substring
|
||||
path could accept a commented Hands denial beside a real authority grant; the
|
||||
malicious fixture and generic class guard now make that impossible. Fourteen
|
||||
high-authority families are typed and 507 substring assertions remain. Next
|
||||
inspect adoption versus scheduling and convert the authority-bearing family
|
||||
with its own negative proof.
|
||||
|
||||
The latest structural count is 32 closure family branches, 744 remaining
|
||||
substring assertions in the closure region, and 1,284 lines in
|
||||
`closure_contracts.rs`. Do not blindly generate a struct forest for every
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -660,4 +660,4 @@ current_status:
|
|||
- Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
|
||||
- `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
|
||||
last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
|
||||
next_action: Continue the conceptual-substitution pass. Thirteen high-authority closure families are typed and guarded; 543 substring assertions remain. Workflow is now a physical closure domain: workflow.rs owns typed verification request closure and workflow_tests.rs owns its counterfeit-Soul-verdict fixture. Direct rustfmt is required because Cargo fmt misses the lexically included files. Next type and move one adoption/scheduling/work-order family into workflow instead of feeding external governance. External governance should converge on tooling plus publication/accounting; operations retains policy/deployment. Provider chronology is explicitly external and guarded as arrival order. Continue auditing evidence/security mirrors and adapters for borrowed authority.
|
||||
next_action: Continue the conceptual-substitution pass. Fourteen high-authority closure families are typed and guarded; 507 substring assertions remain. Workflow owns typed verification and work-order closure plus their counterfeit-authority fixtures. Work-order comments can no longer impersonate Hands authority. Direct rustfmt is required because Cargo fmt misses the lexically included files. Next compare adoption and scheduling closure authority and type the higher-consequence workflow family with a negative proof. External governance should converge on tooling plus publication/accounting; operations retains policy/deployment. Provider chronology is explicitly external and guarded as arrival order. Continue auditing evidence/security mirrors and adapters for borrowed authority.
|
||||
|
|
|
|||
Reference in a new issue