← back to Ticket System
Harden TK-10928 evidence verification
54824da7ba800e30010e52efd34af66d92b5f422 · 2026-09-04 09:10:56 -0700 · Steve Abrams
Files touched
M data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/e2e-proof.jsonM data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/manifest.sha256M data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/verify.js
Diff
commit 54824da7ba800e30010e52efd34af66d92b5f422
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Fri Sep 4 09:10:56 2026 -0700
Harden TK-10928 evidence verification
---
.../TK-10928-20260904T155354Z/e2e-proof.json | 2 +-
.../TK-10928-20260904T155354Z/manifest.sha256 | 2 +-
.../evidence/TK-10928-20260904T155354Z/verify.js | 113 +++++++++++----------
3 files changed, 63 insertions(+), 54 deletions(-)
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/e2e-proof.json b/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/e2e-proof.json
index aa089600..ae4d0654 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/e2e-proof.json
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/e2e-proof.json
@@ -11,7 +11,7 @@
"guard": "PASS: exact ZERO_COST_REQUIRED newline and pinned hash",
"dtd_enforcement": "PASS: static inspection of both installed entry points shows guard-derived zero-cost before secrets/paid branches",
"bundle_membership": "PASS: exact directory allowlist equals exact manifest member set plus the manifest; every non-manifest member hash is verified",
- "ticket_semantics": "PASS: every captured JSONL event parses and carries the canonical ticket id; create identity, latest open status, and latest Steve-action blocker semantics are enforced",
+ "ticket_semantics": "PASS: every captured JSONL line parses; exact-id canonical events enforce create identity, latest open status, and latest Steve-action blocker semantics while cross-ticket references remain permitted",
"runtime_dtd": "SKIP: task packet forbids invoking a model; static enforcement is the requested boundary",
"operational_canary": "SKIP: explicitly out of scope; this bundle is continuity evidence, not recovery proof"
},
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/manifest.sha256 b/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/manifest.sha256
index de5a148a..98a7f3c2 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/manifest.sha256
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/manifest.sha256
@@ -2,7 +2,7 @@ fd7f41fd51d76125af3920150ca1e6bb7e30b59d34c132e403b719777e7c673a README.md
8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed dtd-cost-mode
5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823 dtd-panel.sh
877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef dtd-post-decision-codex.sh
-c7ac216dc02aa65d1953e19d8988a2c9d6839844e5fc187f47660f30b6996fa4 e2e-proof.json
+e1685f6d483e328cdad9245547b1d4d374bc63a9997147f5d5b71031f2f7d5aa e2e-proof.json
acbaec0ed35b488c34849a56b5994aa72142aae879f59af8cebe93b278b9b505 ticket-events-TK-10928.jsonl
0e3fab5bf87a2ac8e1bd208a650d2c1b31cec1b3ee6fcc2c64ea60cad242c875 ticket-show.txt
d3376387f1f011a775991841ae058fcfc17b28696f075f98be1e651b83a7f30d ticketmaster-latest.json
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/verify.js b/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/verify.js
index f06be3d8..4815d79e 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/verify.js
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T155354Z/verify.js
@@ -1,64 +1,73 @@
#!/usr/bin/env node
'use strict';
+const fs=require('fs'),path=require('path'),crypto=require('crypto');
+const base=__dirname,id='TK-10928-cron-issue-com-steve-dw-backup-canary',manifestName='manifest.sha256';
+const payload=['README.md','dtd-cost-mode','dtd-panel.sh','dtd-post-decision-codex.sh','e2e-proof.json','ticket-events-TK-10928.jsonl','ticket-show.txt','ticketmaster-latest.json','verify.js'];
+const sha=b=>crypto.createHash('sha256').update(b).digest('hex'),read=n=>fs.readFileSync(path.join(base,n));
+const fail=m=>{console.error(`FAIL: ${m}`);process.exitCode=1};
+const eq=(a,e,l)=>{if(a!==e)fail(`${l}: expected ${JSON.stringify(e)}, got ${JSON.stringify(a)}`)};
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-
-const base = __dirname;
-const sha = (buf) => crypto.createHash('sha256').update(buf).digest('hex');
