{ "schema": "ghostget-claims-v2", "plan": "kb/plans/formal-verification-assurance.md", "notVerified": [ "Provider behaviour on third-party sites.", "Correctness of Bun, JavaScriptCore, the operating-system filesystem beyond the modelled `StatePort` semantics, WHATWG URL parsing (covered only differentially), GitHub, npm, Sigstore, and Vercel.", "Hostile in-process plugin code, which `AGENTS.md` already treats as trusted.", "Hostile processes running as the same user.", "Sentence-level coverage inside a guideline. A guideline counts as covered when its rule lists every claim that quotes it; a sentence of a covered guideline may still have no claim, and review of the guideline digest is the only check." ], "assumptions": [ { "id": "bun-runtime", "statement": "Bun and JavaScriptCore execute the sources and the test runner as specified." }, { "id": "filesystem-atomic-rename", "statement": "Same-volume rename and link are atomic." }, { "id": "filesystem-durability", "statement": "Data and directory entries that were fsynced persist across a crash or power loss." }, { "id": "same-user-trusted", "statement": "Processes running as the same operating-system user are trusted; file modes and owner-only sockets separate users." }, { "id": "process-liveness", "statement": "Process ID, process start time, and boot identity readings are truthful." }, { "id": "monotonic-clock", "statement": "The injected monotonic clock never runs backward." }, { "id": "whatwg-url", "statement": "Bun's URL parser implements the WHATWG URL Standard." }, { "id": "dns-tls", "statement": "The operating-system resolver and the TLS stack behave as specified." }, { "id": "sha256", "statement": "SHA-256 is collision resistant." }, { "id": "encryption", "statement": "The authenticated encryption primitives and the operating-system key storage are sound." }, { "id": "media-tools", "statement": "yt-dlp, ffmpeg, and whisper.cpp report metadata faithfully and honor the arguments they are given." }, { "id": "provider-behaviour", "statement": "Third-party providers behave as their observed contracts describe." }, { "id": "plugin-trusted", "statement": "Source plugins are trusted in-process code; portable execution contains ordinary failures, not hostile code." }, { "id": "onepassword", "statement": "The 1Password SDK and account return the requested secret faithfully." }, { "id": "github-api", "statement": "GitHub's REST, GraphQL, and Actions APIs report repository, run, and Release state truthfully." }, { "id": "github-enforcement", "statement": "GitHub enforces rulesets, environments, concurrency groups, immutable Releases, and token permissions as configured." }, { "id": "sigstore", "statement": "Sigstore and `gh attestation verify` verify attestation bundles correctly." }, { "id": "npm-registry", "statement": "The npm registry enforces version immutability, trusted publishing, and provenance as documented." }, { "id": "vercel", "statement": "Vercel builds and serves deployments as its project settings and APIs report." }, { "id": "administrator-readback", "statement": "A signed-in administrator performs the documented live readbacks and reports them faithfully." }, { "id": "ci-runner", "statement": "GitHub-hosted runners execute the reviewed workflow faithfully." }, { "id": "verification-tools", "statement": "The pinned Quint, Apalache, JDK, elan, and Lean releases are sound for the outcomes they report." }, { "id": "edge-runtime", "statement": "The Vercel Edge runtime implements the Web Platform APIs the edge code uses." } ], "guides": [ { "path": "AGENTS.md", "managedBlocks": [ { "name": "hraness-public-copy", "digest": "3bfebb2763dc564771dba1e3ceb04170fce994399b7e6e67437334cf99300cbf", "reason": "Synced Hraness public-copy policy for prose; it states no property of the package, CLI, website, or release." }, { "name": "hraness-articles", "digest": "0a072ea0c181dfdc8e2710f50d2baa4642deaf6e96b887dd988ae9882cc0a6bf", "reason": "Synced Hraness article policy for blog posts. website/blog.test.ts checks each post's review record, score, and provenance note and keeps non-indexable posts out of discovery; no automated check covers the prose rules." }, { "name": "hraness-delivery", "digest": "a4e0480f3225579f69f3098d42f490c0190b555b60bbfd45659cd2e179df14b0", "reason": "Synced Hraness delivery and workstation laws, including production-data preservation, runtime-enforced approvals, and delivery-gate guards; no automated check in this repository covers them." }, { "name": "hraness-ci", "digest": "1486c84e5fec6062e3c67d4a3509fab274467df31424a8ffc07dc38a900686cf", "reason": "Synced Hraness CI baseline for admission speed and the Required gate; it states no property of the package, CLI, website, or release." }, { "name": "hraness-releases", "digest": "405d2510c33ffd0c5944d2572319206fccaa9308c40b546f2c63e233ba4b92b9", "reason": "Synced Hraness release page standard. website/release-notes.test.ts checks the page shape, the changelog section failures, and the trailing identity record; the claim release-receipt-bot-and-body-prefix covers the publication readback." }, { "name": "algal-skills", "digest": "34d9d322ecc66cbc7608480876028b5dccde1f44631fc6f2198ba9c23d417cab", "reason": "Synced contributor tooling instructions for the algal skill pack; it states no property of the package, CLI, website, or release." } ] }, { "path": "edge/AGENTS.md", "managedBlocks": [] }, { "path": "src/control/AGENTS.md", "managedBlocks": [] }, { "path": "verification/AGENTS.md", "managedBlocks": [] }, { "path": "website/AGENTS.md", "managedBlocks": [] } ], "excludedGuides": [ { "prefix": ".agents/skills/", "reason": "Reusable repository-maintenance skill guides; they direct agent workflows and state no property of the package, CLI, website, or release." }, { "prefix": "kb/", "reason": "Knowledge-vault authoring guides; `bun run kb:check` validates the vault, and they state no product property." } ], "rules": [ { "guide": "AGENTS.md", "anchor": "Use Bun 1.3.14. Complete", "digest": "04a03c959fcac1804562b47803d63c414cf2507f1161d47b16b55486882d43c3", "claims": [ "ci-source-coverage-contract" ] }, { "guide": "AGENTS.md", "anchor": "CI covers the complete", "digest": "d44cdc0e8a4ce9b2e907f6f9007aa9e36eb9b39de6dcbc2ceb479e67d3d3e296", "claims": [ "ci-source-coverage-contract" ] }, { "guide": "AGENTS.md", "anchor": "Follow `WRITING.md` for", "digest": "01f533e4c8f504f9bf87d3965a3e80e16e3d833cdd4679bd221b8177fa78bf16", "exempt": "Prose style rule; it states no property of the package, CLI, website, or release." }, { "guide": "AGENTS.md", "anchor": "Apply unreasonably robust", "digest": "33436be55a1991b5a0abd77c672982730fd6ef8115b53a58ae89a3b58fed8912", "exempt": "Engineering method; the laws it asks for are claimed under the example-and-property and lifecycle-model rules." }, { "guide": "AGENTS.md", "anchor": "Deliver changes to", "digest": "d5ddd8b4c3aabff1ab590beea212f00054ef6f5f87df2b7bda8905ea3d1101c3", "claims": [ "protect-main-ruleset" ] }, { "guide": "AGENTS.md", "anchor": "Pin Hraness dependencies", "digest": "fea4cfb480cc3e2db31cf85a317dae6768025342556ee01442e5b5c29ce68c38", "claims": [ "hraness-deps-immutable-pins" ] }, { "guide": "AGENTS.md", "anchor": "Extract a shared", "digest": "0a6c062ce46c3d63971138aefb093fa5ce46faab0b0632f44aa0bf21edab9826", "exempt": "Package-extraction process rule; it states no property of shipped behaviour." }, { "guide": "AGENTS.md", "anchor": "For UI work, consume", "digest": "c797148100753b64a06d07c817723780770b44ee86ad9d98995e6f8472b054b5", "claims": [ "hraness-deps-immutable-pins" ] }, { "guide": "AGENTS.md", "anchor": "Freeze shared interfaces", "digest": "19c68a6f3179b717e43fea22bd8cb061ea77e2310599a63fd2e4544fcd019fdd", "exempt": "Parallel-work coordination rule for contributors; it states no property of shipped behaviour." }, { "guide": "AGENTS.md", "anchor": "Keep mandatory rules", "digest": "922413428d559a12875c06b57cf548fd9517d9ae965c247d84df8db54c4f1df5", "exempt": "Documentation placement rule; `bun run kb:check` validates guide shape." }, { "guide": "AGENTS.md", "anchor": "Keep Ghostget a bring-your-own-agent", "digest": "f1b0792d6bf160325b1f936c8e752944f739867334eaeac30a287744196855e7", "exempt": "Product-scope rule; no automated check covers it, and it states no safety or integrity property." }, { "guide": "AGENTS.md", "anchor": "Keep exactly one", "digest": "83595470b91701607d5b181c7bee58b076c35c1d43f322b32b17398849b11262", "exempt": "Skill-packaging rule; it states no safety or integrity property." }, { "guide": "AGENTS.md", "anchor": "Keep `website/` informational:", "digest": "4441f3ef230757117da50c0f5c425fadb1d4347a37e48c868dc28129fff18d64", "claims": [ "website-informational-only" ] }, { "guide": "AGENTS.md", "anchor": "Keep the package", "digest": "261ce9fd568f28911279f1155443465444ac9e0c8c714a2947a7b37a86b5e086", "claims": [ "package-root-import-inert" ] }, { "guide": "AGENTS.md", "anchor": "Expose bounded semantic", "digest": "4b89180c66920ab6af7d2e918f1f48af5d793739a0e5f24a6b19e7bf0a05504f", "claims": [ "no-caller-selected-raw-controls", "web-gateway-durable-audit-precedes-network", "web-gateway-pinned-transport", "web-gateway-policy-admitted-https-only" ] }, { "guide": "AGENTS.md", "anchor": "Keep media acquisition", "digest": "334727c4be56daed3f21d69bcde511551135ac72dbc52fcd66f289bc466d6cac", "claims": [ "media-promote-only-after-verification", "media-reject-drm-auth-bypass", "media-single-finite-item" ] }, { "guide": "AGENTS.md", "anchor": "Treat source plugins", "digest": "117b62a4830e03d385fa9c603a6c3cfbb66c2b577795db5841120cdd5861af15", "claims": [ "portable-host-capability-denial", "portable-plugin-explicit-trust" ] }, { "guide": "AGENTS.md", "anchor": "Parse every foreign", "digest": "ebb31571d51114853f2d48fceaa0ca82196cf3569f847ae92a5d5d914dacb6e4", "claims": [ "strict-foreign-parsing", "verification-itf-strict" ] }, { "guide": "AGENTS.md", "anchor": "Keep installed support", "digest": "08d7906185cff7a1a39e9301bb081325f3c6ac525e4e37822b86aed7383e7c05", "claims": [ "catalog-unique-ownership" ] }, { "guide": "AGENTS.md", "anchor": "Keep built-in durable", "digest": "e1355d1f0bb1fd466e68666ebf048d1afc87e9e30c3f1a58d9da01cf1bac2c0f", "claims": [ "contract-closure-lazy-revalidation", "contract-hash-environment-invariant", "portable-identity-artifact-bound" ] }, { "guide": "AGENTS.md", "anchor": "Bind every authenticated", "digest": "bb225298908cfc6cfdbd974226219eae3b4ef629a69ea69c9fe7ec1558fd9d9a", "claims": [ "auth-request-binding", "no-silent-transport-switch" ] }, { "guide": "AGENTS.md", "anchor": "Keep mutations behind", "digest": "f957eaa51a22b74513736ef0501807dac2b62d1e4a96994475843946c5a1c882", "claims": [ "confirmed-write-at-most-once", "indeterminate-cleared-only-by-evidence", "indeterminate-never-retried", "mutation-exact-preview-confirmation", "portable-retained-release" ] }, { "guide": "AGENTS.md", "anchor": "Keep raw authenticated", "digest": "b411993227481d73cec767f174f12b27bde314ee87354380111a3eb91dbd193c", "claims": [ "secrets-out-of-artifacts" ] }, { "guide": "AGENTS.md", "anchor": "Pair concrete behavior", "digest": "6010a3de6abb915c885ce7916f61cc7029f220347f2700b23022e7193f33ed24", "claims": [ "identifier-roundtrip" ] }, { "guide": "AGENTS.md", "anchor": "Model consequential lifecycle", "digest": "cbccd27b03f72885e2785c620ad75e079af93d02ffecda9092a506e2ade140fd", "claims": [ "lifecycle-injected-clocks", "property-seed-replay", "verification-shrink-promotion" ] }, { "guide": "AGENTS.md", "anchor": "Keep the Bun runner", "digest": "e725eff065f68cf5517187961cc9af8a240eb394efb7e7d370f238b92ce4add1", "claims": [ "runner-timeout-policy" ] }, { "guide": "AGENTS.md", "anchor": "Treat a checker timeout,", "digest": "27f3f1fb1faa0f8d523b2efd9703c277230892910615b16d515874d70ca389e4", "claims": [ "verification-inconclusive-not-evidence" ] }, { "guide": "AGENTS.md", "anchor": "Count a Quint model", "digest": "cf5c1582b8c29733c252c44ae1898005b671967142bd947fbd618b6f3fc650d4", "claims": [ "verification-model-replay-required", "verification-quint-smoke" ] }, { "guide": "AGENTS.md", "anchor": "Promote every recorded", "digest": "392cafa46eb2db0567c0390e0737063be6bf2da87486f45a9353f4f154d72753", "claims": [ "verification-shrink-promotion" ] }, { "guide": "AGENTS.md", "anchor": "Pin Quint, Apalache,", "digest": "3e03126462af081c8720140567274301d0f78312cfaa3799d0deff0ebb789edb", "claims": [ "verification-tools-pinned" ] }, { "guide": "AGENTS.md", "anchor": "When you add or change", "digest": "15c69c605f640fad53e29f515cd377e08ce6e9b622935fc01e7bd60eea2b81b1", "claims": [ "verification-claim-scope", "verification-register-complete" ] }, { "guide": "AGENTS.md", "anchor": "Treat this repository", "digest": "020865a99fea66baf8beda5b9f89b95c4bb9be854541554cc25e677c3421a33d", "exempt": "Editorial scope rule for repository prose; no automated check covers it." }, { "guide": "AGENTS.md", "anchor": "Follow `docs/publishing.md` for", "digest": "e033b8aae003ae5dc6c589b0eddecb51bd56f88a52e00ea82b15503a07dc45b6", "claims": [ "immutable-releases-enabled-before-tag", "npm-failure-never-blocks-canonical", "npm-failure-never-blocks-promotion", "npm-no-token-no-staged-no-dispatch", "npm-publish-after-canonical-only", "promotion-actions-read-single-read", "promotion-already-exact-no-credentials", "promotion-baseline-before-key-wait", "promotion-c-le-w-le-m", "promotion-manual-recovery-untrusted-tag", "promotion-run-id-from-receipt", "promotion-workflow-run-binding", "release-attest-checkout-free-reauthorized", "release-failed-jobs-rerun-recovers-publish", "release-five-file-contract", "release-tag-direct-lightweight", "release-workflow-isolation" ] }, { "guide": "AGENTS.md", "anchor": "Treat the Release", "digest": "a26e2705378a84214653ab0c2b8cebd4c9b6f1395faa9f2763fa7960bcc8b8dd", "claims": [ "mutable-presentation-not-authority" ] }, { "guide": "AGENTS.md", "anchor": "Keep the `npm-release`", "digest": "bcfec7c6fd743878ccdf6a8aa2df2a29ceb26ed19ce8d8a75fb12c2090d981d0", "claims": [ "npm-release-env-config", "npm-release-env-sole-reference", "npm-trusted-publisher-binding" ] }, { "guide": "AGENTS.md", "anchor": "A required fast-forward", "digest": "d319ce3952a7123dd4767a065b437aa16f5aec22571d83f4e7ca51e9c9c0e233", "claims": [ "promotion-canary-preserved", "promotion-candidate-status-history-clean", "promotion-deployment-ref-sha-binding", "promotion-helper-bound-to-production-ref", "promotion-leased-fast-forward-only", "promotion-observation-window", "promotion-revalidate-after-admission", "promotion-success-requires-stable-readbacks", "release-app-date-before-expiry", "release-app-env-scrubbed-from-gh", "release-app-permissions-exact", "release-app-rest-cap-fourteen", "release-app-revocation-receipt-semantics", "release-app-token-narrowed", "release-app-token-revoked-exactly-once", "website-baseline-marker-404-only-v0165", "website-marker-production-only", "website-marker-seven-key-canonical", "website-outcome-baseline-to-target-only", "website-www-exact-308" ] }, { "guide": "AGENTS.md", "anchor": "Before every stable", "digest": "6d2fca25bfc2c565fa820ebf33a76d6fea8a5b5b0086140edaa2834c00d479ed", "claims": [ "no-integration-tag-bypass", "production-branch-missing-is-hard-failure", "production-ref-lifecycle-ruleset", "production-ref-update-ruleset-app-only", "protect-main-ruleset", "tag-ruleset-creation-only", "tag-rulesets-two-split-pairs", "tag-ruleset-immutable", "vercel-project-config", "website-production-build-release-verified" ] }, { "guide": "AGENTS.md", "anchor": "An owner release", "digest": "cdbd3411cd40ef8f519acc94dac9981ce62d3dbdfea5870c8b142516f1bfb729", "exempt": "Delegation of owner authority to agents; it governs who acts, while the readback and tag claims cover what must hold." }, { "guide": "AGENTS.md", "anchor": "The retained proof", "digest": "65ed9a221b383b3dce10bf31f4508fe1d9b43462d4991be7cfbca334bb4f14d3", "claims": [ "control-drift-freezes-production", "production-writer-env-config" ] }, { "guide": "AGENTS.md", "anchor": "Bind every Release", "digest": "b365033a267079e63f0c8fb78b5a0674b73a5e14e31811b853c0ee7775d2dfcc", "claims": [ "release-reauthorize-attempt-before-checkout", "release-reauthorize-only-actions-read", "release-trigger-exact-tag-push-only" ] }, { "guide": "AGENTS.md", "anchor": "Before `publish_npm` sets", "digest": "d8434b598993f639c00e3c43c518e66c9407d6c29b476c7224efb8e292f4e6dc", "claims": [ "npm-admit-registry-identity-provenance", "npm-artifact-by-numeric-id-bound", "npm-clean-defaults-latest-tag", "npm-packed-manifest-publication-settings", "npm-reauthorize-before-oidc", "npm-registry-state-admission", "npm-reread-canonical-before-publish" ] }, { "guide": "AGENTS.md", "anchor": "The `@hraness/ghostget` npm", "digest": "6d2c9682861a9202860570f4d80bc9c883770419bf23f7550ea42711ef8d5a05", "claims": [ "npm-no-content-policy" ] }, { "guide": "AGENTS.md", "anchor": "A matching archive", "digest": "0a5f8c27d65bb7d71ddd7d1a9714f22a94d3662f5707413204fccfa5ddf45c27", "claims": [ "release-attestation-before-mutation" ] }, { "guide": "AGENTS.md", "anchor": "`costs.json` at the", "digest": "c44f8aec6f670f5c834b844c6341eb30e6bf6f1799bdf8d9cd3e2aa383bc846b", "claims": [ "cost-surface-registry" ] }, { "guide": "AGENTS.md", "anchor": "Bound every input", "digest": "308bafb0200b0b64ce578e6f0f3c7c003d11bc4611572d8abd0749cedba2cad1", "claims": [ "bounded-inputs" ] }, { "guide": "AGENTS.md", "anchor": "No writes on read", "digest": "9404228819ce247f0922561863a4f36f84cbe071fa0a6aa4d9ce43751cbb8d16", "claims": [ "menu-bar-snapshot-read-only", "no-writes-on-read-paths", "read-path-auth-check-read-only", "read-path-preparation-read-only", "read-path-read-capability", "read-projection-admission-exemption", "read-projection-key-exemption" ] }, { "guide": "AGENTS.md", "anchor": "`repair-signals` is a", "digest": "26580b332f602a30309d0b140bb5a19e0253a99c7e6a27ae4c759e100b774b9c", "claims": [ "repair-handoff-no-authority", "repair-inspection-no-demand", "repair-signals-private" ] }, { "guide": "AGENTS.md", "anchor": "Derived state is", "digest": "ca28b8a18860f357379e3011a62a0bf11d7faa76bd0278fd311d1128c8dbbda3", "claims": [ "derived-state-rebuildable" ] }, { "guide": "AGENTS.md", "anchor": "Every mutation carries", "digest": "9b3a925b95b4d8f64f3d4ae75a647846875507a358c44b68e963186094a17be9", "claims": [ "mutation-idempotency-key" ] }, { "guide": "AGENTS.md", "anchor": "Analytics and metering", "digest": "2fac5cdd5fe9d2a772bb68388b3acd53267f7b1c7ac7270525d93db88621c5ba", "claims": [ "analytics-allowlist-byte-ceiling" ] }, { "guide": "AGENTS.md", "anchor": "Content bytes live", "digest": "a3ea1cbb18b40da26bd6a6d1205008169a1a3d4946164f7d02df7fbe0a194ec2", "claims": [ "content-bytes-in-content-store" ] }, { "guide": "AGENTS.md", "anchor": "Run `bun run check:cost-surfaces`", "digest": "a1dcb08ead7a301c9d4829f1306f0cd6ddf6ebdfaba0598a862d17c1cfa77384", "claims": [ "cost-surface-registry" ] }, { "guide": "edge/AGENTS.md", "anchor": "Keep every file here", "digest": "1edc6f655fecadcfd37968e69e4c35a3af5e9285e1ec15da36bf39c4e7db44f8", "claims": [ "edge-no-node-imports" ] }, { "guide": "edge/AGENTS.md", "anchor": "Honor Accept q-values,", "digest": "02842091349ded955e9e928eff4c60a197549350603be428d18a7d6d658ee8e2", "claims": [ "edge-accept-406-only-when-empty", "edge-vary-accept" ] }, { "guide": "edge/AGENTS.md", "anchor": "Unknown document paths", "digest": "da952cf175678f6b368df4e330979aa50e3f296fac9ac3539b6be2b1f1f791d2", "claims": [ "edge-unknown-404" ] }, { "guide": "src/control/AGENTS.md", "anchor": "`protocol.ts` is the", "digest": "a431428d58ae42c7e5ac0e4e194433a1aeb0018c78f28df250056dd96e169236", "claims": [ "agent-channel-cannot-escalate", "control-protocol-bounded-reject-drift", "control-single-helper-owner", "tui-input-cannot-bypass-review", "tui-restores-terminal-state" ] }, { "guide": "src/control/AGENTS.md", "anchor": "`service.ts` composes current", "digest": "60f389510d09bd2f7b66bb5f9d1b2ae54d0c53aae913b53a33b69874426e581f", "claims": [ "no-cached-authorization-across-change", "openapi-inert-until-activation" ] }, { "guide": "src/control/AGENTS.md", "anchor": "`web-policy.ts`, `web-gateway.ts` and", "digest": "726925ec349b40d8a7d9d6c26f61d1bee5b65923f8bd4efb4e51b80285abe591", "claims": [ "gateway-activity-excludes-sensitive", "gateway-rejects-private-addresses", "web-gateway-durable-audit-precedes-network", "web-gateway-pinned-transport" ] }, { "guide": "src/control/AGENTS.md", "anchor": "The credential helper", "digest": "6e5b310c0e552462f2483ffde335b8971a7014725250b4b7cca216b9930b867d", "claims": [ "credential-helper-fixed-sink", "credential-publish-exact-staged-bytes", "shutdown-settles-before-custody-release" ] }, { "guide": "verification/AGENTS.md", "anchor": "Keep this directory,", "digest": "609e4c4ac2427b7bffde96c908965bd068666564ef4671499121d6d51da43be3", "claims": [ "verification-unpublished" ] }, { "guide": "verification/AGENTS.md", "anchor": "Change a claim together", "digest": "d91d8ac6b98ea18adcb8ea17dcdf69c0827c040a524ddfe12517436dab7a1d19", "claims": [ "verification-claim-scope" ] }, { "guide": "verification/AGENTS.md", "anchor": "Record every Quint", "digest": "f30a2b9a673543fabbefc671aee75168540ee5d7e01cc8e96ee3e9c4df778305", "claims": [ "verification-model-replay-required" ] }, { "guide": "verification/AGENTS.md", "anchor": "Give a Quint model `nightly`", "digest": "dba8a285d34fd63e049ad92b6075c24df1f8fd46afb57658a0772ccaa653ac9a", "claims": [ "verification-nightly-depth" ] }, { "guide": "verification/AGENTS.md", "anchor": "List every reducer source", "digest": "52bcb0843fe0e9d8ae90b373dda3b5130c5a3e3f443b686fbdce2d4861a4192f", "claims": [ "verification-source-mutants" ] }, { "guide": "verification/AGENTS.md", "anchor": "Keep the Lean project", "digest": "e6cafc5d709902a85345bd4212e0f83b9ddb360f831c6bb272c0ee9037e95c2b", "claims": [ "verification-lean-trusted-base" ] }, { "guide": "verification/AGENTS.md", "anchor": "Keep generated traces,", "digest": "d34fe5068d3f632120be811005a6545778e06ab543fef1b32126f785956977cd", "claims": [ "verification-unpublished" ] }, { "guide": "verification/AGENTS.md", "anchor": "Run every fast-check", "digest": "7df39d14c30575c4c00960e03d5f2074b31616bb0d6ae954c317e7f3a2a3cac1", "claims": [ "property-seed-replay", "verification-shrink-promotion" ] }, { "guide": "verification/AGENTS.md", "anchor": "For a soak,", "digest": "dae3bb8431187d1cb2e3842e7c2cdab6fe9324e55d8f876b611e29abecfb15cf", "claims": [ "property-soak-multiplier" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep the homepage's", "digest": "8a8f7aaac953809f5388fcbadd7be6f065a8143fab37ab3eaa17f3b17836c3b0", "exempt": "Presentation rule for the informational website; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Give ordinary HTML", "digest": "c3da9eac5f0a18427cf042100214fc9151f26fa8f6b42170c960487d10c76018", "exempt": "Presentation rule for the informational website; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Keep the page useful", "digest": "06f62cdf536a9556d356b62f6aacbc237f8e69deeb1c2962ad8c45ceb28648d8", "exempt": "Presentation rule for the informational website; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Keep every product", "digest": "b724aa34d496cfce87d638c2b9b1b9f86ce66cfd3ed1c8e37e0a930e3cb2af2c", "exempt": "Editorial accuracy rule for website copy; no automated check covers it." }, { "guide": "website/AGENTS.md", "anchor": "Derive release identity", "digest": "596d63d7d1165351776479ad9e333d68f8005d4c4ef89c414d9bf5e8f44b053c", "claims": [ "website-release-identity-from-package" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep the Agent Skill", "digest": "72a871d8cb23e0674100f47fc8944b9a8ebf916fac583471f22f6ed24abfd95f", "claims": [ "website-release-identity-from-package" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep the checked-in", "digest": "6f5a905e59ab787cda64eba32f7dc5ebfb777ce494770df0ba87e829989d6fa5", "claims": [ "preview-builds-independent", "release-app-env-scrubbed-from-gh", "release-app-token-revoked-exactly-once", "vercel-build-admission-fail-closed", "website-baseline-marker-404-only-v0165", "website-marker-production-only", "website-marker-seven-key-canonical", "website-outcome-baseline-to-target-only", "website-production-build-release-verified", "website-www-exact-308" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep Vercel project", "digest": "3556af9782bc2f6ba313b626e5ce3ace379204b6f52e19a149cac99bfba7edf7", "claims": [ "vercel-project-config", "website-no-vercel-mutation-in-workflows" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep reviewed workflow", "digest": "1c4902dba4af6e9181984fa84e79bf0b11dbfb8f4c45915637e1dafedf810edf", "claims": [ "promotion-c-le-w-le-m" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep the App and", "digest": "b57b01df4810593ea139fbfc710122f5bf645c965290f688e0bfed19f4b7bb1b", "claims": [ "production-writer-env-config", "release-app-permissions-exact", "release-app-token-narrowed" ] }, { "guide": "website/AGENTS.md", "anchor": "The retained proof", "digest": "1f3db8f820b167ef1689cc954ff2acf7e138c1831f2a889a7f3fa3f18f4d82a9", "claims": [ "control-drift-freezes-production" ] }, { "guide": "website/AGENTS.md", "anchor": "Require a production", "digest": "4aa64de7d37c4b9a01b5078283e2fe5c4ccf065cc215b3dc03e6f796d9662a95", "claims": [ "website-production-build-release-verified" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep canonical metadata,", "digest": "3b3f0c5251dcd711b6251cb4eb34659144cc43a9decd0b03b601bd77f3acd91a", "exempt": "Search-metadata presentation rule; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Keep ordinary reference", "digest": "565a9105cb81bd4643ec63da534bf4efebbb4506d1a519638a05f56797818b63", "exempt": "Presentation rule for website guides and editorial images; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "The HTML 404 renders", "digest": "c34425a70895c13e96541c1283f008b887acf1aeb5c5b848209ca84c603964d9", "exempt": "Presentation rule for the informational website; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Public content pages", "digest": "8a064dd611e5b50e576beda80d2208546bcc3dcc0a7f559e7536620032f5a0bd", "claims": [ "edge-accept-406-only-when-empty", "edge-unknown-404", "edge-vary-accept" ] }, { "guide": "website/AGENTS.md", "anchor": "Keep analytics canonical-host-only,", "digest": "d51d95d61a935f65d2fe9c6a3bf5aa2673a98f5ec058964447d74b26b3772369", "claims": [ "analytics-allowlist-byte-ceiling" ] }, { "guide": "website/AGENTS.md", "anchor": "Do not add private", "digest": "4efd0e5d5c57d95a78e23dec31eb90723e5dc579c71386fdbe4cc976bb1ac365", "claims": [ "analytics-allowlist-byte-ceiling" ] }, { "guide": "website/AGENTS.md", "anchor": "Preserve semantic headings,", "digest": "283268b644f8710c0a1a910f1b40dc181980c07d351fca610841630b52e6e339", "exempt": "Accessibility presentation rule; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Public copy (page", "digest": "5f77956c52f5a40f202d481b25d7529cbefa19022d4cb81ffd47fbfb6525a42d", "exempt": "Public-copy style rule; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "The one-line description", "digest": "64ad7bf406ca14b012c23afe88c89b17afe5b1fa096fed0424b08c3d836978fb", "exempt": "Public-copy consistency rule that the website build enforces; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "On a public page,", "digest": "4c1a10f0703d28481d287727610bef9ab34ddcf11128354375ccca04ba28b424", "exempt": "Public-copy vocabulary rule; it states no safety or integrity property." }, { "guide": "website/AGENTS.md", "anchor": "Describe a sibling", "digest": "4468c62b7a209654a1325a23ce6414b6e30651525d5bc3ad37973d7ec8727d21", "exempt": "Editorial accuracy rule for sibling-product copy; no automated check covers it." }, { "guide": "website/AGENTS.md", "anchor": "Use product names", "digest": "5829232f1c6c88cdf2259303167e1d0eaaad10479faa043eb9b4c70e2afc6834", "exempt": "Public-copy naming rule; it states no safety or integrity property." } ], "claims": [ { "id": "package-root-import-inert", "statement": "Importing the package root `@hraness/ghostget` does not start the CLI, inspect local state, load built-in providers, or access the network.", "area": "runtime", "source": { "path": "AGENTS.md", "quote": "Keep the package root import side-effect-free. Importing `@hraness/ghostget` must not start the CLI, inspect local state, load built-in providers, or access the network." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/package-smoke.ts", "src/cli.test.ts", "src/contracts.test.ts" ], "assumptions": [ "bun-runtime" ], "notVerified": [ "Only the enumerated example cases are checked.", "The package smoke guards filesystem, HTTP, DNS, socket, and fetch entry points while it imports the packed root; it does not intercept child processes or environment reads." ] }, { "id": "runner-timeout-policy", "statement": "Bun runner timeout and concurrency live only in package.json; no test calls setDefaultTimeout or passes per-test runner timeouts.", "area": "runtime", "source": { "path": "AGENTS.md", "quote": "Keep the Bun runner timeout and concurrency policy in `package.json`; test bodies" }, "layer": "example", "status": "evidenced", "evidence": [ "src/test-harness-policy.test.ts" ], "assumptions": [ "bun-runtime" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "property-seed-replay", "statement": "Every fast-check property runs through assertProperty or assertAsyncProperty, so GHOSTGET_PROPERTY_SEED and GHOSTGET_PROPERTY_PATH replay, the seed corpus, and the soak multiplier apply; no other fast-check runner appears outside test-support.", "area": "runtime", "source": { "path": "AGENTS.md", "quote": "retain fast-check's seed and shrink path. Replay one exact property with `GHOSTGET_PROPERTY_SEED`, `GHOSTGET_PROPERTY_PATH`" }, "layer": "example", "status": "evidenced", "evidence": [ "src/test-harness-policy.test.ts", "src/test-support.test.ts" ], "assumptions": [ "bun-runtime" ], "notVerified": [ "The policy scan is static: it follows fast-check's default, namespace, and named imports, the `fc` re-export of `test-support`, and dynamic loads by literal specifier, but not a runner reached through another module's re-export or a computed member name.", "It covers `src/`, `scripts/`, `edge/`, and `website/`; tests elsewhere are not scanned." ], "alsoQuotes": [ { "path": "verification/AGENTS.md", "quote": "Run every fast-check property through `assertProperty` or `assertAsyncProperty` from `src/test-support.ts`" } ] }, { "id": "property-soak-multiplier", "statement": "GHOSTGET_PROPERTY_RUNS accepts only a canonical integer from 1 to 100 and multiplies every helper-run property's run count and interruption budget, including seed corpus replays.", "area": "verification", "source": { "path": "verification/AGENTS.md", "quote": "For a soak, set `GHOSTGET_PROPERTY_RUNS` to an integer from 1 to 100." }, "layer": "example", "status": "evidenced", "evidence": [ "src/test-support.test.ts" ], "assumptions": [ "bun-runtime" ], "notVerified": [ "No nightly workflow runs the soak yet; the multiplier is checked only in a child process at multiplier 3.", "The soak's runner timeout is set on its command line, so a soak that outgrows it fails as a runner timeout rather than a property failure." ] }, { "id": "lifecycle-injected-clocks", "statement": "Consequential lifecycle reducers take injected clocks and randomness; wall-clock jumps cannot extend or prematurely expire leases or proofs.", "area": "runtime", "source": { "path": "AGENTS.md", "quote": "keep clocks and randomness injected" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/control/approval-broker-clock.model.test.ts", "src/control/approval-broker.test.ts", "src/control/gateway.test.ts", "src/effect-architecture.test.ts", "src/linked-device-lifecycle-journal.property.test.ts" ], "assumptions": [ "bun-runtime", "monotonic-clock" ], "notVerified": [ "The stateful model covers the approval broker's pending requests and allow-once grants: their expiry follows only the injected monotonic clock across wall-clock jumps of up to ten days either way, applied to both the injected wall clock and the ambient `Date.now()`. Other lifecycle reducers, such as the portable plugin invocation leases and the linked-device lifecycle journal, are not modelled under clock jumps; they rely on their example and property tests and on the effect-architecture rule that rejects ambient clocks and randomness in checked modules.", "The default monotonic clock is `performance.now()`; the model injects it and does not check that the platform clock is itself monotonic, which is the `monotonic-clock` assumption.", "Injected randomness is covered only by the effect-architecture ambient-random rule, not by a model." ], "properties": [ { "path": "src/control/approval-broker-clock.model.test.ts", "test": "property: pending requests and allow-once grants expire by the injected monotonic clock alone, whatever the wall clock does" } ] }, { "id": "no-caller-selected-raw-controls", "statement": "No semantic provider operation or gateway call accepts caller-selected provider headers, cookies, selectors, scripts, shell commands, or arbitrary file paths; such inputs are rejected before any provider I/O.", "area": "providers", "source": { "path": "AGENTS.md", "quote": "Never add caller-selected provider headers, cookies, selectors, scripts, shell commands, or arbitrary file access." }, "layer": "example", "status": "evidenced", "evidence": [ "src/client-boundary.test.ts", "src/model.test.ts", "src/provider-plugin-host.test.ts", "src/runtime.