persona-harness 0.8.3 → 0.8.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +13 -2
- package/dist/cli/authority-artifact-binding.d.ts +3 -0
- package/dist/cli/authority-artifact-binding.js +98 -0
- package/dist/cli/authority-artifact-binding.js.map +1 -1
- package/dist/cli/authority-command-surface.d.ts +2 -1
- package/dist/cli/authority-command-surface.js +4 -3
- package/dist/cli/authority-command-surface.js.map +1 -1
- package/dist/cli/authority-command.js +3 -3
- package/dist/cli/authority-command.js.map +1 -1
- package/docs/current/release/consumer-authority-beta.md +7 -0
- package/docs/current/release/consumer-authority-v084-acceptance.json +1048 -0
- package/docs/current/release/v0.8.3-release-notes.md +5 -6
- package/docs/current/release/v0.8.4-release-notes.md +20 -0
- package/docs/releases/package-index.md +3 -2
- package/package.json +3 -1
- package/packages/shared-skills/package.json +1 -1
- package/scripts/consumer-authority-v084-acceptance-schema.d.mts +77 -0
- package/scripts/consumer-authority-v084-acceptance-schema.mjs +139 -0
- package/scripts/preflight-consumer-authority-external-artifact-transport.mjs +2 -2
- package/scripts/preflight-consumer-authority-external-attestation.mjs +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -12,6 +12,17 @@ preparation alone does not establish stable support or channel state.
|
|
|
12
12
|
the single-worker resource-sensitive lane for fixtures that own mutable
|
|
13
13
|
package, Gradle, staged-consumer, workflow-loop, or producer runtime state.
|
|
14
14
|
|
|
15
|
+
## [0.8.4] - 2026-08-11
|
|
16
|
+
|
|
17
|
+
- Add a finite, nonreflective `bindingReason` to blocked authority fetch results
|
|
18
|
+
so package-version, source, enrollment, signer, freshness, consumption,
|
|
19
|
+
verification, artifact, run, and unknown ownership classes remain distinct
|
|
20
|
+
without exposing receipt values, paths, tokens, URLs, or raw verifier output.
|
|
21
|
+
- Keep the public fetch schema versioned as `consumer-authority-fetch.3` while
|
|
22
|
+
preserving trusted/unconsumed, one-Finish, and replay rejection behavior.
|
|
23
|
+
- Record `0.8.3` as immutable published history and bind current acceptance to
|
|
24
|
+
the unpublished `0.8.4` package candidate.
|
|
25
|
+
|
|
15
26
|
## [0.8.3] - 2026-08-10
|
|
16
27
|
|
|
17
28
|
- Prepare portable automatic skill activation: ambiguous new-product requests
|
|
@@ -23,8 +34,8 @@ preparation alone does not establish stable support or channel state.
|
|
|
23
34
|
- Preserve an existing source-bound draft or revision plan during strict
|
|
24
35
|
bootstrap, then require the current V4 readiness route to use explicit
|
|
25
36
|
`ph plan --accept` before its Gradle, report, and evidence prerequisites.
|
|
26
|
-
- `0.8.3` is
|
|
27
|
-
|
|
37
|
+
- `0.8.3` is the immutable published release record. Its package cannot be
|
|
38
|
+
repacked or reused for the `0.8.4` correction.
