feat(bin): add verified sovereign ledger replicas - #2473
Open
coreldh wants to merge 19 commits into
Open
Conversation
coreldh
changed the title
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round 5 root cause and contract
The old verifier asked whether the two paths had different inode numbers. That was not the real property: the question is whether the second copy survives losing the disk that holds the primary.
Every command now enters through the single
admit_pair(primary, replica, mode)chokepoint before it may read, compare, execute, or publish. Admission returns canonical validated paths and the identity evidence carried through publication.By default, admission requires different
st_devvalues for primary and replica. A caller deliberately keeping both copies on one disk must name the trade-off with--allow-same-volume-without-device-redundancy; the waiver gives up device-loss redundancy but does not waive member-identity disjointness.Local evidence: the focused suite reports
114 passed, 0 failed, 3 not verifiable; bind mount, directory hard link, and firmlink are individually recorded asNOT_VERIFIABLEon this host without substituting nearby cases. A real 32 MiB APFS image proved primaryst_dev=16777231and replicast_dev=16777240: cross-volume snapshot/verify and destruction recovery were accepted (2/0), while a replica beside the primary was refused (1/0). Cleanup confirmed the image detached and the file removed. The maintained mutation population records each of 53 mutants with exactly one substitution:killed=36 survived=17 void=0 harness_broken=0 denominator=53.Intent
Complete sovereign-ledger round 5 review-r4 by individually recording bind-mount, directory-hard-link, and firmlink attacks as real refusals when constructible or explicit NOT_VERIFIABLE cases when this host cannot construct them, without substituting nearby passing cases. Preserve the distinct-volume admit_pair predicate, named same-volume waiver, publication identity binding, non-deleting cleanup, 114/0 behavioral suite, real APFS cross-volume proof, honest 53-mutant evidence, and maintainer-only merge authority.
What Changed
NOT_VERIFIABLEcases when unavailable.Risk Assessment
✅ Low: The repair correctly routes constructible directory hard links to the existing member-identity refusal and makes APFS cleanup retain all fixture state on detach failure while preserving successful detach-and-removal behavior.
Testing
At exact target 7f76826, the focused CLI suite passed 114/0 while separately recording bind mount, directory hard link, and firmlink as NOT_VERIFIABLE without substitutes; a real APFS volume proved cross-device snapshot/verify and safe detach, and all 53 single-substitution mutants regenerated to 36 killed/17 survived/0 invalid with byte-identical maintainer evidence. This is CLI-only, so screenshots were not applicable; reviewer-visible transcripts were captured instead.
Evidence: Behavioral and attack-case transcript
114 passed, 0 failed, 3 explicitly not verifiableEvidence: Real APFS cross-volume trace
APFS disk image; snapshot and verify across st_dev 16777231!=16777240; clean detachEvidence: 53-mutant evidence verification
killed=36 survived=17 void=0 harness_broken=0 denominator=53Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
🔧 **Review** - 2 issues found → auto-fixed ✅
tests/fm-sovereign-ledger-redundancy.test.sh:486- The constructible directory-hard-link path expectsprimary and replica directories must differ, but that guard compares canonical path strings; two hard-link names remain distinct, so the verifier instead reaches the later member-identity refusal. This violates the required real-refusal record on hosts that permit the attack. Decide whether to compare directory device:inode identities during shared pair admission or authorize the member-identity refusal as the expected invariant.tests/fm-sovereign-ledger-cross-volume.test.sh:14- Ifhdiutil detachfails, cleanup ignores the error and immediately runsrm -rfthrough the still-mounted APFS fixture, deleting its replica contents and potentially returning success with the volume attached. Retain the scratch directory and fail cleanup when detachment fails.🔧 Fix: Harden APFS cleanup and correct hard-link refusal
✅ Re-checked - no issues remain.
✅ **Test** - passed
✅ No issues found.
Baseline:pwd -P,git rev-parse HEAD,git status --short --branch, and target/base diff inspectionbash tests/fm-sovereign-ledger-redundancy.test.shbash tests/fm-sovereign-ledger-cross-volume.test.shbash tests/fm-sovereign-ledger-redundancy.mutation.sh --verify-evidencePS4='+ ' bash -x tests/fm-sovereign-ledger-cross-volume.test.shFinalgit status --porcelain=v1and target-HEAD identity check✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.