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "web-gateway-policy-admitted-https-only", "statement": "The public web gateway dispatches only bounded HTTPS GET and HEAD retrieval requests that the web policy admits, with no request body and no ambient authentication.", "area": "web-gateway", "source": { "path": "AGENTS.md", "quote": "The separate public web gateway accepts only explicitly policy-admitted HTTPS retrieval URLs" }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/gateway.test.ts", "src/control/interface-cli.test.ts", "src/control/validation.test.ts", "src/operation-permission.property.test.ts" ], "assumptions": [ "filesystem-durability", "whatwg-url", "dns-tls" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "web-policy-deny-dominates", "statement": "Web policy decision is default-deny; deny beats ask beats allow, adding a deny rule never widens the result, and domain/path/query-key prefix matching is exact.", "area": "web-gateway", "source": { "path": "SECURITY.md", "quote": "under explicit domain, path, and query-key rules" }, "layer": "lean", "status": "evidenced", "evidence": [ "verification/lean/GhostgetVerification/WebPolicy.lean", "verification/lean/Differential.lean", "scripts/verification-lean-oracle.ts", "scripts/verification-lean-web-policy.test.ts", "src/control/gateway.test.ts", "src/control/validation.test.ts" ], "assumptions": [ "filesystem-durability", "whatwg-url", "dns-tls" ], "notVerified": [ "The Lean model covers the decision, the limits, and rule matching in checkWebRequest over parsed rules and an already parsed URL. WHATWG URL parsing, publicUrl, parseWebRule, and DNS and TLS are assumptions, not proofs.", "Strings are modelled as lists of characters. That equals the production UTF-16 startsWith only because parseWebRule and publicUrl admit ASCII origins, paths, and query keys; the proof does not check that admission.", "The differential test runs the unchanged web-policy.ts over an in-memory private state store, not the real store and its helper. It samples three origins, one a string prefix of another, three path segments, and four query keys, so it checks only its generated cases." ] }, { "id": "web-gateway-pinned-transport", "statement": "Gateway retrieval uses the pinned transport: one validated DNS address, redirects disabled, revocation/cancellation rechecked after DNS before dispatch, and no retry to another address after an ambiguous transport failure.", "area": "web-gateway", "source": { "path": "AGENTS.md", "quote": "through its pinned transport and durable audit boundary." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/gateway.test.ts", "src/pinned-https.test.ts" ], "assumptions": [ "filesystem-durability", "whatwg-url", "dns-tls" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "src/control/AGENTS.md", "quote": "no redirects or ambient credentials" } ] }, { "id": "gateway-rejects-private-addresses", "statement": "The gateway rejects private, loopback, and other non-public addresses (including IPv4-mapped IPv6) after resolution.", "area": "web-gateway", "source": { "path": "SECURITY.md", "quote": "private addresses" }, "layer": "differential", "status": "evidenced", "evidence": [ "src/public-address.ts", "src/public-address.test.ts", "src/pinned-https.test.ts", "src/control/validation.test.ts", "verification/vectors/generate.py", "verification/vectors/addresses.json", "scripts/verification-vectors.test.ts" ], "assumptions": [ "filesystem-durability", "whatwg-url", "dns-tls" ], "notVerified": [ "The pinned transport checks every resolved answer with Ghostget's own allowlist, `src/public-address.ts`, because the `@hraness/kb` 0.19.6 resolver admits the IPv4-translated range `::ffff:0:0:0/96`, the rest of `::/8`, IPv6 outside `2000::/3`, and `192.88.99.0/24` (`kb/plans/kb-ip-classifier-proposal.md`). The kb check still runs first, so its over-blocking of `192.0.0.0/16` still refuses those addresses.", "The Python generator restates the same IANA special-purpose table from the registries, independently of the TypeScript, and compares verdicts on block edges, seeded random addresses, embedded IPv4 forms, and text forms. A row missing from both tables would not be caught; the vectors check the implementation of the table, not the table against the live registries.", "Page capture, derivation, and the derivation network proxy (`src/browser.ts`, `src/derive.ts`, `src/model.ts`, `src/derivation-network-proxy.ts`) still rely on the kb classifier alone; this claim covers the gateway's pinned transport only.", "DNS answers, the operating system's socket layer, and TLS are assumed; the check covers the address the transport connects to, not routing beyond it." ], "alsoQuotes": [ { "path": "src/control/AGENTS.md", "quote": "public pinned DNS" } ] }, { "id": "public-url-matches-url-crate-oracle", "statement": "`publicUrl` makes the same admission decision as an independent reading of the web gateway URL policy over the Rust `url` crate, and every URL that either side admits parses to the same WHATWG components.", "area": "web-gateway", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "a `url`-crate differential for `publicUrl`" }, "layer": "differential", "status": "evidenced", "evidence": [ "verification/oracles/src/url_policy.rs", "scripts/verification-oracles.test.ts" ], "assumptions": [ "whatwg-url" ], "notVerified": [ "URL candidates come from a sampled grammar plus named examples; this is not a proof over all strings.", "The oracle restates the written policy, so a rule that the policy text and the implementation both omit goes unnoticed.", "Known parser differences are named in the test and checked to leave the gateway refusing the input: Bun percent-encodes `^` in paths and the `url` crate 2.5.8 does not; Bun accepts an IPv6 literal such as `[::1:]` and drops the leading `/.` from a non-special path such as `m:/.a`; and the `url` crate keeps a drive-letter segment such as `c:` before `..` in an https: path.", "Address classification after DNS resolution is a separate claim, `gateway-rejects-private-addresses`." ] }, { "id": "web-gateway-durable-audit-precedes-network", "statement": "A durable audit record exists before any gateway network dispatch, and a failed final audit, revocation, redirect, or oversized body withholds output; crash recovery preserves unknown requests without retrying them.", "area": "web-gateway", "source": { "path": "AGENTS.md", "quote": "through its pinned transport and durable audit boundary." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/control/web-gateway.ts", "src/control/activity.ts", "src/control/web-gateway.property.test.ts", "src/control/gateway.test.ts" ], "assumptions": [ "filesystem-durability", "whatwg-url", "dns-tls" ], "notVerified": [ "The model drives the production `WebGateway`, `ActivityStore` and `ApprovalBroker` on a real state home, with a scripted `GatewayTransport` in place of DNS, TLS and sockets. That the pinned transport itself connects only to the address it checked is covered by `gateway-rejects-private-addresses` and its tests, not by this model.", "A crash is modelled as abandoning the in-flight call and reopening the store in the same process; a real process death between the SQLite commit and the socket write rests on SQLite's commit durability, under the filesystem-durability assumption.", "The model samples its schedules: CI runs 15 schedules of up to 8 requests over twelve scenarios." ], "alsoQuotes": [ { "path": "src/control/AGENTS.md", "quote": "durable metadata before dispatch" } ], "properties": [ { "path": "src/control/web-gateway.property.test.ts", "test": "property: gateway output and network dispatch follow a committed durable audit row, and recovery never retries" } ] }, { "id": "gateway-activity-excludes-sensitive", "statement": "Gateway activity storage never contains request bodies, query values or strings, secrets, response bodies, raw transport errors, or a URL digest.", "area": "web-gateway", "source": { "path": "src/control/AGENTS.md", "quote": "Request bodies, query values, secrets, response bodies and raw transport errors must not enter activity storage." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/gateway.test.ts" ], "assumptions": [ "filesystem-durability", "whatwg-url", "dns-tls" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "gateway-only-mode-restricts-routing", "statement": "A state home in gateway-only mode restricts Ghostget command routing to policy-admitted operations; contracts catalog/check/repair are unavailable and capabilities report the reduced surface.", "area": "web-gateway", "source": { "path": "SECURITY.md", "quote": "Gateway-only mode restricts Ghostget command routing" }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/interface-cli.test.ts", "src/control/menubar-cli.test.ts", "src/storage-state-home.test.ts" ], "assumptions": [ "filesystem-durability", "same-user-trusted", "whatwg-url", "dns-tls" ], "notVerified": [ "Only the enumerated example cases are checked.", "Gateway-only mode is not an operating-system network sandbox; a same-user process can bypass the application policy." ] }, { "id": "agent-channel-cannot-escalate", "statement": "Requests on the owner-only agent socket cannot grant approvals, alter policy or permissions, connect accounts, import credentials, or resolve secrets.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Agent requests cannot grant approvals, alter policy, connect accounts, or resolve secrets." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/approval-broker.test.ts", "src/control/helper-lifecycle.test.ts", "src/control/validation.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "control-protocol-bounded-reject-drift", "statement": "Administrative and agent control protocols are bounded and reject unknown fields, unsupported methods, oversized or malformed frames, and nested contract drift before dispatch.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Keep both protocols bounded and reject drift before dispatch." }, "layer": "property", "status": "evidenced", "evidence": [ "src/control/helper-client.test.ts", "src/control/validation.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/control/helper-client.test.ts", "test": "helper rejects malformed envelopes and nested contract drift" }, { "path": "src/control/validation.test.ts", "test": "strict parsers reject every generated unknown key" } ] }, { "id": "tui-input-cannot-bypass-review", "statement": "Terminal input, including pasted or unbracketed bursts, cannot issue confirmation or approval without the complete account and exact revision/digest review being displayed.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Terminal input, including pasted text, must never bypass that review." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/tui.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "tui-restores-terminal-state", "statement": "The TUI restores terminal state (raw mode, cursor, alternate screen) before waiting for helper cancellation and custody settlement, including on failure and signals.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Restore terminal state before waiting for helper cancellation and custody settlement." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/tui.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "managed-policy-corrupt-denies", "statement": "Once operation permissions are enabled, a missing or corrupt policy denies access and never falls back to unmanaged behaviour.", "area": "control", "source": { "path": "SECURITY.md", "quote": "Enabling operation permissions establishes a persistent managed marker: missing or corrupt policy then denies access." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/policy-privacy.test.ts", "src/operation-permission.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "openapi-inert-until-activation", "statement": "User OpenAPI documents remain inert drafts until exact conditional activation and never create arbitrary (authenticated) HTTP executors.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "User OpenAPI documents remain inert until exact conditional activation and never create arbitrary HTTP executors." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/interface-cli.test.ts", "src/control/interfaces.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "credential-helper-fixed-sink", "statement": "The credential helper has one fixed 1Password X-token sink; SDK loading and raw credential material stay in that process and never reach the renderer, agent protocol, or diagnostics.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "The credential helper has one fixed 1Password X-token sink. Keep SDK loading and raw credential material in that process" }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/vault-cli.test.ts", "src/control/vault.test.ts" ], "assumptions": [ "same-user-trusted", "onepassword" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "credential-publish-exact-staged-bytes", "statement": "Credential publication re-verifies the exact staged bytes and account revision; changed or BOM-prefixed bytes are not published.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Verify exact staged bytes and account revision again at publication." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/vault.test.ts" ], "assumptions": [ "same-user-trusted", "onepassword" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "control-single-helper-owner", "statement": "The menu and TUI share exactly one helper owner per state home; a second controller does not acquire custody.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "The menu and TUI share one helper owner per state home." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/control/helper.ts", "src/control/helper-owner.property.test.ts", "src/control/helper-client.test.ts", "src/control/helper-lifecycle.test.ts", "src/control/tui.test.ts" ], "assumptions": [ "same-user-trusted", "filesystem-durability" ], "notVerified": [ "The model drives the production owner record (`inspectControlOwner` and `commitControlOwner`) in one process. Process liveness is a fake that the model controls, so `processOwnerStatus`'s own inspection of real processes is outside it; its tests are in `src/process-identity.test.ts`.", "Contenders interleave only between inspection and commit. That two separate processes cannot both win the create-if-absent or compare-and-swap write rests on the storage layer's exclusive create and locked replace, under the filesystem-durability assumption.", "That the menu and the TUI reach the one helper through its socket, rather than starting their own, rests on the listed example tests only.", "The model samples its schedules: CI runs 30 schedules of up to 20 commands over three contenders." ], "properties": [ { "path": "src/control/helper-owner.property.test.ts", "test": "property: at most one live contender holds helper custody across inspect and commit races, crashes, restarts, and unknown owners" } ] }, { "id": "no-cached-authorization-across-change", "statement": "Authorization is never cached across a changed account, policy, interface, or executable closure; an A-to-B-to-A account change invalidates grants and previewed plans.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Display optimizations must not cache authorization across a changed account, policy, interface or executable closure." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/control/account-revision.test.ts", "src/control/connections.test.ts", "src/operation-authority.property.test.ts", "src/operation-permission.test.ts", "src/operation-permission.ts", "src/runtime.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "The model covers one provider-API account: the bundled X interface with `posts.read` and `posts.publish`, on a real state home with a counting executor in place of the provider. Web-session, local CLI, linked-device, portable-plugin and messaging-composite routes share `validateFreshPlan` and the permission layer but rest on the listed example tests.", "A closure or contract change is simulated by registries whose `implementationClosureHash` or `contractImplementationHash` differ within one process; a real upgrade that loads a different registry in a new process is not modelled.", "The display path, `describeOperationPermissions` with its snapshot-local reuse, is checked only by the listed example tests; the model checks that execution never uses authorization from before a change.", "`ask` is modelled without a human answer, so it never dispatches; the approval broker's own binding is `approvals.qnt`'s.", "The model samples its schedules: CI runs 2 schedules of up to 8 commands, and the nightly soak runs 20 times as many. Each command spawns the bound state helper for every state operation, so a schedule costs tens of seconds." ], "properties": [ { "path": "src/operation-authority.property.test.ts", "test": "property: authority never outlives a change of account incarnation, realm, interface, closure, contract or policy" } ] }, { "id": "grant-binds-exact-identity", "statement": "Operation grants bind the exact account incarnation, manifest, contract, and executable closure; a change to any of them, or a changed approval, invalidates the prior grant.", "area": "control", "source": { "path": "SECURITY.md", "quote": "Grants bind the exact account incarnation, manifest, contract, and executable closure. A changed account, interface, implementation, or approval invalidates the prior grant." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/control/approval-broker.test.ts", "src/operation-authority.property.test.ts", "src/operation-permission.test.ts", "src/operation-permission.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "This claim was planned for a Quint model. It is evidenced instead by a stateful model over the production permission layer, which checks after every grant that the capability digest is equal for the same exact identity and distinct from every digest of another identity, and that preparation, reads and confirmations follow only the policy of the current identity.", "The model covers one provider-API account: the bundled X interface with `posts.read` and `posts.publish`, on a real state home with a counting executor in place of the provider. Web-session, local CLI, linked-device, portable-plugin and messaging-composite routes share `validateFreshPlan` and the permission layer but rest on the listed example tests.", "The contract axis changes the contract implementation identity that `providerContractHash` folds in; a changed contract definition or version reaches the digest through the installed manifest, which the model varies only by display name.", "A changed approval is modelled as a changed policy entry (allow, ask or deny) for the current identity; a human approval answered through the broker is not modelled here.", "The model samples its schedules: CI runs 2 schedules of up to 8 commands, and the nightly soak runs 20 times as many. Each command spawns the bound state helper for every state operation, so a schedule costs tens of seconds." ], "properties": [ { "path": "src/operation-authority.property.test.ts", "test": "property: authority never outlives a change of account incarnation, realm, interface, closure, contract or policy" } ] }, { "id": "approval-allow-once", "statement": "An allow-once approval admits one exact pending request at most once (allowed implies uses ≤ 1), including across client crash, expiry, and reconnect; drift, expiry, and shutdown revoke proofs.", "area": "control", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Model digest binding at dispatch, lease expiry, crash, and reconnect. The invariant `allowed ⇒ uses ≤ 1` drives the fix for D13." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-approvals-replay.test.ts", "src/control/approval-broker.test.ts", "src/control/connections.test.ts", "verification/quint/approvals.qnt" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "verification/quint/approvals.qnt checks one request, two holders and an anonymous caller, with at most two crashes and two policy changes per trace, to Quint simulation depth 20 and Apalache length 10. Its ITF replay drives the production ApprovalBroker with 1,000 traces of up to 30 steps. Longer schedules, more requests, and more callers are sampled only by the fast-check model in src/control/approval-broker.test.ts.", "The model covers the broker alone. Connection reconnect, dispatch digest binding outside the broker, and control-service shutdown are covered only by the listed example tests.", "Plan defect D13 is fixed: the broker binds each allow-once grant to its holder's use secret at request or first allowed check. The Quint variants stepShared, stepFirstCheck and stepAdmitBeforeAwait reproduce the pre-fix defects, and the replay shows the production broker refuses each of their violating traces." ] }, { "id": "shutdown-settles-before-custody-release", "statement": "Connection and helper shutdown settle owned work before custody is released.", "area": "control", "source": { "path": "src/control/AGENTS.md", "quote": "Connection and helper shutdown must settle owned work before custody is released." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/control/helper.ts", "src/control/connections.ts", "src/control/helper-shutdown.property.test.ts", "src/control/connections.test.ts", "src/control/helper-lifecycle.test.ts" ], "assumptions": [ "same-user-trusted" ], "notVerified": [ "The helper model drives the production shutdown sequencer, `settleHelperShutdown`, with the steps `runControlHelper` passes it replaced by recorders over a set of in-flight requests. That `runControlHelper` passes the real steps and tracks every request in its active set rests on reading it and on `src/control/helper-lifecycle.test.ts`, which starts and stops the real helper.", "The wait covers requests in flight when shutdown begins. Clients are disconnected first, so no socket request can start later; a native stdio frame arriving after shutdown began is not modelled.", "A request that never settles holds shutdown open. Provider calls end when the service's shutdown signal aborts them; a call that ignores its signal is outside the model.", "The connection model drives the production `Connections` class with a fake sign-in probe; real browser sign-in and provider verifiers are outside it.", "The models sample their schedules: CI runs 200 helper schedules of up to 14 commands and 12 connection schedules of up to 8 commands over two attempts." ], "properties": [ { "path": "src/control/helper-shutdown.property.test.ts", "test": "property: helper shutdown settles every in-flight request before closing the service and releases the owner once, last" }, { "path": "src/control/helper-shutdown.property.test.ts", "test": "property: closing connections aborts sign-in so no verification or commit survives shutdown" } ] }, { "id": "media-single-finite-item", "statement": "Media acquisition admits exactly one finite item and rejects playlists/collections and live or non-finite streams.", "area": "media", "source": { "path": "AGENTS.md", "quote": "Keep media acquisition to one authorized, accessible, finite, non-DRM item. Reject playlists, live streams" }, "layer": "example", "status": "evidenced", "evidence": [ "src/media/archive.test.ts", "src/media/args.test.ts", "src/media/metadata.property.test.ts", "src/media/metadata.test.ts", "src/media/source-router.property.test.ts", "src/media/yt-dlp.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "Only the enumerated example cases are checked.", "Probe and capture are separate yt-dlp calls, and capture does not recheck live or DRM status." ] }, { "id": "media-reject-drm-auth-bypass", "statement": "Media acquisition rejects affirmative DRM, unsupported authentication, and access-control bypasses, and Ghostget never supplies decryption keys or bypass flags to media tools.", "area": "media", "source": { "path": "AGENTS.md", "quote": "affirmative DRM, unsupported authentication, and access-control bypasses." }, "layer": "example", "status": "evidenced", "evidence": [ "src/media/archive.test.ts", "src/media/metadata.test.ts", "src/media/yt-dlp.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "media-promote-only-after-verification", "statement": "A media item is promoted only after its inspectable archive, versioned manifest, and SHA-256 records pass complete verification; a revision chain has exactly one head.", "area": "media", "source": { "path": "AGENTS.md", "quote": "Promote an item only after its inspectable archive, versioned manifest, and SHA-256 records pass complete verification." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-media-replay.test.ts", "src/media/archive.property.test.ts", "src/media/archive.test.ts", "src/media/lock.test.ts", "src/media/manifest.property.test.ts", "src/media/manifest.test.ts", "src/media/revision.property.test.ts", "verification/quint/media.qnt" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "verification/quint/media.qnt checks promotedVerified (no revision is promoted without passing closed verification of its staged item) with the other media invariants to Quint simulation depth 12 over 3,000 samples and Apalache length 8. Its ITF replay drives production mediaUrl on the yt-dlp pipeline for 300 traces and runs the real verifyMediaItem on every revision the model calls ok after every step. The stepUnverified variant violates promotedVerified, and a replay whose staged verification answers success diverges at the first failing capture.", "The model has one kind of capture that fails verification: an unrecorded file beside a derivative. Hash mismatches, manifest version and schema faults, and archive layout faults reach promotion only through the same verifyMediaItem call and are covered by the listed manifest and archive tests, which check only their enumerated or sampled cases.", "The direct HTTP pipeline verifies its staged item through the same call but is not replayed against the model; only its example tests apply.", "\"Exactly one head\" is checked as the replay reads it: the lineage is the sequence-ordered revision leaves on disk and the head is the last. The model's noPromotionWithoutLock and noForeignRevision show that only the lock holder's own staged item is renamed into the lineage; unique sequence-numbered leaves that bind their predecessor rest on the listed revision tests." ] }, { "id": "media-crash-lineage-progress", "statement": "Each capture subject has one revision lineage with a single head, and a crash or power loss during staging or promotion never leaves that lineage permanently invalid.", "area": "media", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "The progress property \"a crash never makes a lineage permanently invalid\" drives D10." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-media-replay.test.ts", "src/media/archive.property.test.ts", "src/media/archive.test.ts", "src/media/lock.test.ts", "src/media/manifest-durability.test.ts", "src/media/quarantine.test.ts", "src/media/revision.property.test.ts", "src/media/revision.test.ts", "verification/quint/media.qnt" ], "assumptions": [ "filesystem-atomic-rename", "filesystem-durability", "process-liveness", "media-tools" ], "notVerified": [ "Progress is checked as a safety invariant, not as liveness under fairness. verification/quint/media.qnt's lineageRecoverable says a crash or power loss damages a lineage only by tearing a revision, a torn revision never sits below the head, and discovery never answers invalid for a lineage whose only damage is a torn revision; the next locked start quarantines a torn head and recaptures, which the ITF replay drives through production mediaUrl for 300 traces. promotedDurable says every promotion flushed the staged tree and the revision parent before the rename and the revision and staging parents after it, and the replay derives each revision's flag from the flushes production made.", "The stepNoSync variant (promotion without the flushes, as before D10) violates promotedDurable and lineageRecoverable, and stepNoRepair (a torn head answered invalid, as before D10) violates lineageRecoverable. Deleting production's post-rename flush of the revision parent makes the replay diverge.", "Power loss is modelled, not observed: the model tears the head at any time and an older revision only when its promotion was not flushed, so a drive that acknowledges a flush it does not keep is outside the model. F_FULLFSYNC runs in the macOS CI job; on Linux and on filesystems that refuse it, the flush falls back to fsync, which gives no drive-cache guarantee.", "Plan defect D10 is fixed: the staging tree and its parent directories are fsynced before and after the promotion rename, and a start that finds a torn head moves it to the quarantine instead of stopping the lineage.", "Repair quarantines at most one torn head per capture; the direct pipeline promotes durably but does not repair a torn head, and it is not replayed against the model.", "Quarantined revisions stay until their owner removes them; `ghostget media quarantine` lists them and removes nothing." ] }, { "id": "media-lock-exclusion", "statement": "Media item locks exclude concurrent owners; release never removes a replacement lock and final publication is an atomic same-volume rename.", "area": "media", "source": { "path": "SECURITY.md", "quote": "Media locks coordinate Ghostget processes, and final publication uses an atomic same-volume rename." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-media-replay.test.ts", "src/media/lock.test.ts", "verification/quint/media.qnt" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted", "process-liveness", "media-tools" ], "notVerified": [ "verification/quint/media.qnt checks two processes on one revision lineage to Quint simulation depth 12 and Apalache length 8. Its noPromotionWithoutLock invariant restates the guard at the rename, so the checkers show only that the unfenced variant breaks it; noForeignRevision is the lock law the model derives, and the replay is what binds the guard to production. Its ITF replay drives production mediaUrl and the item lock with 300 traces in one test process, not the plan's 1,000: on the CI runner 1,000 traces took 159 seconds and pushed the verification step to 13.6 minutes. In the replay, runs interleave at the capture and flush gates, a crash rewrites the lock to a dead PID, and heartbeat loss is an aged lock file. Truly concurrent processes, other filesystems, and network volumes are not exercised.", "The atomicity of a same-volume rename is an assumption (filesystem-atomic-rename), not a checked property.", "Plan defect D11 is fixed: promotion renames only through the lock's fence, which checks the token and inode immediately before the rename, and a stale heartbeat is reclaimable even when its PID answers. The Quint variant stepUnfenced reproduces the unfenced rename, and the replay shows production refuses each of its violating traces." ] }, { "id": "media-cancellation-stops-work", "statement": "Cancelling a media acquisition stops every process it started, including ffmpeg and HLS grandchildren; a cancellation that arrives before promotion prevents a `created` result, both pipelines discard staging on every error, and when Ghostget exits or receives an unhandled SIGINT, SIGTERM, or SIGHUP it kills every active media process group.", "area": "media", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "D9: spawn in a process group and kill the group. Check cancellation before promotion." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-media-replay.test.ts", "src/media/archive.test.ts", "src/media/process-group.test.ts", "src/media/process-parent-exit.test.ts", "src/media/process.test.ts", "verification/quint/media.qnt" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "Only the enumerated example cases are checked; the grouped-termination property samples scripted exit points, not every signal interleaving.", "A SIGKILL of Ghostget itself, or a kernel or power failure, runs no exit handler, so a detached media tool group can outlive it.", "A signal Ghostget inherited as ignored, such as SIGHUP under nohup, stays ignored, so the group keeps running until Ghostget exits for another reason.", "The group kill reaches only processes that stay in the tool's process group; a helper that calls setsid() or setpgid() leaves the group and is not stopped.", "On Windows media tools run without a process group, so only the direct child is signalled.", "Plan defect D9 is fixed: yt-dlp runs in its own process group and cancellation signals the group, and the promotion fence checks cancellation immediately before the rename. verification/quint/media.qnt checks that a cancelled yt-dlp capture never answers created, its stepLateCancel variant reproduces the pre-fix promotion, and its replay drives production mediaUrl. The direct HTTP pipeline and grandchild process termination are not modelled." ] }, { "id": "media-verify-recomputes-hashes", "statement": "`ghostget verify` recomputes SHA-256 records and detects later archive changes.", "area": "media", "source": { "path": "SECURITY.md", "quote": "SHA-256 records that `ghostget verify` recomputes" }, "layer": "example", "status": "evidenced", "evidence": [ "src/media/archive.test.ts", "src/media/cli.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "media-no-shell-no-ambient-config", "statement": "Media tools are invoked with an argv array without a shell, and ambient yt-dlp configuration is ignored unless explicitly selected.", "area": "media", "source": { "path": "SECURITY.md", "quote": "Ghostget invokes media tools without a shell, ignores ambient yt-dlp configuration unless the user explicitly selects that mode" }, "layer": "example", "status": "evidenced", "evidence": [ "src/media/args.test.ts", "src/media/process.test.ts", "src/media/yt-dlp.