coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Preserve canonical journal digests and bounded JWT source reviews
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 17:30:10 +02:00
parent 4ed50501f6
commit 4e8fa6e831
6 changed files with 241 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/task_execution_journal.py
View file

@ -33,9 +33,11 @@ class Binding:
raise Refused("binding fields must be strings")
if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,127}", self.approval_id):
raise Refused("invalid approval identifier")
for digest in (self.request_digest, self.plan_digest):
if not re.fullmatch(r"[0-9a-f]{64}", digest):
raise Refused("invalid digest")
# Preserve the exact served PDP/Approval value; never silently strip it.
if not re.fullmatch(r"sha256:[0-9a-f]{64}", self.request_digest):
raise Refused("invalid canonical request digest")
if not re.fullmatch(r"[0-9a-f]{64}", self.plan_digest):
raise Refused("invalid owner plan content digest")
try:
if str(uuid.UUID(self.operation_id)) != self.operation_id:
raise ValueError()