Repository navigation
Conversation
Port the remaining slice 2.3 resource-discovery change from #1262 at 122b786. Preserve the build facts already carried in #1435. Verify the three pure filesystem tests in development and release-build configurations with exact-name selection guards. CLI clippy, Rust formatting, domain lint and independent review pass.
Record Gate 1 for user approval: real A/B comparison and rebuild-check publication preserve Phase 1 identities while qualification remains closed. The narrower ordinary-release assurance claim requires explicit approval before implementation.
Port the closed producer primitives from #1262 at 122b786. Stage the manifest, error variants and fail-closed entrypoint; keep selection, signing and publication unavailable. Run 49 audited pure tests locally and wire full process tests and strict clippy into existing Linux CI jobs. Carry schemas unchanged with approved exact reference-host entries and rejection coverage. Document required shared dependency upgrades.
Record the approved merge activation, permanent companion profile contract, direct upload-action identity bridge, rerun rejection and read-only reusable-caller permissions before implementing the adapter.
Begin the separately approved Gate 1 adapter with strict observation shape, closed qualification claims and canonical/reproduction input/environment pairing. Keep the producer entrypoint closed while runtime pin, filesystem, transfer and equality stages remain pending. Verify red-green observation, root-alias and bounded-diagnostic regressions; 58 audited pure tests, strict producer clippy, formatting and domain lint pass. Independent review approves this staged unit with explicit runtime preconditions.
Extend the approved ordinary adapter with bounded full-byte equality after input pairing and observed digest/size checks. Retain bounded exact mismatch diagnostics without normalized or excluded regions; keep command assembly and qualified paths closed. Verify red-green equality coverage, custom-section and EOF differences, mutation-after-observation rejection, 62 audited pure tests and strict clippy. Independent review approves the staged comparison unit.
Reuse the reviewed ZIP32 primitive and negative fixtures from #1262 at 122b786 without moving collection authority into Phase 2. Enforce exact build/observation member sets and source-owned bounds before the original full integrity checks. Verify red-green profile admission, 71 audited pure tests, strict clippy and an exact-ID read-only probe of the current Fastly archive against its recorded GitHub digest. Independent/security review approves this structural unit; transfer authentication remains pending.
Preserve the incoming main integration, HTML EOF checks and corrected Axum bind diagnostics alongside the reviewed Phase 2 producer work. Resolve the compatibility audit by retaining the diagnostic correction and fresh-rehearsal requirement together with the approved rebuild-check profile and activation notes.
Carry the frozen inspection implementation from 122b786. Render the future recipe reference as inline code until its module lands. Keep release commands closed.
Carry the approved Phase 2 source and staged evidence-test splits from 122b786. Validate all seven ordinary cohort rows while preserving four closed controlled destination contracts. Keep qualified selectors and release execution closed.
Implement the approved Gate 1 canonical source recipe and consumed-output hashing. Use the reviewed Cargo message parser from 122b786 without constructing qualified receipts or enabling release commands.
Carry the reviewed preparation helpers from 122b786 while preserving fresh ordinary npm output. Keep the lifecycle observer unchanged at esbuild 0.27.3, document the current-lock gap, and visibly disable its full collector fixture with an enabling guard. Retain newer npm dependency versions and run subprocess fixtures only in CI.
Carry the remaining reviewed prose and formatting hunks from 122b786. Preserve current runtime changes and describe immutable release metadata without claiming a signed index. Cloudflare shell diagnostics remain identical to its pre-existing baseline.