|
|
28
39
|
|
|
29
40
|
## [0.8.0-beta.19] - 2026-08-02
|
|
30
41
|
|
|
@@ -2,3 +2,6 @@ import type { AuthorityArtifact } from "./authority-artifact-store.js";
|
|
|
2
2
|
import type { AuthorityEnrollment } from "./authority-enrollment.js";
|
|
3
3
|
import type { ProjectFinishAttestationVerifierAssessment } from "./project-finish-attestation-verifier.js";
|
|
4
4
|
export declare function matchesAuthorityArtifactBinding(artifact: AuthorityArtifact, enrollment: AuthorityEnrollment, assessment: ProjectFinishAttestationVerifierAssessment): boolean;
|
|
5
|
+
export declare const AUTHORITY_BINDING_REASONS: readonly ["artifact", "package-version", "source", "enrollment", "run", "signer", "freshness", "consumption", "verification", "unknown"];
|
|
6
|
+
export type AuthorityBindingReason = typeof AUTHORITY_BINDING_REASONS[number];
|
|
7
|
+
export declare function classifyAuthorityBindingReason(artifact: AuthorityArtifact, enrollment: AuthorityEnrollment, assessment: ProjectFinishAttestationVerifierAssessment): AuthorityBindingReason;
|
|
@@ -11,4 +11,102 @@ export function matchesAuthorityArtifactBinding(artifact, enrollment, assessment
|
|
|
11
11
|
&& receipt.workflow.certificateSan === projectFinishAttestationReusableCertificateSan(receipt.workflow.reusable.sha)
|
|
12
12
|
&& matchProjectFinishAttestationEnrollment(receipt, enrollment) === undefined;
|
|
13
13
|
}
|
|
14
|
+
export const AUTHORITY_BINDING_REASONS = [
|
|
15
|
+
"artifact",
|
|
16
|
+
"package-version",
|
|
17
|
+
"source",
|
|
18
|
+
"enrollment",
|
|
19
|
+
"run",
|
|
20
|
+
"signer",
|
|
21
|
+
"freshness",
|
|
22
|
+
"consumption",
|
|
23
|
+
"verification",
|
|
24
|
+
"unknown",
|
|
25
|
+
];
|
|
26
|
+
export function classifyAuthorityBindingReason(artifact, enrollment, assessment) {
|
|
27
|
+
const stateReason = classifyAssessmentState(assessment.state);
|
|
28
|
+
if (stateReason !== undefined)
|
|
29
|
+
return stateReason;
|
|
30
|
+
const receipt = assessment.receipt;
|
|
31
|
+
if (receipt !== undefined) {
|
|
32
|
+
const bindingReason = classifyReceiptBindingReason(artifact, enrollment, receipt);
|
|
33
|
+
if (bindingReason !== undefined)
|
|
34
|
+
return bindingReason;
|
|
35
|
+
}
|
|
36
|
+
return classifyDiagnosticReason(assessment.diagnostics);
|
|
37
|
+
}
|
|
38
|
+
function classifyAssessmentState(state) {
|
|
39
|
+
switch (state) {
|
|
40
|
+
case "source-drift":
|
|
41
|
+
return "source";
|
|
42
|
+
case "stale":
|
|
43
|
+
return "freshness";
|
|
44
|
+
case "replayed":
|
|
45
|
+
return "consumption";
|
|
46
|
+
case "certificate-invalid":
|
|
47
|
+
return "signer";
|
|
48
|
+
case "crypto-failed":
|
|
49
|
+
case "dns-unavailable":
|
|
50
|
+
case "network-unavailable":
|
|
51
|
+
case "runtime-unsupported":
|
|
52
|
+
case "signature-invalid":
|
|
53
|
+
case "transparency-invalid":
|
|
54
|
+
case "trust-root-unavailable":
|
|
55
|
+
case "verification-timeout":
|
|
56
|
+
return "verification";
|
|
57
|
+
case "binding-mismatch":
|
|
58
|
+
case "wrong-policy":
|
|
59
|
+
case "trusted":
|
|
60
|
+
return undefined;
|
|
61
|
+
case "malformed":
|
|
62
|
+
case "malformed-bundle":
|
|
63
|
+
case "missing":
|
|
64
|
+
return "artifact";
|
|
65
|
+
default:
|
|
66
|
+
return assertNever(state);
|
|
67
|
+
}
|
|
68
|
+
}
|
|
69
|
+
function classifyReceiptBindingReason(artifact, enrollment, receipt) {
|
|
70
|
+
if (artifact.repositoryId !== receipt.repository.id)
|
|
71
|
+
return "enrollment";
|
|
72
|
+
if (artifact.sourceHead !== receipt.source.head)
