Repository navigation
chore(provenance): review #536 package re-pin coordinate publication - #568
Closed
raylei50653 wants to merge 2 commits into
Closed
raylei50653 wants to merge 2 commits into
raylei50653 wants to merge 2 commits into
Conversation
Implementation axis 9ef960e0 -> 9a0fe01a; 294 members, only entrypoint_pin.json changes. The README is prose-excluded. Decision surface, identity semantics, environment and runtime inputs stay unchanged. Fresh gpu0 probe captured at 9be8e04 using build/; behavior digest is unchanged, build witness differs and both artifact hashes were checked. Independent candidate review passed before promotion. Probe equality is not semantic equivalence; state remains unproven.
Owner
Author
|
Final state: closed without merge — review evidence retained. This package re-pin coordinate review surface (head |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review the runtime-coordinate publication for the #536 package re-pin independently from its implementation. The base is the source/evidence branch
chore/536-package-repin; the diff contains only the canonical publication and an append-only archive with the exact outgoing canonical bytes. The complete payload lands atomically through #569 tomainafter this review.Coordinate delta:
9ef960e0fd1683ee...→9a0fe01a4645616a..., 294 members. Onlyshipping/entrypoint_pin.jsonchanges; packaged README is prose-excluded.gpu0probe was captured at clean9be8e043into a scratch candidate, independently reviewed before canonical update. Behavior digest remains2dabed0b...; the full probe object has a different build witness, whose actual extension and plugin hashes were checked.equivalenceremainsunproven.check_runtime_identity_staleness.py --mode attestedpasses at final head85008e39. The outgoing publication is preserved asruntime_identity.2026-10-10.9ef960e0fd1683ee.json. Publication still does not authenticate artifact origin or approve distribution.The default CI workflow triggers only for PRs targeting
main; this feature-base review does not start a separate default workflow. GitHub may show checks from #569 because both PRs use the same head. The primary PR owns that exact-head CI for the complete payload. Full local pre-push and installed-package evidence are reported there; missing checks would not be CI success.Refs #536. Review boundary:
docs/reference/runbooks/runtime_identity_republication.md§3.2.