d3318c5910
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Builds on the merged W2 store/ack (EPIC #892). Adds A3 (digest.sh) and A5 (sign.sh) under packages/mosaic/framework/tools/wake/, honoring CONVERGED-DESIGN. A3 — digest.sh (cumulative-state digest renderer), §2.1: - CUMULATIVE-STATE: renders the FULL unacked set since consumed_seq from the durable pending-inbox (state-since-CONSUMED, not an event delta). - TWO-TIER TRUST: orientation tier (who/lane/board-head + changed-obligation list with observed_seq + locators) decides the no-op case with ZERO tool calls; actionable tier renders every consequential fact ONLY as a CLAIM-TO-VERIFY, point-in-time-at-seq — never auto-actioned. - HARD LOCATORS: every actionable claim must carry repo+issue#/40-char SHA/ file:anchor; a missing locator is fail-loud (exit 4, nothing emitted). - BOUNDING/INJECTION/SECRETS: source free-text is quoted only inside a delimited, length-capped, ANSI/bidi/zero-width-stripped untrusted block; secret-canary redaction over any inlined content; embeds the W2 ack line. A5 — sign.sh (non-circular HMAC signer), §2.5: - wake_id generated INDEPENDENTLY at emit (not derived from, and not a member of, the signed field-tuple); wake_mac = HMAC(key, wake_id || agent_identity || mission_generation || observed_seq || emit_ts || content_hash) — over wake_id PLUS the fields, genuinely non-circular (the MAC is never its own input). Fills the `hmac` placeholder W2 left in store entries. - Key resolved BY NAME from the credential store, never inlined, never echoed; no flag accepts key material. Same-uid threat boundary documented; off-uid signer named as a future gate. RED-FIRST tests (test-wake-digest-hmac.sh, wired into test:framework-shell): cumulative-state, hard-locator fail-loud, two-tier (zero-call orientation + claim-to-verify), scrub (secret-canary + ANSI/bidi/zero-width), non-circular HMAC (independent wake_id + tamper-breaks-MAC), key-by-name-never-inline. Each verified to go RED on a targeted regression. shellcheck clean; operator-agnostic (XDG/env only). manifest.txt bumped to 0.2.0. Part of #892 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
36 lines
1.6 KiB
Plaintext
36 lines
1.6 KiB
Plaintext
# Mosaic wake component — VERSION metadata manifest (Gate B).
|
|
#
|
|
# EPIC #892, W2 + W3 of the wake/heartbeat canon.
|
|
#
|
|
# SCOPE — THIS FILE IS VERSION METADATA ONLY. It declares the wake component's
|
|
# semantic version and the RANGE of watch-list schema versions it supports. It
|
|
# does NOT authorize file/path ownership: path-ownership remains the sole domain
|
|
# of packages/mosaic/framework/framework-manifest.txt (Gate A). Do not read any
|
|
# ownership meaning into this file.
|
|
#
|
|
# Format: KEY=VALUE, one per line. '#' and blank lines ignored.
|
|
|
|
# Component identity + semantic version.
|
|
# 0.1.0 W2 — store+drain lib + ack-wrapper.
|
|
# 0.2.0 W3 — cumulative-state digest renderer + non-circular HMAC signer.
|
|
component=wake
|
|
version=0.2.0
|
|
|
|
# Watch-list schema this component consumes, and the INCLUSIVE range of
|
|
# schema_version values it supports. A wake-watch-list.json whose schema_version
|
|
# falls outside [schema_min, schema_max] is rejected by the component (fail-loud),
|
|
# never silently coerced.
|
|
schema=wake-watch-list
|
|
schema_min=1
|
|
schema_max=1
|
|
|
|
# Pieces shipped by this component version (informational):
|
|
# store.sh A2 — three-cursor durable store + drain lib. (W2)
|
|
# ack.sh A4 — RECEIVED/CONSUMED ack-wrapper (local-write + ship). (W2)
|
|
# digest.sh A3 — cumulative-state digest renderer (hard locators,
|
|
# two-tier trust, injection/secret scrub). (W3)
|
|
# sign.sh A5 — non-circular HMAC signer (independent wake_id,
|
|
# load_credentials by-name; fills the hmac placeholder). (W3)
|
|
# Out of scope (later waves): detector (W4), FN-oracle/reconciler (W5),
|
|
# beacon (W6), installer (W7).
|