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "media-no-persist-transport-secrets", "statement": "Media archives never persist cookies, request headers, signed media URLs, raw yt-dlp metadata, or transport fragments; diagnostics redact URL paths and credentials.", "area": "media", "source": { "path": "SECURITY.md", "quote": "does not persist cookies, request headers, signed media URLs, raw yt-dlp metadata, or transport fragments" }, "layer": "example", "status": "evidenced", "evidence": [ "src/media/archive.test.ts", "src/media/metadata.test.ts", "src/media/process.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "direct-media-fixed-role-names", "statement": "The direct-media adapter reads a bounded range, identifies media from bytes, and stores fixed role names rather than URL basenames.", "area": "media", "source": { "path": "SECURITY.md", "quote": "It reads a bounded range, identifies media from bytes, and stores fixed role names instead of URL basenames." }, "layer": "property", "status": "evidenced", "evidence": [ "src/media/archive.property.test.ts", "src/media/http-capture.test.ts", "src/media/http-probe.property.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/media/http-probe.property.test.ts", "test": "property: chunk partitioning cannot hide bytes beyond the probe declaration" }, { "path": "src/media/archive.property.test.ts", "test": "property: opaque raw IDs never enter archive or focused path segments" } ] }, { "id": "transcription-setup-no-download", "statement": "Local transcription setup never downloads whisper.cpp, its model, or libraries, and rechecks the selected executable, model, and observable runtime closure.", "area": "media", "source": { "path": "SECURITY.md", "quote": "Ghostget records and rechecks the selected executable, model, and observable non-platform runtime closure" }, "layer": "example", "status": "evidenced", "evidence": [ "src/media/local-transcription.test.ts", "src/media/runtime-closure.test.ts", "src/media/transcriber-config.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "media-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "portable-plugin-explicit-trust", "statement": "Portable plugin code executes only after an explicit trust decision bound to the exact verified content-addressed bundle; `plugin check` never executes plugin code.", "area": "plugins", "source": { "path": "AGENTS.md", "quote": "require an explicit trust decision for the exact verified bundle." }, "layer": "example", "status": "evidenced", "evidence": [ "src/args.test.ts", "src/provider-plugin-lifecycle.test.ts", "src/provider-plugin-package.test.ts", "src/provider-plugin-store.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "portable-host-capability-denial", "statement": "The portable child-process host denies undeclared capabilities, foreign origins, and out-of-bound results, and executes only the verified runtime bytes even if the installed path is rewritten.", "area": "plugins", "source": { "path": "AGENTS.md", "quote": "Treat portable child-process execution as ordinary-failure containment" }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-host.test.ts", "src/provider-plugin-portable-runtime.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "catalog-unique-ownership", "statement": "The validated active catalog rejects duplicate plugin, route, or operation ownership, independent of insertion order, before any command can use it.", "area": "plugins", "source": { "path": "AGENTS.md", "quote": "Reject duplicate plugin, route, or operation ownership before a command can use it." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contracts-catalog.test.ts", "src/operation-permission.property.test.ts", "src/platform-catalog.property.test.ts", "src/provider-plugin-portable-registry.test.ts", "src/provider-plugin-registry.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "contract-hash-environment-invariant", "statement": "Built-in durable contract hashes are versioned and identical across package layout and execution environment.", "area": "plugins", "source": { "path": "AGENTS.md", "quote": "Keep built-in durable contract hashes versioned and invariant across package layout and execution environment." }, "layer": "example", "status": "evidenced", "evidence": [ "src/model.test.ts", "src/provider-plugin-package.test.ts", "src/provider-plugin-registry.test.ts", "src/web-session-contracts.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked.", "Nothing forces a contract version bump when the source closure changes." ] }, { "id": "contract-closure-lazy-revalidation", "statement": "The source/dependency closure is derived automatically, snapshotted at registry startup, and revalidated before and after lazy runtime load; a changed closure is rejected rather than executed.", "area": "plugins", "source": { "path": "AGENTS.md", "quote": "Derive the exact current source/dependency closure automatically, snapshot it at registry startup, and revalidate it before and after lazy runtime load" }, "layer": "example", "status": "evidenced", "evidence": [ "src/beeper-local-plugin.test.ts", "src/provider-plugin-registry.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked.", "Revalidation compares disk bytes under a single-writer assumption, so an A→B→A edit between the checks passes." ] }, { "id": "portable-identity-artifact-bound", "statement": "Portable-plugin identity is bound to its exact verified artifact; artifact tampering changes identity separately from the logical descriptor, and identity extensions are rejected.", "area": "plugins", "source": { "path": "AGENTS.md", "quote": "Portable-plugin identity must remain bound to its exact verified artifact." }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-portable-identity.test.ts", "src/provider-plugin-portable-registry.test.ts", "src/recovery.test.ts", "src/run-journal.property.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "plugin-lifecycle-serialized", "statement": "Plugin update, disable, and removal are refused while the old bundle still owns live or unknown work (invocation leases, confirmations, run journals, recovery capsules, linked-device lifecycles).", "area": "plugins", "source": { "path": "docs/plugins.md", "quote": "Ghostget refuses a transition while the old bundle still owns live or unknown work." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/provider-plugin-invocation-lease.property.test.ts", "src/provider-plugin-invocation-lease.test.ts", "src/provider-plugin-lifecycle-kernel.test.ts", "src/provider-plugin-portable-runtime.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "The stateful model drives `inspectPortableProviderPluginQuiescence`, the check that update, disable, and removal call, through injected listings of up to 24 generated steps over two bundles: invocation leases with a live, dead, or unknown owner, confirmation plans and claims, run journals (active, released, retaining recovery, or holding assets), run receipts, recovery capsules, linked-device lifecycles, malformed entries of each kind, and an unexpected state entry. The listings are the model's own, so how the real stores list and parse those files is covered only by their tests.", "That the store calls this check under its catalog lock before each transition, and leaves the activation unchanged when it throws, is covered only by the named example tests in src/provider-plugin-portable-runtime.test.ts, for a live invocation lease, a cleanup-unsafe lease, and a confirmation plan.", "Work that starts between the check and the store's commit is excluded only by the store's lock and each work kind's own admission; no model covers that interleaving." ], "properties": [ { "path": "src/provider-plugin-lifecycle-kernel.test.ts", "test": "a bundle may change exactly when it owns no live or unknown work" } ] }, { "id": "portable-pack-reproducible", "statement": "`plugin pack` verifies the fixed file set and produces reproducible, relocation-stable bytes; undeclared files are refused.", "area": "plugins", "source": { "path": "docs/plugins.md", "quote": "`pack` verifies the fixed file set and produces reproducible bytes." }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-lifecycle.test.ts", "src/provider-plugin-package.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "portable-no-ambient-authority", "statement": "Portable plugins receive no shell, package manager, ambient environment, raw auth locator, unrestricted filesystem, redirect, automatic retry, or caller-chosen network primitive; native code and undeclared module imports are rejected.", "area": "plugins", "source": { "path": "docs/plugins.md", "quote": "It receives no shell, package manager, ambient environment, raw auth locator" }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-host.test.ts", "src/provider-plugin-import-analysis.test.ts", "src/provider-plugin-module-analysis.test.ts", "src/provider-plugin-package.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "portable-session-material-sinks", "statement": "Cookie material is bound only to a cookie jar and OAuth material only to the Authorization header, for exact-origin HTTPS with bounded bodies.", "area": "plugins", "source": { "path": "docs/plugins.md", "quote": "opaque cookie material bound only to a cookie jar and OAuth material bound only to the Authorization header" }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-auth.test.ts", "src/provider-plugin-host.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "portable-state-cas", "statement": "Versioned namespaced plugin state supports exact-byte compare-and-exchange so overlapping invocations cannot silently overwrite each other.", "area": "plugins", "source": { "path": "docs/plugins.md", "quote": "Namespaced state supports exact-byte compare-and-exchange." }, "layer": "property", "status": "evidenced", "evidence": [ "src/provider-plugin-portable-runtime.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/provider-plugin-portable-runtime.test.ts", "test": "compare-exchange prevents concurrent lost updates and stale deletes" } ] }, { "id": "portable-cannot-declare-local-cli", "statement": "Portable protocol v1 packages cannot declare the local-cli transport or request native process authority.", "area": "plugins", "source": { "path": "docs/local-cli-providers.md", "quote": "Portable plugin protocol v1 cannot declare `local-cli`." }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-package.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "cleanup-unsafe-irreversible", "statement": "Once a cleanup barrier is marked unsafe, later native proof cannot reverse that settlement or release durable admission.", "area": "plugins", "source": { "path": "docs/effect-read-runtime.md", "quote": "once it marks a barrier unsafe, later native proof cannot reverse that settlement or release the durable admission" }, "layer": "example", "status": "evidenced", "evidence": [ "src/provider-plugin-cleanup-barrier.test.ts", "src/web-session-cleanup-admission.test.ts" ], "assumptions": [ "plugin-trusted" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "strict-foreign-parsing", "statement": "Every foreign manifest, package, message, plan, receipt, response, and CLI value is parsed from `unknown` and rejects extra fields, malformed bounds, accessors, non-plain prototypes, ambiguous ownership, smuggled keys, and drift.", "area": "parsing", "source": { "path": "AGENTS.md", "quote": "Parse every foreign manifest, package, message, plan, receipt, response, and CLI value from `unknown`; reject extra fields, malformed bounds, ambiguous ownership, and drift." }, "layer": "property", "status": "evidenced", "evidence": [ "src/browser-admission.property.test.ts", "src/contracts-check.test.ts", "src/contracts-shape.test.ts", "src/control/validation.test.ts", "src/linked-device-lifecycle-journal.property.test.ts", "src/local-cli-tool-identity.test.ts", "src/provider-plugin-portable.property.test.ts", "src/run-journal.property.test.ts" ], "assumptions": [], "notVerified": [ "Key-set checks inside browser-injected script text run in the foreign page’s context and cannot import the shared helper; they are kept self-contained and are outside this AST-scanned rule (their bytes feed contract hashes, which pin them).", "The lint guards the equality-compare shape in non-test TypeScript under src/; a local exactKeys variant in local-cli-tool-identity.ts keeps its optional-key semantics, and the injected hasExactKeys dependency in confirmed-write-platform.ts is a separately owned local implementation." ], "properties": [ { "path": "src/contracts-shape.test.ts", "test": "property: matches exact key-set equality on arbitrary key sets" }, { "path": "src/contracts-shape.test.ts", "test": "property: an unsupported key at any object path is rejected by the parser and the schema" } ] }, { "id": "read-result-proto-roundtrip", "statement": "An own `__proto__` key in foreign JSON stays visible to exact-key parsing, and `parseInvokeReadResult` round-trips any JSON output, including objects with an own `__proto__` key.", "area": "parsing", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "D6: fix the `__proto__` round trip and promote seed 455347073 to a named test." }, "layer": "property", "status": "evidenced", "evidence": [ "src/browser-admission.property.test.ts", "src/contracts-invoke-read.test.ts", "src/contracts-shape.test.ts", "src/provider-plugin-registry-semantic.test.ts" ], "assumptions": [], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/contracts-invoke-read.test.ts", "test": "property: bounded arbitrary outputs round-trip; an unsupported key at any envelope path is rejected" } ] }, { "id": "contracts-schema-parser-agree", "statement": "Contract JSON Schemas are generated from the same shape table as the parsers; parser and schema agree on arbitrary values and reject every unsupported key.", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "The schema is generated from the same shape table the parser uses, so the two cannot drift." }, "layer": "property", "status": "evidenced", "evidence": [ "src/contracts-schema.test.ts", "src/contracts-shape.test.ts" ], "assumptions": [], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/contracts-shape.test.ts", "test": "property: valid documents round-trip and validate; parse and schema agree on arbitrary values" }, { "path": "src/contracts-shape.test.ts", "test": "property: an unsupported key at any object path is rejected by the parser and the schema" } ] }, { "id": "contracts-inspection-read-only", "statement": "Catalog, check, schema, and repair inspection never bind an account or contact a provider.", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "Catalog, check, schema, and repair inspection are read-only projections. They never bind an account or contact a provider." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contracts-check.test.ts", "src/contracts-cli.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "public-authority-code-owned", "statement": "An operation is public only when it is an observed, dispatch-free, built-in R1 web-session read declaring access public; manifests cannot opt into public execution.", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "A web-session operation is `public` only when" }, "layer": "example", "status": "evidenced", "evidence": [ "src/contracts-catalog.test.ts", "src/web-session-authentication-policy.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "collection-plan-read-only-bounded", "statement": "collection-plan.v1 requires risk R1 and sideEffect none and enforces bounds (64 accounts, 8 reads per account, 128 total, 16 metric keys, delay ≤ 600000 ms, input ≤ 32 keys depth 8, canonical credential-free target URLs).", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "`semantics.risk` must be `R1` and `semantics.sideEffect` must be `none`; v1 plans are read-only by construction." }, "layer": "property", "status": "evidenced", "evidence": [ "src/contracts-plan.test.ts" ], "assumptions": [], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/contracts-plan.test.ts", "test": "property: generated plans round-trip through JSON, flatten in order, and validate against the schema" }, { "path": "src/contracts-plan.test.ts", "test": "property: every parser rejection of a generated mutation is a schema violation or a documented semantic rule" } ] }, { "id": "contract-check-single-gap", "statement": "Each checked read reports at most one gap chosen by the fixed precedence; reads has exactly plan.reads indexed entries and ok is true exactly when every verdict is ok.", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "Each read reports at most one gap, chosen in this order" }, "layer": "property", "status": "evidenced", "evidence": [ "src/contracts-check.test.ts" ], "assumptions": [], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/contracts-check.test.ts", "test": "property: checking is deterministic and idempotent and never leaves the closed gap set" }, { "path": "src/contracts-check.test.ts", "test": "property: reads derived from the catalog bind ok with the exact installed contract" } ] }, { "id": "invoke-read-envelope-consistency", "statement": "R1 invoke envelopes are consistent: receipt status/runId equal top-level fields, cache outcome matches status, failed results have null output and a readFailure whose disposition matches its category, output bounded to depth 64 and 4,000,000 nodes.", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "Invoke result: `receipt.status` and `receipt.runId` equal the top-level fields" }, "layer": "example", "status": "evidenced", "evidence": [ "src/contracts-invoke-read.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "read-failure-disposition-table", "statement": "Read failure retry dispositions come from one closed table (retry-once-after-60s, repair-auth, grant-permission, do-not-retry).", "area": "contracts", "source": { "path": "docs/contracts.md", "quote": "`readFailureDispositions` exports the same closed table." }, "layer": "example", "status": "evidenced", "evidence": [ "src/ghostget.test.ts", "src/providers/read-failure.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "read-runtime-zero-dispatch", "statement": "R1 reads store a provisional receipt before execution, accept only zero-dispatch outcomes, and store the final receipt before returning output.", "area": "contracts", "source": { "path": "docs/effect-read-runtime.md", "quote": "`readInvocationProgram` stores the provisional receipt before starting execution. It accepts only zero-dispatch success or failure" }, "layer": "example", "status": "evidenced", "evidence": [ "src/read-client.test.ts", "src/read-effect.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "canonical-json-injective", "statement": "canonicalJson over plain JSON (null, booleans, safe integers, strings of UTF-16 code units, arrays, and objects with distinct keys) is injective up to member order, gives the same text for any member insertion order, and never writes a NUL code unit; its UTF-16 code-unit key order is total and locale-independent.", "area": "encoding", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Canonical JSON over an inductive `Json` with UTF-16 key order: the encoder is injective, parse-then-encode is the identity on canonical output, and key order is total." }, "layer": "lean", "status": "evidenced", "evidence": [ "scripts/verification-lean-encodings.test.ts", "src/canonical-json.test.ts", "src/local-cli-surface-contract.test.ts", "src/model.test.ts", "verification/lean/GhostgetVerification/Encodings/CanonicalJson.lean", "verification/lean/GhostgetVerification/Encodings/CanonicalJsonProofs.lean" ], "assumptions": [ "bun-runtime", "verification-tools" ], "notVerified": [ "The Lean theorems are about a Lean model of the encoder. The differential test checks that the TypeScript agrees with that model on generated values, not on every value.", "Parse-then-encode being the identity on canonical output is not proved.", "Numbers are modelled as safe integers only; fractions, exponents, and the JavaScript engine's number formatting are not modelled.", "The model starts from a plain JSON value. The TypeScript checks that reject undefined members, cycles, symbols, getters, and non-plain objects are not modelled." ] }, { "id": "canonical-json-rejects-non-json", "statement": "`canonicalJson` rejects sparse arrays, non-plain prototypes (Map, Date, typed arrays), accessors, and symbols rather than emitting invalid or colliding output.", "area": "encoding", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "D5: make `canonicalJson` reject non-plain prototypes, sparse arrays, accessors, and symbols" }, "layer": "property", "status": "evidenced", "evidence": [ "src/canonical-json.test.ts", "src/client-boundary.test.ts" ], "assumptions": [], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/canonical-json.test.ts", "test": "property: every value fast-check can build encodes exactly when it is in the JSON domain" }, { "path": "src/canonical-json.test.ts", "test": "property: a domain violation at any nesting depth is rejected" } ] }, { "id": "canonical-json-matches-rfc8785-oracle", "statement": "For every I-JSON value, which excludes lone surrogates, `canonicalJson` writes the same text as an independent RFC 8785 canonicalizer, and it reproduces the committed golden canonical forms, number texts, SHA-256 digests, and script-literal escapes.", "area": "encoding", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Add a dev-only Rust crate under `verification/oracles/` with an RFC 8785 canonicalizer" }, "layer": "differential", "status": "evidenced", "evidence": [ "verification/oracles/src/jcs.rs", "verification/vectors/generate.py", "verification/vectors/jcs.json", "scripts/verification-oracles.test.ts", "scripts/verification-vectors.test.ts" ], "assumptions": [ "sha256" ], "notVerified": [ "Generated values are sampled at the configured run count, and the golden vectors are a fixed corpus; neither is a proof over all inputs.", "`canonicalJson` writes a lone surrogate as JSON.stringify escapes it, where RFC 8785 refuses the input; the vector test pins this difference.", "Duplicate member names never reach `canonicalJson`, because `JSON.parse` keeps the last one; refusing them is a parser's job, not the canonicalizer's.", "The Rust oracle and the Python generator were written from RFC 8785 without reference to the TypeScript, but by the same author, so a misreading all three share would pass. The oracle's number digits come from Rust's correctly rounded formatting, and one misreading of the shortest-digit rule at powers of two was found in review and fixed." ] }, { "id": "media-identity-hashes-match-golden-vectors", "statement": "The media provider identity and source asset key, the authorization-context digest, the native runtime closure digest, the retained revision content digest, and UTF-8 byte ordering reproduce golden vectors from an independent Python generator.", "area": "media", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Commit Python-generated golden vectors for hashes and encodings to `verification/vectors/`." }, "layer": "differential", "status": "evidenced", "evidence": [ "verification/vectors/generate.py", "verification/vectors/hashes.json", "scripts/verification-vectors.test.ts" ], "assumptions": [ "sha256" ], "notVerified": [ "The vectors are a fixed corpus; they pin the byte layout, not a property of all inputs.", "Injectivity of the length framing is `hash-framing-injective`, which Phase 5 addresses." ] }, { "id": "hash-framing-injective", "statement": "The length-framed hash input (a 4-byte label length, an 8-byte payload length, the label, and the payload, per section) determines its sections; the contract hash preimage (canonical JSON as UTF-8, a 0x00 byte, then the implementation hash) determines the JSON bytes and the implementation hash; and the NUL-joined confirmed-write intent key preimage determines the intent's fields.", "area": "encoding", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "The length-framed hash input and the `json ‖ 0x00 ‖ 32-byte` suffix are injective." }, "layer": "lean", "status": "evidenced", "evidence": [ "scripts/verification-lean-encodings.test.ts", "src/media/runtime-closure.property.test.ts", "verification/lean/GhostgetVerification/Encodings/HashFraming.lean", "verification/lean/GhostgetVerification/Encodings/Units.lean" ], "assumptions": [ "sha256", "verification-tools" ], "notVerified": [ "SHA-256 is not modelled; that distinct preimages give distinct hashes rests on the sha256 assumption.", "The Lean theorems are about Lean models of the preimages. The differential test checks that updateLengthFramedHash, providerContractHash, localCliContractHash, and intentLedgerPath agree with those models on generated inputs, not on every input.", "UTF-8 injectivity is not proved, so the contract theorem stops at the UTF-8 bytes of the canonical JSON rather than the JSON value.", "The intent key theorem assumes every field is ASCII and NUL-free, as validated identifiers and hex hashes are; the model does not check that callers only pass such fields.", "Framing lengths must fit their headers (labels under 2^32 bytes, payloads under 2^64 bytes); the TypeScript does not check this.", "Other NUL-separated preimages (the per-hash idempotency key in ledgerPath, web-session contracts, predecessor-compatible contract hashes, provider-plugin package and module-analysis hashes) and the separate framing copy in src/provider-plugin.ts are not covered." ] }, { "id": "identifier-roundtrip", "statement": "Identifier grammars and route/operation composite keys satisfy parse(format(x)) = x and are unambiguous.", "area": "encoding", "source": { "path": "AGENTS.md", "quote": "Add property tests for strict parsers, canonical encodings, identifiers, ordering, round trips" }, "layer": "lean", "status": "evidenced", "evidence": [ "scripts/verification-lean-encodings.test.ts", "src/contracts-repair.test.ts", "src/local-cli-tool-identity.test.ts", "src/platform-catalog.property.test.ts", "src/provider-plugin-registry.test.ts", "verification/lean/GhostgetVerification/Encodings/RouteKey.lean" ], "assumptions": [ "verification-tools" ], "notVerified": [ "The Lean proof covers the provider plugin registry keys: the route key `:` and the exact-contract key `:/@`, over the four transports and the surface ID and operation name grammars. Session-secret file names are the separate claim session-secret-filename-injective. Other identifier grammars, such as adapter, auth, and run IDs, portable operation identities, cursor tokens, and platform catalog IDs, are covered only by the listed example and property tests, not by a proof.", "The Lean theorems are about a Lean model of the key functions and grammars. The differential test checks that `routeKey`, `operationKey`, `isProviderPluginSurfaceId`, and `isProviderPluginOperationName` agree with that model on generated inputs, not on every input, and the grammars are modelled by hand from their regular expressions.", "The registry has no production parser for its keys; the Lean parser is a witness that a key determines its parts. A contract version is modelled as a natural number written in decimal; the registry's own check that it is a positive safe integer is not modelled." ] }, { "id": "auth-request-binding", "statement": "Every authenticated request is bound to one exact account realm, provider target, transport, contract version, and implementation identity; drift in any of them rejects the request and consumes prepared plans.", "area": "authentication", "source": { "path": "AGENTS.md", "quote": "Bind every authenticated request to one exact account realm, provider target, transport, contract version, and implementation identity." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/auth-storage.test.ts", "src/beeper-message-like-me-source.test.ts", "src/client-boundary.test.ts", "src/local-cli-durable-identity.test.ts", "src/operation-authority.property.test.ts", "src/operation-permission.ts", "src/runtime.test.ts", "src/runtime.ts", "src/web-session-authentication-policy.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "The model covers one provider-API account: the bundled X interface with `posts.read` and `posts.publish`, on a real state home with a counting executor in place of the provider. Web-session, local CLI, linked-device, portable-plugin and messaging-composite routes share `validateFreshPlan` and the permission layer but rest on the listed example tests.", "The model varies the account incarnation, the account realm (a record for a different subject under the same ID), the interface bytes, the executable closure and the contract implementation identity. The provider target and transport are fixed by the X contract, and a transport or contract-version change reaches a plan only through the manifest bytes it binds; neither is varied on its own.", "Saved plans bind the reviewed contract implementation identity (`contractImplementationHash`), which is stable across builds of one built-in plugin version, not the exact closure. Under managed permissions the grant binds the exact closure, so a changed closure dispatches nothing until the new identity is granted; without managed permissions a closure change that keeps the reviewed contract identity does not consume a plan.", "A plan refused only by policy is kept for a later confirmation under current authority, by design; every other refusal consumes it.", "The model samples its schedules: CI runs 2 schedules of up to 8 commands, and the nightly soak runs 20 times as many. Each command spawns the bound state helper for every state operation, so a schedule costs tens of seconds." ], "properties": [ { "path": "src/operation-authority.property.test.ts", "test": "property: authority never outlives a change of account incarnation, realm, interface, closure, contract or policy" } ] }, { "id": "no-silent-transport-switch", "statement": "Ghostget never silently switches between official API, browser session, linked-device, or portable transports; error text cannot grant a transport switch.", "area": "authentication", "source": { "path": "AGENTS.md", "quote": "Never silently switch transport." }, "layer": "example", "status": "evidenced", "evidence": [ "src/beeper-local-plugin.test.ts", "src/ghostget.test.ts", "src/pinned-https.test.ts", "src/providers/linkedin-company-program.test.ts", "src/providers/linkedin-self-program.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "mutation-exact-preview-confirmation", "statement": "A mutation dispatches only after an exact preview and a confirmation whose digest binds that preview; each plan is consumed exactly once, and expired, drifted, or altered plans are consumed without dispatch.", "area": "mutations", "source": { "path": "AGENTS.md", "quote": "Keep mutations behind exact preview, confirmation, durable dispatch, and at-most-once evidence." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/confirmed-write-program.test.ts", "src/control/menubar-cli.test.ts", "src/messaging-runtime-composite.test.ts", "src/operation-authority.property.test.ts", "src/operation-permission.test.ts", "src/providers/x.test.ts", "src/runtime.test.ts", "src/runtime.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The model covers one provider-API account: the bundled X interface with `posts.read` and `posts.publish`, on a real state home with a counting executor in place of the provider. Web-session, local CLI, linked-device, portable-plugin and messaging-composite routes share `validateFreshPlan` and the permission layer but rest on the listed example tests. The model's write is single-dispatch; multi-part and composite plans rest on the listed example tests.", "An altered plan is modelled by flipping one byte of the saved plan file; other alterations rest on the strict plan parser's tests. A crash between consuming a plan and its durable dispatch is the fence model's (`confirmed-write-at-most-once`), not this one's.", "Expiry is modelled by confirming a day later through the injected clock.", "The model samples its schedules: CI runs 2 schedules of up to 8 commands, and the nightly soak runs 20 times as many. Each command spawns the bound state helper for every state operation, so a schedule costs tens of seconds." ], "properties": [ { "path": "src/operation-authority.property.test.ts", "test": "property: authority never outlives a change of account incarnation, realm, interface, closure, contract or policy" } ] }, { "id": "confirmed-write-at-most-once", "statement": "For every intent (account realm, provider target, operation id, canonical input), provider effects are at most 1 + duplicate successors, including across reconnect and manifest-hash changes.", "area": "mutations", "source": { "path": "AGENTS.md", "quote": "durable dispatch, and at-most-once evidence." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-fence-replay.test.ts", "src/confirmed-write-intent-fence.test.ts", "src/run-journal.property.test.ts", "src/run-journal.test.ts", "src/runtime.test.ts", "verification/quint/fence.qnt" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The model is bounded: three runs of one intent, one reconnect, one manifest upgrade, one duplicate-risk successor per source run (a successor may itself be a source), 5,000 simulated samples of up to 12 steps, and Apalache to length 8.", "The replay drives every seeded trace through the pure fence cores with an in-memory store, and five of them, a greedy cover of every action result the seeded traces take, through the file-backed state layer on a real state home: `createRunJournal`, `updateRunJournal`, `listRunJournalSnapshots`, `acquireConfirmedWriteLedgers` (the intent ledger, then the hash-keyed ledger), `repairInterruptedRunJournals` with its receipt and ledger projection, and `releaseReconciledRunRecovery`. It does not run the `confirmInvocation` program, so plan validation, recovery capsules, and `claimDuplicateRiskSource`'s receipt, capsule, and ledger rechecks are covered only by the listed example tests.", "Owner acceptance of the duplicate risk, the preview's successor check, election of a source across a same-subject reconnect (the model's source must bind the current auth record), and a successor whose election fails at its dispatch boundary are not modelled; the model disables that dispatch, and the listed example tests cover production failing the run before any request.", "The dedupe window's expiry, partial multi-dispatch runs, and journals from before the intent fence are not modelled." ] }, { "id": "portable-retained-release", "statement": "An indeterminate portable write's intent fence opens only on a not-applied observation that Ghostget itself obtained from the plugin's declared readback, bound to the run, its intent, auth realm, and manifest; a source whose elected duplicate successor settled is superseded, which releases its recovery material and lets its plugin bundle be removed while its indeterminate ledger still fences the intent.", "area": "mutations", "source": { "path": "AGENTS.md", "quote": "Never retry or clear an indeterminate dispatch; reconcile it from separately obtained exact evidence." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-retained-replay.test.ts", "src/provider-plugin-host.test.ts", "src/provider-plugin-package.test.ts", "src/provider-plugin-portable-runtime.test.ts", "src/provider-plugin-protocol.test.ts", "src/run-journal.test.ts", "verification/quint/retained.qnt" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The model is bounded: one source run, at most one elected successor, one retry of the base intent, 2,000 simulated samples of up to 12 steps, and Apalache to length 8. Auth rotation, manifest upgrades, chains of successors, successor readback, and assets are not modelled.", "Whether the plugin declared a readback is chosen by the trace, and the readback's answer is modelled as the provider's truth or unknown: a plugin whose declared read-only operation reports not-applied after an applied effect breaks the bound, which the seeded `stepUntruthfulReadback` mutant shows. The readback is trusted plugin code under the same trust boundary as its write.", "The replay drives every seeded trace through the pure cores (`transitionRunJournal`, `intentFenceBlocker`, `observedNotAppliedRelease`, `duplicateSourceSupersession`, `reconciledRecoveryRelease`) and `inspectPortableProviderPluginQuiescence` with an in-memory journal list. The file-backed store, the child host's protocol 2 frames, and the create-once observation record are covered only by the listed example tests.", "No owner-approval route reaches portable not-applied reconciliation; a plugin without a readback declaration stays on the explicit-input path, which never releases the ledger.", "Supersession runs at plugin install, disable, and removal and in the doctor repair pass, not at the moment the successor settles." ] }, { "id": "indeterminate-never-retried", "statement": "An indeterminate (post-dispatch uncertain) mutation is never retried; a lost acknowledgement never permits another remote submission.", "area": "mutations", "source": { "path": "AGENTS.md", "quote": "Never retry or clear an indeterminate dispatch" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-fence-replay.test.ts", "src/confirmed-write-intent-fence.test.ts", "src/control/gateway.test.ts", "src/derive.test.ts", "src/imessage-direct-plugin.test.ts", "src/linked-device-lifecycle-journal.test.ts", "src/linked-device-lifecycle-runtime.test.ts", "src/portable-run-recovery.test.ts", "src/run-journal.property.test.ts", "src/runtime.test.ts", "verification/quint/fence.qnt" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The fence model checks the confirmed-write path (`posts.publish`-shaped R3 web-session writes with one planned dispatch): no intent is dispatched twice, and a later dispatch of the same effect is only an elected duplicate-risk successor of an indeterminate source. It is bounded to three runs, one reconnect, one manifest upgrade, 5,000 simulated samples of up to 12 steps, and Apalache to length 8.", "The replay drives the fence cores on every seeded trace and the file-backed journal, ledger, repair, and reconciliation layer on a five-trace cover of their action results, not the `confirmInvocation` program, the provider transports, or owner acceptance of the duplicate risk.", "Linked-device lifecycle, local CLI, iMessage, derive, and control-gateway paths, and partial multi-dispatch runs, are covered only by the listed example and property tests." ] }, { "id": "indeterminate-cleared-only-by-evidence", "statement": "An indeterminate dispatch fence is released only from separately obtained exact evidence (plugin readback or owner approval), never from caller-typed hashes.", "area": "mutations", "source": { "path": "AGENTS.md", "quote": "reconcile it from separately obtained exact evidence." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-fence-replay.test.ts", "src/ghostget.test.ts", "src/portable-run-recovery.test.ts", "src/provider-plugin-portable-runtime.test.ts", "src/provider-plugin-reconciliation.property.test.ts", "src/run-journal.test.ts", "src/web-session-recovery.test.ts", "verification/quint/fence.qnt" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The fence model abstracts the evidence: one reconcile action stands for applied plugin readback or owner approval. The in-memory replay checks that `reconciledRecoveryRelease` and `transitionRunJournal` settle a reconciled run and keep its ledger; the file-backed replay settles it through `releaseReconciledRunRecovery`. That a source with an elected successor keeps its recovery material is covered only by the listed example tests.", "The replay does not call `recordNotAppliedClaim`: its not-applied action changes no journal in the replay world, so that `recordNotAppliedClaim` releases nothing is covered only by the listed example tests.", "The web-session reconciler and the CLI and portable parsers of reconciliation input are covered only by the listed example and property tests.", "Terminalizing a run from supplied evidence says nothing about provider liveness." ] }, { "id": "recovery-auth-continuity", "statement": "Reconciliation and duplicate-risk successor election accept a current auth record other than the run's exact record only when it keeps the locator ID and kind and names the provider subject that the run's encrypted recovery capsule recorded; a capsule with no recorded subject still needs the exact record.", "area": "mutations", "source": { "path": "docs/effect-confirmed-write-runtime.md", "quote": "locator ID and kind and names the provider subject that the run's encrypted recovery capsule recorded." }, "layer": "property", "status": "evidenced", "evidence": [ "src/confirmed-write-intent-fence.test.ts", "src/provider-plugin-portable-runtime.test.ts", "src/recovery.test.ts", "src/runtime.test.ts", "src/web-session-recovery.test.ts" ], "assumptions": [ "encryption", "provider-behaviour", "same-user-trusted" ], "notVerified": [ "The check compares subject strings. That one subject names one provider account rests on how the auth record's subject was bound, by a plugin subject probe or by the operator; a subject typed onto another account's credentials is not detected here.", "The property test samples the pure `recoveryAuthContinuity` decision; its use by the web-session reconciler, the portable reconciler, and successor election is covered only by the listed example tests.", "The intent fence itself stays keyed by locator ID: a fulfilled run under other auth bytes is still withheld rather than replayed, because run journals do not record the subject." ], "properties": [ { "path": "src/recovery.test.ts", "test": "property: only exact bytes or the recorded provider subject continue a run's realm" } ] }, { "id": "intent-fence-readback", "statement": "`ghostget doctor` reads every confirmed-write intent claim back against its run journal without writing, reports malformed, orphaned, stale, drifted, misplaced, and repeated claims as unhealthy, and names claims and runs only by opaque key and run ID.", "area": "mutations", "source": { "path": "docs/effect-confirmed-write-runtime.md", "quote": "`ghostget doctor` reads the fence back without writing, after its repair pass." }, "layer": "example", "status": "evidenced", "evidence": [ "src/confirmed-write-intent-fence.test.ts", "src/ghostget.test.ts" ], "assumptions": [ "filesystem-durability", "same-user-trusted" ], "notVerified": [ "The readback is not modelled; only the listed example tests cover it, and they plant an orphaned, a malformed, and an off-chain claim but not every issue kind.", "The readback reads at most 10,000 directory entries and then reports itself truncated; it does not re-derive the hash-keyed ledgers.", "Doctor runs its journal repair pass before the readback, so the readback describes the state after that repair." ] }, { "id": "durable-boundaries-before-dispatch", "statement": "Confirmation claim, plan consumption, provisional receipt, idempotency ledger, and recovery capsule reach durable storage before remote dispatch; dispatch is refused if the capsule cannot be stored.", "area": "mutations", "source": { "path": "docs/effect-confirmed-write-runtime.md", "quote": "Confirmation claims, plan consumption, provisional receipt, idempotency ledger and recovery capsule must reach their existing durable boundaries before remote dispatch." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/confirmed-write-program.test.ts", "src/runtime.test.ts", "src/state-crash-harness.fixture.ts", "src/state-crash-harness.test.ts", "src/state-crash-port.test-support.ts", "src/state-crash-preload.test-support.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The crash harness samples its schedules: CI runs one fast-check schedule of up to four commands per crash mode, each crashing at one generated boundary, so it does not visit every boundary of every operation.", "Crashes land only on the state and path helpers' filesystem effects. Writes the runtime process makes directly, such as the provider-effect ground truth, are outside the crash port.", "Power loss is modelled by the port, not observed: it rolls back, newest first, created, linked, renamed, and unlinked entries whose directory was not fsynced after the effect, and truncates data not fsynced after its write. Directory tree removals are treated as durable when they return, and a real filesystem may keep or lose unsynced effects in other combinations.", "One runtime process mutates the state at a time; concurrent confirmations under crash are not modelled here.", "The harness checks outcomes: no crossing repeats, none is forgotten, and a crossing leaves a durable started journal. It does not check separately that each named record (claim, plan consumption, receipt, ledger, capsule) was durable, and it re-confirms with a freshly saved plan, so replaying a consumed plan digest after a crash is not exercised.", "That dispatch is refused when the recovery capsule cannot be stored rests on the listed example tests only." ], "properties": [ { "path": "src/state-crash-harness.test.ts", "test": "a crash just before a durable boundary never repeats or forgets a crossing" }, { "path": "src/state-crash-harness.test.ts", "test": "a crash just after a durable boundary never repeats or forgets a crossing" }, { "path": "src/state-crash-harness.test.ts", "test": "a torn data write never repeats or forgets a crossing" }, { "path": "src/state-crash-harness.test.ts", "test": "power loss at a durable boundary never repeats or forgets a crossing" } ] }, { "id": "journal-stale-writer-rejected", "statement": "Dispatch callbacks persist transitions against one current journal cell; a stale or competing callback cannot reuse an older journal snapshot (content-hash CAS).", "area": "mutations", "source": { "path": "docs/effect-confirmed-write-runtime.md", "quote": "A stale or competing callback cannot reuse an older journal snapshot." }, "layer": "property", "status": "evidenced", "evidence": [ "src/confirmed-write-program.test.ts", "src/run-journal.property.test.ts", "src/run-journal.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "src/run-journal.property.test.ts", "test": "a lost native acknowledgement never permits a stale journal write in a bounded dispatch schedule" } ] }, { "id": "journal-invariant-inductive", "statement": "assertJournalInvariants is inductive under transitionRunJournal and dispatch counters are monotone; skipped, duplicate, or contradictory progress is rejected.", "area": "mutations", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "`assertJournalInvariants` is inductive under `transitionRunJournal`, and the dispatch counters are monotone." }, "layer": "lean", "status": "evidenced", "evidence": [ "verification/lean/GhostgetVerification/RunJournal.lean", "verification/lean/Differential.lean", "scripts/verification-lean-oracle.ts", "scripts/verification-lean-run-journal.test.ts", "src/run-journal.property.test.ts", "src/run-journal.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The proof is about a Lean model of assertJournalInvariants, the parseDispatch bounds, and transitionRunJournal. The differential test ties the model to the TypeScript on generated journals and events only; it is not a proof that the TypeScript equals the model.", "The transition's own guards do not preserve the invariant alone: an explicit no-op success before the confirmation is consumed and a duplicate successor naming its own run are rejected only by the final parseRunJournal. The production-shape theorem holds by construction, because the model rechecks the invariant; the substantive results are that the guarded step keeps the invariant outside those two events and that the final parse rejects exactly those two.", "Adapter, auth, owner identity, digests, the final origin, error text, the 64 KiB bound, durable storage, and the compare-and-swap write in updateRunJournal are outside the model." ] }, { "id": "public-rejection-preserved", "statement": "The confirmed-write public boundary preserves the exact selected rejection value, including undefined, null, and other falsey values.", "area": "mutations", "source": { "path": "docs/effect-confirmed-write-runtime.md", "quote": "The public boundary keeps the exact selected rejection, including `undefined`, `null` and other falsey values." }, "layer": "example", "status": "evidenced", "evidence": [ "src/confirmed-write-program.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "messaging-composite-ordered-prefix", "statement": "A messaging turn is one composite confirmation and one ordered, prefix-durable run: the accepted prefix is monotone, at most one part is dispatching or indeterminate, and no part is redispatched.", "area": "messaging", "source": { "path": "SECURITY.md", "quote": "A messaging turn is one composite confirmation and one ordered, prefix-durable run." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-messaging-replay.test.ts", "src/messaging-action-store.test.ts", "src/messaging-confirmation-recovery.test.ts", "src/messaging-provider-identity-collision.test.ts", "src/messaging-runtime-composite.test.ts", "src/messaging-runtime-execution.test.ts", "verification/quint/messaging.qnt" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The Quint model covers one run of three parts; Apalache checks it to depth 10 and seeded simulation samples 2,000 runs of up to 12 steps. Neither is a proof for longer runs or more parts.", "The replay drives `transitionMessagingRun` and the runtime's `messagingRecoveryEvent` over 1,000 seeded traces. It does not cover the durable journal writes, file locking, or the provider adapters around them.", "A provider history window may evict the accepted prefix before recovery reads it." ] }, { "id": "messaging-recovery-model", "statement": "Beeper and Message Like Me recovery retain a live or indeterminate owner and never reclaim it until death is proved.", "area": "messaging", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Add a `fc.commands` model for Beeper and Message Like Me recovery." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/beeper-message-like-me-recovery.model.test.ts", "src/beeper-message-like-me-recovery.test.ts" ], "assumptions": [ "filesystem-durability", "process-liveness", "provider-behaviour" ], "notVerified": [ "The fast-check model covers the export admission claim: acquisition, helper launch, bind, settle, cleanup-unsafe, release, stale controllers, parent or helper death or unreadable liveness, and reboot, over 10 generated sequences of up to 10 commands on a real claim file. Liveness readings come from the model through test-only seams, answered as a truthful processOwnerStatus would; real process-start and boot identity reading is covered by src/process-identity.test.ts.", "The directory-lease recovery (raw working directories and bundle stages) is covered only by the listed example tests. A dead owner's launching lease is reclaimed once its recorded deadline passes, so that path treats the deadline, not a proved child death, as the end of the launch.", "Two seeded defects are killed by the model: taking over an owner whose liveness cannot be read, and taking over a cleanup-unsafe admission in the same boot." ], "properties": [ { "path": "src/beeper-message-like-me-recovery.model.test.ts", "test": "retains a live or indeterminate owner and takes over only after death is proved" } ] }, { "id": "messaging-stop-on-drift", "statement": "Before every remaining part, current provider state is rechecked and the run stops on foreign activity, edit, retraction, participant or provider drift, permanent failure, partial work, or possible completion.", "area": "messaging", "source": { "path": "SECURITY.md", "quote": "Ghostget checks current provider state before every remaining part and stops on foreign activity, edit, retraction, participant drift, provider drift" }, "layer": "property", "status": "evidenced", "evidence": [ "src/messaging-automation.test.ts", "src/messaging-runtime-execution.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The property runs the production composite runtime through a synthetic provider plugin, for one to three parts with at most one adverse event per run: an incoming or extra outgoing message, an edit, a deletion, a reordering, a participant or provider-revision change on the route, a failure before or after the durable fence, a malformed result, or a deadline or abort before or after the fence. It checks the terminal state, proven prefix, stop reason, and dispatch count against a reference model. CI runs 6 generated runs; two seeded runtime defects are killed.", "Two or more adverse events in one run, and the real Beeper, iMessage, and WhatsApp plugins' own drift readings, are covered only by the listed example tests.", "The claim was scheduled as a stateful model; it is evidenced by a property over single-event schedules instead, because each part's recheck is independent of the earlier parts' events." ], "properties": [ { "path": "src/messaging-runtime-execution.test.ts", "test": "stops on every drift, failure, or cancellation at the modelled part and never resubmits" } ] }, { "id": "messaging-transition-inductive", "statement": "The messaging run reducer invariant is inductive under transitionMessagingRun.", "area": "messaging", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "The same inductive-invariant proof for `transitionMessagingRun`." }, "layer": "lean", "status": "evidenced", "evidence": [ "verification/lean/GhostgetVerification/MessagingRun.lean", "verification/lean/Differential.lean", "scripts/verification-lean-oracle.ts", "scripts/verification-lean-messaging-run.test.ts", "src/messaging-action-store.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The proof is about a Lean model of assertRun, the structural checks of parseRun, and transitionMessagingRun. The differential test ties the model to the TypeScript on generated runs of up to eight parts only; it is not a proof that the TypeScript equals the model.", "The transition's own guards do not preserve the invariant alone: an accepted part whose provider message ID repeats one in the accepted prefix is rejected only by the final parseRun. The production-shape theorem holds by construction, because the model rechecks the invariant; the substantive results are that the guarded step keeps the invariant outside that event and that the final parse rejects exactly that event.", "Part text, digests, reply references, delivery and read fields, context evidence, encryption, durable storage, and the compare-and-swap write in updateMessagingRun are outside the model." ] }, { "id": "messaging-uncertain-not-resubmitted", "statement": "Cancellation never proves an already-started action was unsent; uncertain submits are reconciled by exact run identity and never resubmitted.", "area": "messaging", "source": { "path": "docs/messaging-automation.md", "quote": "reconcile its exact run identity without resubmitting uncertain work." }, "layer": "property", "status": "evidenced", "evidence": [ "src/beeper-message-like-me-recovery.test.ts", "src/messaging-automation.test.ts", "src/messaging-confirmation-recovery.test.ts", "src/messaging-runtime-execution.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "The property checks that a deadline or abort after the durable fence, a failure after it, or a malformed result leaves the run indeterminate at that part with possibleSubmittedPartIndex set, never failed-before-dispatch; that confirming the same plan again is refused without another provider attempt; and that the stored run read back by its run identity is unchanged. CI runs 6 generated runs over the synthetic provider plugin. A seeded defect that records a post-fence failure as unsent is killed.", "Reconciliation of an indeterminate part against provider state, and Beeper and Message Like Me recovery, are covered only by the listed example tests and the recovery model; the property does not resolve an indeterminate part.", "The claim was scheduled as a stateful model; it is evidenced by a property over single-event schedules instead." ], "properties": [ { "path": "src/messaging-runtime-execution.test.ts", "test": "stops on every drift, failure, or cancellation at the modelled part and never resubmits" } ] }, { "id": "messaging-capability-io-private", "statement": "Messaging route, context, reply, and provider references enter only through stdin or owner-only files and leave only through explicit atomic mode-0600 artifacts, never argv or ordinary output.", "area": "messaging", "source": { "path": "SECURITY.md", "quote": "These values enter through stdin or checked owner-only files and leave only through explicit atomic mode-`0600` artifacts." }, "layer": "example", "status": "evidenced", "evidence": [ "src/args.test.ts", "src/messaging-private-output-boundary.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "messaging-encrypted-no-plaintext-fallback", "statement": "Messaging route, context, preview, and execution state is encrypted at rest with authenticated reference binding; authentication failure, expiry, generation drift, or implementation drift makes records unusable and never falls back to plaintext.", "area": "messaging", "source": { "path": "SECURITY.md", "quote": "Ghostget encrypts route, context, preview, and execution state at rest" }, "layer": "example", "status": "evidenced", "evidence": [ "src/cursor-token.test.ts", "src/messaging-action-store.test.ts", "src/messaging-runtime-execution.test.ts", "src/messaging-store.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "messaging-output-outside-state-root", "statement": "Explicit messaging output paths are distinct from each other and outside the Ghostget state root, so plaintext exports cannot replace keys, plans, runs, or receipts.", "area": "messaging", "source": { "path": "SECURITY.md", "quote": "Explicit messaging output paths must be distinct and outside the Ghostget state root" }, "layer": "example", "status": "evidenced", "evidence": [ "src/messaging-private-output-boundary.test.ts", "src/messaging-runtime-composite.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "messaging-automation-grant-scoped", "statement": "The owner messaging host requires explicit allow grants for messaging.automation.* operations; old messaging.send allow, ask, deny, or unmanaged policy provide no unattended authority, and changed manifests or closures invalidate grants.", "area": "messaging", "source": { "path": "docs/messaging-automation.md", "quote": "An old `messaging.send` allow does not authorize this host. `ask`, `deny`, and an unmanaged policy do not provide unattended authority." }, "layer": "example", "status": "evidenced", "evidence": [ "src/messaging-automation-server.test.ts", "src/messaging-automation.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "messaging-automation-bounds", "statement": "The messaging automation protocol rejects a second ordinary in-flight request and enforces frame (24 MiB), response (32 MiB), and asset (16 MiB each, 64 MiB total, 32 entries, canonical Base64 with checked SHA-256) bounds.", "area": "messaging", "source": { "path": "docs/messaging-automation.md", "quote": "Frames are bounded to 24 MiB; responses to 32 MiB. Assets use canonical Base64 and a checked SHA-256, at most 16 MiB each, 64 MiB total and 32 entries." }, "layer": "example", "status": "evidenced", "evidence": [ "src/messaging-automation-server.test.ts", "src/messaging-automation.test.ts" ], "assumptions": [ "filesystem-durability", "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "helper-mutual-exclusion", "statement": "The state helper's three-phase claim and the path helper's per-leaf claim each admit at most one critical-section holder, including with stale-owner reaping and non-atomic readdir.", "area": "storage", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "The invariant is `|{p : critical(p)}| ≤ 1`." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-path-claim-replay.test.ts", "scripts/verification-state-claim-replay.test.ts", "src/browser-snapshots.test.ts", "src/path-helper.test.ts", "src/read-projections.test.ts", "src/storage-cas.test.ts", "verification/quint/path-claim.qnt", "verification/quint/state-claim.qnt" ], "assumptions": [ "filesystem-atomic-rename", "process-liveness", "same-user-trusted" ], "notVerified": [ "verification/quint/state-claim.qnt checks two state helpers with at most one kill. A listing may report the other claim at any phase it had since the listing began, or not at all after it changed. CI runs 20,000 simulated samples of up to 12 steps and Apalache to length 8. The replay runs the production listing and stage decision on real claim files for 2,000 traces; concurrent helper processes run only in the example tests. Three or more helpers, an owner whose liveness cannot be inspected, and the eight-listing retry bound are not modelled.", "When listings are not atomic, both state-helper claims can reach `held`. The later one then fails with \"state mutation arbitration admitted two owners\" instead of entering, so mutual exclusion holds but that request fails.", "The path-helper model is bounded: three helpers, at most one kill, kills only at pause points, 10,000 simulated samples of up to 12 steps, Apalache to length 6, and 60 replayed traces.", "A path helper from before the reaper election can move a live claim away without restoring it. A current helper that claims afterwards finds that claim in the quarantine, releases its own claim, and fails; the residue sweep keeps the quarantine until the claim's PID exits. Liveness is by PID alone, so a reused PID keeps such a quarantine, and blocks the leaf, until that PID exits; this also applies to a current reaper killed between moving a dead claim into its quarantine and removing it, when the dead claim's PID is reused. Only src/path-helper.test.ts covers this, the Quint model has no such helper, and nothing stops an old helper that claims third." ] }, { "id": "state-cas-no-rollback", "statement": "Private state writes are compare-and-swap: exactly one overlapping writer for an exact snapshot succeeds, a stale writer never rolls state back or resurrects a removed file, disappearance is a conflict, and symlinks are never followed.", "area": "storage", "source": { "path": "docs/plugins.md", "quote": "exact-byte compare-and-exchange" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/auth-storage.test.ts", "src/session-secrets.test.ts", "src/storage-cas.model.test.ts", "src/storage-cas.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "The stateful model runs 12 schedules of up to 8 commands against the real bound state helper on one file under `session-secrets`: conditional writes and removals that hold a current or stale snapshot, an unconditional recreate, and a swap of the file for a symbolic link to a file outside the state layout. It checks the sequential interleavings it generates. Genuinely overlapping writers are covered only by the cross-process example test in src/storage-cas.test.ts, for two writers.", "A symbolic link in a parent directory, and the path helper that writes outside `GHOSTGET_STATE_HOME`, are not in the model; the example tests cover only their enumerated cases.", "Crashes during a compare-and-swap are covered by the state-crash-consistency claim, not by this model." ], "properties": [ { "path": "src/storage-cas.model.test.ts", "test": "stale snapshots never roll state back, resurrect a removed file, or follow a link" } ] }, { "id": "state-crash-consistency", "statement": "A crash or power loss at any durable state-helper or path-helper boundary leaves each private file with its old or its new content, never a torn one; a session-secret read afterwards returns the old value, the new value, or nothing, a completed removal stays removed, and the next write succeeds.", "area": "storage", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "power-loss truncation" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/state-crash-harness.fixture.ts", "src/state-crash-harness.test.ts", "src/state-crash-port.test-support.ts", "src/state-crash-preload.test-support.ts" ], "assumptions": [ "filesystem-atomic-rename", "filesystem-durability", "process-liveness", "same-user-trusted" ], "notVerified": [ "The harness samples its schedules: CI runs two fast-check schedules each for session secrets and private files, each command crashing at one generated boundary. Only a single private-file replacement is swept at every boundary under power loss.", "Power loss is modelled by the port, not observed: it rolls back, newest first, created, linked, renamed, and unlinked entries whose directory was not fsynced after the effect, and truncates data not fsynced after its write. Directory tree removals are treated as durable when they return, and a real filesystem may keep or lose unsynced effects in other combinations.", "A crashed session-secret write may lose the previous value; the law allows that outcome and does not check that the old value survives.", "One process mutates the state at a time; overlapping writers under crash are not modelled here." ], "properties": [ { "path": "src/state-crash-harness.test.ts", "test": "a crash at any durable boundary leaves the old value, the new value, or nothing" }, { "path": "src/state-crash-harness.test.ts", "test": "a crash at any durable boundary leaves the old or the new value, never a torn one" } ] }, { "id": "session-secret-filename-injective", "statement": "sessionSecretFileName is injective on valid (namespace, authId) coordinates, and parseSessionSecretFileName reads every name it writes back to that coordinate.", "area": "storage", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Identifier grammars, and route, operation, and session-secret composite keys: `parse ∘ format = id` and the keys are unambiguous." }, "layer": "lean", "status": "evidenced", "evidence": [ "scripts/verification-lean-encodings.test.ts", "src/session-secrets.test.ts", "verification/lean/GhostgetVerification/Encodings/SessionSecret.lean" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted", "verification-tools" ], "notVerified": [ "The Lean theorems are about a Lean model of the naming and parsing functions. The differential test checks that the TypeScript agrees with that model on generated names, not on every name.", "The name grammar is modelled by hand from its regular expression.", "File removal, adoption of ambiguous historical files, and filesystem behaviour are not modelled, so two properties are covered only by the listed tests: removing one account never deletes or blocks another account's files, and single-coordinate and auth-wide removal both take an ambiguous historical file only for the coordinate its envelope names, by compare-and-swap on the bytes that named it.", "Ownership of an ambiguous historical file is read from its envelope header without decryption, so a same-user writer that forges the header can direct its removal; that writer could already delete the file directly." ] }, { "id": "no-writes-on-read-paths", "statement": "Read paths never mutate state; reads may only cache.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "No writes on read paths. Reads may cache; they never mutate." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-cli.test.ts", "src/contract-repair-inbox.test.ts", "src/control/policy-privacy.test.ts", "src/control/read-capability.test.ts", "src/cursor-token.test.ts", "src/linked-device-lifecycle-journal.test.ts", "src/provider-plugin-store.test.ts", "src/providers/whatsapp-interaction-projection-helper.test.ts", "src/read-path-incarnation.test.ts", "src/read-path-preparation.