ci(af01): add posture proof and main enforcement - #45
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
ⓘ Your Qodo trial ends soon. Ask your workspace admin to set up billing to keep reviews running after the trial. Manage billing |
|
@coderabbitai review Please review exact head |
|
@qodo review Please independently review exact head |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
@qodo review Fresh exact-head re-review required for Please specifically re-check the two High false-PASS findings raised by the latest CodeRabbit full review:
All five exact-head workflows are SUCCESS. Final artifact: Report any remaining substantive false-PASS/security/correctness/governance finding. |
|
@coderabbitai full review Perform a complete review from scratch of exact final head Please verify remediation of your two High findings from exact head
All five exact-head workflow gates are SUCCESS. Final |
Fresh exact-head review: I do not see a remaining substantive false-PASS, security, correctness, or governance issue in the two challenged areas.
Based on the supplied exact-head results and the inspected binding path, I would not report any additional substantive finding. The live main-ruleset T038–T040 status remains appropriately out of scope rather than being claimed complete. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='301aa5e66089859e938145870dc4a9300a25692a'
head='0491b964a6a8844bb9b356fac9a24914c7cf16a0'
printf '%s\n' '== Commit identity =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested='; git rev-parse "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== Complete base-to-head delta =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Final head delta =='
git diff --no-ext-diff --unified=100 "${head}^" "$head" -- .github Cargo.lock SECURITY.md
printf '%s\n' '== Relevant exact-head file map =='
git ls-tree -r --name-only "$head" |
rg '^(?:\.github/(?:workflows/|scripts/|.*(?:required-checks|main-ruleset|workflow-trust-policy))|SECURITY\.md|Cargo\.lock)$' |
sort
printf '%s\n' '== Candidate outlines =='
git ls-tree -r --name-only "$head" |
rg '^(?:\.github/(?:workflows/|scripts/|.*(?:required-checks|main-ruleset|workflow-trust-policy))|SECURITY\.md)$' |
sort |
while IFS= read -r file; do
printf '\n--- %s\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
printf '%s\n' '== Required-check topology, scanner validation, and workflows =='
for file in \
.github/scripts/test_required_check_topology.py \
.github/scripts/validate_af01_scanner_invocations.py \
.github/workflows/af01-assurance-proof.yml \
.github/workflows/ci.yml \
.github/workflows/af01-scorecard.yml \
.github/workflows/af01-security.yml \
.github/required-checks.json \
.github/main-ruleset.json \
.github/workflow-trust-policy.json
do
if [ -f "$file" ]; then
printf '\n--- %s\n' "$file"
nl -ba "$file"
fi
doneLength of output: 20121 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='0491b964a6a8844bb9b356fac9a24914c7cf16a0'
show_numbered() {
file="$1"
printf '\n--- %s\n' "$file"
git show "${head}:${file}" | awk '{ printf "%6d %s\n", NR, $0 }'
}
printf '%s\n' '== Exact final commit changes =='
git diff --name-status "${head}^" "$head"
printf '%s\n' '== Scanner workflow and validator sources =='
for file in \
.github/workflows/af01-assurance-proof.yml \
.github/scripts/validate_af01_scanner_invocations.py \
.github/scripts/test_validate_af01_scanner_invocations.py \
.github/scripts/test_audit_workflow_trust_scanner_invocations.py \
.github/scripts/build_af01_assurance_summary_verified.py \
.github/scripts/test_build_af01_assurance_summary_verified.py
do
show_numbered "$file"
done
printf '%s\n' '== Checksum, audit, inventory, and assurance sources =='
for file in \
.github/scripts/verify_crate_checksums.py \
.github/scripts/test_verify_crate_checksums.py \
.github/scripts/build_af01_assurance_summary.py \
.github/scripts/test_build_af01_assurance_summary.py \
.github/scripts/summarize_cargo_metadata.py \
.github/scripts/test_summarize_cargo_metadata.py \
.github/scripts/test_required_check_topology.py
do
show_numbered "$file"
done
printf '%s\n' '== Workflow trust and governance contracts =='
for file in \
.github/scripts/audit_workflow_trust.py \
.github/scripts/audit_workflow_trust_surface.py \
