Repository navigation
Conversation
An epoch registered through POST /api/v1/config/epochs could never satisfy activation: every review and activation path was keyed to a rediscovered proposal manifest (ROADMAP CI-018). This adds one discriminated review subject to the proposal-review owner, reusing its one-use attestation, consumption, GitHub recheck and scope-lock mechanisms. ci-registered-epoch-attestation-start/v1 re-reads and re-admits the exact in-scope epoch that has a standalone registration receipt, and keeps target_missing, target_ineligible (no receipt, e.g. proposal-created) and source_mismatch distinct before provider work. It requires a complete, locally closed current-default-head inventory (owner decision D5) and binds source hash, revision, inventory digest, baseline, session, actor and profile to a cookie sealed under distinct associated data with an exact subjectKind key set; the callback dispatches by the cookie that opens and consumes only the registered-epoch pending relation. The callback rediscovers (stale on a moved head or changed inventory), re-checks the baseline and subject under the scope lock and retains an immutable review plus pair-owned audit naming the earliest standalone registrant (D7, no separation-of-duties rule). Review never changes the active pointer. ci-config-epoch-activation/v3 selects registeredEpochReviewOperationId and expectedSourceHash, re-loads receipt, baseline and subject, samples database time, rechecks GitHub permission and requires the exact reviewed revision and digest (provisional D4); evidence hash registered-epoch-activation-authority/v1 and audit config-epoch-activation-audit/v3. v1/v2 wire, audit bytes and replay are unchanged and cross-subject selectors conflict. Expand revision 20261011_0019 adds capability registered-epoch-review/v1 with registered_epoch_attestation_transactions and the immutable registered_epoch_reviews (existing review immutability routine), an exact catalog contract, result/runtime attestation and least-privilege grants (provisional D6). Proposal relations and cookie bytes are untouched, so no pending challenge is invalidated. OpenAPI and the generated client are regenerated; UI stays with CI-019 (provisional D9). Rollback (D8) is out of scope. Native PostgreSQL, unit, vitest and mutation witnesses are unexecuted locally and run only in GitHub CI; no provider, deployment or UI evidence is claimed.
iperev
force-pushed
the
feat/custom-epoch-review
branch
from
October 12, 2026 09:28
ce975fd to
ed3ccc3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
ROADMAP CI-018. An epoch registered through
POST /api/v1/config/epochscould never be activated, because review and activation were keyed to a rediscovered proposal manifest.What changed
ci-registered-epoch-attestation-start/v1. It re-admits the exact in-scope epoch that has a standalone registration receipt, and keepstarget_missing,target_ineligible,source_mismatch,blockedandstaledistinct. It binds source hash, earliest registrant, revision, inventory digest and baseline.subjectKind). Each subject consumes only its own pending table.ci-config-epoch-activation/v3, evidence hashregistered-epoch-activation-authority/v1, auditconfig-epoch-activation-audit/v3.20261011_0019with capabilityregistered-epoch-review/v1.Expected result
A reviewed registered epoch activates only through its own v3 selector, after a fresh GitHub recheck with the baseline and inventory unchanged. Proposal v1/v2 wire, audit bytes, replay, cookies and pending challenges are unchanged.
Non-claims:
Independent review: gpt-6-astra (xhigh); the fixture-clock finding was fixed. Owner decisions: D5/D7 binding; D4/D6/D9 provisional (2026-10-11). Rollback restriction D8 is delivered separately in #66. Note: the migration head moves to 20261011_0019.