[object Object]

← back to Ticket System

Harden TK-10928 evidence replay negatives

f67741f40aa0edb2f22444c90422f6f92ece3b5d · 2026-09-03 22:02:26 -0700 · Steve Abrams

Files touched

Diff

commit f67741f40aa0edb2f22444c90422f6f92ece3b5d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 22:02:26 2026 -0700

    Harden TK-10928 evidence replay negatives
---
 .../TK-10928-20260904T0444Z-vpops/README.md        |  2 +-
 .../TK-10928-20260904T0444Z-vpops/e2e-proof.json   |  5 ++-
 .../TK-10928-20260904T0444Z-vpops/manifest.json    | 12 ++---
 .../TK-10928-20260904T0444Z-vpops/replay.sh        | 52 +++++++++++++++++-----
 4 files changed, 52 insertions(+), 19 deletions(-)

diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md
index cede4dd0..de13d53f 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/README.md
@@ -19,6 +19,6 @@ This R0 bundle preserves the exact point-in-time ticketmaster snapshot, the late
 
 Expected semantics: snapshot timestamp `2026-09-04T04:44:11.309Z`; 56 open/active; zero actionable pickups; zero `execute`; zero `fast-track-local`; TK-10928 is open, `hold-policy`, and Steve-gated. The preserved blocker defers the read-only scheduler/artifact correlation until `2026-09-04T11:10:00Z` and keeps remediation gated.
 
-Run `CHECK_LIVE_SOURCES=1 bash replay.sh . <trusted-commit>`. The commit argument binds the bundle to Git. Replay validates JSON, hashes/sizes, board/blocker semantics, exact guard bytes, pinned installed scripts, zero-cost enforcement before every paid-provider branch with inherited `DTD_ZERO_COST` absent, live-source identity, and a one-field tamper rejection. Omit `CHECK_LIVE_SOURCES=1` after canonical sources advance. Temporary directories are retained for OS reclamation.
+Run `CHECK_LIVE_SOURCES=1 bash replay.sh . <trusted-commit>`. The commit argument binds the bundle to Git. Replay validates JSON, hashes/sizes, an exact top-level file allowlist (the manifest is the sole intentional self-exclusion), board/blocker semantics, exact guard bytes, pinned installed scripts, zero-cost enforcement before every paid-provider branch with inherited `DTD_ZERO_COST` absent, and live-source identity. It then invokes the actual replay against retained unmanifested-file and actionable-tamper fixtures, requiring nonzero rejection and the expected failure boundary; nested fixture runs set `RUN_NEGATIVE_FIXTURES=0` to prevent recursion. Omit `CHECK_LIVE_SOURCES=1` after canonical sources advance. Temporary directories are retained for OS reclamation.
 
 Cost: USD 0. No DTD, Claude, provider API, paid HTTP endpoint, external write, process action, or gated mutation was invoked.
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json
index 0157fc20..77b2e384 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/e2e-proof.json
@@ -22,8 +22,9 @@
     {"boundary":"DTD static enforcement","check":"installed scripts force zero cost before all four paid-provider branches and blank provider keys without inherited DTD_ZERO_COST","verdict":"PASS"},
     {"boundary":"Git trust anchor","check":"every bundle path matches the supplied trusted commit","verdict":"PASS"},
     {"boundary":"canonical source identity","check":"captured snapshot and latest blocker compare byte-for-byte with canonical sources","verdict":"PASS"},
-    {"boundary":"integrity","check":"manifest payload hashes and sizes","verdict":"PASS"},
-    {"boundary":"negative","check":"one-field actionable tamper rejected","verdict":"PASS"}
+    {"boundary":"integrity","check":"manifest payload hashes and sizes plus exact top-level file allowlist with manifest self-exclusion","verdict":"PASS"},
+    {"boundary":"negative","check":"actual replay rejects retained unmanifested-file fixture with nonzero status","verdict":"PASS"},
+    {"boundary":"negative","check":"actual replay rejects retained actionable-tamper fixture with nonzero status and recursion disabled","verdict":"PASS"}
   ],
   "cleanup": "No cleanup; unique mktemp tamper directory retained for OS reclamation.",
   "skips": [
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json
index 7e12dc3b..07d90062 100644
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/manifest.json
@@ -4,8 +4,8 @@
   "files": [
     {
       "path": "README.md",
-      "bytes": 2436,
-      "sha256": "0e1d529eb19ea7b84f80998693bb5011d7d8f5bed8bda95bd7c890cdf537d71a"
+      "bytes": 2731,
+      "sha256": "63bb25d84d8872e94008c775a8cec367e971415de9460d8f853464f3924f7357"
     },
     {
       "path": "dtd-cost-mode",
@@ -14,8 +14,8 @@
     },
     {
       "path": "e2e-proof.json",
-      "bytes": 2460,
-      "sha256": "22c2f61ae54c5f363a5bb0a779eeea26af6b574d0570bde40b587365efbdf97c"
+      "bytes": 2721,
+      "sha256": "a450fb7c8f49e57e3a381edbf5e75dcfbe247de39317efde5f5ac08b01403dfa"
     },
     {
       "path": "installed-panel.sh",
@@ -34,8 +34,8 @@
     },
     {
       "path": "replay.sh",
-      "bytes": 6196,
-      "sha256": "8e4763bcf1f3b6d51fbcea51a7a3b289b78639efd658321971b3a51c860a3824"
+      "bytes": 8418,
+      "sha256": "35ab0682f244293ca104c50821d157cf5732d84766801582c59de309e3ab59a2"
     },
     {
       "path": "ticketmaster-latest.json",
diff --git a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh
index 6730088f..de5eb170 100755
--- a/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh
+++ b/data/codex-yoloforever/evidence/TK-10928-20260904T0444Z-vpops/replay.sh
@@ -7,15 +7,23 @@ fail() { printf 'FAIL %s\n' "$1" >&2; exit 1; }
 pass() { printf 'PASS %s\n' "$1"; }
 