-const read = (name) => fs.readFileSync(path.join(base, name));
-const fail = (message) => { console.error(`FAIL: ${message}`); process.exitCode = 1; };
-const equal = (actual, expected, label) => {
- if (actual !== expected) fail(`${label}: expected ${expected}, got ${actual}`);
-};
+eq(JSON.stringify(fs.readdirSync(base).sort()),JSON.stringify([...payload,manifestName].sort()),'bundle filename set');
+const manifest=new Map();
+for(const [i,line] of read(manifestName).toString().trimEnd().split('\n').entries()){
+ const m=line.match(/^([0-9a-f]{64}) ([A-Za-z0-9._-]+)$/);
+ if(!m){fail(`malformed manifest line ${i+1}`);continue}
+ if(manifest.has(m[2]))fail(`duplicate manifest member: ${m[2]}`);
+ manifest.set(m[2],m[1]);
+}
+eq(JSON.stringify([...manifest.keys()].sort()),JSON.stringify(payload.slice().sort()),'manifest filename set');
+for(const name of payload)if(manifest.has(name))eq(sha(read(name)),manifest.get(name),`${name} sha256`);
-const expectedHashes = {
- 'ticketmaster-latest.json': 'd3376387f1f011a775991841ae058fcfc17b28696f075f98be1e651b83a7f30d',
- 'dtd-cost-mode': '8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed',
- 'dtd-panel.sh': '5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823',
- 'dtd-post-decision-codex.sh': '877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef',
- 'ticket-events-TK-10928.jsonl': 'acbaec0ed35b488c34849a56b5994aa72142aae879f59af8cebe93b278b9b505',
- 'ticket-show.txt': '0e3fab5bf87a2ac8e1bd208a650d2c1b31cec1b3ee6fcc2c64ea60cad242c875'
-};
-for (const [name, expected] of Object.entries(expectedHashes)) equal(sha(read(name)), expected, `${name} sha256`);
+const pinned={
+ 'ticketmaster-latest.json':'d3376387f1f011a775991841ae058fcfc17b28696f075f98be1e651b83a7f30d',
+ 'dtd-cost-mode':'8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed',
+ 'dtd-panel.sh':'5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823',
+ 'dtd-post-decision-codex.sh':'877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef',
+ 'ticket-events-TK-10928.jsonl':'acbaec0ed35b488c34849a56b5994aa72142aae879f59af8cebe93b278b9b505',
+ 'ticket-show.txt':'0e3fab5bf87a2ac8e1bd208a650d2c1b31cec1b3ee6fcc2c64ea60cad242c875'};
+for(const [name,digest] of Object.entries(pinned))eq(sha(read(name)),digest,`${name} pinned sha256`);
-const snapshot = JSON.parse(read('ticketmaster-latest.json'));
-equal(snapshot.ts, '2026-09-04T15:53:34.821Z', 'snapshot timestamp');
-equal(JSON.stringify(Object.keys(snapshot)), JSON.stringify(['ts','poller','totals','needs_orchestration','orchestration_reasons','nudges_sent_this_tick','stale_builds','top']), 'snapshot schema keys');
-const ticket = snapshot.top.find((item) => item.id === 'TK-10928-cron-issue-com-steve-dw-backup-canary');
-if (!ticket) fail('TK-10928 absent from snapshot top');
-else {
- equal(ticket.status, 'open', 'ticket status');
- equal(ticket.disposition, 'hold-policy', 'ticket disposition');
- equal(ticket.approvalLane, 'hold-policy', 'ticket approval lane');
- equal(ticket.steveGated, true, 'ticket Steve gate');
- equal(ticket.collide, false, 'ticket collision flag');
+let snapshot={};try{snapshot=JSON.parse(read('ticketmaster-latest.json'))}catch(e){fail(`snapshot JSON: ${e.message}`)}
+eq(snapshot.ts,'2026-09-04T15:53:34.821Z','snapshot timestamp');
+eq(JSON.stringify(Object.keys(snapshot)),JSON.stringify(['ts','poller','totals','needs_orchestration','orchestration_reasons','nudges_sent_this_tick','stale_builds','top']),'snapshot schema keys');
+const ranked=Array.isArray(snapshot.top)&&snapshot.top.find(x=>x.id===id);
+if(!ranked)fail('TK-10928 absent from snapshot top');else{
+ eq(ranked.status,'open','ticket status');eq(ranked.assignee,'codex-yoloforever','ticket assignee');
+ eq(ranked.disposition,'hold-policy','ticket disposition');eq(ranked.approvalLane,'hold-policy','ticket approval lane');
+ eq(ranked.steveGated,true,'ticket Steve gate');eq(ranked.collide,false,'ticket collision flag');
}
-equal(read('dtd-cost-mode').toString(), 'ZERO_COST_REQUIRED\n', 'guard bytes');
-for (const name of ['dtd-panel.sh', 'dtd-post-decision-codex.sh']) {
- const script = read(name).toString();
- for (const marker of [
- 'CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"',
- 'refusing non-canonical DTD cost-mode guard',
