[object Object]

← back to Ticket System

Harden TK-10928 evidence identity checks

e674fe130aa27924d1ae498c3a5ebf09821daa90 · 2026-09-04 06:26:28 -0700 · Steve Abrams

Files touched

Diff

commit e674fe130aa27924d1ae498c3a5ebf09821daa90
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 4 06:26:28 2026 -0700

    Harden TK-10928 evidence identity checks
---
 .../evidence/TK-10928-20260904T1313Z-vpops/README.md               | 2 +-
 .../evidence/TK-10928-20260904T1313Z-vpops/e2e-proof.json          | 4 ++--
 .../evidence/TK-10928-20260904T1313Z-vpops/manifest.sha256         | 6 +++---
 .../evidence/TK-10928-20260904T1313Z-vpops/verify.js               | 7 ++++++-
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/README.md b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/README.md
index d69cedd0..c4163827 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/README.md
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/README.md
@@ -8,4 +8,4 @@ Replay from the ticket-system repository:
 env -u DTD_ZERO_COST CHECK_LIVE_SOURCES=1 node data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/verify.js data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops
 ```
 
-The zero execute/fast-local assertion applies exactly to the snapshot's 25 ranked `top` rows, not all 57 open/active tickets. Runtime DTD behavior is deliberately skipped; the guard claim is limited to static source and control-flow ordering.
+The zero execute/fast-local assertion applies exactly to the snapshot's 25 ranked `top` rows, not all 57 open/active tickets. The verifier requires exact unique manifest filename-set equality and binds the latest blocker event to the exact summarized TK-10928 ticket ID. Runtime DTD behavior is deliberately skipped; the guard claim is limited to static source and control-flow ordering.
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/e2e-proof.json b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/e2e-proof.json
index a7bfddf5..e27b7529 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/e2e-proof.json
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/e2e-proof.json
@@ -7,9 +7,9 @@
   "assertions": [
     {"boundary":"guard","verdict":"PASS","detail":"Exact 19-byte ZERO_COST_REQUIRED newline source and SHA-256 are bound; panel/post source ordering forces zero-cost before paid branches."},
     {"boundary":"ticketmaster","verdict":"PASS","detail":"Frozen 13:13:21.304Z snapshot has 57 open/active; its 25 ranked top rows contain zero execute and zero fast-local dispositions."},
-    {"boundary":"ticket/gate","verdict":"PASS","detail":"Frozen canonical TK-10928 events contain latest steve_action blocker with recheck_at 11:10Z; ranked row is open, hold-policy, Steve-gated."},
+    {"boundary":"ticket/gate","verdict":"PASS","detail":"Frozen canonical TK-10928 events contain a latest steve_action blocker whose event id exactly matches the summarized TK-10928 ticket id and has recheck_at 11:10Z; ranked row is open, hold-policy, Steve-gated."},
     {"boundary":"scheduler/artifact","verdict":"PASS","detail":"Scheduler-owned run.log line and immutable scan/latest JSON agree on 695 repos, 2 FAIL, 10 WARN; Designer-Wallcoverings is 6114MB and FAIL against the issue text's 1400MB floor."},
-    {"boundary":"tamper resistance","verdict":"PASS","detail":"Verifier enforces strict recursive allowlist, manifest, source equality where requested, and cross-document semantics; retained temp negatives reject tamper, extra, nested, and coherent semantic mutation."},
+    {"boundary":"tamper resistance","verdict":"PASS","detail":"Verifier enforces strict recursive allowlist, exact unique manifest filename-set equality, source equality where requested, and cross-document semantics; retained temp negatives reject hash tamper, extra, nested, coherent semantic mutation, manifest membership substitution/duplication, and a foreign-ticket blocker."},
