Repository navigation
security: persist signed authority receipts and restore STEP_UP after restart - #88
Conversation
… authority restarts
…and recover previous decisions on restart
…ng or concurrent ledger writers
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 986319c358
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const size = Buffer.byteLength(raw) | ||
| if (size !== fileStat.size || (size > 0 && !raw.endsWith("\n"))) { | ||
| throw new Error("TRUNCATED_OR_CHANGED_RECEIPT_LEDGER") | ||
| } | ||
| for (const line of raw.split("\n").filter(Boolean)) { |
There was a problem hiding this comment.
If the ledger loses one or more complete trailing records, startup accepts the shortened file because its remaining signatures and chain links still verify. I reproduced this by appending two signed receipts, closing the ledger, removing the second JSONL line, and reopening successfully with a count of one. Truncating to zero bytes is also accepted. This silently loses previously acknowledged decisions and prior STEP_UP receipts instead of failing closed. Persist and verify an independent committed head or record count so recovery can distinguish an intact ledger from a valid prefix.
Useful? React with 👍 / 👎.
CFAV P0 follow-on for staging availability, fail-closed auditability, and approval continuity. Replace process-local receipt Map/lastHash with a single-instance, append-only HMAC-verified chained on-disk ledger that must be configured via an absolute private path. Every authority decision is fsynced before a PERMIT, STEP_UP, or DENY response is returned. Startup refuses malformed, tampered, truncated, symlinked, or permission-unsafe state. Exclusive ownership lock prevents two authority instances from forking the same ledger; unclean lock recovery requires operator review. Synthetic CI exercises real HTTP authority decisions, restart recovery, attempted concurrent opening, and tampering. No real GitHub reviewer/production secrets or unverified permissions are granted. Multi-node storage, external audit and target-side effect confirmation remain independent blockers.