feat(prism): production constation wire and attestation routes - #2
Conversation
Port constation_ok, HTTP checkers, and break-glass admission from the base monorepo package so standalone prism can fail-closed on the six mechanism bundle without TEE claims. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Deserialize result.constation_bundle on ingest and attach BASE HTTP or in-process checkers. Pin base to monorepo SHA that ships attestation modules (release wheel v3.1.2 lacks them). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Host challenge/answer and internal constation check endpoints on the prism app (BASE proxy surface), matching monorepo package wiring. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Make constation_ok the sole elevation predicate (tier ceiling 1), require bundles on the lium backend, and drop the obsolete lium client tests. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Add HTTP ingest fail-closed coverage and a trust-contract guard that effective_tier never exceeds 1 without constation_ok. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Record miner-root threat model, six mechanisms with limits, and P1 no-bundle-no-score behavior without TEE or tamper-prevention claims. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
Warning Review limit reached
Next review available in: 16 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (31)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…sport Type MINER_FAULT/INFRA_FAULT as Final[Literal[...]] so fault_class_of returns FaultClass. Narrow BaseHttpConstationClient transport to sync BaseTransport. Widen optional-import ignore for AttestationVerifyReason. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Replace the git+ SHA pin with the published wheel URL and sha256 so docker-build on python:3.12-slim can resolve base without git. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
2 participants
Summary
BaseIntelligence/prisminto content-parity with the already-merged constation/attestation wiring inbasepackages/challenges/prism/(PRs #41/#42 on BaseIntelligence/base).result.constation_bundleand re-runsconstation_okvia BASE HTTP checkers (or in-process services for single-node/tests).Changes
constation.py,constation_checkers.py,breakglass.py,attestation_routes.py.app.py; gateingestion/audit/queue/proofonconstation_ok(tier ceiling 1).baseto monorepo SHAe6951699(release wheel v3.1.2 lacksDigestAllowlist/AttestationNonceService/ attestation payload).test_lium_client.pyto match base package.Test plan
uv run ruff check .(exit 0)uv run pytest -q— 1367 passed, 16 skippedtests/test_prism_no_tee_absence.pynot weakenedCI
Notes
constation_ok; noeffective_tier≥ 2; insecure checkers stay behindallow_insecure_signaturesfor tests only.prism-recipeminer image attestation PR is independent.