     {"boundary":"UI","verdict":"SKIP","detail":"No UI changed or exercised; CTA and screenrecord are not applicable."},
     {"boundary":"runtime DTD","verdict":"SKIP","detail":"Explicitly prohibited for this delegated monitoring increment; enforcement evidence is static source/order proof."}
   ],
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/manifest.sha256 b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/manifest.sha256
index 8f5d452f..2c328b0b 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/manifest.sha256
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/manifest.sha256
@@ -1,8 +1,8 @@
-a7733a3a24b0fc2b7facede0b77ca2546f3ff1bdf0137cb727af868fdf63923e  README.md
+458d0a567111310a923abd767ca9e6051fd26995f1d4f2444b11e559d2466497  README.md
 2e959f58e9ea8e75717534dda806a2fc59251f16d8d12dd50aabd54102b49aaf  allowlist.txt
-5d46326e94ca6f6c92482adcc7414bf189c2ba53979e204358b442fe9364ce19  e2e-proof.json
+2b301d504c884ca1f0f0f4c5b3b20d10985ab97ca580059db43edc68b46ec320  e2e-proof.json
 2bb4af0ed0a04a7f5dc9ed451da2c297a541f8ee4390f7774eae73f149f539fd  summary.json
-e1b2ac4be915bc33b999bb695010d03ffcf934e448d6334ae119b1713a99ee76  verify.js
+3930ba69ac3c139123e12e001d482b1162365d448b106a9798b9efc601c6a7e9  verify.js
 274901ff5a6b04d6f466bd2eaa07c737f32f11144eeb3bf952942f4f05bbc394  sources/canary-latest.json
 8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed  sources/dtd-cost-mode
 5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823  sources/panel.sh
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/verify.js b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/verify.js
index d0f45495..b7f654ff 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/verify.js
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T1313Z-vpops/verify.js
@@ -21,6 +21,11 @@ if (JSON.stringify(actual) !== JSON.stringify(allow)) fail(`allowlist mismatch\n
 const manifestLines = read('manifest.sha256').toString().trim().split(/\n/);
 const expectedManifestFiles = allow.filter(x => x !== 'manifest.sha256');
 if (manifestLines.length !== expectedManifestFiles.length) fail('manifest entry count');
+const manifestFiles = manifestLines.map(line => {
+  const m = line.match(/^([0-9a-f]{64})  (.+)$/); if (!m) fail('manifest syntax');
+  return m[2];
+});
+if (new Set(manifestFiles).size !== manifestFiles.length || JSON.stringify([...manifestFiles].sort()) !== JSON.stringify([...expectedManifestFiles].sort())) fail('manifest filename set');
 for (const line of manifestLines) {
   const m = line.match(/^([0-9a-f]{64})  (.+)$/); if (!m) fail('manifest syntax');
   if (!expectedManifestFiles.includes(m[2])) fail(`manifest unknown ${m[2]}`);
@@ -41,7 +46,7 @@ if (!row || row.status !== s.ticket.status || row.assignee !== s.ticket.assignee
 const events = read('sources/ticket-events-TK-10928.jsonl').toString().trim().split(/\n/).map(JSON.parse);
 const blockers = events.filter(x => x.type === 'blocker');
 const blocker = blockers[blockers.length-1];
-if (!blocker || blocker.blocker?.type !== s.ticket.blocker_type || blocker.blocker?.recheck_at !== s.ticket.recheck_at) fail('ticket blocker semantics');
+if (!blocker || blocker.id !== s.ticket.id || blocker.id !== 'TK-10928-cron-issue-com-steve-dw-backup-canary' || blocker.blocker?.type !== s.ticket.blocker_type || blocker.blocker?.recheck_at !== s.ticket.recheck_at) fail('ticket blocker semantics');
 if (new Date(s.captured_at) <= new Date(s.ticket.recheck_at)) fail('post-recheck capture semantics');
 if (sha(read('sources/canary-latest.json')) !== sha(read('sources/scan-2026-09-04T11-00-29-189Z.json'))) fail('latest/scan identity');
 if (scan.scanned_at !== s.scheduler_canary.scan_utc || scan.status !== s.scheduler_canary.verdict || scan.results.length !== s.scheduler_canary.repos) fail('scan summary');

← a96fcb3f Add TK-10928 post-recheck correlation proof  ·  back to Ticket System  ·  Record TK-10928 monitoring cycle 096b5fab →