Cover local acceptance gaps and reject nonfinite JSON exponents
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
This commit is contained in:
parent
c29bf39b5d
commit
3e537d117f
12 changed files with 604 additions and 34 deletions
|
|
@ -3,31 +3,31 @@
|
|||
This maps the current repository tests to the obligations in
|
||||
[acceptance v0.1](../specs/acceptance-v0.1.md). A listed test is evidence for its
|
||||
specific assertion, not completion of the whole criterion. The local suite uses
|
||||
disposable keys, fake clocks and loopback HTTP; it does not prove independent UTC
|
||||
disposable keys, fake clocks and loopback HTTP/TLS; it does not prove independent UTC
|
||||
accuracy, production admission or native consumer correctness.
|
||||
|
||||
Test names below are in `tests/test_clock.py`, `tests/test_authority.py`, and
|
||||
`tests/test_health.py` unless otherwise noted. Parameterized cases count as tests,
|
||||
Test names below are in `tests/test_*.py`; the added protocol, transport,
|
||||
attribution and interval sweeps have dedicated files. Parameterized cases count as tests,
|
||||
not additional acceptance criteria. The release smoke script is separate from
|
||||
pytest and runs against an installed wheel.
|
||||
|
||||
| ID | Existing local evidence | Uncovered or native obligation; existing owner record |
|
||||
| --- | --- | --- |
|
||||
| C01 | `test_interval_contains_send_with_asymmetric_delay` changes `time.time` and exercises the injected timer | No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02 |
|
||||
| C02 | `test_interval_contains_send_with_asymmetric_delay`; `test_lifecycle_during_exchange_refuses[delay]` | One deterministic asymmetric-delay case, not property-based interval coverage or measured network guarantees: 0002-T03, 0004-T02 |
|
||||
| C03 | `test_signed_wrong_binding_refuses`, `test_bad_signature`, `test_rotation_requires_fresh_client_and_matching_signer`; wheel smoke refuses wrong key | No exhaustive version/header/modified-uncertainty matrix; accepted signing/trust profile: 0002-T02 |
|
||||
| C02 | `test_interval_encloses_true_receipt_across_asymmetry_and_drift` sweeps 324 combinations of outbound/inbound delay, processing, authority error, verification delay and timer drift; delayed exchange refusal | A finite deterministic sweep under explicit error assumptions is not measured network or oscillator evidence: 0002-T03, 0004-T02 |
|
||||
| C03 | `test_signed_wrong_binding_refuses`, `test_bad_signature`, signed invalid version/number samples, unadmitted and malformed headers, modified uncertainty, signer rotation; wheel smoke refuses wrong key | Finite adversarial cases do not exhaust possible inputs; accepted signing/trust profile: 0002-T02 |
|
||||
| C04 | `test_replay_refused`, delayed-exchange refusal, `test_restart_preserves_floor`, `test_new_client_cannot_reset_expired_trust` | Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02 |
|
||||
| C05 | `test_authority_refuses_unusable_health`, `test_restart_changes_epoch`, `test_step_at_final_timestamp_latches_refusal`, `test_health_expires_during_sample_preparation`, `test_health_model_refusals`, collector replacement test | Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013 |
|
||||
| C06 | `test_lifecycle_during_exchange_refuses[suspend/domain/backward]`; boot-bound admission behavior | Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02 |
|
||||
| C06 | `test_lifecycle_during_exchange_refuses[suspend/domain/backward]`; boot-bound admission; 45 elapsed-time cases spanning drift bounds and timer disagreement | Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02 |
|
||||
| C07 | `test_validity_uses_entire_interval` checks entirely valid, not-before overlap and exact expiry | Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03 |
|
||||
| C08 | Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation | No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02 |