Collaborator
Author
|
Rehearsal .18 — repeated ARM64 hosted-runner acquisition failure The source rehearsed by both tags is 36454c5 on Phase 1 base 4940928. The later documentation-only PR head 5163241 records the open gate; these tag runs do not attest that later head. All four IAB workflow runs for source 36454c5 completed successfully: 29 successful checks and four expected skips. Hosted macOS producer supervision passed all 45 selected tests; Linux producer unit tests passed 952 with nine explicitly ignored tests, boundary integration passed three, command integration passed 18, and the explicit comparison-failure sentinel passed. Fresh fork rehearsals v0.0.0-rehearsal.17 (https://github.com/prk-Jr/trusted-server/actions/runs/40710926728) and v0.0.0-rehearsal.18 (https://github.com/prk-Jr/trusted-server/actions/runs/40714430928) both hit the same external blocker: the ARM macOS CLI job never acquired a hosted runner. The check annotations report “The job was not acquired by Runner of type hosted even after multiple attempts” and macOS arm64 capacity constraints. No steps ran for those ARM jobs. Rehearsal .17 settled with nine successful jobs, one cancelled job, and two expected skips for signing and release. Rehearsal .18 settled with the same nine successful jobs, one cancelled job, and two skips for signing and release. Neither tag has a published or draft release. Both lightweight tags remain at the reviewed source commit. No workflow rerun, tag reuse, deletion, retargeting, or settings change was performed. Fresh immutable-publication, attestation and exact-release runtime verification remains pending a successful new rehearsal; the earlier .16 evidence remains historical and is not evidence for the new process cleanup change. The PR remains draft. No .19 attempt is queued. A fresh successful seven-binary rehearsal remains the release-readiness gate once hosted ARM64 capacity is available; no cohort or verification requirement is waived. The original .16 exact-runtime evidence gap is separately closed: #1449 (comment) |
Collaborator
Author
|
Rehearsal .19 — hosted ARM64 runner acquisition failure Exact reviewed source: Final fork run 40726649596: 9 successful jobs, 1 cancelled job, 2 skipped jobs. Six binary builds, the second Fastly build and complete-byte comparison passed. The ARM64 macOS CLI job executed zero steps and never acquired a runner. Its annotations say “The job was not acquired by Runner of type hosted even after multiple attempts” and cite macOS ARM64 capacity constraints. Signing and publication were skipped. Read-only checks found no draft or published .19 release and no leftover drafts. Consequently, published-asset, attestation and exact-release runtime verification could not run; no successful rehearsal is claimed. The lightweight .19 tag remains at the exact source above, untouched. No source, runner, cohort or settings changes were made. The .16 runtime supplement remains historical evidence for |
Collaborator
Author
|
Phase 2 exact-head rehearsal .20 — transcript 1/3 Source Rehearsal Verification summary:
Tool archive checksum validation (recomputed while preparing this record): Exact published inventory (30 files): The following is the actual command/output transcript; private temporary roots are replaced with shell-style placeholders. JSON-formatted verification results were retained privately; the transcript includes their explicit boolean policy/equality results. |
Collaborator
Author
|
Phase 2 exact-head rehearsal .20 — transcript 2/3 Source Continued actual verification transcript; full source/tag pins are unchanged. |
Collaborator
Author
|
Phase 2 exact-head rehearsal .20 — transcript 3/3 Source Continued actual verification transcript; full source/tag pins are unchanged. Raw runtime log excerpt (three requests and three successful responses; each was also echoed to stdout): Runtime check: PASS at the exact published digest above; all owned listeners stopped. The release verifier’s earlier “runtime remains separate” line precedes the subsequently successful runtime supplement. |
11 of 14 tasks
8 tasks
12 of 15 tasks
Integrate the Phase 1 maintainer-review changes with the Phase 2 ordinary Fastly equality gate. - Port the rebuild-check companion and its verification commands into the extracted scripts/release/publish.mjs publisher and release notes. - Keep Phase 1's push-only triggers and major-tag action references for the Phase 2 jobs, and set up pinned Node in the signing job from the checks job. - Build the trace viewer only from the build-all command line and move it out of the checked bundle directory in build.rs, so the strict bundle scan and release JS collection are unchanged. - Keep the release-policy, release-tools and release-index schema data that the release crate compiles in, and rename its Axum capability to axum-evaluation to match the cohort. - Emit the CLI release cfg from the release control without duplicating core's release-source validation.
- Fail build-all on Node before 24.2 instead of silently skipping the build. - Drop pull_request fallbacks from the push-only release build workflow. - Describe what the ordinary negative canaries prove.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
…tion or class' Remove unused isDeepStrictEqual import from release tests The Phase 1 merge dropped the node:util mock that used it but kept the import. Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Adopt Phase 1's third and fourth review rounds: four release binaries, no Rust source audit, no post-publish re-download, pre-publication signing-bundle checks and the Phase 1 spec and guide trim. Phase 2 keeps its Fastly A/B equality gate. The release is now four binaries plus the rebuild check and SHA256SUMS (18 files). The publisher also verifies the rebuild check against the Fastly provenance bundle before creating a draft. The producer's ordinary artifact list drops the three Axum rows, and the cohort file returns with the four fixed rows from the frozen design. The actions.github.io allowlist entry returns for the producer and CLI release policy. Phase 2's compatibility notes move into its integration plan, and its new build guards exit explicitly.