.github/scripts/audit_workflow_trust_environment_channels.py \
.github/scripts/test_audit_workflow_trust_required_check_topology.py \
.github/required-checks.json \
.github/main-ruleset.json \
.github/workflow-trust-policy.json \
.github/workflows/ci.yml \
.github/workflows/af01-scorecard.yml \
.github/workflows/af01-security.yml
do
show_numbered "$file"
done
printf '%s\n' '== Security-sensitive syntax across all exact-head workflows =='
git ls-tree -r --name-only "$head" .github/workflows |
while IFS= read -r file; do
git show "${head}:${file}" |
awk -v f="$file" '
/^[[:space:]]*(if|continue-on-error|permissions|uses|run|name|needs)[[:space:]]*:/ {
printf "%s:%d:%s\n", f, NR, $0
}'
doneLength of output: 118267 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='0491b964a6a8844bb9b356fac9a24914c7cf16a0'
show_numbered() {
file="$1"
printf '\n--- %s\n' "$file"
git show "${head}:${file}" | awk '{ printf "%6d %s\n", NR, $0 }'
}
printf '%s\n' '== Terminal scanner execution contract =='
for file in \
.github/workflows/af01-assurance-proof.yml \
.github/scripts/validate_af01_scanner_invocations.py \
.github/scripts/test_validate_af01_scanner_invocations.py \
.github/scripts/build_af01_assurance_summary_verified.py \
.github/scripts/test_build_af01_assurance_summary_verified.py
do
show_numbered "$file"
done
printf '%s\n' '== Scanner-specific test names and assertions =='
for file in \
.github/scripts/test_validate_af01_scanner_invocations.py \
.github/scripts/test_audit_workflow_trust_scanner_invocations.py
do
printf '\n--- %s\n' "$file"
git show "${head}:${file}" |
grep -nE '^( *def test_| *class |.*(continue-on-error|quoted|unsupported|cargo-deny|zizmor|cargo-audit|if:))' || true
doneLength of output: 60662 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='0491b964a6a8844bb9b356fac9a24914c7cf16a0'
show_numbered() {
file="$1"
printf '\n--- %s\n' "$file"
git show "${head}:${file}" | awk '{ printf "%6d %s\n", NR, $0 }'
}
printf '%s\n' '== Core assurance validation =='
for file in \
.github/scripts/build_af01_assurance_summary.py \
.github/scripts/test_build_af01_assurance_summary.py \
.github/scripts/verify_crate_checksums.py \
.github/scripts/test_verify_crate_checksums.py
do
show_numbered "$file"
done
printf '%s\n' '== Cargo inventory and required-check topology =='
for file in \
.github/scripts/summarize_cargo_metadata.py \
.github/scripts/test_summarize_cargo_metadata.py \
.github/scripts/test_required_check_topology.py \
.github/scripts/test_main_ruleset_contract.py
do
show_numbered "$file"
doneLength of output: 97894
I found one substantive governance and false-PASS risk.
The requested remediations are present in this head:
I did not infer live You are interacting with an AI system. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
@qodo review Fresh exact-head review required for Please re-check the remaining CodeRabbit High finding that required checks execute PR-controlled workflow definitions. The remediation establishes an explicit human governance trust root for the user-owned repository:
This is deliberately not a Exact-head evidence: all five workflows SUCCESS; artifact Live rulesets remain |
|
@coderabbitai full review Perform a complete review from scratch of exact head Please specifically re-evaluate your remaining High finding: PR-controlled workflow definitions could retain required check names and GitHub Actions integration identity while weakening the checks. The remediation now establishes a base-branch Code Owner trust boundary:
GitHub's CODEOWNERS model uses the base-branch CODEOWNERS file for PR review requirements, so once this Stack C change is canonical, a malicious PR cannot weaken its own workflow ownership rule and have that head version govern the same PR. This PR is the bootstrap: it does NOT claim existing base-branch CODEOWNERS protection and still must receive exact-head independent review plus T038-T040 live ruleset deployment/read-back before merge. We intentionally did not use Exact-head qualification is complete: ci, cf06-oracle, af01-security, af01-scorecard, af01-assurance-proof all SUCCESS. Artifact Live repository rulesets are still |
Fresh exact-head reviewI find no remaining substantive false-PASS, security, correctness, or governance defect in the reviewed remediation.