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "Evidence is by named example. Whole-state-tree fingerprints taken before and after cover a cache read (hit, miss, first read, and a leftover admission claim whose owner is dead), a revalidation, a capability read, and `invoke --cache-only`; omni materialization, control inspection, confirmation preparation, and the operation-permission description are checked only for not creating an incarnation. No static or exhaustive check shows that every command that reads is write-free; a new read path is covered only once it takes the typed `AuthIncarnationReader` capability and has its own test.", "The D14 exemptions are writes by design and are tested as the only permitted changes: a cache read may create and release its own admission claim, remove a claim whose recorded owner is proven dead, and create the projection encryption key and its store-key marker when they are absent.", "Only the menu-bar snapshot, its account and permission listings, the auth checks of cache reads, live-read publication, and omni materialization, read-path invocation preparation, confirmation preparation, and the operation-permission account identity take a typed read capability; explicit invocation preparation, including the messaging route, context, and action preparations, still creates a missing auth incarnation as an admitted execution path." ] }, { "id": "read-path-read-capability", "statement": "A read path receives a branded read capability with only read members, such as `AuthIncarnationReader`, not an environment that reaches writers; a structurally similar unbranded object is rejected by the type checker.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "Hand a read path a read capability with no writer members, such as `AuthIncarnationReader`, not an environment that reaches writers." }, "layer": "example", "status": "evidenced", "evidence": [ "src/control/read-capability.test.ts", "src/read-path-incarnation.test.ts", "src/read-path-preparation.test.ts" ], "assumptions": [ "bun-runtime" ], "notVerified": [ "Only the enumerated example cases are checked; the type assertions run under `bun run typecheck`.", "The brand exists only in the type system; code that casts through `unknown` can still forge a capability.", "Only the menu-bar snapshot, its account and permission listings, the auth checks of cache reads, live-read publication, and omni materialization, read-path invocation preparation, confirmation preparation, and the operation-permission account identity take the typed capability; other read paths are not covered." ] }, { "id": "menu-bar-snapshot-read-only", "statement": "The menu-bar snapshot and its account and permission listings take no admission and create no state; auth incarnations are created only by account saves, the control-service startup backfill, and admitted execution paths.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "The menu-bar snapshot and its account and permission listings take no admission and create no state; account saves, the control-service startup backfill, and admitted execution paths create auth incarnations." }, "layer": "property", "status": "evidenced", "evidence": [ "src/control/read-capability.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs.", "The law fingerprints only the read-projection control tree; writes elsewhere in the state home are covered only by the example snapshot test." ], "properties": [ { "path": "src/control/read-capability.test.ts", "test": "for any set of legacy accounts and orphaned claims, listing revisions write nothing and match the admitted revision exactly when an incarnation exists" } ] }, { "id": "read-path-auth-check-read-only", "statement": "The auth checks of a cache read, a live-read publication, and an omni materialization read the auth incarnation through `AuthIncarnationReader`; a missing incarnation reads as changed and none is created.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "The auth checks of a cache read, a live-read publication, and an omni materialization read the incarnation through `AuthIncarnationReader`, so a missing incarnation reads as changed and nothing is created." }, "layer": "example", "status": "evidenced", "evidence": [ "src/read-path-incarnation.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked.", "The omni example observes the incarnation only between materialization and the next source preparation; read-path preparation itself is covered by read-path-preparation-read-only." ] }, { "id": "read-projection-admission-exemption", "statement": "The only admission write a read-projection cache read makes is its own admission claim, which it creates and releases, and the removal of a claim whose recorded owner is proven dead; the claim carries no data.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "First, a read-projection cache read may create and release its own admission claim and remove a claim whose recorded owner is proven dead, because it must exclude a concurrent projection transition; the claim is coordination state with no data." }, "alsoQuotes": [ { "path": "AGENTS.md", "quote": "The exemptions cover nothing else." } ], "layer": "example", "status": "evidenced", "evidence": [ "src/read-projections.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "process-liveness", "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked.", "No check establishes that a cache read writes nothing beyond its own claim and dead-owner removal." ] }, { "id": "read-path-preparation-read-only", "statement": "Read-path invocation preparation (capability and omni reads, cache-only invocations, and control-plane inspection), confirmation preparation, and the operation-permission account identity read the auth incarnation through `AuthIncarnationReader`; a missing incarnation fails closed and none is created, while explicit invocation preparation remains the admitted execution path that may create one.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "Read-path preparation (capability and omni reads, cache-only invocations, and control-plane inspection), confirmation preparation, and the operation-permission account identity bind the current incarnation the same way: they read it through `AuthIncarnationReader`, fail closed when it is missing, and create none." }, "layer": "example", "status": "evidenced", "evidence": [ "src/read-path-preparation.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked: one missing incarnation per read path, on a fresh state home.", "The cache-only `ghostget invoke` branch is driven in process through `main` with a stubbed cache read, not through the installed binary; the retry preparation after a discarded live read is checked by type and review only.", "Explicit invocation preparation, including the messaging route, context, and action preparations, still creates a missing incarnation as an admitted execution path." ] }, { "id": "read-projection-key-exemption", "statement": "A cache read creates at most the projection encryption key and its store-key marker, only when they are absent; a later cache read writes nothing.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "Second, a cache read may create the projection encryption key and its store-key marker when they are absent, because a miss returns the query key that this encryption key derives; each is created at most once per state home and holds no user data." }, "layer": "example", "status": "evidenced", "evidence": [ "src/read-path-incarnation.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "Only the enumerated example cases are checked.", "The example checks a cache read after preparation on a fresh state home; it does not cover concurrent first reads or a legacy store that needs only its marker." ] }, { "id": "derived-state-rebuildable", "statement": "Derived state is rebuildable from authoritative state and lives in the cheapest serving tier; only authoritative state uses transactional storage.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "Derived state is rebuildable and lives in the cheapest tier that can serve it." }, "layer": "not-verified", "status": "not-verified", "evidence": [], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "No automated check covers this claim.", "Only the `costs.json` kind classification is checked; rebuildability and tier placement are not." ] }, { "id": "content-bytes-in-content-store", "statement": "Content bytes live only in the content store; the control plane holds references and metadata.", "area": "storage", "source": { "path": "AGENTS.md", "quote": "Content bytes live in the content store; the control plane keeps references and metadata only." }, "layer": "not-verified", "status": "not-verified", "evidence": [ "src/control/gateway.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "same-user-trusted" ], "notVerified": [ "No automated check covers this claim as stated; the listed tests check only related cases." ] }, { "id": "secrets-out-of-artifacts", "statement": "The code paths that the cited tests exercise keep raw authenticated traffic, cookies, tokens, profiles, private content, and local paths out of the receipts, logs, diagnostics, and captured evidence they produce.", "area": "privacy", "source": { "path": "AGENTS.md", "quote": "Keep raw authenticated traffic, cookies, tokens, profiles, private content, and local paths out of Git, tests, receipts, logs, and diagnostics." }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/verification-tools.test.ts", "src/auth-storage.test.ts", "src/control/gateway.test.ts", "src/control/interface-cli.test.ts", "src/control/vault.test.ts", "src/derive-review.test.ts", "src/ghostget.test.ts", "src/har-internal.test.ts", "src/media/archive.test.ts", "src/media/process.test.ts", "src/run-journal.test.ts" ], "assumptions": [ "same-user-trusted", "encryption" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs.", "Modules outside the cited tests are not checked, and nothing scans output for secrets in general.", "Git history, test fixtures, and CI logs are not mechanically scanned." ], "properties": [ { "path": "src/har-internal.test.ts", "test": "property: arbitrary identifier-shaped path segments and JSON map keys never survive evidence" }, { "path": "scripts/verification-tools.test.ts", "test": "never lets a replaced path, a marker, or a control character through" } ] }, { "id": "secrets-at-rest-encrypted-private", "statement": "Provider session material is stored encrypted with authenticated ciphertext and private modes, invalidated on auth incarnation rotation, and never re-keyed beside existing ciphertext.", "area": "privacy", "source": { "path": "README.md", "quote": "Replacing or removing an auth locator rotates its local lifetime identity, so old projection and provider-session ciphertext cannot revive after recreation." }, "layer": "example", "status": "evidenced", "evidence": [ "src/auth-storage.test.ts", "src/nonstate-storage.test.ts", "src/session-secrets.test.ts" ], "assumptions": [ "same-user-trusted", "encryption" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "confirmation-plans-encrypted", "statement": "Confirmation plan inputs are encrypted at rest with authenticated metadata; a missing or replaced key never causes key replacement or ciphertext overwrite.", "area": "privacy", "source": { "path": "skills/ghostget/references/social-platform-routing.md", "quote": "Ghostget's plan owns encrypted confirmed input and attachment bundles for its lifecycle." }, "layer": "example", "status": "evidenced", "evidence": [ "src/ghostget.test.ts", "src/runtime.test.ts" ], "assumptions": [ "same-user-trusted", "encryption" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "browser-admission-cap-two", "statement": "At most two locally owned browser acquisitions run concurrently across processes sharing one state home.", "area": "browser-admission", "source": { "path": "SECURITY.md", "quote": "Ghostget caps locally owned browser acquisition at two across processes sharing one state home" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/browser-admission.model.test.ts", "src/browser-admission.property.test.ts", "src/browser-admission.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "process-liveness" ], "notVerified": [ "The fast-check model drives production acquireBrowserAdmission and acquireCaptureBrowserWithAdmission against real slot files in one state home, with simulated processes that all reuse one PID, an injected monotonic clock that jumps on every read, owner deaths, unreadable liveness, and reboots. CI runs 8 generated sequences of up to 10 commands. Process and boot identity and owner liveness come from the model through the dependency seams, answered as a truthful processOwnerStatus would; the real readings are covered by src/process-identity.test.ts.", "The acquisitions run one at a time in one process; concurrent creates from separate processes are covered by the listed example and property tests, and the slot create relies on the atomic create-if-absent the filesystem-atomic-rename assumption names.", "Seeded defects that reclaim every claim, or a same-boot claim whose owner reads as dead, are killed by the model.", "The claim was scheduled as a Quint model with production replay; it is evidenced by the stateful model instead." ], "properties": [ { "path": "src/browser-admission.model.test.ts", "test": "never runs more than two acquisitions, never reclaims a same-boot claim, and never launches after expiry" } ] }, { "id": "browser-admission-no-pid-reuse-reclaim", "statement": "PID reuse alone cannot reclaim a browser admission claim; automatic reclamation requires a verified prior boot and same-boot claims stay occupied after owner death.", "area": "browser-admission", "source": { "path": "SECURITY.md", "quote": "PID reuse alone cannot reclaim a claim. Automatic reclamation requires a verified prior operating-system boot" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/browser-admission.model.test.ts", "src/browser-admission.property.test.ts", "src/browser-admission.test.ts", "src/process-identity.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "process-liveness" ], "notVerified": [ "The fast-check model drives production acquireBrowserAdmission and acquireCaptureBrowserWithAdmission against real slot files in one state home, with simulated processes that all reuse one PID, an injected monotonic clock that jumps on every read, owner deaths, unreadable liveness, and reboots. CI runs 8 generated sequences of up to 10 commands. Process and boot identity and owner liveness come from the model through the dependency seams, answered as a truthful processOwnerStatus would; the real readings are covered by src/process-identity.test.ts.", "The model checks that a same-boot claim stays occupied after its owner dies or becomes unreadable, and that only a claim from an earlier boot is reclaimed. That a boot identity really changes at reboot and that a process-start identity really distinguishes reused PIDs are assumptions of process-liveness, checked only by the listed example tests.", "A seeded defect that reclaims a same-boot claim whose owner reads as dead is killed by the model.", "The claim was scheduled as a Quint model with production replay; it is evidenced by the stateful model instead." ], "properties": [ { "path": "src/browser-admission.model.test.ts", "test": "never runs more than two acquisitions, never reclaims a same-boot claim, and never launches after expiry" } ] }, { "id": "browser-admission-malformed-reduces-capacity", "statement": "A malformed claim, unverifiable owner, or unsafe state path reduces available capture capacity and never creates an extra slot.", "area": "browser-admission", "source": { "path": "SECURITY.md", "quote": "A malformed claim, an unverifiable owner, or an unsafe state path reduces available capture capacity and never creates an extra slot." }, "layer": "example", "status": "evidenced", "evidence": [ "src/browser-admission.property.test.ts", "src/browser-admission.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "process-liveness" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "browser-admission-no-launch-after-deadline", "statement": "Admission polling is budgeted to min(remaining capture time, 30 s), and deadline revalidation plus conditional rollback prevent a browser launch after expiry.", "area": "browser-admission", "source": { "path": "SECURITY.md", "quote": "deadline revalidation and conditional rollback prevent a browser launch after expiry" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "src/browser-admission.model.test.ts", "src/browser-admission.test.ts" ], "assumptions": [ "filesystem-atomic-rename", "process-liveness", "monotonic-clock" ], "notVerified": [ "The fast-check model drives production acquireBrowserAdmission and acquireCaptureBrowserWithAdmission against real slot files in one state home, with simulated processes that all reuse one PID, an injected monotonic clock that jumps on every read, owner deaths, unreadable liveness, and reboots. CI runs 8 generated sequences of up to 10 commands. Process and boot identity and owner liveness come from the model through the dependency seams, answered as a truthful processOwnerStatus would; the real readings are covered by src/process-identity.test.ts.", "The model checks every sleep against min(remaining capture time, 30 s, the timeout), that no admission is returned at or after that bound, and that a whole capture launches its browser at most once, under a held slot, before its deadline, with no more time than remains. Browser launch is a stub; what a real browser does with its timeout is not checked.", "Seeded defects that drop the deadline revalidation after a create, launch with no time left, or raise the polling cap to 60 s are killed by the model." ], "properties": [ { "path": "src/browser-admission.model.test.ts", "test": "never runs more than two acquisitions, never reclaims a same-boot claim, and never launches after expiry" } ] }, { "id": "repair-signals-private", "statement": "Repair signals are bounded and contain no account ID, subject, input or input hash, provider output, URL, credential, raw diagnostic, or HAR.", "area": "repair-signals", "source": { "path": "AGENTS.md", "quote": "Keep failed-invocation signals free of account identifiers, inputs, private content, and raw errors." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-cli.test.ts", "src/contract-repair-inbox.test.ts", "src/contracts-repair.test.ts" ], "assumptions": [ "filesystem-atomic-rename" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "repair-inspection-no-demand", "statement": "Catalog, check, cache-only, and identity-only inspection records no repair demand.", "area": "repair-signals", "source": { "path": "AGENTS.md", "quote": "Catalog/check/cache-only/identity-only inspection must not record demand." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-cli.test.ts", "src/contract-repair-inbox.test.ts", "src/contracts-repair-lifecycle.test.ts" ], "assumptions": [ "filesystem-atomic-rename" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "repair-handoff-no-authority", "statement": "Every repair handoff fixes `authority.recapture`, `retry`, `activate`, and `publish` to false; repair signals never authorize capture, retry, activation, or publication, and changed contracts remain unverified candidates.", "area": "repair-signals", "source": { "path": "AGENTS.md", "quote": "Repair handoffs never authorize capture, retry, activation, or publication; changed contracts remain unverified candidates." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-cli.test.ts", "src/contracts-repair-lifecycle.test.ts", "src/contracts-repair.test.ts" ], "assumptions": [ "filesystem-atomic-rename" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "repair-inbox-budget", "statement": "The contract-repair inbox holds at most 128 entries, 2048 bytes per signal, and 262144 bytes total; full storage refuses new leads without evicting live ones.", "area": "repair-signals", "source": { "path": "costs.json", "quote": "budget\": { \"maxEntries\": 128, \"maxBytes\": 262144, \"maxBytesPerSignal\": 2048 }" }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-inbox.test.ts" ], "assumptions": [ "filesystem-atomic-rename" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "repair-inbox-ttl", "statement": "Repair inbox entries are hidden after 30 days and compacted only on the next admitted write; duplicate delivery never rewrites an entry.", "area": "repair-signals", "source": { "path": "costs.json", "quote": "Hidden after 30 days; expired entries are compacted on the next admitted write" }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-inbox.test.ts" ], "assumptions": [ "filesystem-atomic-rename" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "repair-storage-failure-isolated", "statement": "Malformed, unsafe, or contended repair storage never changes the original operation outcome, and inspection never repairs or replaces the cache.", "area": "repair-signals", "source": { "path": "docs/contracts.md", "quote": "Malformed, unsafe, or contended storage never changes the original operation outcome." }, "layer": "example", "status": "evidenced", "evidence": [ "src/contract-repair-inbox.test.ts" ], "assumptions": [ "filesystem-atomic-rename" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "local-cli-digest-authority", "statement": "A local-CLI binding executes only an executable whose exact SHA-256 matches the reviewed tool identity; reported versions are drift checks, not authority.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "the exact executable SHA-256, which is the execution authority" }, "layer": "example", "status": "evidenced", "evidence": [ "src/beeper-local-plugin.test.ts", "src/local-cli-tool-identity.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "local-cli-identity-change-invalidates", "statement": "Changing the tool identity changes the operation implementation and contract hash, so old previews, receipts, caches, and recovery evidence cannot authorize new bytes.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "Changing the tool identity changes the operation's implementation and contract hash, so old previews, receipts, caches, and recovery evidence cannot silently authorize the new bytes." }, "layer": "example", "status": "evidenced", "evidence": [ "src/local-cli-durable-identity.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "local-cli-fixed-argument-positions", "statement": "Caller values fill only reviewed argument positions and cannot select a command, flag, endpoint, target, env var, header, shell fragment, or output path.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "Caller values may fill only reviewed argument positions." }, "layer": "example", "status": "evidenced", "evidence": [ "src/beeper-local-plugin.test.ts", "src/providers/beeper-local-runtime.internal.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "local-cli-command-coverage-ledger", "statement": "Every upstream canonical command maps to exactly one semantic operation or one explicit unavailable reason, and R4 destructive commands are unavailable to provider dispatch.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "Map every canonical command to one semantic Ghostget operation or one explicit unavailable reason." }, "layer": "example", "status": "evidenced", "evidence": [ "src/beeper-local-plugin.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "local-cli-isolated-env", "statement": "Local-CLI children start without a shell, with a minimal environment and operation-private directories, and inherit no credentials, targets, proxies, debug overrides, or user plugins.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "Start the process directly without a shell. Give it a minimal environment and operation-private config, data, cache, and temporary directories." }, "layer": "example", "status": "evidenced", "evidence": [ "src/imessage-direct-plugin.test.ts", "src/providers/beeper-local-runtime.internal.test.ts" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "local-cli-birth-time-readiness", "statement": "Local-CLI readiness requires a nonzero immutable directory birth time for operation-private roots and reports the transport unavailable before staging credentials otherwise.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "The temporary filesystem must expose a nonzero immutable directory birth time for operation-private roots." }, "layer": "not-verified", "status": "not-verified", "evidence": [], "assumptions": [ "provider-behaviour" ], "notVerified": [ "No automated check covers this claim, and no plan phase schedules one.", "No test exercises the birth-time readiness requirement." ] }, { "id": "local-cli-post-spawn-indeterminate", "statement": "Once a local-CLI mutation child starts, any failure (timeout, signal, malformed or lost response) is post-dispatch indeterminate and is never retried.", "area": "local-cli", "source": { "path": "docs/local-cli-providers.md", "quote": "Never retry a mutation after the child may have reached the provider." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-local-cli-replay.test.ts", "src/imessage-direct-plugin.test.ts", "src/providers/beeper-direct-messaging.test.ts", "verification/quint/local-cli.qnt" ], "assumptions": [ "provider-behaviour" ], "notVerified": [ "verification/quint/local-cli.qnt checks one confirmed local-CLI mutation of one or two children, with a dispatch-boundary refusal and seven post-start faults (deadline timeout, signal, nonzero exit, malformed response, lost response, the child's own not-started report, and a failure while recording the acceptance), to Quint simulation depth 8 and Apalache length 8. Its ITF replay compares 1,000 traces with executeImsgDirectOperation for the iMessage send and executeBeeperLocalOperation for Beeper presence.set, one child or the bounded typing-then-paused pair. The traces reduce to a few dozen distinct runner scripts; each script runs once per runtime on a fresh store and every trace is compared with that run.", "The replay replaces runImsgRpc and runBeeperCli with a scripted runner at their seam, so how a real deadline, signal, or lost pipe becomes a thrown error or exit status is covered only by their example tests. The other Beeper mutations share the same dispatch loop and catch but are not replayed; their acknowledgement parsing and readbacks are covered only by the listed example tests.", "Reconciliation from separately obtained evidence, and the kernel's durable journal behind beforeDispatch, are outside this model; fence.qnt covers them." ] }, { "id": "cost-surface-registry", "statement": "Every product data surface (table, bucket, stream, dynamic route, blob, provider meter) is registered in costs.json with kind, retention class, owner, and budget; an unregistered surface fails check:cost-surfaces.", "area": "costs", "source": { "path": "AGENTS.md", "quote": "A new table, bucket, stream, dynamic route, blob, or provider meter fails `check:cost-surfaces` until it registers." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/check-cost-surfaces.mjs", "scripts/ci-pr-gate.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked.", "No unit test covers the surface detector in `scripts/check-cost-surfaces.mjs`." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "Run `bun run check:cost-surfaces` before handoff whenever a data surface changes." } ] }, { "id": "bounded-inputs", "statement": "The parsers and stores that the cited tests exercise bound their inputs before storage or provider I/O: request bytes, row counts, page sizes, batch sizes, retry counts, and event payloads.", "area": "costs", "source": { "path": "AGENTS.md", "quote": "Bound every input before storage or provider I/O" }, "layer": "example", "status": "evidenced", "evidence": [ "src/article-draft-document.test.ts", "src/contract-repair-inbox.test.ts", "src/contracts-plan.test.ts", "src/control/approval-broker.test.ts", "src/control/gateway.test.ts", "src/control/validation.test.ts", "src/messaging-automation-server.test.ts", "src/omni-limits.test.ts", "src/provider-plugin-host.test.ts", "src/provider-plugin-registry.test.ts" ], "assumptions": [], "notVerified": [ "Only the enumerated example cases are checked.", "Modules without a cited test are not checked, and no static scan finds an unbounded input elsewhere." ] }, { "id": "mutation-idempotency-key", "statement": "Every mutating route declares `idempotency: local-at-most-once` with a dedupe window of at least 60 seconds, so a retried write is refused while an unsettled same-intent journal exists and while a fulfilled journal’s dedupe window or duplicate-intent record still holds — a provider charge happens at most once per intent within its window. `idempotency: none` routes are dispatch-free by contract. After the window expires, a retry is admitted as a new charged attempt.", "area": "costs", "source": { "path": "AGENTS.md", "quote": "Every mutation carries an idempotency key; a retried write never double-charges storage, quota, or provider spend." }, "layer": "property", "status": "evidenced", "evidence": [ "src/contract-repair-inbox.test.ts", "src/idempotency-fence.property.test.ts", "src/idempotency-inventory.test.ts", "src/run-journal.test.ts", "src/runtime.test.ts" ], "assumptions": [], "notVerified": [ "The boundary is the dedupe window: a fulfilled journal fulfills its intent while the window holds (or while a duplicate-intent record exists) and an expired window admits a fresh charged attempt. Provider-internal retries below the dispatch boundary, and any provider-side quota accounting, are outside this claim.", "Storage and quota are bounded per-attempt journal artifacts rather than metered charges; each attempt writes its own plan, claim, and receipt, so the at-most-once guarantee covers provider dispatch, not artifact growth.", "The fence predicate is exercised directly over production intentFenceBlocker on synthesized journals; the property does not re-derive the reducer transitions that produce those ledger states." ], "properties": [ { "path": "src/idempotency-fence.property.test.ts", "test": "property: the fulfilled blocker is the same-intent journal whose dedupe ends last" }, { "path": "src/idempotency-fence.property.test.ts", "test": "a succeeded journal fences while its dedupe window holds and admits after expiry" }, { "path": "src/idempotency-fence.property.test.ts", "test": "a duplicate-intent record fences a settled predecessor at every clock reading" } ] }, { "id": "analytics-allowlist-byte-ceiling", "statement": "Analytics events come from a checked allowlist (page lifecycle, web vitals, the two GitHub links) with a byte ceiling per event, canonical-host-only, cookieless, personless, and query-free.", "area": "website", "source": { "path": "AGENTS.md", "quote": "Analytics and metering events come from a checked allowlist with a byte ceiling per event." }, "layer": "example", "status": "evidenced", "evidence": [ "website/analytics.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "Only the enumerated example cases are checked.", "No test asserts a per-event byte ceiling." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Keep analytics canonical-host-only, cookieless, personless" }, { "path": "website/AGENTS.md", "quote": "cookies, replay, identity, feature flags, broad autocapture, console capture" } ] }, { "id": "website-release-identity-from-package", "statement": "Website release identity and install commands derive from the validated root package.json; the skill install command pins hraness/ghostget#v.", "area": "website", "source": { "path": "website/AGENTS.md", "quote": "Derive release identity and install commands from the validated root `package.json`; never copy a version into page source." }, "layer": "example", "status": "evidenced", "evidence": [ "website/site.test.ts", "website/skill-install-command.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "pin its skills source to `hraness/ghostget#v`" } ] }, { "id": "vercel-build-admission-fail-closed", "statement": "A marked or Vercel-signalled build requires the exact marker, VERCEL=1, valid VERCEL_ENV, and exact VERCEL_GIT_COMMIT_REF; production requires website-production and non-production rejects it; inconsistent state fails before build.", "area": "website", "source": { "path": "website/AGENTS.md", "quote": "A marked or otherwise Vercel-signaled build must have the exact marker, `VERCEL=1`, a valid `VERCEL_ENV`, and an exact nonempty `VERCEL_GIT_COMMIT_REF`" }, "layer": "example", "status": "evidenced", "evidence": [ "website/vercel-build.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "preview-builds-independent", "statement": "Preview builds do not depend on npm or GitHub release availability.", "area": "website", "source": { "path": "website/AGENTS.md", "quote": "preview builds must not depend on npm or GitHub release availability and must not emit the production marker" }, "layer": "example", "status": "evidenced", "evidence": [ "website/vercel-build.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "website-marker-production-only", "statement": "Preview, development and local builds never emit the marker and remove any stale marker; a failed verifier or build cannot publish it.", "area": "website", "source": { "path": "AGENTS.md", "quote": "Preview and local builds emit no marker." }, "layer": "example", "status": "evidenced", "evidence": [ "website/vercel-build.