Phase 1 sends the locked workspace graph to /dev/null because nothing in Phase 1 reads it, but Phase 2's Fastly ordinary capture records that file. Rehearsal v0.0.0-rehearsal.26 failed the canonical build with "ordinary Cargo capture path is missing or aliased". Write the file again, and test that the capture's metadata path is the file the acquisition step writes.
Docs only: the merged head 9eeccbb passed rehearsal v0.0.0-rehearsal.27 and the guide's verification block, so the Phase 2 records no longer ask for a fresh rehearsal.
Adopt the checks-job refusal of tags on commits that are on no branch. The step joins the checks job ahead of the Fastly build jobs.
dhruv8sh
requested changes
Nov 5, 2026
dhruv8sh
left a comment
dhruv8sh
left a comment
Collaborator
There was a problem hiding this comment.
Summary
Adds a second, independently configured Fastly build plus a byte-equality comparison, and signs and publishes trusted-server-fastly.wasm.rebuild-check.json alongside the Phase 1 binaries. The gating design (path-remap scope, ambient-flag refusal, inline sign-time receipt checks, publisher bundle verification) looks solid. Two blocking items are scope/test-validity issues.
Scope note: the
trusted-server-releasecrate was not reviewed line by line beyondsrc/ordinary/normalization.rs.
Blocking
- 🔧 Unrelated reformatting conflicts with
main— commitf721ddbe0rewritesscripts/docs-proposal/hunks.mjs/hunks.test.mjs(~830 lines) and the quote style offormat.yml/test.ymlto single-quote/no-semicolon, whilemainand the Phase 1 base use double quotes and semicolons. This buries the real workflow changes and will conflict withmain. Please restore from the base (git checkout origin/feature/binary-attestations-phase1 -- scripts/docs-proposal/) and revert the quote-only workflow hunks. - 🔧 Negative canaries can never fire — inline at
.github/workflows/test.yml:214
Non-blocking
- 🤔 Reproduction build serialized after canonical — inline at
release-build.yml:201 - ⛏ Lost prebuild hint in the
TSJS_SKIP_BUILDpanic — inline atbuild.rs:80(suggestion, compile-unverified) - ⛏ Redundant
success()— inline atrelease-build.yml:429(suggestion) - 📌
crates/trusted-server-adapter-cloudflare/build.sh— comment move and flag reorder with no behavioural change; belongs outside this PR. - 👍 Ordinary remap normalization and scan — same four-entry remap for both roles, refusal of ambient
RUSTFLAGS/extra config layers/existing remap flags, leftover-path scan, and sign-time re-checks of the rebuild file make the companion hard to fake.
CI Status
32 checks PASS; 2 ordinary negative canaries SKIPPED (see blocking item).
Remove the three ordinary negative canary jobs. Their condition read a hard-coded output, so they only showed that GitHub skips a false `if:`. The Rust mismatch fixture stays, and the contract test now requires the real sign job to need the comparison and forbids status functions in the sign and publication job conditions. Restore the docs-proposal scripts, the Cloudflare build script and the workflow quote style from the Phase 1 base. Explain why the Fastly reproduction waits for the canonical build, drop a redundant success() and restore the prebuild hint in the TSJS_SKIP_BUILD panic.
Collaborator
Author
|
Summary-level items from the review, fixed in 1858b6d:
Local: release Node suite 45/45, docs-proposal gate (shellcheck, hunks tests, test.sh), |
dhruv8sh
approved these changes
Nov 5, 2026
dhruv8sh
left a comment
dhruv8sh
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed the release-signing gate path. sign now depends on fastly-comparison and runs only fixed inline checks: it requires a canonical, matched rebuild-check.json whose SHA-256, size, SPDX digest, run ID/attempt and two distinct job IDs all match the signed binary. The rebuild check is added as a provenance subject, and publish.mjs verifies it before anything is created. Producer and comparison tools build from the same pinned commit, and the new release-crate tests and clippy run in CI and are listed in AGENTS.md. No blocking issues; the inline comments are non-blocking.
