coulomb/railiance-clock
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify reproducible release artifacts and map acceptance evidence

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
This commit is contained in:
tegwick 2026-09-28 10:22:52 +02:00
parent c976c9c277
commit c29bf39b5d
13 changed files with 577 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

47
docs/acceptance-coverage.md Normal file
View file

@ -0,0 +1,47 @@
# Acceptance coverage — 2026-09-28
This maps the current repository tests to the obligations in
[acceptance v0.1](../specs/acceptance-v0.1.md). A listed test is evidence for its
specific assertion, not completion of the whole criterion. The local suite uses
disposable keys, fake clocks and loopback HTTP; it does not prove independent UTC
accuracy, production admission or native consumer correctness.
Test names below are in `tests/test_clock.py`, `tests/test_authority.py`, and
`tests/test_health.py` unless otherwise noted. Parameterized cases count as tests,
not additional acceptance criteria. The release smoke script is separate from
pytest and runs against an installed wheel.
| ID | Existing local evidence | Uncovered or native obligation; existing owner record |
| --- | --- | --- |
| C01 | `test_interval_contains_send_with_asymmetric_delay` changes `time.time` and exercises the injected timer | No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02 |
| C02 | `test_interval_contains_send_with_asymmetric_delay`; `test_lifecycle_during_exchange_refuses[delay]` | One deterministic asymmetric-delay case, not property-based interval coverage or measured network guarantees: 0002-T03, 0004-T02 |
| C03 | `test_signed_wrong_binding_refuses`, `test_bad_signature`, `test_rotation_requires_fresh_client_and_matching_signer`; wheel smoke refuses wrong key | No exhaustive version/header/modified-uncertainty matrix; accepted signing/trust profile: 0002-T02 |
| C04 | `test_replay_refused`, delayed-exchange refusal, `test_restart_preserves_floor`, `test_new_client_cannot_reset_expired_trust` | Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02 |
| C05 | `test_authority_refuses_unusable_health`, `test_restart_changes_epoch`, `test_step_at_final_timestamp_latches_refusal`, `test_health_expires_during_sample_preparation`, `test_health_model_refusals`, collector replacement test | Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013 |
| C06 | `test_lifecycle_during_exchange_refuses[suspend/domain/backward]`; boot-bound admission behavior | Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02 |
| C07 | `test_validity_uses_entire_interval` checks entirely valid, not-before overlap and exact expiry | Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03 |
| C08 | Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation | No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02 |
| C09 | Wrong signer and changed/revoked trust refusal; wheel smoke requires explicit disposable loopback admission | No real invalid-date TLS bootstrap or redirect-server integration test in this suite. Transport trust acceptance: 0002-T02, 0005-T03 |
| C10 | No approval/CAS concurrency fixture in this repository | Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03 |
| C11 | `attribution.py` emits recording-time evidence; no direct attribution test | No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03 |
| C12 | No occurrence-ordering test; application clock returns intervals | Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03 |
| C13 | `test_strict_json`, `test_http_framing_refused`, `test_malformed_health_is_stable_http_refusal`, `test_bad_policy_refuses`, `test_helper_failures_are_sanitized` | Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03 |
| C14 | `test_rotation_requires_fresh_client_and_matching_signer`, changed-trust refusal, expired admission and persisted rollback tests | Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05 |
| C15 | `test_connection_limit_and_capacity_recovery`, HTTP liveness/readiness separation, framing and delayed-exchange tests | Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06 |
| C16 | `tools/wheel_smoke.py` checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal | This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03 |
## Release and dependency evidence
`tools/verify_release.py` separately checks byte equality of two builds from
separate source roots with different file mtimes, packaged/spec schema equality,
wheel installation into a fresh runtime environment, CLI startup and a signed
loopback exchange. Build tools are hash-pinned in `tools/build-requirements.txt`;
runtime dependencies are installed from a hash-bearing export of `uv.lock`.
The SBOM lists installed runtime distributions and versions, not all platform
libraries, transitive native-library internals, licenses or vulnerability findings.
See [release verification](release-verification.md) for the exact receipt and
reproduction procedure. No test or artifact publication makes the proposed
contract adopted. The 0003 closeout is limited to the reference implementation;
its original task prose is broader than the evidence in several rows above.
Those unproven native claims remain in existing 0002/0004/0005 records.