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "preview builds must not depend on npm or GitHub release availability and must not emit the production marker" } ] }, { "id": "website-baseline-marker-404-only-v0165", "statement": "The baseline reads the marker twice; a 404 is admitted only when promoting exact v0.16.5, and every later baseline requires one stable valid marker.", "area": "website", "source": { "path": "AGENTS.md", "quote": "The provider baseline reads it twice; only exact v0.16.5 may begin from 404." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "The marker may be absent only at the v0.16.5 baseline that introduces it; every later baseline requires it." } ] }, { "id": "website-www-exact-308", "statement": "Each public snapshot requires exactly one no-follow www 308 whose Location preserves the marker path and query, plus bounded canonical apex health responses.", "area": "website", "source": { "path": "AGENTS.md", "quote": "finishes with two stable apex marker/health snapshots plus one exact no-follow `www` 308 in each snapshot." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "require `www` to return one exact no-follow 308 to the same apex marker path and query" } ] }, { "id": "website-marker-seven-key-canonical", "statement": "Only a verified Production build emits `/.well-known/wrench-release.json`, after the release verifier and site build pass, as one exact canonical seven-key JSON body (schema, package, repository, tag, version, verified HEAD, strict unique Vercel deployment URL) plus one line feed; reordered, expanded, noncanonical, or identity-drifting bodies are rejected.", "area": "website", "source": { "path": "AGENTS.md", "quote": "A verified Production build emits one exact seven-key `/.well-known/wrench-release.json` after its site build, binding the verifier-proven local HEAD and release tag to the strict unique Vercel deployment URL." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/release-provider-outcome.test.ts", "website/production-release-marker.test.ts", "website/production-release-verifier.test.ts", "website/vercel-build.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Each verified Production build emits exact bounded `/.well-known/wrench-release.json` bytes only after the release verifier and site build pass" } ] }, { "id": "website-outcome-baseline-to-target-only", "statement": "During outcome the apex marker may show only the baseline identity or the exact target; a third identity, changed same-release deployment URL, target-to-baseline regression or disagreement with pinned status URLs fails closed.", "area": "website", "source": { "path": "AGENTS.md", "quote": "Outcome requires that deployment URL to equal the pinned status URLs, permits only baseline-to-target movement" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/verification-promotion-replay.test.ts", "verification/quint/promotion.qnt" ], "assumptions": [ "vercel" ], "notVerified": [ "`verification/quint/promotion.qnt` checks one run of the website production workflow after its verify job, with seven abstract commits, one release tag, and a three-observation poll budget, against an environment that may move protected main, the production ref, and the tag, replace Latest, finish or fail the Vercel deployment, change the apex marker, and arm one of ten readback drifts between the two terminal readbacks. Quint simulation checks it with 3,000 samples of up to 14 steps and Apalache to length 11 in the Required verification job (every mutant step is found at that length; at length 10 the single-readback mutant is not), and the nightly workflow repeats it with 10,000 samples of up to 20 steps and Apalache to length 12.", "Its ITF replay runs the production `revalidateReleaseAuthority`, `createProviderBaseline`, `promoteWebsiteProduction`, and `waitForProviderOutcome` on 300 traces of up to 14 steps per step relation, and the production writer's real `/usr/bin/git` tag fetch, peel, and `--force-with-lease` push against a local bare repository. GitHub's REST and GraphQL answers and the public site are stubs computed from the model state, and longer schedules, more commits, and the production poll budget of 20 are not modelled.", "The model's apex marker takes four identities: the baseline, the target at the pinned deployment URL, the target at another deployment URL, and a third release. The replay reaches each refusal: a third identity, a target-to-baseline regression, a changed same-release deployment URL, and disagreement with the pinned status URL. Marker parsing and its canonical form are separate claims." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Public outcome checks require that URL to equal the pinned deployment status" } ] }, { "id": "website-production-build-release-verified", "statement": "A production Vercel build requires VERCEL_GIT_COMMIT_REF=website-production, exact marker env, local HEAD and package version equal to the v tag commit, the canonical artifact, and a non-draft, non-prerelease, Latest immutable Release; main/preview refs never produce production, and missing or inconsistent Vercel state fails before verification.", "area": "website", "source": { "path": "AGENTS.md", "quote": "`main` and pull requests are preview sources, never production website sources." }, "layer": "example", "status": "evidenced", "evidence": [ "website/production-release-verifier.test.ts", "website/vercel-build.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Require `VERCEL_GIT_COMMIT_REF=website-production` only for production" }, { "path": "website/AGENTS.md", "quote": "production verifies immutable GitHub metadata, exact five descriptors, bot/source receipt, manifest/archive digests, HEAD/tag, and Latest" } ] }, { "id": "website-no-vercel-mutation-in-workflows", "statement": "Checked-in workflows stay token-free for Vercel and never mutate project settings, call the Vercel API, redeploy, alias, or promote; promotion outcome uses token-free public HTTPS plus read-only GitHub evidence.", "area": "website", "source": { "path": "docs/publishing.md", "quote": "Checked-in workflows never mutate this project setting, call the Vercel API, or perform an alias or promote operation" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Checked-in workflows remain token-free and never mutate the setting, call Vercel APIs, alias, or promote." } ] }, { "id": "edge-same-origin-retrieval", "statement": "Edge negotiation retrieves only same-origin sibling assets: the retrieved origin equals the request origin for every request path, including `//host/x.md`.", "area": "edge", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "D12: require `retrieved.origin === request.origin` and add the property." }, "layer": "property", "status": "evidenced", "evidence": [ "edge/negotiation.test.ts" ], "assumptions": [ "whatwg-url", "edge-runtime" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "edge/negotiation.test.ts", "test": "property: every retrieved URL keeps the request origin" } ] }, { "id": "edge-accept-406-only-when-empty", "statement": "Over parsed Accept media ranges, document negotiation returns 406 exactly when the header has ranges and no offered representation has a best matching range with q above 0; a selected representation is offered, accepted with q above 0, and has the highest q among the acceptable representations.", "area": "edge", "source": { "path": "edge/AGENTS.md", "quote": "Honor Accept q-values, set `Vary: Accept`, and return `406` only when no owned representation remains." }, "layer": "lean", "status": "evidenced", "evidence": [ "edge/negotiation.test.ts", "scripts/verification-lean-encodings.test.ts", "verification/lean/GhostgetVerification/Edge/Negotiation.lean" ], "assumptions": [ "whatwg-url", "edge-runtime", "verification-tools" ], "notVerified": [ "The Lean theorems are about a Lean model of the selection. The differential test checks that negotiateDocumentRepresentation agrees with that model on generated headers, not on every header.", "The Accept header parser (parseAcceptMediaRanges) is not modelled; the differential test parses each header with the TypeScript.", "Tie-breaking after q (specificity, header order, server preference) is only sampled, and response headers such as Vary: Accept are covered only by the listed tests." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "return `406` only when no owned representation remains" } ] }, { "id": "edge-vary-accept", "statement": "Negotiated document responses set Vary: Accept.", "area": "edge", "source": { "path": "edge/AGENTS.md", "quote": "set `Vary: Accept`" }, "layer": "example", "status": "evidenced", "evidence": [ "edge/negotiation.test.ts" ], "assumptions": [ "whatwg-url", "edge-runtime" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "set `Vary: Accept`" } ] }, { "id": "edge-unknown-404", "statement": "Unknown document paths stay HTTP 404 and serve the static markdown 404 body.", "area": "edge", "source": { "path": "edge/AGENTS.md", "quote": "Unknown document paths stay HTTP 404 and serve the static markdown 404 body." }, "layer": "example", "status": "evidenced", "evidence": [ "edge/negotiation.test.ts" ], "assumptions": [ "whatwg-url", "edge-runtime" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Unknown paths stay HTTP 404" } ] }, { "id": "edge-no-node-imports", "statement": "Edge files import no Node, Bun, website build, or filesystem modules, and middleware.ts imports only edge/.", "area": "edge", "source": { "path": "edge/AGENTS.md", "quote": "Keep every file here free of Node, Bun, website build, and filesystem imports." }, "layer": "example", "status": "evidenced", "evidence": [ "edge/imports.test.ts", "edge/tsconfig.json" ], "assumptions": [ "whatwg-url", "edge-runtime" ], "notVerified": [ "Only static import declarations and `import()` calls with literal specifiers are scanned; test files under `edge/` run on Bun and are not scanned." ] }, { "id": "release-trigger-exact-tag-push-only", "statement": "The Release workflow runs only on a protected direct tag push (no workflow_dispatch); the entry job rejects any event whose sender is not User 894119 or whose repository is not public Ghostget ID 1316443113.", "area": "release", "source": { "path": "AGENTS.md", "quote": "Bind every Release run at entry to a protected tag-push event and embedded sender owned by User `894119` in public Ghostget repository ID `1316443113`." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-source-ci-admission-exact", "statement": "Release admits source only with the exact commit's successful default-branch CI run on its current attempt: exact repository, workflow ID/path, main-push source and tree, every CI job successful with its real checkout log, and recorded workflow/lock hashes and toolchain versions; missing, failed, skipped, ambiguous, stale-attempt, or drifting evidence blocks.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "It requires the exact repository, active workflow ID/path, main-push source and tree" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-source-codeql-exact-two-languages", "statement": "Source admission requires exactly the Actions and JavaScript/TypeScript CodeQL jobs and analyses on the exact source and current main; missing or extra languages, or two exact-source CodeQL runs, are rejected.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Admission requires exactly those two jobs and analyses, with missing or extra languages rejected." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-source-codeql-pr-association", "statement": "The CodeQL PR comparison is accepted via its returned PR association; the exact 'View all branch alerts' summary is a fallback only when the association array is empty, never when a nonempty association contradicts.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "A nonempty contradictory association never falls back to the summary." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-source-evidence-72h-freshness", "statement": "Every required CI and CodeQL job must have completed within 72 hours of admission with valid, non-future timestamps, and each analysis must fall inside its attempt's language-job interval; mutable run update times never establish freshness.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Every required CI and CodeQL job must have completed within 72 hours of admission" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts" ], "assumptions": [ "monotonic-clock", "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-source-no-caller-receipt", "statement": "The source-CI helper resamples control evidence before returning, never reruns CI, and never accepts a caller-supplied receipt.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "The helper samples the control evidence again before returning" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-fresh-build-before-capability", "statement": "After admission Release performs a fresh frozen install and deterministic build, checks dist and bun.lock cleanliness, and the new npm archive passes the strict artifact parser and isolated consumer smoke before any attestation or publication capability exists.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Its new exact npm archive passes the strict artifact parser and isolated consumer smoke before attestation or publication capability is available." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/ci-pr-gate.test.ts", "scripts/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-tag-direct-lightweight", "statement": "A release tag is one direct lightweight v tag on the admitted commit; annotated tags are rejected and a historical tag is never overwritten, annotate-converted, moved or deleted to recover a run.", "area": "release", "source": { "path": "AGENTS.md", "quote": "Keep direct lightweight tags" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/release-ref-authority.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "release-manifest-strict-binding", "statement": "release-manifest.json is parsed strictly and must bind repository, name, version, tag, source C, workflow authority W, run ID/attempt and archive size/SHA-256/SHA-512 to the requested values.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "`release-manifest.json`, the strict `hraness-github-release-v1` identity, including repository/name/version/tag, source `C`, reviewed workflow authority `W`, run ID/attempt, and archive size/SHA-256/SHA-512." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "website/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-file-specific-size-bounds", "statement": "Archive transfer is capped at 12 MiB from v0.18.1 (8 MiB earlier), receipt and manifest at 1 MiB, checksums and provenance at 8 MiB, applied uniformly by preparation, downloads, draft readbacks, attestation and npm handoff without relaxing digest or inventory checks.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "The transfer envelope admits an archive of at most 12 MiB from `v0.18.1`; earlier archives retain their 8 MiB limit" }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "website/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs." ], "properties": [ { "path": "scripts/github-release-artifact.test.ts", "test": "property: foreign archive sizes are accepted exactly within the versioned transfer bound" } ] }, { "id": "release-archive-receipt-ustar-agreement", "statement": "The archive and npm receipt must agree on every safe USTAR entry, mode, count, size and integrity; extra files, traversal, links, malformed receipts, unsafe package configuration and mismatched bytes are rejected, and both tar consumers agree on hostile USTAR headers.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Reject extra files, traversal, links, malformed receipts, unsafe package configuration, and mismatched bytes." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-attest-checkout-free-reauthorized", "statement": "A separate checkout-free attest job reauthorizes owner/run/tag before requesting OIDC and invokes pinned actions/attest; attest and publish_npm are the only jobs with id-token: write.", "area": "release", "source": { "path": "AGENTS.md", "quote": "a separate checkout-free OIDC attestation job" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-single-contents-write-job", "statement": "Across all workflows, the Release publish job is the only job with contents: write; workflow defaults are contents: read and no workflow uses write-all.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "the checked workflow census leaves only the Release `publish` job with a `contents: write` `GITHUB_TOKEN`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-existing-release-single-latest-check", "statement": "An exact Release that already existed gets one immediate Latest check and never enters the convergence loop; after either path the terminal tag, main, control, by-tag and Latest reads must bind the same tag, ID and publication time.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "An exact Release that already existed gets one immediate Latest check and never enters this convergence loop" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-receipt-bot-and-body-prefix", "statement": "Every publication readback requires Actions bot ID 41898282 of type Bot and a deterministic trailing identity record binding repository, tag, source SHA and GITHUB_RUN_ID after notes rendered from the tagged changelog section; target_commitish is informational only and the protected tag must peel to C.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Every publication readback instead requires Actions bot ID `41898282` with type `Bot` and a deterministic trailing identity record binding repository, tag, source SHA, and `GITHUB_RUN_ID`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts", "website/release-notes.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "release-reauthorize-attempt-before-checkout", "statement": "Before the sole write-capable job checks out source, the current attempt's actor and triggering_actor must both be User 894119 and the attempt must bind Release workflow ID 323493609, its exact path, the verified direct tag object and current-main ancestry; delegated reruns fail closed.", "area": "release", "source": { "path": "AGENTS.md", "quote": "Before the sole write-capable job checks out source, use only `actions:read` to bind the exact current attempt—including both `actor` and `triggering_actor`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "release-reauthorize-only-actions-read", "statement": "The reauthorization before checkout uses only actions:read; no Release job holds Administration or calls ruleset/rule-suite endpoints.", "area": "release", "source": { "path": "AGENTS.md", "quote": "use only `actions:read`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-version-monotone-stable", "statement": "A new stable package version must exceed every completed stable Release; a higher raw tag alone is an incomplete request, and the publication path exhausts the bounded completed stable-Release ordering census before creating or publishing a draft.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Choose a new stable package version greater than every completed stable Release. A raw tag is a request, not a completed publication." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-publish-model.test.ts", "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts", "scripts/release-ref-authority.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The census law itself (a target is admitted exactly when it exceeds every completed stable Release in the 500-Release window) is the sampled property in `scripts/release-provider-outcome.test.ts`; the model checks that a clean census precedes each draft creation and publication, and that success never leaves a higher completed stable Release.", "GitHub has no conditional create or publish, so a stable Release that completes between the last census and the PATCH is caught only by the census repeated after publication, which fails the run but cannot undo the already immutable publication. A stable Release that completes after that last census, while the terminal Latest read still names the target, is not detected, and the model injects no such completion." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-five-file-contract", "statement": "The canonical GitHub Release publishes, independently of npm, exactly five files: the packed `.tgz`, `npm-pack.json`, `release-manifest.json` (`hraness-github-release-v1`), `SHA256SUMS` covering the preceding three in order, and `provenance.jsonl`; duplicate, unknown, foreign-URL, or uncommitted assets are rejected.", "area": "release", "source": { "path": "AGENTS.md", "quote": "publish the exact five-file archive/packing-receipt/manifest/checksums/provenance contract independently of npm." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "website/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-attestation-before-mutation", "statement": "Before GitHub mutation, the attestation bundle must cryptographically verify for all four subjects with signed certificate repository/owner IDs, source/ref, workflow, GitHub-hosted push and run ID/attempt exactly matching; a matching archive hash or predicate metadata alone is not authority.", "area": "release", "source": { "path": "AGENTS.md", "quote": "A matching archive hash is insufficient release authority. Before GitHub mutation, require successful cryptographic verification" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/npm-release-workflow.test.ts", "website/github-release-artifact.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "sigstore" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-draft-create-only-on-exact-404", "statement": "A draft is created only after an authenticated exact REST 404 by tag plus bounded inventory discovery shows none exists; any other lookup failure aborts.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Only an authenticated exact REST 404 permits draft creation; other lookup failures abort." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/github-release-publish-model.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The model's lookup faults are HTTP 500 and 403, a status and exit code that disagree, an unparseable response, a 404 with another body, and an unreadable inventory; other malformed responses rest on the parser's example tests." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-upload-missing-only-no-clobber", "statement": "Publication uploads only missing exact asset names without clobber, then downloads each asset by ID within its byte bound and compares bytes and SHA-256 to the verified local artifact before and after publication.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "downloads each exact asset ID with its admitted byte bound, and compares its actual bytes and SHA-256" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/github-release-publish-model.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "Stored-byte corruption is injected only between publisher invocations, not between an upload and its own readback." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-draft-resume-exact-only", "statement": "A pre-existing draft or published Release from the same attesting attempt, including one that a failed-jobs rerun of that run resumes, resumes only with matching Actions bot, source receipt, body, tag, and every already-uploaded asset; a mismatched draft or another attempt fails closed and is never deleted, recreated, clobbered, or relabeled.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "A matching partial draft or published Release from the same attesting attempt, including one a failed-jobs rerun of that run resumes, may resume only with matching source, bot, body, and every already uploaded asset." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/github-release-publish-model.test.ts", "scripts/verification-release-replay.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The model represents a failed-jobs rerun as a further invocation of the same attesting attempt, because the rerun publishes that attempt's attested manifest; that the rerun receives that manifest is covered by the `release-failed-jobs-rerun-recovers-publish` claim, not here." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-single-publish-patch", "statement": "The only publication mutation is one PATCH turning the admitted draft non-draft and requesting Latest after the complete five-file readback; no deletion, tag movement or rollback is ever issued.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "The only publication PATCH changes the admitted draft to non-draft and requests Latest after the complete five-file readback." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/github-release-publish-model.test.ts", "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The model rejects any command outside the publisher's exact reads and three write shapes, so a DELETE, a tag write, or a second PATCH fails it; Git ref writes made outside `publishCanonicalRelease` are covered only by the workflow's example tests." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-closure-check-before-each-write", "statement": "Before each draft creation, missing-asset upload and publication, the helper proves C<=M on fully qualified main and tag refs, requires unchanged release-control closure, and observes two equal combined main-plus-tag advertisements around the proof.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Before each draft creation, missing-asset upload, and publication, fetch only the fully qualified governed main and tag refs, prove `C<=M`, and require unchanged release controls" }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-publish-model.test.ts", "scripts/release-ref-authority.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The model checks that a successful `publication-prewrite` run of the ref-authority helper on current main immediately precedes each draft creation, upload, and publication, and that a failing helper blocks the write. It treats the helper as a black box: its `C<=M` proof, release-control closure, and two equal combined advertisements are covered only by the example tests in `scripts/release-ref-authority.test.ts`." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-completed-release-original-identity", "statement": "A completed Release is accepted only with its original signed identity and exact bot/body receipt; a newly rebuilt artifact never satisfies an existing Release, and a front-run Release or one from another run fails closed.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "A completed release is accepted only with its original signed identity, never with a newly rebuilt artifact." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/github-release-publish-model.test.ts", "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The model covers the bot author (including an owner-authored completed Release that copies the exact receipt body and asset bytes), exact receipt body, and stored bytes; the signed attestation identity is verified before publication and covered by the `release-attestation-before-mutation` claim's example tests, not by the model." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "release-latest-convergence-bounded", "statement": "When creating a missing Release, the workflow pins one older immutable Latest predecessor; Latest may only remain that predecessor or advance to the exact target within at most twelve 5-second absolute slots in a 60-second monotonic deadline; any third identity, regression, drift, clock regression or exhaustion fails closed.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "GitHub's Latest projection may remain only that exact predecessor or advance to the exact created target while the workflow makes at most twelve observations at absolute five-second slots inside one 60-second monotonic deadline." }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/github-release-publish-model.test.ts", "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "monotonic-clock", "github-api", "github-enforcement" ], "notVerified": [ "The property drives `waitForLatestRelease` with a fake API, monotonic clock, and sleeper. The production publisher's `gh api` reader ignores the per-request timeout it is passed and bounds each read only by its 120-second command timeout; a read that completes after the 60-second deadline fails closed, so the deadline bounds acceptance, not wall time.", "The publisher model checks that a fresh publication reads Latest as the target after its terminal authority proof, and one example test in it drives a lagging Latest projection through the production wait on a fake clock; the stateful schedules themselves project Latest immediately.", "The publisher model checks that no draft is created while Latest is a completed Release under a non-stable tag, which the completed-Release census skips; the other refusals of `exactLatestPredecessor` (a mutable, malformed, or not strictly older Latest) rest on its example tests in the same file.", "How quickly GitHub's Latest projection converges is not verified; the window is a fail-closed ceiling." ], "properties": [ { "path": "scripts/release-provider-outcome.test.ts", "test": "property: Latest converges only through the exact predecessor to the exact target inside twelve absolute slots and 60 seconds" } ] }, { "id": "release-never-delete-published", "statement": "A published immutable Release is never deleted or rewritten, even if terminal readback fails after publication; historical versions, tags and assetless Releases are preserved.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "Preserve that immutable release and inspect current authority; never delete or rewrite it." }, "layer": "stateful-model", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/github-release-publish-model.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The publisher model drives the production `publishCanonicalRelease` and its bounded asset downloader against an in-memory fake of GitHub; that GitHub behaves like the fake (drafts invisible to the by-tag endpoint, one published Release per tag, `gh release upload` resolving a tag to its published Release or else the newest draft) is the `github-api` assumption.", "CI samples up to 1,000 schedules of at most 12 commands; it does not enumerate every interleaving.", "The model's history is one assetless predecessor Release; larger histories and tag deletion outside the publisher are not modelled, and the tag rulesets that forbid tag deletion are `github-enforcement` configuration." ], "properties": [ { "path": "scripts/github-release-publish-model.test.ts", "test": "stateful model: every schedule of attempts, faults, and foreign releases keeps the publisher's write laws" } ] }, { "id": "stable-release-concurrency-no-cancel-pending", "statement": "The stable-release concurrency group serializes Release runs without cancelling a pending tag run.", "area": "release", "source": { "path": "docs/publishing.md", "quote": "The workflow's `stable-release` concurrency group and npm's version immutability serialize publication" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The test checks the workflow's single `stable-release` concurrency group with `cancel-in-progress: false` and `queue: max`, and that no job declares its own group. That GitHub then queues pending runs in order is the `github-enforcement` assumption; GitHub still cancels pending runs beyond 100 in the group.", "No live run has exercised three overlapping tag pushes." ] }, { "id": "release-failed-jobs-rerun-recovers-publish", "statement": "Re-running only the failed jobs of a Release run publishes the exact bytes that an earlier attempt of the same run attested: the publisher downloads the carried artifact only by its numeric ID behind an exact-identity guard, admits a manifest whose attempt is no later than the current attempt of the same run, and requires every signed certificate to name that attempt. The canonical download admits an attesting attempt whose publication failed only when a strictly later completed attempt of the same run proves all four canonical jobs in its own job inventory: the current attempt, or one of at most three exact intermediate attempts when the current attempt did not publish.", "area": "release", "source": { "path": "AGENTS.md", "quote": "The GitHub publisher downloads the attested artifact only by numeric artifact ID behind an exact-identity guard, so a failed-jobs rerun publishes the exact bytes and signed attempt its run already attested, never another run's or a later attempt's." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/github-release-artifact.test.ts", "scripts/npm-release-workflow.test.ts", "scripts/verification-release-replay.test.ts", "verification/quint/release.qnt" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "The model and its replay cover the handoff's attempt and signature binding and the canonical download's admission. Downloading the carried artifact by numeric ID behind the exact-identity guard is checked only by the listed example tests.", "That GitHub carries the verify and attestation outputs and their artifact into a failed-jobs rerun, and reports every job of an attempt, carried or not, under that attempt, are assumptions about GitHub Actions; CI does not check them.", "A failed attestation job cannot be recovered this way, because attestation downloads the build of its own attempt; re-running all jobs rebuilds under a new attempt, which the draft body check rejects.", "The model covers one run of up to three attempts; Apalache checks it to depth 10 and seeded simulation samples 2,000 runs of up to 12 steps." ] }, { "id": "release-workflow-isolation", "statement": "The Release workflow never reads, creates, or updates website-production, never receives the release App key or Administration permission, and never waits for Vercel.", "area": "release", "source": { "path": "AGENTS.md", "quote": "The Release workflow must never read, create, or update `website-production`, receive the release App key, or wait for Vercel." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "mutable-presentation-not-authority", "statement": "Release display title, run display name, actor logins and receipt body are presentation; authority comes only from stable numeric IDs/types, the protected tag and immutable Release coordinates, and the sampled source receipt is revalidated on every accepted Release read.", "area": "release", "source": { "path": "AGENTS.md", "quote": "Treat the Release display title, Actions workflow-run display name, actor logins, and receipt body as mutable presentation or control-plane data." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "github-api", "github-enforcement" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-publish-after-canonical-only", "statement": "publish_npm runs only after verify, attest and publish succeed (the immutable GitHub Release exists) and publishes the identical canonical bytes; canonical publication has no dependency on npm.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "The same tag Release run then publishes the identical canonical bytes to npm" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "The test checks the job graph: `publish_npm` transitively needs exactly `authorize`, `verify`, `attest`, and `publish`, no canonical job needs an npm job, and no job or step carries an `if:` or `continue-on-error` that could run npm after a failed prerequisite or let a canonical job succeed without its work. That GitHub skips a job whose needed jobs did not succeed is the `github-enforcement` assumption.", "The identical-bytes half rests on the enumerated example tests of the npm job's artifact-by-ID, archive-hash, and canonical-Release re-read steps." ] }, { "id": "npm-failure-never-blocks-canonical", "statement": "An npm failure never unpublishes or blocks the GitHub Release.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "an npm failure is rerun from the same run and never blocks canonical publication." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/verification-release-replay.test.ts", "verification/quint/release.qnt" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "The model takes the job order (npm after the immutable Release) from the `needs` of `.github/workflows/release.yml`; it does not check that workflow file.", "The replay drives the publisher handoff, promotion authority, and canonical download validators. The draft, resume, and Latest convergence of `publishCanonicalRelease` are modeled but not replayed.", "The model covers one run of up to three attempts; Apalache checks it to depth 10 and seeded simulation samples 2,000 runs of up to 12 steps." ] }, { "id": "npm-failure-never-blocks-promotion", "statement": "A Release attempt that published the canonical Release and then failed a later npm job can still be promoted to the website through manual recovery: its authority resolution and the canonical download admit that attempt only through its bounded job inventory proving the four canonical jobs succeeded, and after a re-run of all jobs, only through the earlier receipt attempt that the Release body names, whose own inventory must prove all four, or, when that receipt attempt attested but did not publish, through one of at most three exact intermediate attempts of the same run whose own attempt record and inventory prove all four. Automatic promotion admits only a first attempt that succeeded.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Manual recovery requires a positive current attempt and admits an unsuccessful latest attempt only through that attempt's own bounded job inventory proving all four or, when that attempt did not publish, through the earlier receipt attempt that the Release body names, whose own bounded inventory must prove all four" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/verification-release-replay.test.ts", "verification/quint/release.qnt" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "The shell gate in `.github/workflows/website-production.yml` that limits automatic promotion to a successful first attempt is outside the model and its replay. The model lets automatic promotion admit any successful latest attempt, a superset of what the gate allows.", "Promotion after an npm failure waits for an owner to dispatch manual recovery; the automatic path fails its first-attempt gate by design.", "The model's `promotionNotBlocked` ghost flags a manual recovery or canonical download refusal whenever any attempt of the run proved all four canonical jobs, independent of the admission rule; the D8 and D15 mutants violate it, and the replay's verdict equality ties it to production. Recovery reads at most three attempts between the receipt attempt and the latest attempt and fails closed beyond that bound, so a Release published by an attempt followed by more than three further reruns cannot be promoted; the model's three attempts never reach that bound, which only the example tests cover.", "The replay serves synthetic run, job inventory, and Release responses to `resolveReleaseAuthority`; it does not exercise the deadline, pagination, or main-branch ancestry reads.", "The model covers one run of up to three attempts; Apalache checks it to depth 10 and seeded simulation samples 2,000 runs of up to 12 steps." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "when that receipt attempt attested but did not publish, through one of at most three attempts strictly between it and the latest whose own attempt record binds the exact owner actors, repository, workflow ID and path, tag push, tag, SHA, and completion and whose own complete bounded inventory proves all four; a wider gap fails closed, and the mutable body only selects which inventories to read." } ] }, { "id": "npm-reauthorize-before-oidc", "statement": "Before npm setup or OIDC minting, publish_npm reauthorizes the current attempt identically to the GitHub publisher (actor and triggering_actor 894119, repository 1316443113, workflow 323493609 at its path, protected tag, verified SHA, main ancestry); delegated reruns fail closed.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Before `publish_npm` sets up npm or mints OIDC, bind its current attempt—including both `actor` and `triggering_actor`—to owner User `894119`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-job-checkout-free-minimal-permissions", "statement": "publish_npm is checkout-free, runs no product source, bun, scripts, NPM_TOKEN or NODE_AUTH_TOKEN, and declares exactly actions: read, contents: read, id-token: write.", "area": "npm", "source": { "path": "docs/publishing.md", "quote": "It is checkout-free, runs no product source or `bun install`, declares only `actions: read`, `contents: read`, and `id-token: write`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-artifact-by-numeric-id-bound", "statement": "publish_npm downloads the attested artifact only by numeric artifact ID and binds all five files to the verify job's SHA-256 hashes and bundle digest, and the manifest to the verified source, tag, workflow, run and package, before handing off only archive and receipt.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Download the attested canonical artifact only by numeric artifact ID and bind all five files to the verify hashes and bundle digest." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "npm-clean-defaults-latest-tag", "statement": "Before publishing, ambient npm_config_tag is absent, user/global/project npm config is empty, pinned npm 11.19.0's default tag is proven to be latest, and npm publish runs without --tag.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Scrub ambient tag variables and project, user, and global npm configuration; prove pinned npm's clean default tag is `latest`;" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-admit-registry-identity-provenance", "statement": "@hraness/ghostget@ is advertised as available only after admit_npm proves the registry tarball matches the canonical archive and npm audit signatures binds publish and SLSA attestations to the tag push, verified commit and release.yml, within a bounded propagation window.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Require the exact public registry package and its npm provenance to match the canonical archive in `admit_npm` before advertising registry availability" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "sigstore", "npm-registry" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "npm-no-token-no-staged-no-dispatch", "statement": "No npm token, staged publish, separate dispatch workflow, or human step follows the tag push; npm-stage.yml does not exist.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "No dispatch, staged publish, token, or human step follows the tag push" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-no-content-policy", "statement": "The @hraness/ghostget package carries no contentPolicy declaration and no DISCLOSURE file.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "the package carries no `contentPolicy` declaration and no `DISCLOSURE` file" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-reread-canonical-before-publish", "statement": "Immediately before npm publish, the immutable canonical Release is re-read by tag: immutable, non-draft, non-prerelease, Actions-bot author, exact source and attempt receipt, exactly five uploaded assets, and archive digest and size equal to the handed-off tarball; returned identity and integrity must match.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "re-read the immutable canonical Release immediately before `npm publish` without `--tag`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "npm-packed-manifest-publication-settings", "statement": "The independently parsed packed manifest must have private omitted or false, no contentPolicy, no top-level tag, and publishConfig exactly {access: public, canonical registry}; scoped registries, proxies, credentials and any other publication setting are rejected.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "permit no top-level `tag` plus only `publishConfig.access=public` and the canonical npm registry—reject scoped registries, proxies, credentials, and all other publication settings." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "npm-registry-state-admission", "statement": "npm mutation is admitted only when the version is absent and public latest is strictly older (publish), or the same version is public with the exact canonical dist.integrity (skip, no second write); every other state, including same version with different bytes or an unprovable registry state, fails closed.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Admit only an absent registry version newer than public `latest`, or the same version already public with the exact canonical integrity (skip without a second write); never overwrite a published version." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "npm-publish-at-most-once-per-version", "statement": "Across any sequence of attempts and reruns of a Release run, an attempt issues `npm publish` only when the registry readback shows the version absent; an ambiguous write resolves by readback and never blind-retries. When the readback lags a rerun can issue a second publish, which npm's per-version immutability refuses, so a published version's bytes never change.", "area": "npm", "source": { "path": "docs/publishing.md", "quote": "The workflow's `stable-release` concurrency group and npm's version immutability serialize publication" }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/npm-publish-model.test.ts", "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "npm-registry" ], "notVerified": [ "The sampled rerun property in `scripts/npm-publish-model.test.ts` runs the real registry-admission and publish step scripts against a fake npm registry: each attempt issues at most one `npm publish`, only after an absent readback, never changes a held version, and never reports success after an ambiguous or failed write.", "The named registry-lag test shows a rerun whose readback still answers absent can issue a second `npm publish`; npm's per-version immutability refuses it, and the held bytes stay canonical. The registry's own immutability is the `npm-registry` assumption; the workflow's responsibility is the absent-readback gate and readback-only ambiguity resolution." ], "properties": [ { "path": "scripts/npm-publish-model.test.ts", "test": "property: each attempt issues at most one npm publish, only after an absent readback, and never changes a held version" } ] }, { "id": "npm-release-env-sole-reference", "statement": "Only the `publish_npm` job references the `npm-release` environment or mints an npm OIDC token; it is the sole environment in `release.yml`, and no other workflow names it.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Only `publish_npm` may reference it or mint an npm OIDC token" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/ci-pr-gate.test.ts", "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "npm-registry" ], "notVerified": [ "Only the enumerated example cases are checked.", "The test covers `release.yml` only; plan Phase 6 adds the scan that no other workflow names the environment." ] }, { "id": "npm-release-env-config", "statement": "GitHub environment npm-release has administrator bypass disabled, no reviewers, no secrets, sole protection rule branch_policy, and the single custom deployment policy tag v* with no branch admitted.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "Keep the `npm-release` environment fail closed: administrator bypass disabled, no reviewers, no secrets, sole protection rule `branch_policy`, and the single custom deployment policy `tag` `v*` with no branch admitted." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "npm-registry", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift.", "The listed tests check only the checked-in side of the contract." ] }, { "id": "npm-trusted-publisher-binding", "statement": "The npm trusted publisher for @hraness/ghostget names exactly hraness/ghostget, release.yml and environment npm-release; no other relationship exists, package access requires 2FA and disallows tokens, and no npm token is stored in GitHub.", "area": "npm", "source": { "path": "AGENTS.md", "quote": "the npm trusted publisher names `release.yml` and this environment." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-api", "npm-registry", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "tag-ruleset-creation-only", "statement": "In each tag ruleset pair, the creation-only ruleset has the exact rule set [creation] and sole always-bypass User 894119; it never authorizes update or deletion.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "In each pair, the creation-only ruleset must have exact rule `creation` and sole always-bypass User `894119`; it must never authorize update or deletion." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "tag-ruleset-immutable", "statement": "In each tag ruleset pair, the immutable ruleset has exact rules [deletion, update] and no bypass actors; it never authorizes creation.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "The immutable ruleset must have no bypass actors and exact deletion plus update rules; it must never authorize creation." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "tag-rulesets-two-split-pairs", "statement": "Exactly four active repository tag rulesets form two split creation-only and immutable pairs, one targeting only `refs/tags/v*` and one targeting only `refs/tags/desktop-v*-macos-arm64`; any other active tag ruleset is drift, and the split semantics, not the ruleset IDs or names, carry the authority.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "read back all four active repository tag rulesets. They form two split pairs: one pair targets only `refs/tags/v*`, and the other targets only `refs/tags/desktop-v*-macos-arm64`." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "Any other active tag ruleset is drift." } ] }, { "id": "immutable-releases-enabled-before-tag", "statement": "Immediately before every stable tag push, signed-in administrator readback shows repository immutable Releases enabled=true.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Immediately before tag dispatch, require administrator readback that immutable Releases are enabled; grant no Administration to workflows." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift.", "An administrator could change the setting between the readback and publication." ] }, { "id": "no-integration-tag-bypass", "statement": "Neither GitHub Actions nor any other Integration has a release-tag ruleset bypass.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Never give GitHub Actions or another Integration a release-tag bypass." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "production-ref-lifecycle-ruleset", "statement": "Ruleset 21832074 targets exactly website-production and website-production-canary with no bypass actors and exact creation, deletion and non-fast-forward rules.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Live ruleset `21832074` supplies no-bypass creation, deletion, and non-fast-forward protection to the production and persistent canary refs." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "production-ref-update-ruleset-app-only", "statement": "Ruleset 21887484 supplies the sole update restriction on both production refs with exactly one Integration bypass, App 4783991, bypass_mode=always; no other actor (including Actions App 15368) may update either ref.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Live ruleset `21887484` supplies the sole update restriction and exact App `4783991` `Integration` bypass with `bypass_mode=always`; no other actor may update either ref." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "protect-main-ruleset", "statement": "Protect-main has no bypass actors, requires the pull-request path and exact Required CI check, approval minimum zero and require_code_owner_review=false while only one eligible code owner exists.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Protect-main has no bypass actors and retains pull-request admission plus the exact Required CI check. Keep its approval minimum at zero and `require_code_owner_review=false` until a second eligible independent code owner exists." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [ "scripts/ci-pr-gate.test.ts" ], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift.", "The listed tests check only the checked-in side of the contract." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "Never force-push or bypass the gate." } ] }, { "id": "production-writer-env-config", "statement": "Environment production-ref-writer-key has deployment=false, main-only branch policy, no required reviewers or wait timer, prevent_self_review=false, no administrator bypass, exactly four App identity variables and the single WRENCH_RELEASE_APP_PRIVATE_KEY secret.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "the main-only, automatically admitted `production-ref-writer-key` environment with no required deployment reviewers or wait timer, no administrator bypass, `prevent_self_review=false`, exactly four App identity variables and the one private-key secret." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift.", "The listed tests check only the checked-in side of the contract.", "The workflow-side `deployment: false` is source-checked; the environment's protection settings are confirmed only by readback." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Keep no required deployment reviewers or wait timer, `prevent_self_review=false`, no administrator bypass, exact `main` admission, and `deployment: false`." } ] }, { "id": "release-app-permissions-exact", "statement": "The release App registration grants exactly metadata:read, contents:write and workflows:write with no Administration or other permission, and installation 158077029 selects only repository ID 1316443113.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "The App registration and every minted token must close to exactly `metadata:read`, `contents:write`, and `workflows:write`, with no Administration or other permission." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Keep the App and minted token permission set exact at `metadata:read`, `contents:write`, and `workflows:write`." } ] }, { "id": "promotion-canary-preserved", "statement": "refs/heads/website-production-canary remains at exactly 0bf88a064233635e0c5485c61f9c533974a7dca4 and is never reset, deleted or repurposed.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Retain persistent canary `refs/heads/website-production-canary` at exact `C=0bf88a064233635e0c5485c61f9c533974a7dca4`; never reset, delete, or repurpose it." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ] }, { "id": "vercel-project-config", "statement": "Vercel project `prj_TZbDZ38ABPan158IqnczgsuTu6Ue` under team `team_UAd1iD2XogJlbFg4h14mRaPM` is linked to GitHub repository 1316443113 with `link.productionBranch=website-production`, `autoExposeSystemEnvs=true`, and persistent `autoAssignCustomDomains=true`; main and pull requests deploy only previews.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "keep exact project `prj_TZbDZ38ABPan158IqnczgsuTu6Ue`, team `team_UAd1iD2XogJlbFg4h14mRaPM`, GitHub repository ID `1316443113`, `link.productionBranch=website-production`, `autoExposeSystemEnvs=true`, and persistent `autoAssignCustomDomains=true`." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "vercel", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Keep Vercel project `prj_TZbDZ38ABPan158IqnczgsuTu6Ue` under team `team_UAd1iD2XogJlbFg4h14mRaPM` linked to GitHub repository ID `1316443113`" } ] }, { "id": "control-drift-freezes-production", "statement": "Any detected control-plane drift (rulesets, App bypass, App permissions, installation selection, writer environment) leaves production unchanged until the controls are requalified by fresh administrator readback.", "area": "control-plane", "source": { "path": "AGENTS.md", "quote": "Any detected drift leaves production unchanged until those controls are requalified." }, "layer": "configuration-readback", "status": "not-verified", "evidence": [], "assumptions": [ "github-enforcement", "administrator-readback" ], "notVerified": [ "Live settings are confirmed only by administrator readback; CI cannot read them or detect drift.", "Drift is detected only at setup, after control changes, and during recovery, not on each routine promotion." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Any detected drift leaves production unchanged until those controls are requalified." } ] }, { "id": "release-app-token-narrowed", "statement": "Every minted App token is requested and validated to carry exactly metadata:read, contents:write, workflows:write, name only repository 1316443113, and a bounded one-hour expiry.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Runtime must request and validate a token narrowed to Ghostget repository ID `1316443113`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "Runtime must narrow and validate the minted token for Ghostget" } ] }, { "id": "release-app-token-revoked-exactly-once", "statement": "After the operation the helper sends exactly one DELETE /installation/token requiring 204 with zero body, then requires two stable 401 denials from the exact installation-repositories endpoint within a 30-second, at-most-ten-slot absolute schedule; a 200 after 401, nonconvergence, malformed or timing-ambiguous responses fail closed and nothing is retried.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "send exactly one empty-204 revocation request and require two stable authorization denials" }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-app-token-revocation.test.ts" ], "assumptions": [ "monotonic-clock", "github-api", "github-enforcement", "vercel" ], "notVerified": [ "The properties drive `revokeReleaseAppTokenWithConvergence` and `withReleaseAppToken` with a fake fetch, clock, and sleeper; live revocation against GitHub is retained evidence from one workflow run, not a CI check.", "GitHub does not guarantee how quickly a revoked token stops working." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "the shared helper must send exactly one empty-204 token revocation" } ], "properties": [ { "path": "scripts/release-app-token-revocation.test.ts", "test": "property: exactly one DELETE, then two stable denials inside ten absolute slots and 30 seconds, or fail closed" }, { "path": "scripts/release-app-token-revocation.test.ts", "test": "property: a minted token is revoked exactly once whatever fails, and an unminted token is never revoked" } ] }, { "id": "release-app-date-before-expiry", "statement": "The GitHub Date header on the DELETE 204 and on every accepted 200 or 401 observation is canonical and strictly precedes the token's expires_at.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Require canonical GitHub `Date` headers strictly before the minted `expires_at` on that DELETE 204 and every accepted 200 or 401." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "release-app-revocation-receipt-semantics", "statement": "propagationObserved=false iff the first two probes are the stable 401 pair with no 200; true iff at least one exact 200 preceded the final two 401s; advanced receipts bind this object as releaseAppRevocation and already-exact binds null.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "`propagationObserved=false` means the first two probes were the stable 401 pair with no observed 200; `propagationObserved=true` means at least one exact 200 preceded the final two stable 401s. Bind that exact bounded object as `releaseAppRevocation`" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-helper-bound-to-production-ref", "statement": "The production helper is hard-bound to website-production and never targets the canary or any other ref.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Keep the production helper hard-bound to `website-production`." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "promotion-workflow-run-binding", "statement": "The automatic workflow_run path requires repository 1316443113, Release workflow 323493609 at its exact path, tag push, first attempt, success, same head repository, and head SHA equal to the peeled immutable tag commit, with the payload run ID equal to the Release receipt's run ID.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "bind its automatic `workflow_run` to Ghostget repository ID `1316443113` and Release workflow ID `323493609` plus the exact path, tag-push event, first attempt, success, head repository, tag, peeled immutable release SHA, and payload run ID." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-manual-recovery-untrusted-tag", "statement": "Manual recovery runs only from the main-origin promotion workflow with an untrusted stable-tag input and carries no upstream SHA, run ID or attempt; it requires a positive current attempt and never reruns or changes the tag Release.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Manual recovery on that same main-origin workflow accepts only an untrusted stable-tag input and carries no upstream SHA, run ID, or attempt." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-run-id-from-receipt", "statement": "The authoritative Release run ID is derived only from the Release's sampled exact Actions receipt and is carried through baseline-v4, promotion-v3 and every later authority, promotion and outcome check.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Carry that run ID through exact `wrench-provider-baseline-v4` and `wrench-provider-promotion-v3` receipts" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-baseline-before-key-wait", "statement": "A complete bounded Vercel Production deployment baseline (at most 500 deployments, two stable order-independent reads bracketed by authenticated GitHub Date headers) is recorded before any key-environment wait.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Record the complete bounded Vercel Production baseline before any key-environment wait." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-deployment-ref-sha-binding", "statement": "The REST deployment's lowercase 40-hex .ref equals .sha equals the verified release commit, while the matching GraphQL deployment reports ref null and the same commitOid.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Bind the REST deployment's lowercase commit `.ref` and `.sha` to the verified release while GraphQL reports a null `ref` and the same `commitOid`." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-recovery-no-newer-success", "statement": "Already-exact recovery selects the unique newest deployment for the verified SHA postdating the Release; a newer or same-second successful deployment for another SHA blocks recovery, while newer terminal failures do not displace the exact candidate.", "area": "promotion", "source": { "path": "docs/publishing.md", "quote": "Recovery from an already-exact branch instead selects the unique newest deployment for the verified SHA and requires it to postdate the immutable Release. A newer or same-second deployment for another SHA blocks recovery when its current Vercel status is successful." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "production-branch-missing-is-hard-failure", "statement": "After the one-time bootstrap, a missing website-production branch is a hard failure; no workflow or recovery creates it.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "After it, a missing production branch is a hard failure." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "promotion-rest-graphql-public-budgets", "statement": "Promotion stays within the documented request budgets: at most 209 REST calls in the provider outcome job and 358 together with the immutable Release workflow, at most 120 GraphQL requests at no more than two points each, and at most 32 unauthenticated public-host GETs.", "area": "promotion", "source": { "path": "docs/publishing.md", "quote": "The immutable Release and downstream promotion workflows together use at most 370 REST calls" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "promotion-actions-read-single-read", "statement": "Only the initial verify job has `actions: read`, and its authority resolution reads the Release Actions run exactly once, binding stable numeric actor and triggering-actor IDs and types, repository identities, workflow ID and path, tag-push event, source SHA, completion, success, and attempt.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "In the initial verify job's authority resolution, read that Actions run exactly once" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "release-app-rest-cap-fourteen", "statement": "The App path makes at most fourteen REST requests (three setup/mint, one DELETE, at most ten probes).", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "cap the App path at fourteen REST requests." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "release-app-env-scrubbed-from-gh", "statement": "Every read-only gh child process has all WRENCH_RELEASE_APP_* values removed from its environment; the installation token reaches only the private GIT_ASKPASS for the exact fetch and push.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Scrub every `WRENCH_RELEASE_APP_*` value from read-only `gh` children." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "every read-only GitHub child must be scrubbed of App values" } ] }, { "id": "promotion-leased-fast-forward-only", "statement": "The production writer fetches only the verified tag, peels it locally to the independently verified SHA without executing tagged code, and pushes exactly one refspec with --force-with-lease=refs/heads/website-production:; a stale lease leaves the ref unchanged and the workflow never creates, deletes, force-moves or recreates the branch.