Scope: this covers the workflows, the build/publish scripts and the two build.rs changes. I did not review the ~79k lines of the trusted-server-release crate line by line. A PR this size is very hard to review fully; if maintainers want the crate itself reviewed, splitting it out or reviewing it module by module would help.
Maintainer decisions listed in the PR body (removing the Axum rows, the actions.github.io / json-schema.org / spdx.org allowlist entries, and the extra Fastly build on every push to main) need explicit maintainer sign-off, separate from this code review.
Explain that HEAD_REPOSITORY_ID is the expected value matched against each artifact's API-reported head repository, note that pipefail guards the cargo | tee pipeline, and add a CHANGELOG entry for TSJS_SKIP_BUILD now failing whenever it is set.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
trusted-server-fastly.wasm.rebuild-check.json, with current-run transfer binding. Keep the four Phase 1 binary names, the reusable signer and the existing binary/SPDX verification commands; publication grows to 18 files.Changes
crates/trusted-server-release/**; workspace manifests/lockcrates/trusted-server-js/**; CLI resource discovery.github/workflows/{release,release-build,test,format}.yml;scripts/release/{phase1*,publish.mjs,release-notes.md,release-cohort.json};AGENTS.md9eeccbb88size versus Phase 13e2dd4842: 271 new files (one binary fixture), 91,299 new text lines; 42 existing files +3,270/−668. Rust: 79,236 new lines +374 existing additions. Remaining text is workflow/script/test support, docs, schemas and lockfile. Frozen source:122b78664b1235c717e9208fd200f9a9b0c335df.Closes
Part of #1235. This parent issue tracks the phased work; no separate tracking issue is pending. This PR does not close its remaining maintainer settings/approval requirements.
Spec / Plan
Phase 2 spec with its own two-round review log · Approved Gate 1 design, with the compatibility and rehearsal record · implementation and normalization plan · phase assignment.
Test plan
Current head
1858b6dd31c3190d4a953ebec2d0caf85c729eef: hosted CI PASS; release rehearsal not yet run. Review fixes only:if:. The CI step still runs the exact Rust mismatch fixture, and the contract test now requires the realsignjob to needfastly-comparisonand forbidsalways()/failure()/cancelled()in thesignandreleasejob conditions.scripts/docs-proposal/hunks*.mjs,crates/trusted-server-adapter-cloudflare/build.shand the workflow quote style from the Phase 1 base (style-only churn).success()from the rebuild-check upload, and restores the prebuild hint in theTSJS_SKIP_BUILDpanic.Hosted CI: 30 successful checks, no skips (the removed jobs were the two skipped canaries and their audit). Local: release Node suite 45/45, docs-proposal gate,
cargo fmt,trusted-server-jsclippy and tests,cargo check-axum,cargo clippy-fastly. The tworelease-build.ymledits (a comment and an equivalent step condition) have not been through a fresh rehearsal.Previous rehearsed head
44557229af80720c689759ac180ee375696b667f: PASS. Merges Phase 1's new branch check (thechecksjob refuses a tag whose commit is on no branch). Fresh lightweightv0.0.0-rehearsal.30at this exact commit passed all 13 jobs: both Fastly builds matched (3b18e5d0365af1b146a65149158df63205a0097ce6729ad10b07994ae994e914; canonical 411s, reproduction 373s, comparison 105s), 18 immutable prerelease assets were published, and the guide's verification block passed with all 17 checksum entries OK. Hosted CI: 31 successful checks, two expected skips. Phase 1's rehearsal.29showed the new step refusing a tag-only commit before any build.Previous rehearsed head
9eeccbb88cd75332bc95c6914e997ffca43e1939: PASS. Merges the narrowed Phase 1 (3e2dd4842, four binaries) in3ddcd1996and fixes the one break that merge caused. Fresh lightweightv0.0.0-rehearsal.27at this exact commit passed all 13 jobs.9eeccbb888fc36bb49a06f2182512d57976b26ee763f0ef06e9a40635f24540ef7c7980eb; ordinary profile,release_qualification:false. Canonical 399s, reproduction 443s, comparison 129sjqcheck; all 17SHA256SUMSentries OK. Run locally with GitHub CLI 2.87.2, older than the guide's 2.102.0cargo fmt; clippy for Fastly and the CLI;cargo test-fastly(Viceroy 0.21.0);cargo test-axum; CLI tests; shellcheck; prettier; domain lintv0.0.0-rehearsal.26of the merge commit3ddcd1996failed the canonical Fastly build before anything was signed: Phase 1 had stopped writingcargo-metadata.json(nothing in Phase 1 read it), but Phase 2's ordinary capture reads it.9eeccbb88writes it again, and a test now ties the capture's metadata path to the file the acquisition step writes.Not repeated at