|
||||
| C09 | Wrong signer and changed/revoked trust refusal; wheel smoke requires explicit disposable loopback admission | No real invalid-date TLS bootstrap or redirect-server integration test in this suite. Transport trust acceptance: 0002-T02, 0005-T03 |
|
||||
| C09 | Real TLS positive control and expired/not-yet-valid/wrong-host/untrusted certificate refusals; all five redirect statuses refused without following; wrong signer and changed/revoked trust refusal | Disposable CA tests do not prove production bootstrap or trust distribution. Transport trust acceptance: 0002-T02, 0005-T03 |
|
||||
| C10 | No approval/CAS concurrency fixture in this repository | Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03 |
|
||||
| C11 | `attribution.py` emits recording-time evidence; no direct attribution test | No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03 |
|
||||
| C11 | `test_recording_evidence_preserves_original_event` verifies additive recording-time labels and preservation when merged; disabled, unavailable and expired-clock paths are tested | No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03 |
|
||||
| C12 | No occurrence-ordering test; application clock returns intervals | Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03 |
|
||||
| C13 | `test_strict_json`, `test_http_framing_refused`, `test_malformed_health_is_stable_http_refusal`, `test_bad_policy_refuses`, `test_helper_failures_are_sanitized` | Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03 |
|
||||
| C13 | Signed numeric overflow, units/types, malformed headers/envelopes and nonfinite exponent refusal; strict JSON, HTTP framing, malformed health/policy/helper tests | Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03 |
|
||||
| C14 | `test_rotation_requires_fresh_client_and_matching_signer`, changed-trust refusal, expired admission and persisted rollback tests | Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05 |
|
||||
| C15 | `test_connection_limit_and_capacity_recovery`, HTTP liveness/readiness separation, framing and delayed-exchange tests | Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06 |
|
||||
| C15 | `test_connection_limit_and_capacity_recovery`, HTTP liveness/readiness separation, unexpected status/media/encoding refusals, framing and delayed-exchange tests | Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06 |
|
||||
| C16 | `tools/wheel_smoke.py` checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal | This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03 |
|
||||
|
||||
## Release and dependency evidence
|
||||
|
|
@ -45,3 +45,19 @@ reproduction procedure. No test or artifact publication makes the proposed
|
|||
contract adopted. The 0003 closeout is limited to the reference implementation;
|
||||
its original task prose is broader than the evidence in several rows above.
|
||||
Those unproven native claims remain in existing 0002/0004/0005 records.
|
||||
|
||||
|
||||
## Local gap follow-up
|
||||
|
||||
The expanded suite passes 167 tests and 4 subtests. The two arithmetic sweep
|
||||
tests additionally exercise 324 signed-exchange scenarios and 45 elapsed-time
|
||||
scenarios internally; these are not separate pytest counts. The true-time oracle
|
||||
uses independent simulated transit/processing/verification time and authority
|
||||
error, with ±500ppm simulated timer drift inside the declared 1000ppm allowance.
|
||||
This validates containment under that model, not a universal platform drift bound.
|
||||
|
||||
The nonfinite exponent regression exposed a parser gap: Python JSON parsing can
|
||||
turn `1e999` into infinity without invoking the literal-constant callback. The
|
||||
parser now rejects nonfinite floats at every nesting level while retaining finite
|
||||
JSON numbers. All certificates and keys in the transport tests are disposable;
|
||||
TLS verification remains enabled and each refusal checks its certificate reason.
