coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(cases): validate optional exact machine descriptor pins
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 21:23:04 +02:00
parent 8ae5150d4d
commit 015694ee41
6 changed files with 187 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tools/security-case-types/README.md
View file

@ -95,3 +95,18 @@ Integration tests invoke actual sibling Mason `prepare` and Warden `Journal.save
with metadata fixtures only. They need those owner source checkouts, and existing
type suites need the public KeyCape request file and provider declarations beside
the checkout. `NET_KINGDOM_ROOT` selects the source root for the 1.2 package tests.
## Machine descriptor source pins
The optional `spec.execution_descriptors` map uses the existing Warden kernel's
step-to-exact-descriptor-byte SHA-256 contract. The JSON schema accepts at most
128 lowercase `sha256:<64 hex>` pins. The semantic validator additionally requires
every key to name a declared follow-through step. Malformed maps are refused by
the direct evidence API too. Absent and partial maps remain legal for source
preparation; missing steps remain explicit in the evidence report.
A valid pin is source metadata. It does not authenticate its owner, acknowledge
a machine seam, admit an adapter or change the implemented-type requirement.
The existing browser types contain no descriptors; their bytes and lifecycle
states are unchanged. Owner descriptor/provenance acceptance and actual native
receipts remain prerequisites to execution and acceptance.