73
docs/evidence/2026-09-28-release/runtime.cdx.json Normal file
View file

@ -0,0 +1,73 @@
{
"bomFormat": "CycloneDX",
"components": [
{
"name": "PyJWT",
"purl": "pkg:pypi/pyjwt@2.14.0",
"type": "library",
"version": "2.14.0"
},
{
"name": "attrs",
"purl": "pkg:pypi/attrs@26.1.0",
"type": "library",
"version": "26.1.0"
},
{
"name": "cffi",
"purl": "pkg:pypi/cffi@2.1.1",
"type": "library",
"version": "2.1.1"
},
{
"name": "cryptography",
"purl": "pkg:pypi/cryptography@50.0.1",
"type": "library",
"version": "50.0.1"
},
{
"name": "jsonschema",
"purl": "pkg:pypi/jsonschema@4.26.0",
"type": "library",
"version": "4.26.0"
},
{
"name": "jsonschema-specifications",
"purl": "pkg:pypi/jsonschema-specifications@2025.9.1",
"type": "library",
"version": "2025.9.1"
},
{
"name": "pycparser",
"purl": "pkg:pypi/pycparser@3.0",
"type": "library",
"version": "3.0"
},
{
"name": "railiance-clock",
"purl": "pkg:pypi/railiance-clock@0.1.0",
"type": "library",
"version": "0.1.0"
},
{
"name": "referencing",
"purl": "pkg:pypi/referencing@0.37.0",
"type": "library",
"version": "0.37.0"
},
{
"name": "rpds-py",
"purl": "pkg:pypi/rpds-py@2026.6.3",
"type": "library",
"version": "2026.6.3"
},
{
"name": "typing_extensions",
"purl": "pkg:pypi/typing-extensions@4.16.0",
"type": "library",
"version": "4.16.0"
}
],
"specVersion": "1.5",
"version": 1
}

127
docs/evidence/2026-09-28-release/verification.json Normal file
View file

@ -0,0 +1,127 @@
{
"build_requirements_sha256": "ff153e73ea3a33c7d33858be50eda03943c5ef5e2706477a90ca76d250878adb",
"build_tools": [
[
"hatchling",
"1.32.4"
],
[
"packaging",
"26.3"
],
[
"pathspec",
"1.1.1"
],
[
"pluggy",
"1.6.0"
],
[
"tomlkit",
"0.15.1"
],
[
"trove-classifiers",
"2026.9.21.13"
]
],
"byte_identical": true,
"checkout_build": {
"railiance_clock-0.1.0-py3-none-any.whl": "7a4790efc97f19b69e942ae1f91a09b1b2a3b22ceca68e41ea4e45655848e420",
"railiance_clock-0.1.0.tar.gz": "cc23505334fbe7a29c5892d52db50883f62082c3885b1e61b559b6b0f5f0d12f"
},
"independent_builds": [
{
"railiance_clock-0.1.0-py3-none-any.whl": "7a4790efc97f19b69e942ae1f91a09b1b2a3b22ceca68e41ea4e45655848e420",
"railiance_clock-0.1.0.tar.gz": "cc23505334fbe7a29c5892d52db50883f62082c3885b1e61b559b6b0f5f0d12f"
},
{
"railiance_clock-0.1.0-py3-none-any.whl": "7a4790efc97f19b69e942ae1f91a09b1b2a3b22ceca68e41ea4e45655848e420",
"railiance_clock-0.1.0.tar.gz": "cc23505334fbe7a29c5892d52db50883f62082c3885b1e61b559b6b0f5f0d12f"
}
],
"limits": "Local Linux build/install evidence; no native UTC, security admission, vulnerability audit or cross-platform reproducibility claim.",
"platform": "Linux/x86_64",
"python": "3.12.3",
"runtime_lock_sha256": "fe4b4ab7fb1740648a13ff87d028914d94e4c793bb5957830e776a878c9adbb9",
"sbom_sha256": "69b45bf19e94e485d08e7af238f2aa3e3fa4f3969d8a552fcf874a12aa1eb07d",
"smoke": {
"checks": [
"installed_import",
"three_packaged_schemas",
"cli_help",
"signed_http_cli_read",
"wrong_key_refusal",
"unhealthy_cli_refusal"
],
"distributions": [
[
"PyJWT",
"2.14.0"
],
[
"attrs",
"26.1.0"
],
[
"cffi",
"2.1.1"
],
[
"cryptography",
"50.0.1"
],
[
"jsonschema",
"4.26.0"
],
[
"jsonschema-specifications",
"2025.9.1"
],
[
"pycparser",
"3.0"
],
[
"railiance-clock",
"0.1.0"
],
[
"referencing",
"0.37.0"
],
[
"rpds-py",
"2026.6.3"
],
[
"typing_extensions",
"4.16.0"
]
]
},
"smoke_script_sha256": "cdb3adb57a68f95d8fd6878195d0ee7dd7a0a00060bacc2a3f95073e6c0b27ec",
"source_base_commit": "c976c9c277033e9fca384b9e9fcd5d79ff776d43",
"source_date_epoch": "315532800",
"source_inputs_sha256": {
".gitignore": "74e4a2bdd348ce27bd64fbafbc09bef61433a821df2f23c726b062ead4896ebf",
"README.md": "c544450bc755e5743bac961fd3832f20ec4d9f86ec3562ca4a2d734a2d694a3e",
"pyproject.toml": "11a3e79fcd7b2929137ebad31647c839edc40572958b08b95f08b0605482416d",
"src/railiance_clock/__init__.py": "7c9c93a7d6bee6c68da5c19055c899d84040ecd5186169441f3a4d24d12c45c4",
"src/railiance_clock/admission.py": "afbea12a31e8ac6bea002a4d0477564d76698b633e88edeb0d2f60c582b5fc47",
"src/railiance_clock/attribution.py": "6cc6a5603295bda8fed47c5b144bdec1c6faff8b27acc440a65b81eb376415bd",
"src/railiance_clock/authority.py": "9a7ba85d17d70aeaad86cbb850b36515b7a82aef085799591bdfdf410cd023ee",
"src/railiance_clock/cli.py": "8ed77836cbdd823b86de849f76f228355bf47fcbfbbc572e22e6e48662929b59",
"src/railiance_clock/client.py": "34401db8cecf76a791013b383f9dc6bd56c0478472fe222f86b2be93505ac00f",
"src/railiance_clock/core.py": "32ac078f8729533dbbee15166cd6e450cd8638d178294304c1c60665d536b9a1",
"src/railiance_clock/health.py": "366e725eaf68d88df3a236d1f71bde5e5b7f24846932041fbaa46182e88d0f07",
"src/railiance_clock/protocol.py": "d076bfd0482d553e1c57133e7ab532c8360db3c100f164404a7c44211c3290a2",
"src/railiance_clock/schemas/protected-header-v0.1.schema.json": "15de9f38e61b49677479b431c3ef7e37a674e4b817ef8f78a19bc8fc47bbf4f8",
"src/railiance_clock/schemas/time-request-v0.1.schema.json": "c5a122b1f1f48872a25fffa5950e60dddd585e87a4da502fc4e873a44ae60f4c",
"src/railiance_clock/schemas/time-sample-v0.1.schema.json": "97e026520fff98c7140b8a91b9332ffcba22fd5d509fa983057c7cac6e6aa2d2"
},
"uv": "uv 0.5.9",
"verifier_sha256": "f3eb2a489ddf32bca164a78c0b3c22358bf45703bcd6d0572413353c1875fb81"
}