 EXPECTED_COMMIT="${2:-}"
-[[ -n "$EXPECTED_COMMIT" ]] || fail "expected trusted Git commit argument"
-REPO_ROOT="$(git -C "$BUNDLE_DIR" rev-parse --show-toplevel 2>/dev/null)" || fail "bundle is not in Git"
-BUNDLE_REL="${BUNDLE_DIR#"$REPO_ROOT"/}"
-git -C "$REPO_ROOT" cat-file -e "${EXPECTED_COMMIT}^{commit}" 2>/dev/null || fail "trusted commit missing"
-git -C "$REPO_ROOT" diff --quiet "$EXPECTED_COMMIT" -- "$BUNDLE_REL" || fail "bundle differs from trusted commit"
-pass "bundle bound to trusted Git commit $EXPECTED_COMMIT"
+if [[ "${SKIP_GIT_BINDING:-0}" != 1 ]]; then
+  [[ -n "$EXPECTED_COMMIT" ]] || fail "expected trusted Git commit argument"
+  REPO_ROOT="$(git -C "$BUNDLE_DIR" rev-parse --show-toplevel 2>/dev/null)" || fail "bundle is not in Git"
+  BUNDLE_REL="${BUNDLE_DIR#"$REPO_ROOT"/}"
+  git -C "$REPO_ROOT" cat-file -e "${EXPECTED_COMMIT}^{commit}" 2>/dev/null || fail "trusted commit missing"
+  git -C "$REPO_ROOT" diff --quiet "$EXPECTED_COMMIT" -- "$BUNDLE_REL" || fail "bundle differs from trusted commit"
+  pass "bundle bound to trusted Git commit $EXPECTED_COMMIT"
+fi
 
 for json in ticketmaster-latest.json latest-blocker-event.jsonl e2e-proof.json manifest.json; do jq -e . "$json" >/dev/null || fail "JSON $json"; done
 pass "JSON parses"
+
+LIST_DIR="$(mktemp -d)"
+jq -r '.files[].path, "manifest.json"' manifest.json | LC_ALL=C sort > "$LIST_DIR/expected-files.txt"
+find . -mindepth 1 -maxdepth 1 -type f -print | sed 's#^./##' | LC_ALL=C sort > "$LIST_DIR/actual-files.txt"
+cmp -s "$LIST_DIR/expected-files.txt" "$LIST_DIR/actual-files.txt" || fail "unexpected or unmanifested top-level bundle file"
+pass "top-level file allowlist including manifest self-exclusion"
 jq -e '.ts == "2026-09-04T04:44:11.309Z" and .totals.open_or_active == 56 and .orchestration_reasons.actionable_pickups == 0' ticketmaster-latest.json >/dev/null || fail "board totals"
 jq -e '([.top[] | select(.disposition == "execute")] | length) == 0 and ([.top[] | select(.disposition == "fast-track-local")] | length) == 0' ticketmaster-latest.json >/dev/null || fail "executable lanes"
 jq -e '[.top[] | select(.id == "TK-10928-cron-issue-com-steve-dw-backup-canary") | select(.status == "open" and .disposition == "hold-policy" and .steveGated == true and .approvalLane == "hold-policy")] | length == 1' ticketmaster-latest.json >/dev/null || fail "TK-10928 row"
@@ -69,8 +77,32 @@ while IFS=$'\t' read -r path expected_size expected_hash; do
 done < <(jq -r '.files[] | [.path, (.bytes|tostring), .sha256] | @tsv' manifest.json)
 pass "manifest hashes and sizes"
 
