AUR-233 - Verify the bootstrap lockset
Documento histórico do board. Pode descrever componentes removidos; para uso atual, consulte o guia do produto.
Outcome
BootstrapLocksetV1 accepts exactly AUR-359 through AUR-364 when every locked
artifact exists, its content digest matches the index, and the aggregate
identity recomputes from the sorted child/digest pairs.
Contract
- The index is
.board/bootstrap/locks.yml. - The index contains one
schema, one aggregateidentity, and exactly sixchildrows. - Each child is bound to its embedded artifact path; aliases are rejected.
- Digests are recomputed from artifact bytes. A value written in the index is not trusted merely because it has the right shape.
- The aggregate identity is
sha256:plus the SHA-256 digest of sorted lines in the form<card-id> <recomputed-digest>. - Verdict words and hand-written outcome claims are not accepted in the index.
- The index is non-empty and at most 64 KiB/512 lines; each artifact is non-empty and at most 4 MiB.
Typed failures are lock_domain_missing, child_duplicate,
child_digest_mismatch, and candidate_identity_mismatch. Child execution
failures are reported separately by the acceptance harness and are never
converted into a successful aggregate.
Child bindings
| Card | Artifact |
|---|---|
| AUR-359 | locks/trust-root.yml |
| AUR-360 | locks/go.yml |
| AUR-361 | locks/actions.yml |
| AUR-362 | locks/scanners.yml |
| AUR-363 | locks/parsers.yml |
| AUR-364 | locks/docs.yml |
Validation
tests/acceptance/AUR-233.sh consumes and validates the tab-separated case
matrix, then exercises the nominal domain, missing and
duplicate children, digest and identity tampering, self-reference, handwritten
verdicts, aliasing, malformed index lines, symlink artifacts, and child
re-execution. tests/gates/bootstrap/AUR-233/cases.tsv is the compact mutation
matrix. For example, deleting the AUR-363 row returns
lock_domain_missing, while changing one artifact's content returns
child_digest_mismatch. bash .board/bootstrap/verify.sh performs the same
deterministic index, bounds, artifact, and identity checks without executing a
child.
Non-goals
This card does not produce or reinterpret child artifacts, install toolchains, resolve credentials, or publish external state. Child acceptance programs are re-executed by the acceptance harness and their raw exit status remains the source of the child observation.