9eeccbb88: offline bundle verification, the online SBOM lookup, and the local Viceroy runtime check of the published wasm. Those remain recorded below for earlier sources.Previous rehearsed source
5163241b947b1aa335987bd832b9205e4364e4bb: PASS. Fresh lightweightv0.0.0-rehearsal.20passed all 18 jobs. Full independent verification: transcript 1, 2, 3.5163241b95163241b9CI: 29 successful checks, four expected skips. Binary, Tests, Format, Integration. Hosted coverage includes 952 Linux producer tests / nine existing ignores, three boundary tests, 18 command tests, 38 JS fixtures and 45 macOS process tests / zero ignores. Independent implementation/security and follow-up reviews found no remaining actionable findings; review limits remain documented. Local pure regressions, strict host checks/clippy and applicable formatting/domain/workflow/shell checks passed.Previous head
0f89eae69was docs-only after5163241b9; its hosted CI passed (29 successful checks, four expected skips).5163241b9observed cost: reproduction 282s plus comparison 122s, overlapping native builds. Canonical/reproduction Wasm SHA-2564fe7204f17df07a392f4e4b64f31eebf3b02179e57abee689ab0094990d0a572. Different checkout/target roots, job counts, umasks and start times; UID/locale/timezone stayed equal. Controlled qualification remains closed.Historical evidence keeps its source: .16/runtime supplement at
5fa384336; .17/.18 capacity failures at36454c526; .19 capacity failure at5163241b9, no releases for those failed attempts. .10 rerun-all recovery remains at3ccfe2971; .13 remains at770a425df. Tags are preserved.Checklist
cargo-metadata.json) fixed and tested.1858b6dd3hosted CI green (30 success, no skips);44557229awas green with 31 success and two expected skips.1858b6dd3..30exact-head release rehearsal and documented-guide verification at44557229a(and.27at9eeccbb88)..20full published-asset/attestation/runtime verification at5163241b9(seven-binary release).Human gates and limits
Merging Phase 2 activates the equality gate on the next eligible tag: a second Fastly build plus comparison, no release on mismatch. Native release CI builds each asset once; controlled qualification, later index/SPDX/consumer gates and GNU masking remain closed. No IAB tags, releases or settings changes.
Decisions from merging the narrowed Phase 1, needing maintainer review:
release-cohort.jsondrop the three Axum rows; the cohort file is restored byte-for-byte from the frozen design's four rows. An Axum row is now refused as unknown.actions.github.ioallowlist entry returns, because the producer and the CLI release policy pin the GitHub Actions build-type URI.phase1-build.shexit explicitly, like Phase 1's.Earlier merge decisions still standing:
pull_requesttrigger fromrelease.yml, so pull requests no longer run the two-build Fastly comparison. It runs on every push to main (adding a second Fastly build and comparison there) and on tags.release-policy.json,release-tools.jsonandrelease-index-v1.schema.jsonare kept: the release crate compiles them in.trusted_server_release_build, only fromTRUSTED_SERVER__RELEASE_BUILD; core's build script still owns validation. Releasetsbinaries use it to drop the build-checkout fallback for JS resources.checksjob, before its inline validation.Allowlist changes needing maintainer review: exact
json-schema.org,spdx.organdactions.github.ioentries, with justification and rejection tests; four per-lineapi.github.comsuppressions, no wildcard/global API-host entry.Outside-scope CI fix (mirrors main #1454): separate
886cf333apins only the browser runner to Ubuntu 24.04 with the same comment; later merges retain the upstream fix.🤖 Generated with Claude Code