-TAMPER_DIR="$(mktemp -d)"
-jq '.orchestration_reasons.actionable_pickups = 1' ticketmaster-latest.json > "$TAMPER_DIR/tampered.json"
-if jq -e '.orchestration_reasons.actionable_pickups == 0' "$TAMPER_DIR/tampered.json" >/dev/null 2>&1; then fail "tampered actionable accepted"; fi
-pass "negative tamper assertion rejected (retained $TAMPER_DIR)"
+if [[ "${RUN_NEGATIVE_FIXTURES:-1}" == 1 ]]; then
+  NEGATIVE_DIR="$(mktemp -d)"
+
+  cp -R . "$NEGATIVE_DIR/unexpected-file"
+  printf 'must be rejected\n' > "$NEGATIVE_DIR/unexpected-file/unmanifested.txt"
+  set +e
+  (cd "$NEGATIVE_DIR/unexpected-file" && env SKIP_GIT_BINDING=1 RUN_NEGATIVE_FIXTURES=0 CHECK_LIVE_SOURCES=0 bash replay.sh . ignored) > "$NEGATIVE_DIR/unexpected-file.log" 2>&1
+  unexpected_status=$?
+  set -e
+  [[ "$unexpected_status" -ne 0 ]] || fail "actual replay accepted unmanifested file"
+  rg -q 'FAIL unexpected or unmanifested top-level bundle file' "$NEGATIVE_DIR/unexpected-file.log" || fail "unmanifested rejection reason"
+  pass "actual replay rejected unmanifested file fixture status=$unexpected_status"
+
+  cp -R . "$NEGATIVE_DIR/actionable-tamper"
+  jq '.orchestration_reasons.actionable_pickups = 1' ticketmaster-latest.json > "$NEGATIVE_DIR/actionable-tamper/ticketmaster-latest.json"
+  tampered_size="$(wc -c < "$NEGATIVE_DIR/actionable-tamper/ticketmaster-latest.json" | tr -d ' ')"
+  tampered_hash="$(shasum -a 256 "$NEGATIVE_DIR/actionable-tamper/ticketmaster-latest.json" | awk '{print $1}')"
+  jq --argjson bytes "$tampered_size" --arg sha256 "$tampered_hash" '(.files[] | select(.path == "ticketmaster-latest.json") | .bytes) = $bytes | (.files[] | select(.path == "ticketmaster-latest.json") | .sha256) = $sha256' "$NEGATIVE_DIR/actionable-tamper/manifest.json" > "$NEGATIVE_DIR/tampered-manifest.json"
+  cp "$NEGATIVE_DIR/tampered-manifest.json" "$NEGATIVE_DIR/actionable-tamper/manifest.json"
+  set +e
+  (cd "$NEGATIVE_DIR/actionable-tamper" && env SKIP_GIT_BINDING=1 RUN_NEGATIVE_FIXTURES=0 CHECK_LIVE_SOURCES=0 bash replay.sh . ignored) > "$NEGATIVE_DIR/actionable-tamper.log" 2>&1
+  tampered_status=$?
+  set -e
+  [[ "$tampered_status" -ne 0 ]] || fail "actual replay accepted actionable tamper"
+  rg -q 'FAIL board totals' "$NEGATIVE_DIR/actionable-tamper.log" || fail "actionable rejection reason"
+  pass "actual replay rejected actionable tamper fixture status=$tampered_status"
+  pass "negative fixtures retained $NEGATIVE_DIR"
+fi
 printf 'VERDICT PASS\n'

← a40e8ab9 Handle legacy DTD hash record in replay  ·  back to Ticket System  ·  Reject non-file entries in TK-10928 replay 4c6d4f78 →