Repository navigation
P0: Activate and independently validate TTP governed execution in staging #80
Description
Current factual blocker (Nov 2 2026)
The Governed Execution run 41544110333 failed closed with: RUNTIME_AUTH_URL, RUNTIME_AUTH_TOKEN or RUNTIME_AUTH_GRANT_REF missing; no local authorization fallback. This is not a successful permission or an active production integration.
The core CFAV security controls have been merged in PR #77. JS/Python/Go verifier CI is green, but production GitHub/authority end-to-end proof remains NOT VERIFIED.
Required operator approvals and evidence
- Provision a restricted staging HTTPS authority endpoint. Make its TLS trust anchor, reverse proxy, certificate rotation and workload identity operator-controlled.
- Provision unique
RUNTIME_AUTH_URL,RUNTIME_AUTH_TOKEN(min 32 bytes), andRUNTIME_AUTH_GRANT_REFas repository action secrets. Do not put values in issues. - Provision server
RECEIPT_HMAC_SECRETandRUNTIME_AUTH_GRANTS_JSONin a protected secret store. Runtime grants must be scoped to subject, repo, action, branch (when applicable), trust score and independently verified freshness. - Configure
protected-executionGitHub Environment with REQUIRED independent reviewers, prevent author self-approval, constrain deployment branches. - Run legitimate safe-PR PERMIT with fresh signed receipt bound to GitHub repo, commit, changed files, run and requester.
- Run protected-path STEP_UP, authenticated reviewer, fresh post-approval PERMIT with new bound receipt; prove no bypass using stale or copied approval.
- Verify no-token, wrong-token, malformed/expired/revoked grant, stale attestation, forged keyID, replayed receipt, API outage and bad TLS all DENY.
- Run documented authorization-negative tests in non-production before making workflow a REQUIRED merge check.
- Migrate service receipts from in-memory state and HMAC reference signer to durable tenant-isolated ledger with governed KMS/HSM keys and target-side effect verification.
- Obtain independent threat-model review and penetration test. Reconcile policy with legal/patent license before external certification claims.
Scope / stop condition
Never turn off the fail-closed GitHub workflow just to make checks green. Close only when reviewer-signed, redacted staging evidence proves safe PERMIT and DENY scenarios. A GitHub Actions passing unit suite is insufficient for live approval claims.
Activity
blocksifrdev commentedon Nov 2, 2026
CFAV update, November 2, 2026. PR #85 merged: #85. Local synthetic HTTP integration tests now instantiate the actual TypeScript authority server, exercise valid PERMIT/STEP_UP/post-approval PERMIT, deny missing/wrong credentials, stale/revoked/cross-tenant grants, mismatched prior receipts/commit/paths, malformed input, and compare receipt HMACs. CI run: https://github.com/BlockSiFr/ttp-protocol/actions/runs/41545817734 passed. The starter service now binds only to 127.0.0.1 by default. This is a synthetic local proof, not actual GitHub reviewer authorization or remote TLS proof. The governed-execution workflow remains red because RUNTIME_AUTH_URL, RUNTIME_AUTH_TOKEN, RUNTIME_AUTH_GRANT_REF are not provisioned; do not disable fail-closed. Issue remains OPEN.
blocksifrdev commentedon Nov 2, 2026
November 2 follow-on: PR #86 merged with an independently authenticated GitHub approval verifier: #86. Reauthorization now queries the official workflow-run approval history and live PR metadata, requiring the protected-execution environment, non-author reviewer, unchanged commit SHA/branch, and a distinct fresh receipt. Untrusted
approved: trueassertions are DENIED; malformed reviewer claims return HTTP 400. CI passed: https://github.com/BlockSiFr/ttp-protocol/actions/runs/41547001174. PR #87 also merged: #87; a single-host, owner-private, atomic on-disk replay ledger prevents a STEP_UP receipt being redeemed again across process restarts. CI passed: https://github.com/BlockSiFr/ttp-protocol/actions/runs/41547355700. Still blocked: real staging environment must provision RUNTIME_AUTH_URL, RUNTIME_AUTH_TOKEN, RUNTIME_AUTH_GRANT_REF, GITHUB_APPROVAL_VERIFY_TOKEN, RECEIPT_HMAC_SECRET, RUNTIME_AUTH_GRANTS_JSON, RUNTIME_AUTH_REPLAY_LEDGER_DIR and independent protected-execution reviewers. Actual GitHub approved-run evidence still NOT VERIFIED. No production changes or secrets made in these PRs.blocksifrdev commentedon Nov 2, 2026
CFAV November 2 evidence update. PR #88 merged: #88; a single-instance append-only HMAC-signed receipt ledger now persists every decision before a response, restores prior STEP_UP receipts after graceful restart and refuses malformed/tampered ledgers or concurrent writers. Standard CI run #41548364976 passed. PR #89 merged: #89; exact mobile-accessible operator staging instructions are published at https://github.com/BlockSiFr/ttp-protocol/blob/main/docs/security/CFAV_STAGING_ACTIVATION.md. Live governed proof remains NOT VERIFIED. Run #41548759079 again denied missing
RUNTIME_AUTH_URL,RUNTIME_AUTH_TOKEN, orRUNTIME_AUTH_GRANT_REF. Operator must provision staged HTTPS authority, separate GitHub verifier token, scoped fresh grants, persistent signed receipt and replay storage, and independent required GitHub environment reviewers. Do not supply credentials in an issue or disable fail-closed. External pen test, distributed storage, counsel approval and target-side verification remain open.