- 'ZERO_COST_REQUIRED) DTD_ZERO_COST=1',
- 'if [[ "$DTD_ZERO_COST" != 1'
- ]) if (!script.includes(marker)) fail(`${name} missing enforcement marker: ${marker}`);
+const events=[];
+for(const [i,line] of read('ticket-events-TK-10928.jsonl').toString().trimEnd().split('\n').entries()){
+ try{events.push(JSON.parse(line))}catch(e){fail(`ticket event JSON line ${i+1}: ${e.message}`)}
}
-const panel = read('dtd-panel.sh').toString();
-for (const marker of ['OPENAI_KEY=""', 'XAI_KEY=""', 'MOONSHOT_KEY=""', '[claude disabled: DTD_ZERO_COST=1]', 'codex exec --ephemeral']) {
- if (!panel.includes(marker)) fail(`dtd-panel.sh missing zero-cost marker: ${marker}`);
+if(!events.length)fail('ticket event capture is empty');
+const ownEvents=events.filter(event=>event.id===id);
+if(!ownEvents.length)fail('canonical ticket events absent');
+const created=ownEvents.find(event=>event.type==='create')||{};
+eq(created.type,'create','first ticket event type');eq(created.title,'Cron issue: com.steve.dw-backup-canary','ticket title');eq(created.project,'cron-fire-canary','ticket project');
+eq(ownEvents.filter(e=>e.type==='status').at(-1)?.status,'open','latest captured ticket status');
+const blocker=ownEvents.filter(e=>e.type==='blocker'&&e.blocker).at(-1)?.blocker;
+if(!blocker)fail('canonical ticket blocker absent');else{
+ eq(blocker.type,'steve_action','ticket blocker type');eq(blocker.owner,'codex-yoloforever','ticket blocker owner');eq(blocker.steve_one_action,true,'ticket one-action gate');
+ if(!blocker.condition?.includes('remediation requires destructive history/ref/prune action or threshold policy change'))fail('ticket blocker condition semantics');
+ if(!blocker.next_action?.includes('unless Steve explicitly approves'))fail('ticket blocker next-action gate semantics');
}
+const show=read('ticket-show.txt').toString();
+if(!show.startsWith(`${id} [open]`))fail('ticket-show identity/status semantics');
+if(!show.includes('blocker {"type":"steve_action"'))fail('ticket-show blocker type semantics');
+if(!show.includes('remediation requires destructive history/ref/prune action or threshold policy change'))fail('ticket-show blocker condition semantics');
-if (process.env.CHECK_LIVE_SOURCES === '1') {
- const live = {
- 'ticketmaster-latest.json': '/Users/macstudio3/.agents/skills/ticketmaster/state/latest.json',
- 'dtd-cost-mode': '/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode',
- 'dtd-panel.sh': '/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh',
- 'dtd-post-decision-codex.sh': '/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh'
- };
- for (const [name, source] of Object.entries(live)) equal(sha(fs.readFileSync(source)), expectedHashes[name], `${name} live-source sha256`);
+eq(read('dtd-cost-mode').toString(),'ZERO_COST_REQUIRED\n','guard bytes');
+for(const name of ['dtd-panel.sh','dtd-post-decision-codex.sh']){
+ const script=read(name).toString();
+ for(const marker of ['CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"','refusing non-canonical DTD cost-mode guard','ZERO_COST_REQUIRED) DTD_ZERO_COST=1','if [[ "$DTD_ZERO_COST" != 1'])if(!script.includes(marker))fail(`${name} missing enforcement marker: ${marker}`);
}
+const panel=read('dtd-panel.sh').toString();
+for(const marker of ['OPENAI_KEY=""','XAI_KEY=""','MOONSHOT_KEY=""','[claude disabled: DTD_ZERO_COST=1]','codex exec --ephemeral'])if(!panel.includes(marker))fail(`dtd-panel.sh missing zero-cost marker: ${marker}`);
-if (!process.exitCode) console.log('PASS: immutable TK-10928 continuity bundle verified');
+if(process.env.CHECK_LIVE_SOURCES==='1'){
+ const live={'ticketmaster-latest.json':'/Users/macstudio3/.agents/skills/ticketmaster/state/latest.json','dtd-cost-mode':'/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode','dtd-panel.sh':'/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh','dtd-post-decision-codex.sh':'/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh'};
+ for(const [name,source] of Object.entries(live))eq(sha(fs.readFileSync(source)),pinned[name],`${name} live-source sha256`);
+}
+if(!process.exitCode)console.log('PASS: immutable TK-10928 continuity bundle verified');
← 08ed0ab3 auto-data-snapshot: 2026-09-04T09:09:45 (3 data files) — dat
·
back to Ticket System
·
Record TK-10928 continuity cycle 35a9afe0 →