I did not dismiss finding 1 because you requested a review, not a finding-status change. Based on the code and supplied exact-head evidence, it is ready for closure once the governance prerequisites are independently confirmed. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='301aa5e66089859e938145870dc4a9300a25692a'
head='8955425270ee7931f98e9b3777d2e6ac8d4a341a'
echo '== Commit identity =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested='; git rev-parse "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '== Complete base-to-head delta =='
git diff --name-status "$base" "$head"
echo '== Exact-head files relevant to AF-01 =='
git ls-tree -r --name-only "$head" |
rg '^(?:\.github/(?:CODEOWNERS|workflows/|scripts/|.*(?:required-checks|main-ruleset|workflow-trust-policy))|SECURITY\.md|Cargo\.lock)$' |
sort
echo '== Final commit delta =='
git diff --no-ext-diff --unified=100 "${head}^" "$head" -- .github Cargo.lock SECURITY.md
echo '== Candidate file outlines =='
git ls-tree -r --name-only "$head" |
rg '^(?:\.github/(?:CODEOWNERS|workflows/|scripts/|.*(?:required-checks|main-ruleset|workflow-trust-policy))|SECURITY\.md)$' |
sort |
while IFS= read -r file; do
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
doneLength of output: 3815 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='8955425270ee7931f98e9b3777d2e6ac8d4a341a'
show_numbered() {
file="$1"
echo
echo "--- $file"
git show "${head}:${file}" | nl -ba
}
echo '== Governance contracts and CODEOWNERS =='
for file in \
.github/CODEOWNERS \
.github/main-ruleset.json \
.github/required-checks.json \
.github/workflow-trust-policy.json \
.github/scripts/test_codeowners_trust_boundary.py \
.github/scripts/test_main_ruleset_contract.py \
.github/scripts/test_required_check_topology.py \
.github/scripts/test_audit_workflow_trust_codeowners_boundary.py \
.github/scripts/test_audit_workflow_trust_main_ruleset_contract.py \
.github/scripts/test_audit_workflow_trust_required_check_topology.py
do
show_numbered "$file"
done
echo '== Required workflows =='
for file in \
.github/workflows/ci.yml \
.github/workflows/af01-assurance-proof.yml \
.github/workflows/af01-scorecard.yml \
.github/workflows/af01-security.yml
do
show_numbered "$file"
done
echo '== Scanner and assurance validation =='
for file in \
.github/scripts/validate_af01_scanner_invocations.py \
.github/scripts/test_validate_af01_scanner_invocations.py \
.github/scripts/verify_crate_checksums.py \
.github/scripts/build_af01_assurance_summary.py \
.github/scripts/build_af01_assurance_summary_verified.py \
.github/scripts/summarize_cargo_metadata.py
do
show_numbered "$file"
done
echo '== Universal trust-suite wiring and security-sensitive workflow syntax =='
git show "${head}:.github/workflows/ci.yml" |
nl -ba | sed -n '1,420p'
git ls-tree -r --name-only "$head" .github/workflows |
while IFS= read -r file; do
git show "${head}:${file}" |
awk -v file="$file" '
/^[[:space:]]*(if|continue-on-error|needs|permissions|uses|run|name)[[:space:]]*:/ {
printf "%s:%d:%s\n", file, NR, $0
}'
doneLength of output: 2284 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='8955425270ee7931f98e9b3777d2e6ac8d4a341a'
show_numbered() {
file="$1"
printf '\n--- %s\n' "$file"
git show "${head}:${file}" | awk '{ printf "%6d %s\n", NR, $0 }'
}
echo '== Governance contracts and CODEOWNERS =='
for file in \
.github/CODEOWNERS \
.github/main-ruleset.json \
.github/required-checks.json \
.github/workflow-trust-policy.json \
.github/scripts/test_codeowners_trust_boundary.py \
.github/scripts/test_main_ruleset_contract.py \
.github/scripts/test_required_check_topology.py \
.github/scripts/test_audit_workflow_trust_codeowners_boundary.py \
.github/scripts/test_audit_workflow_trust_main_ruleset_contract.py \
.github/scripts/test_audit_workflow_trust_required_check_topology.py
do
show_numbered "$file"
done
echo '== Required workflows =='
for file in \
.github/workflows/ci.yml \
.github/workflows/af01-assurance-proof.yml \
.github/workflows/af01-scorecard.yml \
.github/workflows/af01-security.yml