|
||||
|
|
|
|||
73
docs/evidence/2026-09-28-protocol-hardening/runtime.cdx.json
Normal file
73
docs/evidence/2026-09-28-protocol-hardening/runtime.cdx.json
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"bomFormat": "CycloneDX",
|
||||
"components": [
|
||||
{
|
||||
"name": "PyJWT",
|
||||
"purl": "pkg:pypi/pyjwt@2.14.0",
|
||||
"type": "library",
|
||||
"version": "2.14.0"
|
||||
},
|
||||
{
|
||||
"name": "attrs",
|
||||
"purl": "pkg:pypi/attrs@26.1.0",
|
||||
"type": "library",
|
||||
"version": "26.1.0"
|
||||
},
|
||||
{
|
||||
"name": "cffi",
|
||||
"purl": "pkg:pypi/cffi@2.1.1",
|
||||
"type": "library",
|
||||
"version": "2.1.1"
|
||||
},
|
||||
{
|
||||
"name": "cryptography",
|
||||
"purl": "pkg:pypi/cryptography@50.0.1",
|
||||
"type": "library",
|
||||
"version": "50.0.1"
|
||||
},
|
||||
{
|
||||
"name": "jsonschema",
|
||||
"purl": "pkg:pypi/jsonschema@4.26.0",
|
||||
"type": "library",
|
||||
"version": "4.26.0"
|
||||
},
|
||||
{
|
||||
"name": "jsonschema-specifications",
|
||||
"purl": "pkg:pypi/jsonschema-specifications@2025.9.1",
|
||||
"type": "library",
|
||||
"version": "2025.9.1"
|
||||
},
|
||||
{
|
||||
"name": "pycparser",
|
||||
"purl": "pkg:pypi/pycparser@3.0",
|
||||
"type": "library",
|
||||
"version": "3.0"
|
||||
},
|
||||
{
|
||||
"name": "railiance-clock",
|
||||
"purl": "pkg:pypi/railiance-clock@0.1.0",
|
||||
"type": "library",
|
||||
"version": "0.1.0"
|
||||
},
|
||||
{
|
||||
"name": "referencing",
|
||||
"purl": "pkg:pypi/referencing@0.37.0",
|
||||
"type": "library",
|
||||
"version": "0.37.0"
|
||||
},
|
||||
{
|
||||
"name": "rpds-py",
|
||||
"purl": "pkg:pypi/rpds-py@2026.6.3",
|
||||
"type": "library",
|
||||
"version": "2026.6.3"
|
||||
},
|
||||
{
|
||||
"name": "typing_extensions",
|
||||
"purl": "pkg:pypi/typing-extensions@4.16.0",
|
||||
"type": "library",
|
||||
"version": "4.16.0"
|
||||
}
|
||||
],
|
||||
"specVersion": "1.5",
|
||||
"version": 1
|
||||
}
|
||||
127
docs/evidence/2026-09-28-protocol-hardening/verification.json
Normal file
127
docs/evidence/2026-09-28-protocol-hardening/verification.json
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
{
|
||||
"build_requirements_sha256": "ff153e73ea3a33c7d33858be50eda03943c5ef5e2706477a90ca76d250878adb",
|
||||
"build_tools": [
|
||||
[
|
||||
"hatchling",
|
||||
"1.32.4"
|
||||
],
|
||||
[
|
||||
"packaging",
|
||||
"26.3"
|
||||
],
|
||||
[
|
||||
"pathspec",
|
||||
"1.1.1"
|
||||
],
|
||||
[
|
||||
"pluggy",
|
||||
"1.6.0"
|
||||
],
|
||||
[
|
||||
"tomlkit",
|
||||
"0.15.1"
|
||||
],
|
||||
[
|
||||
"trove-classifiers",
|
||||
"2026.9.21.13"
|
||||
]
|
||||
],
|
||||
"byte_identical": true,
|
||||
"checkout_build": {
|
||||
"railiance_clock-0.1.0-py3-none-any.whl": "d6816343fe20007e05d50bf5b8578cdf68e4c12db2f32df6fd71766e40a69fd0",
|
||||
"railiance_clock-0.1.0.tar.gz": "4465d517f9636ec2243394abdc8e0a3086ad809b81d338be5d0620e0febf90ad"
|
||||
},
|
||||
"independent_builds": [
|
||||
{
|
||||
"railiance_clock-0.1.0-py3-none-any.whl": "d6816343fe20007e05d50bf5b8578cdf68e4c12db2f32df6fd71766e40a69fd0",
|
||||
"railiance_clock-0.1.0.tar.gz": "4465d517f9636ec2243394abdc8e0a3086ad809b81d338be5d0620e0febf90ad"
|
||||
},
|
||||
{
|
||||
"railiance_clock-0.1.0-py3-none-any.whl": "d6816343fe20007e05d50bf5b8578cdf68e4c12db2f32df6fd71766e40a69fd0",
|
||||
"railiance_clock-0.1.0.tar.gz": "4465d517f9636ec2243394abdc8e0a3086ad809b81d338be5d0620e0febf90ad"
|
||||
}
|
||||
],
|
||||
"limits": "Local Linux build/install evidence; no native UTC, security admission, vulnerability audit or cross-platform reproducibility claim.",
|
||||
"platform": "Linux/x86_64",
|
||||
"python": "3.12.3",
|
||||
"runtime_lock_sha256": "fe4b4ab7fb1740648a13ff87d028914d94e4c793bb5957830e776a878c9adbb9",
|
||||
"sbom_sha256": "69b45bf19e94e485d08e7af238f2aa3e3fa4f3969d8a552fcf874a12aa1eb07d",
|
||||
"smoke": {
|
||||
"checks": [
|
||||
"installed_import",
|