62
docs/release-verification.md Normal file
View file

@ -0,0 +1,62 @@
# Local release verification
Run from this repository on Linux with Python 3.11+ and `uv`:
```sh
python3 tools/verify_release.py --output /tmp/rclk-release-UNIQUE
```
The output directory must not already exist. Temporary keys, virtual environments
and build trees are removed at exit. The output retains `verification.json` and
`runtime.cdx.json`; it does not publish or deploy a package. Package downloads may
require registry access. No production credentials or host clock changes are used.
The verifier performs:
1. Byte comparison of the three packaged JSON schemas against `specs/`.
2. A fresh build environment installed from hash-pinned
`tools/build-requirements.txt`, independently of runtime dependencies.
3. Two sdist/wheel builds from separate source roots with deliberately different
mtimes and fixed `SOURCE_DATE_EPOCH=315532800`. The sdist explicitly includes
source, project metadata and README; Hatchling also includes `.gitignore`.
All four are represented in the input manifest; generated evidence is excluded.
4. A build from the actual checkout, which must match both copied-source builds.
5. A fresh runtime environment installed from the hash-bearing locked runtime
requirements plus the built wheel, followed by `uv pip check`.
6. An isolated (`python -I`) smoke check outside the checkout: installed-package
import, schema presence, CLI startup, a signed HTTP exchange with a disposable
authority, wrong-key refusal, and sanitized CLI failure on unusable health.
7. Installed distribution/version comparison against `uv.lock` and a CycloneDX
runtime component inventory. Build dependencies are listed separately in the
receipt; neither development dependencies nor build tools enter the runtime.
Build constraints can be deliberately refreshed with:
```sh
uv pip compile tools/build-requirements.in --generate-hashes -o tools/build-requirements.txt
```
Review that diff and rerun verification after a refresh. Normal verification
uses the committed pins and does not resolve newer build versions. Runtime
installation similarly uses `uv export --locked` and verifies archive hashes.
## Retained evidence
The September 28 run is in
[evidence/2026-09-28-release/verification.json](evidence/2026-09-28-release/verification.json)
and its [runtime SBOM](evidence/2026-09-28-release/runtime.cdx.json).
The receipt records source-input hashes, lock/build-requirement hashes, verifier
hashes, Python/uv/build-tool versions, artifact digests and smoke checks. Its base
commit identifies the checkout before the verification changes were committed;
the input manifest identifies the exact built contents, including pending edits.
This demonstrates repeatability on the recorded Linux/Python toolchain. It does
not establish reproducibility on other platforms/interpreters, native UTC accuracy,
consumer admission, deployment, license clearance or absence of vulnerabilities.
The component inventory covers installed Python distributions, not system libraries
or native libraries embedded inside third-party wheels. Build timestamps are
normalized metadata and are never used as trusted time.
The [acceptance coverage map](acceptance-coverage.md) distinguishes local checks
from unproven native obligations. RCLK-WP-0003-T03 owns this package evidence;
existing 0002/0004/0005 records retain owner acceptance and deployment gates.