do
show_numbered "$file"
done
echo '== Scanner and assurance validation =='
for file in \
.github/scripts/validate_af01_scanner_invocations.py \
.github/scripts/test_validate_af01_scanner_invocations.py \
.github/scripts/verify_crate_checksums.py \
.github/scripts/build_af01_assurance_summary.py \
.github/scripts/build_af01_assurance_summary_verified.py \
.github/scripts/summarize_cargo_metadata.py
do
show_numbered "$file"
done
echo '== Universal trust-suite wiring =='
git show "${head}:.github/workflows/ci.yml" |
awk '{ printf "%6d %s\n", NR, $0 }' | sed -n '1,420p'
echo '== Workflow execution modifiers =='
git ls-tree -r --name-only "$head" .github/workflows |
while IFS= read -r file; do
git show "${head}:${file}" |
awk -v file="$file" '
/^[[:space:]]*(if|continue-on-error|needs|permissions|uses|run|name)[[:space:]]*:/ {
printf "%s:%d:%s\n", file, NR, $0
}'
doneLength of output: 177817 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Pull request author and target branch =='
gh pr view 45 --repo TheHalfMoon/commandF \
--json number,author,baseRefName,headRefOid,isDraft \
--jq '{number, author: .author.login, baseRefName, headRefOid, isDraft}'
echo '== Current live repository rulesets (read-only) =='
gh api repos/TheHalfMoon/commandF/rulesets --jq '.[] | {id, name, enforcement, target}' || true
echo '== Exact-head ownership and no-bypass contract references =='
rg -n -C 3 \
'EXPECTED_OWNER|EXPECTED_PATTERN|ownership_entries|require_code_owner_review|bypass_actors|require_last_push_approval' \
.github/CODEOWNERS \
.github/main-ruleset.json \
.github/scripts/test_codeowners_trust_boundary.py \
.github/scripts/test_main_ruleset_contract.pyLength of output: 8552 🤖 web_search executed:
Length of output: 14344
I found one substantive governance risk.
The base-branch I confirmed that live repository rulesets currently read empty. I did not infer live You are interacting with an AI system. |
AF-01 Stack C live blocker checkpointExact candidate head remains: No head mutation was made while evaluating the latest CodeRabbit review. Exact-head qualification still observedThe five path-applicable workflows remain terminal
The selected required contexts each have exactly one exact-head GitHub Actions producer bound to application id
Prior Qodo scanner-binding threadThe older Qodo scanner self-declaration thread was re-verified against the current implementation and counterexample suite, answered with exact-head evidence, and resolved. That disposition is limited to the scanner-binding finding. Current substantive CodeRabbit governance finding — OPENThe latest exact-head CodeRabbit review correctly identifies a separate High governance/availability defect in the proposed trust root: Because PR authors cannot approve their own PRs, a future The currently available repository tooling exposes collaborator-permission lookup only for a known username; it does not expose collaborator listing/invitation, and no second trusted write-capable human principal is established by repository evidence. Therefore I am not modifying Live ruleset deployment remains independently blockedLive read-back still returns: []for The available GitHub connector exposes ruleset reads but no create/update mutation. Therefore: This is the furthest truthful Stack C boundary with the currently authorized tooling and established repository identities. Do not infer live enforcement from |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
@qodo review Fresh exact-head review required for Please re-evaluate the prior Code Owner deadlock finding against the new layered-ruleset design:
Please report any remaining substantive false-PASS, security, correctness, governance, or maintenance-deadlock finding. Do not infer T038-T040 or live enforcement from checked-in JSON; live repository rulesets are still a separate read-back gate. |
|
@coderabbitai full review Perform a complete review from scratch of exact head Please specifically re-check your prior High maintenance-deadlock finding. The remediation no longer requires a second Code Owner and does not add a bypass to assurance controls. Instead it uses GitHub ruleset layering:
Please identify any substantive security, correctness, false-PASS, ruleset-layering, or governance issue. Do not infer live ruleset enforcement from the checked-in files; T038-T040 remain separate live GitHub gates. |
Fresh-head review for
No T038–T040 completion or live ruleset enforcement is inferred. The remaining gate is the explicitly documented authorized application and read-back of both live rulesets. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='301aa5e66089859e938145870dc4a9300a25692a'
head='c82ef6e6f137805074cc5e0c453d47e0d2799839'
printf '%s\n' '== Commit identity =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested='; git rev-parse "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== Complete base-to-head delta =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Final-head delta =='
git diff --no-ext-diff --unified=80 "${head}^" "$head" -- .github SECURITY.md Cargo.lock specs
printf '%s\n' '== Relevant exact-head file map =='
git ls-tree -r --name-only "$head" |
rg '^(?:\.github/(?:CODEOWNERS|workflows/|scripts/|.*(?:required-checks|main-ruleset|workflow-trust-policy))|SECURITY\.md|Cargo\.lock|specs/015-af-01-trusted-development-baseline/)' |
sort
printf '%s\n' '== Candidate source outlines =='
git ls-tree -r --name-only "$head" |
rg '^(?:\.github/(?:workflows/|scripts/|CODEOWNERS|.*(?:required-checks|main-ruleset|workflow-trust-policy))|specs/015-af-01-trusted-development-baseline/)' |
sort |
while IFS= read -r file; do
printf '\n--- %s\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
doneLength of output: 69100 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='c82ef6e6f137805074cc5e0c453d47e0d2799839'
show_numbered() {
file="$1"
printf '\n--- %s\n' "$file"
git show "${head}:${file}" | awk '{printf "%6d %s\n", NR, $0}'
}
printf '%s\n' '== Governance files and regression tests =='
for file in \
.github/CODEOWNERS \
.github/required-checks.json \
.github/main-ruleset.json \
.github/main-review-ruleset.json \
.github/scripts/test_main_ruleset_contract.py \
.github/scripts/test_codeowners_trust_boundary.py \
.github/scripts/test_required_check_topology.py \
specs/015-af-01-trusted-development-baseline/stack-c-governance-layering.md
do
show_numbered "$file"
done
printf '%s\n' '== Required workflows and workflow-trust policy =='
for file in \
.github/workflow-trust-policy.json \
.github/workflows/ci.yml \
.github/workflows/af01-assurance-proof.yml \
.github/workflows/af01-scorecard.yml \
.github/workflows/af01-security.yml
do
show_numbered "$file"
done
printf '%s\n' '== Terminal assurance and evidence validators =='
for file in \
.github/scripts/validate_af01_scanner_invocations.py \
.github/scripts/verify_crate_checksums.py \
.github/scripts/build_af01_assurance_summary.py \
.github/scripts/build_af01_assurance_summary_verified.py \
.github/scripts/summarize_cargo_metadata.py \
.github/scripts/test_validate_af01_scanner_invocations.py \
.github/scripts/test_verify_crate_checksums.py \
.github/scripts/test_build_af01_assurance_summary.py \
.github/scripts/test_build_af01_assurance_summary_verified.py
do
show_numbered "$file"
done
printf '%s\n' '== Workflow execution modifiers across all workflows =='
git ls-tree -r --name-only "$head" .github/workflows |
while IFS= read -r file; do
git show "${head}:${file}" |
awk -v file="$file" '
/^[[:space:]]*(if|continue-on-error|needs|permissions|uses|run|name)[[:space:]]*:/ {
printf "%s:%d:%s\n", file, NR, $0
}'
done
printf '%s\n' '== Live rulesets, read-only =='
gh api repos/TheHalfMoon/commandF/rulesets \
--jq '[.[] | {id, name, target, enforcement, bypass_actors, rules}]' || trueLength of output: 203065 🤖 web_search executed:
Length of output: 19705
I found no additional substantive security, correctness, false-PASS, ruleset-layering, or maintenance-deadlock finding in the checked-in implementation. The prior maintenance-deadlock finding is resolved by the split ruleset design.
The contract tests enforce the intended separation. They reject an assurance-ruleset bypass. They reject assurance controls in the bypassable review ruleset. They require the exact review policy and PR-only administrator bypass. The required-check topology remains fail-closed. It rejects filtered PR triggers, quoted or unsupported job syntax, dynamic job names, job-level conditions, The terminal assurance path remains fail-closed for the reviewed surfaces.
The trust boundary has a stated limit. A fully compromised repository administrator can modify live governance. The design does not claim to prevent that case. This limit is consistent with the documented threat model. I confirmed that the live repository ruleset read-back is still You are interacting with an AI system. |
AF-01 Stack C exact-head qualification checkpointExact candidate head: Exact source tree: All five path-applicable workflows are terminal Required check provenance is exact-head and unique: Retained assurance artifact: The retained source-status file is empty, consistent with the assurance workflow's clean-source requirement. Fresh exact-head independent review disposition:
This supports T041 and T042 for the current exact head. It does not claim T038, T039, T040, T043, live ruleset enforcement, merge, or The remaining live gate is application and read-back of both reviewed rulesets through an authorized GitHub administrator mutation path. |
AF-01 Stack C live-governance qualification checkpointExact PR head: T038 — authorized live applicationBoth reviewed repository rulesets now exist on GitHub and are
T039 — authoritative read-back
GitHub's imported read-back additionally materializes GitHub now reports T040 — non-destructive negative governance proofAuthoritative live configuration establishes the negative cases without attempting destructive history mutation:
No destructive direct push, force push, or branch deletion was attempted. Exact-head requalification before T043All five exact-head workflow runs remain terminal Required-check producer read-back on exact head remains unique and successful ( Fresh exact-head Qodo and CodeRabbit reviews report no remaining substantive finding, and the only inline review thread is resolved. This checkpoint supports T038-T042. T043 still requires an exact-head protected merge plus post-merge |
AF-01 Stack C post-merge canonicalization — T043PR #45 merged successfully from exact qualified head Canonical post-merge identity:
Post-merge governance read-back:
Post-merge proof applicability:
The universal required-check topology remains the reviewed PR topology ( T043 is therefore |
1 participant
AF-01 Stack C — posture evidence, deterministic assurance, and main enforcement
Canonical Stack B base:
This PR is the implementation carrier for AF-01 Phase 3 / Stack C (T030–T043). It MUST NOT merge until the exact final head is qualified, independently reviewed, and the complete live
maingovernance ruleset set has been applied and read back.Implemented posture and evidence controls
contents: readonly and retains raw JSON evidence for seven days.SECURITY.mdwith private vulnerability-reporting guidance..github/required-checks.json:rust,assurance-proof, andscorecard, each bound to GitHub Actions integration15368..github/CODEOWNERSas the base-branch trust boundary for.github/..github/main-ruleset.json— deletion, non-fast-forward, and strict integration-bound required checks withbypass_actors=[];.github/main-review-ruleset.json— PR review policy with one approval, Code Owner review, stale-review dismissal, latest-push approval, resolved threads, and a repository-admin-role (actor_id=5) bypass limited tobypass_mode=pull_request.specs/015-af-01-trusted-development-baseline/stack-c-governance-layering.md.Current evidence disposition
The Stack C local Scorecard posture shows least-privilege workflow controls, dependency-update automation, pinned Actions, and the security policy as present. RustSec for the locked Cargo graph is clean. Two Scorecard vulnerability warnings remain bounded to the Java/HL7-oracle dependency surface and are not being silently waived or used to mutate the frozen oracle dependency graph without separate qualification.
The repository-aware Scorecard scan has reported
Branch-Protection=0on canonicalmain. That remains an intentional blocking condition for T038, not a PASS. The checked-in ruleset payloads are configuration intent only until an authorized GitHub administrator mutation applies both rulesets and T039/T040 live read-back/negative proofs succeed.Freeze boundary
This PR changes governance/security workflow surfaces only. Product Rust semantics, CF-06 oracle identity, CF-10 corpus authority, and frozen product behavior remain unchanged.
No PASS, approval, ruleset enforcement, merge, or
CLOSED_CANONICALstate may be inferred from stale runs, aggregate Scorecard score, checked-in configuration, or earlier heads. All qualification and review evidence must bind to the exact final PR head.