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Fetch only the exact verified tag through the private askpass token, peel it locally" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-ref-authority.test.ts", "scripts/verification-promotion-replay.test.ts", "verification/quint/promotion.qnt" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "`verification/quint/promotion.qnt` checks one run of the website production workflow after its verify job, with seven abstract commits, one release tag, and a three-observation poll budget, against an environment that may move protected main, the production ref, and the tag, replace Latest, finish or fail the Vercel deployment, change the apex marker, and arm one of ten readback drifts between the two terminal readbacks. Quint simulation checks it with 3,000 samples of up to 14 steps and Apalache to length 11 in the Required verification job (every mutant step is found at that length; at length 10 the single-readback mutant is not), and the nightly workflow repeats it with 10,000 samples of up to 20 steps and Apalache to length 12.", "Its ITF replay runs the production `revalidateReleaseAuthority`, `createProviderBaseline`, `promoteWebsiteProduction`, and `waitForProviderOutcome` on 300 traces of up to 14 steps per step relation, and the production writer's real `/usr/bin/git` tag fetch, peel, and `--force-with-lease` push against a local bare repository. GitHub's REST and GraphQL answers and the public site are stubs computed from the model state, and longer schedules, more commits, and the production poll budget of 20 are not modelled.", "The replay's remote is a local bare repository, not GitHub. GitHub's ref-update ruleset and non-fast-forward rule are assumed under `github-enforcement`. That the workflow never creates, deletes, or recreates the branch, that the tag is fetched through the private askpass token, and that the peel executes no tagged code rest on the writer's fixed argument lists, which only the example tests in `scripts/npm-release-workflow.test.ts` check, and on the production-ref lifecycle ruleset, which only a live readback checks.", "Defect found and fixed here: `git push --porcelain` reports a stale `--force-with-lease` as `=` `[up to date]` with exit status 0 when the remote already holds the pushed commit, and the writer accepted that as its own update. It now requires the one porcelain update line from the leased SHA to the release SHA; the test “fails a leased write closed when the remote already holds the release commit” fails on the previous writer, and the replay's seeded `force-push` defect diverges from the model." ] }, { "id": "promotion-c-le-w-le-m", "statement": "Promotion proves release commit C ≤ reviewed workflow source W ≤ protected current main M at every authority check before any provider or ref work, accepts only identical or strictly linear-forward movement of main, rejects rollback or divergence, and binds package, tag, Release, deployment, and production-ref identity to C.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "prove release `C<=W<=M` for protected current main `M`, allowing only linear descendant movement after dispatch" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-ref-authority.test.ts", "scripts/verification-promotion-replay.test.ts", "verification/quint/promotion.qnt" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "`verification/quint/promotion.qnt` checks one run of the website production workflow after its verify job, with seven abstract commits, one release tag, and a three-observation poll budget, against an environment that may move protected main, the production ref, and the tag, replace Latest, finish or fail the Vercel deployment, change the apex marker, and arm one of ten readback drifts between the two terminal readbacks. Quint simulation checks it with 3,000 samples of up to 14 steps and Apalache to length 11 in the Required verification job (every mutant step is found at that length; at length 10 the single-readback mutant is not), and the nightly workflow repeats it with 10,000 samples of up to 20 steps and Apalache to length 12.", "Its ITF replay runs the production `revalidateReleaseAuthority`, `createProviderBaseline`, `promoteWebsiteProduction`, and `waitForProviderOutcome` on 300 traces of up to 14 steps per step relation, and the production writer's real `/usr/bin/git` tag fetch, peel, and `--force-with-lease` push against a local bare repository. GitHub's REST and GraphQL answers and the public site are stubs computed from the model state, and longer schedules, more commits, and the production poll budget of 20 are not modelled.", "C ≤ W is the verify job's precondition in `scripts/release-ref-authority.ts`, covered by `scripts/release-ref-authority.test.ts`; the model fixes it and checks W ≤ M at every source check that passes, including a main that forks from C before W. Linear movement is judged against W: a main that later moves back to an earlier descendant of W still satisfies W ≤ M and is accepted, and protected main's non-fast-forward rule, assumed under `github-enforcement`, excludes that move.", "The model binds the tag, the Release, Latest, and the production ref to C. The package and deployment identity bindings are covered only by the listed example tests." ], "alsoQuotes": [ { "path": "website/AGENTS.md", "quote": "prove `C<=W<=M` for protected current main `M` at every authority sandwich" } ] }, { "id": "promotion-already-exact-no-credentials", "statement": "When the production ref already equals the verified release, promotion takes a separate read-only path with no environment admission, App variable, private key, token mint, or Git push, and binds `releaseAppRevocation` to null.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "An already-exact ref must take a separate read-only path with no environment, App variable, private key, token mint, or Git push." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "promotion-revalidate-after-admission", "statement": "A required fast-forward enters production-ref-writer-key only after immutable release, workflow-source and provider-baseline checks pass, then revalidates C<=W<=M, peeled tag, immutable Release and Latest before credentials and mutation.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "admit it automatically after the existing immutable release, exact workflow-source, and provider-baseline checks pass, then revalidate source and immutable release authority before credentials and mutation" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/verification-promotion-replay.test.ts", "verification/quint/promotion.qnt" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "`verification/quint/promotion.qnt` checks one run of the website production workflow after its verify job, with seven abstract commits, one release tag, and a three-observation poll budget, against an environment that may move protected main, the production ref, and the tag, replace Latest, finish or fail the Vercel deployment, change the apex marker, and arm one of ten readback drifts between the two terminal readbacks. Quint simulation checks it with 3,000 samples of up to 14 steps and Apalache to length 11 in the Required verification job (every mutant step is found at that length; at length 10 the single-readback mutant is not), and the nightly workflow repeats it with 10,000 samples of up to 20 steps and Apalache to length 12.", "Its ITF replay runs the production `revalidateReleaseAuthority`, `createProviderBaseline`, `promoteWebsiteProduction`, and `waitForProviderOutcome` on 300 traces of up to 14 steps per step relation, and the production writer's real `/usr/bin/git` tag fetch, peel, and `--force-with-lease` push against a local bare repository. GitHub's REST and GraphQL answers and the public site are stubs computed from the model state, and longer schedules, more commits, and the production poll budget of 20 are not modelled.", "The model orders the checks inside one run. The `production-ref-writer-key` environment gate, the job `needs` graph, and which steps receive the release-App key are checked only by the workflow example tests in `scripts/npm-release-workflow.test.ts`, and their enforcement is assumed under `github-enforcement`. In the replay the write step stands in for `GitHubApi.advanceRef`, where production mints the release-App token, so the token's own lifecycle is not replayed." ] }, { "id": "promotion-observation-window", "statement": "Provider outcome uses exactly 20 absolute observation slots at minute offsets 0..19 inside one injected monotonic half-open 20-minute window; latency never slides slots, no provider read starts at or after the deadline, and the job has a separate 30-minute timeout.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Keep 20 observation slots at absolute minute offsets zero through 19 inside one injected monotonic 20-minute `[start, deadline)` interval and a separate 30-minute read-only job" }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts" ], "properties": [ { "path": "scripts/npm-release-workflow.test.ts", "test": "keeps 20 absolute observation slots under any read latency and partial sleep wakeups" } ], "assumptions": [ "monotonic-clock", "github-api", "github-enforcement", "vercel" ], "notVerified": [ "The property test runs `waitForProviderOutcome` 100 times against a candidate that never appears, with up to 64 generated read latencies from 1 to 45,000 ms and early sleep wakeups. Generated latencies rarely land exactly on the deadline, so the boundary read, clock regression, overflow, and a sleep that never reaches its slot are covered by the example test “enforces one half-open monotonic 20-minute provider observation deadline”.", "`verification/quint/promotion.qnt` abstracts time and does not carry this claim. The 30-minute provider job timeout is a workflow setting that an example test checks; GitHub enforcing it is assumed under `github-enforcement`." ] }, { "id": "promotion-eventual-promotion-or-stuck-evidence", "statement": "An immutable Release is eventually promoted or leaves explicit stuck evidence (progress law).", "area": "promotion", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "The progress goal is \"an immutable Release is eventually promoted or leaves explicit stuck evidence\"." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-promotion-replay.test.ts", "verification/quint/promotion.qnt" ], "assumptions": [ "github-api", "github-enforcement", "vercel", "ci-runner" ], "notVerified": [ "`verification/quint/promotion.qnt` checks one run of the website production workflow after its verify job, with seven abstract commits, one release tag, and a three-observation poll budget, against an environment that may move protected main, the production ref, and the tag, replace Latest, finish or fail the Vercel deployment, change the apex marker, and arm one of ten readback drifts between the two terminal readbacks. Quint simulation checks it with 3,000 samples of up to 14 steps and Apalache to length 11 in the Required verification job (every mutant step is found at that length; at length 10 the single-readback mutant is not), and the nightly workflow repeats it with 10,000 samples of up to 20 steps and Apalache to length 12.", "Its ITF replay runs the production `revalidateReleaseAuthority`, `createProviderBaseline`, `promoteWebsiteProduction`, and `waitForProviderOutcome` on 300 traces of up to 14 steps per step relation, and the production writer's real `/usr/bin/git` tag fetch, peel, and `--force-with-lease` push against a local bare repository. GitHub's REST and GraphQL answers and the public site are stubs computed from the model state, and longer schedules, more commits, and the production poll budget of 20 are not modelled.", "The progress law is checked as a bounded safety property, not as a temporal one: no Quint or Apalache check of a liveness property under fairness runs. The invariant `boundedVerdict` shows that every run reaches a verdict within nine production steps (three authority checks, the baseline, the promotion checks, the write, and the model's three observations), and `stuckHasEvidence` that every stuck verdict names one of ten reasons that the environment state explains. Every production step stays enabled until the verdict, so under weak fairness for the workflow's jobs a run terminates; that step is argued, not checked.", "The stuck evidence is the failed run's refusal message; the replay maps each production refusal to the model's reason and fails on a refusal it cannot map. Eventual promotion across runs while the environment keeps faulting is outside the model: it needs Vercel to succeed and expose the exact marker inside the observation window.", "Progress assumes fair Actions scheduling and an owner who dispatches manual recovery when the automatic path is ineligible." ] }, { "id": "promotion-success-requires-stable-readbacks", "statement": "Promotion succeeds only with one exact successful Vercel Production deployment plus stable terminal tag, Release, Latest, workflow-source, ref, inventory, status and two byte-stable canonical-host readbacks.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "Bind one exact successful Vercel Production deployment plus stable terminal tag, Release, Latest, workflow source, ref, inventory, status, and canonical-host readbacks before promotion succeeds." }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts", "scripts/verification-promotion-replay.test.ts", "verification/quint/promotion.qnt", "website/production-release-marker.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "`verification/quint/promotion.qnt` checks one run of the website production workflow after its verify job, with seven abstract commits, one release tag, and a three-observation poll budget, against an environment that may move protected main, the production ref, and the tag, replace Latest, finish or fail the Vercel deployment, change the apex marker, and arm one of ten readback drifts between the two terminal readbacks. Quint simulation checks it with 3,000 samples of up to 14 steps and Apalache to length 11 in the Required verification job (every mutant step is found at that length; at length 10 the single-readback mutant is not), and the nightly workflow repeats it with 10,000 samples of up to 20 steps and Apalache to length 12.", "Its ITF replay runs the production `revalidateReleaseAuthority`, `createProviderBaseline`, `promoteWebsiteProduction`, and `waitForProviderOutcome` on 300 traces of up to 14 steps per step relation, and the production writer's real `/usr/bin/git` tag fetch, peel, and `--force-with-lease` push against a local bare repository. GitHub's REST and GraphQL answers and the public site are stubs computed from the model state, and longer schedules, more commits, and the production poll budget of 20 are not modelled.", "The replay arms at most one drift per trace: the production ref, the candidate's status history, the apex marker, Latest, a health route, the `www` redirect, the tag commit, the Release, protected main, or the Production inventory. Combined drifts and GraphQL and REST disagreement are covered only by the listed example tests.", "Byte stability is checked as digest equality of the stubbed bodies; the canonical host's real HTTP behaviour is assumed under `vercel`." ] }, { "id": "promotion-candidate-status-history-clean", "statement": "The pinned candidate's exhaustive REST status history (cap 500, empty sentinel page) must contain no failure, error or inactive row even if a newer row reports success; GraphQL latestStatus.id must equal the REST status node_id.", "area": "promotion", "source": { "path": "AGENTS.md", "quote": "exhaustively audit only the pinned candidate's REST status history. Reject any retained failure, error, or inactive candidate status even after success." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/npm-release-workflow.test.ts", "scripts/release-provider-outcome.test.ts" ], "assumptions": [ "github-api", "github-enforcement", "vercel" ], "notVerified": [ "No property test covers this law yet; only the enumerated example cases are checked." ] }, { "id": "committed-binaries-reproducible", "statement": "Bundled native messaging runtimes are accepted only as exact pinned bytes.", "area": "supply-chain", "source": { "path": "docs/messaging-automation.md", "quote": "Only exact pinned bytes are accepted." }, "layer": "example", "status": "evidenced", "evidence": [ "src/providers/messaging-native-install.test.ts", "src/scripts/install-whatsapp-protocol.test.ts" ], "assumptions": [ "ci-runner" ], "notVerified": [ "Only the enumerated example cases are checked.", "The bundled-runtime install case runs only on darwin-arm64, so only the arm64 `macos-15` job of the macOS CI suite runs it; Linux CI skips it." ] }, { "id": "committed-binaries-provenance", "statement": "The committed native messaging binaries (imsg, wacli) carry a reviewed patch stack over a pinned upstream commit; Required CI recomputes every recorded pin from the checked-in bytes, and the nightly macOS job rebuilds each artifact from pinned source — wacli byte-for-byte, imsg as a pinned-recipe build whose non-deterministic signed bytes are recorded honestly.", "area": "supply-chain", "source": { "path": "kb/plans/formal-verification-assurance.md", "quote": "Build imsg and wacli in CI from pinned source with provenance, and stop committing binaries." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/messaging-runtime-provenance.ts", "scripts/messaging-runtime-provenance.test.ts", ".github/workflows/ci.yml", ".github/workflows/verification-nightly.yml" ], "assumptions": [ "ci-runner" ], "notVerified": [ "imsg is not byte-reproducible: its provenance record reports signedBytesIdentical false and cleanRebuilds 0, so the nightly evidence for imsg is that the pinned recipe builds an arm64 Mach-O under the pinned Swift toolchain — not that the committed bytes re-derive. A deterministic unsigned-build comparison would need upstream link determinism work.", "Neither binary has live provider qualification (account pairing, send, delivery); artifact admission and live qualification stay separate.", "The nightly rebuild asserts the recorded patch-stack tip commit, but upstream repository content is admitted by commit pin plus patch digests, not by a second reviewer." ] }, { "id": "hraness-deps-immutable-pins", "statement": "Hraness dependencies are pinned to reviewed immutable releases or full commits, never sibling paths, submodules, or main.", "area": "supply-chain", "source": { "path": "AGENTS.md", "quote": "Pin Hraness dependencies to reviewed immutable releases or full commits." }, "layer": "example", "status": "evidenced", "evidence": [ "website/site.test.ts" ], "assumptions": [ "ci-runner" ], "notVerified": [ "Only the enumerated example cases are checked.", "`website/site.test.ts` asserts only the design-kit, site-footer, and ui pins; the other Hraness dependencies, and rejection of branches, sibling paths, and submodules, are not checked." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "consume shared design-kit or `@hraness/ui` primitives only at immutable versions" } ] }, { "id": "ci-source-coverage-contract", "statement": "The `Required` job succeeds only when every source CI job succeeds, including `verification`, and each source job runs the checked checkout, toolchain, source-identity, and frozen-install template with SHA-pinned actions, unpersisted credentials, and least permissions.", "area": "ci", "source": { "path": "AGENTS.md", "quote": "Complete `Required` PR CI is the normal final source integration gate for executable and documentation changes" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/ci-pr-gate.test.ts", "scripts/github-release-artifact.test.ts", "scripts/npm-release-workflow.test.ts" ], "assumptions": [ "github-enforcement", "ci-runner" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "CI covers the complete Linux aggregate and a selected macOS suite." } ] }, { "id": "verification-inconclusive-not-evidence", "statement": "A Quint, Apalache, or Lean run passes only on its exact success outcome; a timeout, interruption, violation, unparsed output, or a successful compile or typecheck alone fails `bun run verify` and the `verification` job.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Treat a checker timeout, an inconclusive or unparsed checker result, and a successful compile or typecheck alone as missing evidence" }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-tools.test.ts" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "verification-tools-pinned", "statement": "Quint 0.32.0, Apalache 0.62.2, the Temurin 21.0.12.1+1 JDK, elan 4.2.4, and Lean v4.34.0 are pinned exactly, and every downloaded checker archive, the JDK included, is admitted only at its pinned size and SHA-256.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Pin Quint, Apalache, the JDK, elan, and Lean to exact versions, and admit every downloaded checker archive only at its pinned SHA-256." }, "layer": "example", "status": "evidenced", "evidence": [ ".github/workflows/ci.yml", "scripts/verification-tools.test.ts", "verification/lean/lean-toolchain" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "verification-quint-smoke", "statement": "The Quint smoke model typechecks, passes seeded simulation and bounded Apalache checking of `mutualExclusion`, both checkers find the violation in its unguarded mutant, 1,000 seeded ITF traces replay through a TypeScript reference lock, and the replay rejects a defective lock and every mutant trace that breaks mutual exclusion.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Pair every model with a seeded mutant or pre-fix variant that its checkers must find." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-lock-replay.test.ts", "scripts/verification-tools.test.ts", "verification/quint/lock.qnt", "verification/quint/models.json" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked.", "The smoke model is toolchain evidence: its traces replay through a TypeScript reference lock, not production code." ] }, { "id": "verification-nightly-depth", "statement": "`bun run ./scripts/verification-tools.ts quint-nightly` checks every Quint model at its recorded `nightly` bounds, which the parser rejects when any bound falls below its CI bound or none deepens it; the soak multiplies the run count and time limit of every `assertProperty` and `assertAsyncProperty` by an explicit `GHOSTGET_PROPERTY_RUNS` from 2 to 100; and `.github/workflows/verification-nightly.yml` runs both with the reducer mutants on a schedule, read-only, SHA-pinned, and outside `Required`.", "area": "verification", "source": { "path": "verification/AGENTS.md", "quote": "Give a Quint model `nightly` bounds only when they deepen its CI bounds and none falls below them. Keep `.github/workflows/verification-nightly.yml` read-only and outside `Required`" }, "layer": "example", "status": "evidenced", "evidence": [ ".github/workflows/verification-nightly.yml", "scripts/ci-pr-gate.test.ts", "scripts/verification-soak.ts", "scripts/verification-tools.test.ts", "src/test-support.test.ts", "verification/quint/models.json" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked; `Required` checks the nightly configuration, not a nightly run.", "The nightly workflow has not run on `main` yet. Its first scheduled run after merge is the first CI evidence at the deeper bounds and soak multiplier.", "Only `verification/quint/lock.qnt`, the toolchain smoke model with a `reference` replay target, lists `nightly` bounds. The six production models run in the nightly at their CI bounds, so the nightly deepens no model of production code until one lists `nightly` bounds.", "A nightly failure blocks no merge or release. Only the quarterly review in `docs/claims-review.md` checks that failures were triaged, and no automated check enforces that review.", "The serialized omni runtime test file is outside the soak." ] }, { "id": "verification-source-mutants", "statement": "Every mutant in `verification/mutants.json` changes exactly one occurrence of a guard in `src/run-journal.ts`, `src/messaging-action-store.ts`, or `src/linked-device-lifecycle-journal.ts` and still transpiles, and `bun run ./scripts/verification-mutants.ts` reports it killed only when its fully named test passes alone on unmodified source and is the only failing test on the mutant; a timeout, another failure, or unparsed output is inconclusive and fails the run.", "area": "verification", "source": { "path": "verification/AGENTS.md", "quote": "List every reducer source mutant in `mutants.json` with its defect and the full name of the one test that must fail." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-mutants.ts", "scripts/verification-tools.test.ts", "verification/mutants.json" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "`Required` checks only that each mutant applies, compiles, and names a declared test; the kill runs happen in the nightly workflow.", "The manifest lists hand-picked guards. It is not a mutation score over the reducers, and StrykerJS was evaluated and not adopted (see `docs/claims-review.md`)." ] }, { "id": "verification-itf-strict", "statement": "The ITF reader accepts only the value encodings Quint and Apalache write; bounds a trace's bytes, states, variables, nesting depth, value count, and string bytes; and rejects extra fields, duplicate set members and map keys, non-canonical integers, and states that are misindexed or do not assign exactly the declared variables.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Parse every foreign manifest, package, message, plan, receipt, response, and CLI value from `unknown`; reject extra fields, malformed bounds, ambiguous ownership, and drift." }, "layer": "property", "status": "evidenced", "evidence": [ "scripts/verification-itf.test.ts" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Generated inputs are sampled at the configured run count; this is not a proof over all inputs.", "CI reads only the traces that the pinned Quint and Apalache releases write; another release may write an encoding the reader rejects." ], "properties": [ { "path": "scripts/verification-itf.test.ts", "test": "every container level counts once against the depth bound" }, { "path": "scripts/verification-itf.test.ts", "test": "bounds every string in UTF-8 bytes wherever the trace holds one" }, { "path": "scripts/verification-itf.test.ts", "test": "a set or map is rejected exactly when two members or keys denote the same value" }, { "path": "scripts/verification-itf.test.ts", "test": "a JSON number is read exactly when it is a safe integer other than -0" }, { "path": "scripts/verification-itf.test.ts", "test": "#bigint text is read exactly when it is a canonical decimal integer of at most 78 digits" }, { "path": "scripts/verification-itf.test.ts", "test": "every state must carry its own index and assign exactly the declared variables" } ] }, { "id": "verification-lean-trusted-base", "statement": "The core-only Lean project builds with warnings as errors; every theorem listed in `proofs.json` exists as a theorem whose kernel statement matches its recorded SHA-256; for each seeded defect, the audit checks at the kernel-term level that the defect has the guarded definition's type and that the refutation states exactly the negation of the guarded theorem with the defect in place of the guarded definition; the axiom audit and source scan reject `sorry`, `admit`, native evaluation, unlisted axioms, and other trust escapes; and a seeded `sorry` canary must fail the build and the audit on every run.", "area": "verification", "source": { "path": "verification/AGENTS.md", "quote": "the audit rejects `sorry`, `admit`, native evaluation, unlisted axioms, and other trust escapes." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-tools.test.ts", "verification/lean/AxiomAudit.lean", "verification/lean/GhostgetVerification/Smoke.lean", "verification/lean/proofs.json" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked.", "The smoke theorems state nothing about Ghostget code, and the Lean kernel and toolchain are trusted.", "The negation check compares kernel terms syntactically; a refutation that is only definitionally equal to the negation is rejected, not accepted." ] }, { "id": "verification-model-replay-required", "statement": "Every Quint model records its invariants, seeds, bounds, a mutant, and a replay test, and the register accepts an evidenced Quint claim only when it cites a model whose replay test drives production code.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Count a Quint model as conformance evidence only after an ITF trace replay test drives production code through its traces; until then it is design evidence." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-claims.test.ts", "scripts/verification-tools.test.ts", "verification/quint/models.json" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "verification/AGENTS.md", "quote": "Set the replay target to `production` only when the replay test drives production code" } ] }, { "id": "verification-register-complete", "statement": "Every guideline in the scanned `AGENTS.md` guides maps to exactly one register rule whose digest matches its current text and which lists at least one claim or an exemption reason, and every evidence path in the register exists.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "When you add or change a rule in an `AGENTS.md`, update its claims and rule digest in `verification/claims.json` in the same change." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-claims.test.ts" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ] }, { "id": "verification-claim-scope", "statement": "Every claim carries its layer, status, assumptions, and a non-empty not-verified scope, and `docs/assurance.md` is generated from the register and fails its freshness test when stale.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Give every claim its not-verified scope, and regenerate `docs/assurance.md`." }, "layer": "example", "status": "evidenced", "evidence": [ "docs/assurance.md", "scripts/verification-claims.test.ts" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "verification/AGENTS.md", "quote": "Keep a claim `planned` with its plan phase until its layer runs in CI." } ] }, { "id": "verification-shrink-promotion", "statement": "Every failing seed recorded in the seed corpus is replayed by its named property and cites a named example test registered beside that property.", "area": "verification", "source": { "path": "AGENTS.md", "quote": "Promote every recorded shrink or failing seed to a named example test." }, "layer": "example", "status": "evidenced", "evidence": [ "src/test-harness-policy.test.ts", "src/test-support.test.ts", "src/contracts-invoke-read.test.ts" ], "assumptions": [ "bun-runtime" ], "notVerified": [ "Only failures someone records in `verification/seeds/corpus.json` are checked; a shrink fixed without a corpus entry is not.", "The check confirms that the cited regression test is registered, not that it exercises the recorded input; only the `contracts-invoke-read` entry pins its generated input with `fc.sample`." ], "alsoQuotes": [ { "path": "AGENTS.md", "quote": "then promote a minimized failure to a named regression" }, { "path": "verification/AGENTS.md", "quote": "Record a failing seed and shrink path in `seeds/corpus.json` under the property's name" } ] }, { "id": "verification-unpublished", "statement": "The published package excludes `verification/`, the verification scripts, and checker downloads, and generated traces, Lean build output, and downloaded checkers stay out of Git.", "area": "verification", "source": { "path": "verification/AGENTS.md", "quote": "Keep this directory, the verification scripts, and the checker downloads out of the published package." }, "layer": "example", "status": "evidenced", "evidence": [ "scripts/verification-tools.test.ts" ], "assumptions": [ "ci-runner", "verification-tools" ], "notVerified": [ "Only the enumerated example cases are checked." ], "alsoQuotes": [ { "path": "verification/AGENTS.md", "quote": "Keep generated traces, build output, and downloaded tools out of Git." } ] }, { "id": "website-informational-only", "statement": "`website/` explains and documents Ghostget and contains no agent runtime, authenticated product surface, or browser-based substitute for the CLI and SDK.", "area": "website", "source": { "path": "AGENTS.md", "quote": "Keep `website/` informational: it may explain and document Ghostget, but must not grow an agent runtime, authenticated product surface, or browser-based substitute for the CLI and SDK." }, "layer": "not-verified", "status": "not-verified", "evidence": [], "assumptions": [ "vercel" ], "notVerified": [ "No automated check inspects `website/` for authenticated surfaces, credential handling, or runtime features; review alone enforces this boundary." ] }, { "id": "intent-fence-subject-across-locators", "statement": "New run journals record the provider subject their auth record named; before dispatch, the confirmed-write fence also refuses while an unsettled run of the same provider target, operation, canonical input, and duplicate-risk source recorded the same subject under a different auth locator, both in its journal scan and in a recheck after its own claim is on record. Journals without a subject keep the per-locator fence and stay valid.", "area": "mutations", "source": { "path": "docs/effect-confirmed-write-runtime.md", "quote": "the fence also refuses while an unsettled run of the same provider target, operation, and canonical input" }, "layer": "quint", "status": "evidenced", "evidence": [ "scripts/verification-fence-replay.test.ts", "src/confirmed-write-intent-fence.test.ts", "src/run-journal.test.ts", "verification/quint/fence.qnt" ], "assumptions": [ "filesystem-durability", "same-user-trusted" ], "notVerified": [ "Subjects are compared as strings. The operator may type a subject, so two locators that record one subject are fenced as one account even when they are not; this only refuses more. Two locators of one account with no recorded subject, or a run recorded before journals kept the subject, are not fenced against each other.", "Two runs that race past their scans may both refuse at the recheck; neither dispatches, and each is retried after the other settles. No progress law is checked.", "The fence model has two locators, one subject, three runs, 5,000 simulated samples of up to 12 steps, and Apalache to length 8; the replay drives the subject scan and recheck through the pure fence cores and a five-trace file-backed cover, not the `confirmInvocation` program, which the listed example tests cover.", "A succeeded run under another locator neither fences nor replays across locators, by design." ] } ] }