|
|
73
|
+
return "source";
|
|
74
|
+
if (artifact.runId !== receipt.lifecycle.runId || artifact.runId !== receipt.workflow.runId)
|
|
75
|
+
return "run";
|
|
76
|
+
if (receipt.workflow.certificateSan !== projectFinishAttestationReusableCertificateSan(receipt.workflow.reusable.sha)) {
|
|
77
|
+
return "signer";
|
|
78
|
+
}
|
|
79
|
+
const enrollmentMismatch = matchProjectFinishAttestationEnrollment(receipt, enrollment);
|
|
80
|
+
if (enrollmentMismatch === undefined)
|
|
81
|
+
return undefined;
|
|
82
|
+
return enrollmentMismatch.path === "enrollment.reusable-workflow" ? "signer" : "enrollment";
|
|
83
|
+
}
|
|
84
|
+
function classifyDiagnosticReason(diagnostics) {
|
|
85
|
+
for (const diagnostic of diagnostics) {
|
|
86
|
+
const reason = classifyDiagnosticPath(diagnostic.path);
|
|
87
|
+
if (reason !== undefined)
|
|
88
|
+
return reason;
|
|
89
|
+
}
|
|
90
|
+
return "unknown";
|
|
91
|
+
}
|
|
92
|
+
function classifyDiagnosticPath(path) {
|
|
93
|
+
if (path === "predicate.receipt.phVersion")
|
|
94
|
+
return "package-version";
|
|
95
|
+
if (path.startsWith("consumption."))
|
|
96
|
+
return "consumption";
|
|
97
|
+
if (path === "enrollment.reusable-workflow" || path === "predicate.receipt.workflow")
|
|
98
|
+
return "signer";
|
|
99
|
+
if (path.startsWith("enrollment."))
|
|
100
|
+
return "enrollment";
|
|
101
|
+
if (path === "source" || path === "workspace")
|
|
102
|
+
return "source";
|
|
103
|
+
if (path === "predicate.receipt.lifecycle")
|
|
104
|
+
return "freshness";
|
|
105
|
+
if (["archive", "artifact", "bundle", "evidence", "payload", "predicate", "subject"].includes(path))
|
|
106
|
+
return "artifact";
|
|
107
|
+
return undefined;
|
|
108
|
+
}
|
|
109
|
+
function assertNever(value) {
|
|
110
|
+
throw new Error(`authority-binding-state:${String(value)}`);
|
|
111
|
+
}
|
|
14
112
|
//# sourceMappingURL=authority-artifact-binding.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-artifact-binding.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-artifact-binding.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAMhG,OAAO,EAAE,8CAA8C,EAAE,MAAM,mDAAmD,CAAA;AAElH,MAAM,UAAU,+BAA+B,CAC7C,QAA2B,EAC3B,UAA+B,EAC/B,UAAsD;IAEtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,OAAO,UAAU,CAAC,iBAAiB;WAC9B,OAAO,KAAK,SAAS;WACrB,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;WAC/C,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;WAC3C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK;WAC1C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK;WACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;WACjH,uCAAuC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,SAAS,CAAA;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,iBAAiB;IACjB,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,aAAa;IACb,cAAc;IACd,SAAS;CACD,CAAA;AAIV,MAAM,UAAU,8BAA8B,CAC5C,QAA2B,EAC3B,UAA+B,EAC/B,UAAsD;IAEtD,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IAEjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACjF,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,aAAa,CAAA;IACvD,CAAC;IAED,OAAO,wBAAwB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA0D;IAE1D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,cAAc;YACjB,OAAO,QAAQ,CAAA;QACjB,KAAK,OAAO;YACV,OAAO,WAAW,CAAA;QACpB,KAAK,UAAU;YACb,OAAO,aAAa,CAAA;QACtB,KAAK,qBAAqB;YACxB,OAAO,QAAQ,CAAA;QACjB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB,CAAC;QACvB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB,CAAC;QACzB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,OAAO,cAAc,CAAA;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAA;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,kBAAkB,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,UAAU,CAAA;QACnB;YACE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,QAA2B,EAC3B,UAA+B,EAC/B,OAAwC;IAExC,IAAI,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,YAAY,CAAA;IACxE,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAA;IAChE,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACzG,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,kBAAkB,GAAG,uCAAuC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACvF,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtD,OAAO,kBAAkB,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAA;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAC/B,WAAkE;IAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,6BAA6B;QAAE,OAAO,iBAAiB,CAAA;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,aAAa,CAAA;IACzD,IAAI,IAAI,KAAK,8BAA8B,IAAI,IAAI,KAAK,4BAA4B;QAAE,OAAO,QAAQ,CAAA;IACrG,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,YAAY,CAAA;IACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAA;IAC9D,IAAI,IAAI,KAAK,6BAA6B;QAAE,OAAO,WAAW,CAAA;IAC9D,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAA;IACtH,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC7D,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { AuthorityBindingReason } from "./authority-artifact-binding.js";
|
|
1
2
|
import type { CliRunResult } from "./bearshell.js";
|
|
2
3
|
import type { GithubAuthorityFetchDiagnostic } from "./authority-fetch-worker.js";
|
|
3
4
|
export type AuthorityStatus = {
|
|
@@ -24,5 +25,5 @@ export declare function parseEnrollmentArgs(args: readonly string[]): {
|
|
|
24
25
|
export declare function textStatus(summary: AuthorityStatus, explain: boolean): CliRunResult;
|
|
25
26
|
export declare function jsonStatus(summary: AuthorityStatus): CliRunResult;
|
|
26
27
|
export declare function invalidAuthorityCommand(invocationName: string): CliRunResult;
|
|
27
|
-
export declare function blockedFetch(json: boolean, state: string, next?: AuthorityStatus["next"], diagnostic?: GithubAuthorityFetchDiagnostic): CliRunResult;
|
|
28
|
+
export declare function blockedFetch(json: boolean, state: string, next?: AuthorityStatus["next"], diagnostic?: GithubAuthorityFetchDiagnostic, bindingReason?: AuthorityBindingReason): CliRunResult;
|
|
28
29
|
export declare function githubAuthenticationRequired(): CliRunResult;
|
|
@@ -66,7 +66,7 @@ export function jsonStatus(summary) {
|
|
|
66
66
|
export function invalidAuthorityCommand(invocationName) {
|
|
67
67
|
return { status: 1, stdout: "", stderr: `${authorityUsage(invocationName)}\n` };
|
|
68
68
|
}
|
|
69
|
-
export function blockedFetch(json, state, next = "authority-fetch-github", diagnostic) {
|
|
69
|
+
export function blockedFetch(json, state, next = "authority-fetch-github", diagnostic, bindingReason) {
|
|
70
70
|
return {
|
|
71
71
|
status: 1,
|
|
72
72
|
stdout: json
|
|
@@ -74,11 +74,12 @@ export function blockedFetch(json, state, next = "authority-fetch-github", diagn
|
|
|
74
74
|
authorityEligible: false,
|
|
75
75
|
consumptionState: "not-applicable",
|
|
76
76
|
...(diagnostic === undefined ? {} : { diagnostic }),
|
|
77
|
+
...(bindingReason === undefined ? {} : { bindingReason }),
|
|
77
78
|
next,
|
|
78
|
-
schemaVersion: "consumer-authority-fetch.