||||
"three_packaged_schemas",
|
||||
"cli_help",
|
||||
"signed_http_cli_read",
|
||||
"wrong_key_refusal",
|
||||
"unhealthy_cli_refusal"
|
||||
],
|
||||
"distributions": [
|
||||
[
|
||||
"PyJWT",
|
||||
"2.14.0"
|
||||
],
|
||||
[
|
||||
"attrs",
|
||||
"26.1.0"
|
||||
],
|
||||
[
|
||||
"cffi",
|
||||
"2.1.1"
|
||||
],
|
||||
[
|
||||
"cryptography",
|
||||
"50.0.1"
|
||||
],
|
||||
[
|
||||
"jsonschema",
|
||||
"4.26.0"
|
||||
],
|
||||
[
|
||||
"jsonschema-specifications",
|
||||
"2025.9.1"
|
||||
],
|
||||
[
|
||||
"pycparser",
|
||||
"3.0"
|
||||
],
|
||||
[
|
||||
"railiance-clock",
|
||||
"0.1.0"
|
||||
],
|
||||
[
|
||||
"referencing",
|
||||
"0.37.0"
|
||||
],
|
||||
[
|
||||
"rpds-py",
|
||||
"2026.6.3"
|
||||
],
|
||||
[
|
||||
"typing_extensions",
|
||||
"4.16.0"
|
||||
]
|
||||
]
|
||||
},
|
||||
"smoke_script_sha256": "cdb3adb57a68f95d8fd6878195d0ee7dd7a0a00060bacc2a3f95073e6c0b27ec",
|
||||
"source_base_commit": "c29bf39b5dab1c69d9fa2baf80c974417d7d4e63",
|
||||
"source_date_epoch": "315532800",
|
||||
"source_inputs_sha256": {
|
||||
".gitignore": "74e4a2bdd348ce27bd64fbafbc09bef61433a821df2f23c726b062ead4896ebf",
|
||||
"README.md": "c544450bc755e5743bac961fd3832f20ec4d9f86ec3562ca4a2d734a2d694a3e",
|
||||
"pyproject.toml": "11a3e79fcd7b2929137ebad31647c839edc40572958b08b95f08b0605482416d",
|
||||
"src/railiance_clock/__init__.py": "7c9c93a7d6bee6c68da5c19055c899d84040ecd5186169441f3a4d24d12c45c4",
|
||||
"src/railiance_clock/admission.py": "afbea12a31e8ac6bea002a4d0477564d76698b633e88edeb0d2f60c582b5fc47",
|
||||
"src/railiance_clock/attribution.py": "6cc6a5603295bda8fed47c5b144bdec1c6faff8b27acc440a65b81eb376415bd",
|
||||
"src/railiance_clock/authority.py": "9a7ba85d17d70aeaad86cbb850b36515b7a82aef085799591bdfdf410cd023ee",
|
||||
"src/railiance_clock/cli.py": "8ed77836cbdd823b86de849f76f228355bf47fcbfbbc572e22e6e48662929b59",
|
||||
"src/railiance_clock/client.py": "34401db8cecf76a791013b383f9dc6bd56c0478472fe222f86b2be93505ac00f",
|
||||
"src/railiance_clock/core.py": "32ac078f8729533dbbee15166cd6e450cd8638d178294304c1c60665d536b9a1",
|
||||
"src/railiance_clock/health.py": "366e725eaf68d88df3a236d1f71bde5e5b7f24846932041fbaa46182e88d0f07",
|
||||
"src/railiance_clock/protocol.py": "3aa7755ffc8c03cbf656bc8c82012ba0bf09fc09d9f8647838b6c0f56229f9eb",
|
||||
"src/railiance_clock/schemas/protected-header-v0.1.schema.json": "15de9f38e61b49677479b431c3ef7e37a674e4b817ef8f78a19bc8fc47bbf4f8",
|
||||
"src/railiance_clock/schemas/time-request-v0.1.schema.json": "c5a122b1f1f48872a25fffa5950e60dddd585e87a4da502fc4e873a44ae60f4c",
|
||||
"src/railiance_clock/schemas/time-sample-v0.1.schema.json": "97e026520fff98c7140b8a91b9332ffcba22fd5d509fa983057c7cac6e6aa2d2"
|
||||
},
|
||||
"uv": "uv 0.5.9",
|
||||
"verifier_sha256": "f3eb2a489ddf32bca164a78c0b3c22358bf45703bcd6d0572413353c1875fb81"
|
||||
}
|
||||
|
|
@ -42,9 +42,11 @@ installation similarly uses `uv export --locked` and verifies archive hashes.
|
|||
|
||||
## Retained evidence
|
||||
|
||||
The September 28 run is in
|
||||
[evidence/2026-09-28-release/verification.json](evidence/2026-09-28-release/verification.json)
|
||||
and its [runtime SBOM](evidence/2026-09-28-release/runtime.cdx.json).
|
||||
The current parser-hardening run is in
|
||||
[evidence/2026-09-28-protocol-hardening/verification.json](evidence/2026-09-28-protocol-hardening/verification.json)
|
||||
and its [runtime SBOM](evidence/2026-09-28-protocol-hardening/runtime.cdx.json).
|
||||
The earlier [release-verification receipt](evidence/2026-09-28-release/verification.json)
|
||||
is retained as historical evidence.
|
||||
The receipt records source-input hashes, lock/build-requirement hashes, verifier
|
||||
hashes, Python/uv/build-tool versions, artifact digests and smoke checks. Its base
|
||||
commit identifies the checkout before the verification changes were committed;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue