fix: trust on-ramp + hygiene — Action snippet, install checksum, CI, verify (Act-1 PR-C) - #35
Merged
Conversation
…verify The first-contact and trust surfaces, where a "verifiable" tool was not verifying: - The headline Action snippet `logannye/rosalind-budget@v1` did not resolve (no such repo/tag) — the single most important adoption action failed on first copy-paste. Fixed to `logannye/rosalind@v0.1.0` (the root action.yml) in README + CHANGELOG. - install.sh advertised checksum verification but never ran it. It now fetches the `.sha256` sidecar the release ships and verifies before unpacking, aborting on a mismatch (verified end-to-end against the live v0.1.0 release; a corrupt sidecar is correctly rejected). - CI cli-e2e regenerated reference.fa at 1 Mbp without --length, overwriting the committed 4 kbp fixture and checking freshly-generated files against freshly-generated sums (a tautology that also tested a different reference than ships). Now pins the committed reference to a known hash (a real anti-corruption gate) and simulates reads FROM it via --reference. - verify gains internal-consistency cross-checks (max_working_set <= peak_rss; contract_verdict agrees with peak-vs-budget) — the first line against a hand-edited receipt, since the manifest has no self-hash yet (a signed tamper-evident receipt is its own Act-2 feature). - Removed the dead IndexFreeIterator/MarkerScanner scaffolding: a public-API next_item() that was unimplemented!() (a panic landmine) with zero callers. - Track Cargo.lock (rosalind ships a binary → a pinned lockfile is part of the reproducible-build story and stabilizes CI cache keys). Full suite green; rustc 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
# Conflicts: # tests/plan_enforce.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Act-1 hardening, PR-C (trust on-ramp + hygiene). The first-contact and trust surfaces, where a "verifiable" tool wasn't verifying — the §C/§D audit findings.
logannye/rosalind-budget@v1doesn't resolve (no such repo, nov1tag) — the single most important adoption action errored before a user saw the contract work. Fixed tologannye/rosalind@v0.1.0(the rootaction.yml) in README + CHANGELOG.install.shadvertised checksum verification it never ran. It now fetches the.sha256sidecar the release ships and verifies before unpacking, aborting on a mismatch. Verified end-to-end against the live v0.1.0 release (rosalind-aarch64-apple-darwin.tar.gz: OK); a corrupted sidecar is correctly rejected.cli-e2echecksum was a tautology. It regeneratedreference.faat 1 Mbp without--length, overwriting the committed 4 kbp fixture and checking freshly-generated files against freshly-generated sums — zero protection, and it tested a different reference than ships. Now it pins the committed reference to a known hash (a real anti-corruption gate) and simulates reads from it via--reference, so cli-e2e exercises exactly the fixture the release bundle ships.verifygains internal-consistency cross-checks —max_working_set_bytes ≤ peak_rss_bytes, andcontract_verdictmust agree with peak-vs-budget. The first line against a hand-edited receipt, since the manifest has no self-hash yet. (A signed, tamper-evident receipt is its own Act-2 feature —verify-attest, scored 43 in the audit.)IndexFreeIterator/MarkerScannerscaffolding — a public-APInext_item()that wasunimplemented!()(a panic landmine in the v0.1.0 surface) with zero callers.Cargo.lock—rosalindships a binary, so a pinned lockfile is part of the reproducible-build story behind the receipts and stabilizes CI cache keys.Test plan
verify_rejects_an_internally_inconsistent_manifest(integration) — a flippedcontract_verdictis rejected (exit 5) even though file hashes matchinstall.shchecksum verification end-to-end against the live v0.1.0 release (OK) + corrupt-sidecar rejectedinstall.shsh -nclean;ci.ymlvalid YAML; the pinned reference hash matches the committed fixturecargo fmtcleanDeferred (noted, not in scope)
verify-attestfeature (a product surface, not a nit).Act-1 sequence
PR-C of 3 — completes Act 1. PR-A (#33, soundness) and PR-B (#34, real-genome correctness) are open and CI-green. All three are independent branches off
main(disjoint surfaces), mergeable in any order. Plan:docs/superpowers/plans/2026-06-02-act1-contract-hardening.md.🤖 Generated with Claude Code