|
|
79
|
+
schemaVersion: "consumer-authority-fetch.3",
|
|
79
80
|
state,
|
|
80
81
|
})}\n`
|
|
81
|
-
: `Consumer authority fetch: BLOCKED (${state})${diagnostic === undefined ? "" : `; diagnostic: ${diagnostic}`}. No evidence was retained or consumed.\n`,
|
|
82
|
+
: `Consumer authority fetch: BLOCKED (${state})${diagnostic === undefined ? "" : `; diagnostic: ${diagnostic}`}${bindingReason === undefined ? "" : `; binding reason: ${bindingReason}`}. No evidence was retained or consumed.\n`,
|
|
82
83
|
stderr: "",
|
|
83
84
|
};
|
|
84
85
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAmB3E,MAAM,UAAU,cAAc,CAAC,cAAc,GAAG,IAAI;IAClD,OAAO;QACL,UAAU,cAAc,oDAAoD;QAC5E,EAAE;QACF,WAAW;QACX,+FAA+F;QAC/F,oFAAoF;QACpF,sDAAsD;QACtD,6FAA6F;QAC7F,4CAA4C;QAC5C,wGAAwG;KACzG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACrE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC5F,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAA;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IAIzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAA;IAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,+BAA+B,CAAC;QACjD,kBAAkB,EAAE,YAAY;QAChC,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,cAAc,IAAI,EAAE;QACpC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,OAAgB;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE;YACN,eAAe,OAAO,CAAC,UAAU,EAAE;YACnC,0BAA0B,OAAO,CAAC,oBAAoB,EAAE;YACxD,uBAAuB,KAAK,EAAE;YAC9B,gBAAgB,OAAO,CAAC,gBAAgB,EAAE;YAC1C,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;SAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACnB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,6BAA6B,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI;QAC3F,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAsB;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAa,EACb,KAAa,EACb,OAAgC,wBAAwB,EACxD,UAA2C,EAC3C,aAAsC;IAEtC,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,KAAK;gBACxB,gBAAgB,EAAE,gBAAgB;gBAClC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,IAAI;gBACJ,aAAa,EAAE,4BAA4B;gBAC3C,KAAK;aACN,CAAC,IAAI;YACN,CAAC,CAAC,sCAAsC,KAAK,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,UAAU,EAAE,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,2CAA2C;QACrO,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,uIAAuI;KAChJ,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA6B,EAAE,OAAgB;IAC/D,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,OAAO;YAChD,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,qBAAqB,CAAA;IACzB,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,yBAAyB,CAAA;IAC3J,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,wBAAwB,CAAA;IAClJ,OAAO,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,iBAAiB,CAAA;AACzG,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;WAChB,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;WACjD,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAA;AACtE,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { writeAuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
|
-
import { matchesAuthorityArtifactBinding } from "./authority-artifact-binding.js";
|
|
2
|
+
import { classifyAuthorityBindingReason, matchesAuthorityArtifactBinding, } from "./authority-artifact-binding.js";
|
|
3
3
|
import { authorityEnrollmentFromReadback, readAuthorityEnrollments, writeAuthorityEnrollment, } from "./authority-enrollment.js";
|
|
4
4
|
import { readGithubAuthorityEnrollment } from "./authority-github-readback-worker.js";
|
|
5
5
|
import { fetchGithubAuthorityArtifact } from "./authority-fetch-worker.js";
|
|
@@ -90,7 +90,7 @@ function runFetch(args, options, invocationName) {
|
|
|
90
90
|
}
|
|
91
91
|
const assessment = (options.artifactInspector ?? inspectProjectFinishAttestationArtifact)(projectDir, enrollment, artifact.archive, options.now ?? new Date());
|
|
92
92
|
if (!matchesAuthorityArtifactBinding(artifact, enrollment, assessment)) {
|
|
93
|
-
return blockedFetch(parsed.json, "binding-mismatch");
|
|
93
|
+
return blockedFetch(parsed.json, "binding-mismatch", "authority-fetch-github", undefined, classifyAuthorityBindingReason(artifact, enrollment, assessment));
|
|
94
94
|
}
|
|
95
95
|
if (!writeAuthorityArtifact(artifact, options)) {
|
|
96
96
|
return blockedFetch(parsed.json, "binding-mismatch");
|
|
@@ -108,7 +108,7 @@ function runFetch(args, options, invocationName) {
|
|
|
108
108
|
},
|
|
109
109
|
consumptionState: assessment.consumptionState,
|
|
110
110
|
next: "workflow-finish",
|
|
111
|
-
schemaVersion: "consumer-authority-fetch.
