Pular para conteúdo

AUR-005: Content-addressed evidence manifest

Documento histórico do board. Pode descrever componentes removidos; para uso atual, consulte o guia do produto.

Behavior

internal/evidence seals sanitized evidence outputs against the complete CandidateIdentityV1. The manifest stores only metadata, byte counts and SHA-256 digests; output bytes remain with the caller. Verification recomputes the manifest digest, compares all fifteen candidate-identity members with an externally supplied identity, and hashes every supplied output before returning success. A spec, pinned-image or result change therefore invalidates the bundle.

Parsing and verification are observations only. Every artifact carries authority: "none"; changing it to an agent or another authority is rejected and a payload that says “approved” never authorizes anything.

Contract and canonicalization

  • .board/schemas/evidence-bundle.schema.json is the closed JSON Schema.
  • schema is aurum.evidence-bundle, version is 1, and unknown or duplicate fields fail closed.
  • All CandidateIdentityV1 members are required as lowercase sha256: values. The tuple is never shortened locally.
  • Artifacts are uniquely keyed and sorted by path byte order. Paths are bounded, relative normalized POSIX paths; traversal, whitespace, controls, backslashes, empty components and absolute paths are rejected.
  • Canonical JSON is compact UTF-8 with struct/schema field order and sorted artifacts. Noncanonical input, including a trailing newline, is rejected.
  • manifest_digest is SHA-256 over the domain aurum.evidence-bundle.manifest.v1, a newline, and canonical JSON with manifest_digest omitted. Artifact SHA-256 values cover exact output bytes.
  • Seal, Marshal, Parse, Verify, VerifyBytes, and ValidateSchema do no filesystem, network, authorization or publication I/O.

Limits

The parser accepts at most 4 MiB of canonical manifest JSON, 64 artifacts, 4 MiB per output and 4 MiB across all outputs. A path is at most 512 bytes. The vector harness accepts at most 64 vectors and 4 MiB and declares a deadline no greater than 30 seconds. Limits are checked before hashing unbounded data.

Executed example

The integration selector extracts the JSON between the markers below, seals it, and verifies it through the production package. The values are non-secret test digests and sanitized output text.

{"candidate_identity":{"repository_identity":"sha256:0000000000000000000000000000000000000000000000000000000000000000","base_tree_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","head_tree_digest":"sha256:2222222222222222222222222222222222222222222222222222222222222222","change_digest":"sha256:3333333333333333333333333333333333333333333333333333333333333333","task_spec_digest":"sha256:4444444444444444444444444444444444444444444444444444444444444444","configuration_digest":"sha256:5555555555555555555555555555555555555555555555555555555555555555","policy_digest":"sha256:6666666666666666666666666666666666666666666666666666666666666666","prompt_and_rubric_digest":"sha256:7777777777777777777777777777777777777777777777777777777777777777","skill_set_digest":"sha256:8888888888888888888888888888888888888888888888888888888888888888","provider_model_backend_identity_digest":"sha256:9999999999999999999999999999999999999999999999999999999999999999","toolchain_and_tool_set_digest":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","dependency_lock_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","container_image_set_digest":"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","test_manifest_digest":"sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","role_context_manifest_digest":"sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"},"outputs":[{"path":"acceptance/AC-001.json","kind":"acceptance-result","media_type":"application/json","data":"{\"exit_code\":0,\"result\":\"pass\"}"}]}

Diagnosis

  • duplicate_field, unknown_field, malformed, or non_canonical: reject the document rather than normalizing hostile bytes after the fact.
  • candidate_mismatch: obtain the expected candidate tuple from the caller's independent identity calculation; never copy it from the bundle under test.
  • digest_mismatch: recompute the named manifest or output digest. Do not rewrite a digest to match unexplained bytes.
  • authority_denied: remove the authority claim. Authorization belongs to a separate adapter and cannot be manufactured by evidence content.
  • limit_exceeded or unsafe_path: reduce the bounded evidence set or use a normalized card-scoped path; never relax the parser only.
  • Exit 69, missing Go, module/loader failure or OCI failure is infrastructure, not behavioral tamper detection.

Run go test ./internal/evidence, each exact selector through tests/acceptance/AUR-005.sh, and finally the card's exact OCI acceptance. MUT-001 must detect a changed output hash with an unchanged manifest; MUT-002 must detect a forged agent authority. Restoring either mutation must reproduce the canonical bytes, output order and exit code.

Rollback reverts only AUR-005-owned paths. No external state is migrated or published by this contract.