|
|
111
|
+
schemaVersion: "consumer-authority-fetch.3",
|
|
112
112
|
state: "trusted",
|
|
113
113
|
})}\n`
|
|
114
114
|
: "Fetched and verified matching original public evidence. Artifact identity was retained. No completion authority was consumed.\n",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-command.js","sourceRoot":"","sources":["../../src/cli/authority-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAA;AAC9F,OAAO,
|
|
1
|
+
{"version":3,"file":"authority-command.js","sourceRoot":"","sources":["../../src/cli/authority-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,+BAA+B,EAE/B,wBAAwB,EACxB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,4BAA4B,EAC5B,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,UAAU,GAEX,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EACL,uCAAuC,GAExC,MAAM,0CAA0C,CAAA;AAiBjD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA;AAGlC,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,UAAmC,EAAE,EACrC,cAAc,GAAG,IAAI;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,aAAa,CACpB,IAAuB,EACvB,OAAgC,EAChC,cAAsB;IAEtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7F,OAAO,4BAA4B,EAAE,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,oEAAoE;SAC7E,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,CAChF,6BAA6B,CAC3B,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EACnC,cAAc,EACd,YAAY,EACZ,OAAO,CAAC,WAAW,CACpB,CAAC,CAAC,CACH,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,YAAY,CACpB,CAAA;IACD,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9G,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7I,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAA;IAC9H,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAA;IACzG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,iFAAiF;QACzF,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,OAAgC,EAAE,cAAsB;IACjG,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS;QACpD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC,CAAA;IACjF,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAChG,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACtD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,EAAE,qBAAqB,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS;QACjD,CAAC,CAAC,4BAA4B,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACtG,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAA;IACvF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;QAChF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,uCAAuC,CAAC,CACvF,UAAU,EACV,UAAU,EACV,QAAQ,CAAC,OAAO,EAChB,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAC1B,CAAA;IACD,IAAI,CAAC,+BAA+B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACvE,OAAO,YAAY,CACjB,MAAM,CAAC,IAAI,EACX,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CACjE,CAAA;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,MAAM,CAAC,IAAI;YACjB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ,CAAC,cAAc;oBAC/B,EAAE,EAAE,QAAQ,CAAC,UAAU;oBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC;gBACD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,4BAA4B;gBAC3C,KAAK,EAAE,SAAS;aACjB,CAAC,IAAI;YACN,CAAC,CAAC,iIAAiI;QACrI,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAmC,EAAE;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACtD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;IACtG,MAAM,mBAAmB,GAAG,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IACnG,IAAI,mBAAmB,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO;YACL,iBAAiB,EAAE,KAAK;YACxB,gBAAgB,EAAE,gBAAgB;YAClC,UAAU,EAAE,aAAa;YACzB,oBAAoB;YACpB,IAAI,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB;YAC9F,KAAK,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B;SACtG,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAA;IAClH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;YACrF,UAAU,EAAE,WAAW;YACvB,oBAAoB;YACpB,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,SAAS;SACjB,CAAA;IACH,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,gBAAgB;QAClC,UAAU,EAAE,WAAW;QACvB,oBAAoB;QACpB,IAAI,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB;QAC7F,KAAK,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B;KACvF,CAAA;AACH,CAAC"}
|
|
@@ -349,6 +349,13 @@ blocked and never convert package provenance into Finish authority.
|
|
|
349
349
|
Multiple enrollments require an explicit enrolled `owner/repository` argument
|
|
350
350
|
to `fetch github`; ambiguous selection performs no network request.
|
|
351
351
|
|
|
352
|
+
The public fetch JSON uses `consumer-authority-fetch.3`. A verifier block keeps
|
|
353
|
+
the public state `binding-mismatch` and may add only the fixed `bindingReason`
|
|
354
|
+
enum: `artifact`, `package-version`, `source`, `enrollment`, `run`, `signer`,
|
|
355
|
+
`freshness`, `consumption`, `verification`, or `unknown`. It never includes
|
|
356
|
+
diagnostic paths, receipt values, tokens, URLs, raw verifier output, or local
|
|
357
|
+
paths; Finish and replay behavior are unchanged.
|
|
358
|
+
|
|
352
359
|
## Live Trust Diagnostics
|
|
353
360
|
|
|
354
361
|
`ph doctor` performs a live, read-only Sigstore trust-root check with a
|