From 22901eac88a2cff68b9833a19a310fc221b4add7 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 28 Aug 2026 08:49:07 +0500 Subject: [PATCH 1/3] feat(harness): promote signed active-seven closure --- .github/workflows/release-bundle.yml | 4 +-- core/app/module_release_evidence_test.go | 4 ++- core/app/services.go | 2 +- core/harness/module_bridge_test.go | 16 +++++++---- core/harness/registry.go | 9 ++++-- core/harness/work_policy_test.go | 4 +-- core/harnessevidence/evidence.go | 8 ++++-- core/harnessevidence/evidence_test.go | 6 ++-- core/releasebuilder/workflow_contract_test.go | 2 +- ...0035-agent-first-explicit-control-plane.md | 7 +++-- docs/contracts/agent-control-plane-v1.md | 2 +- docs/contracts/harness-adapters-v1.md | 18 ++++++------ docs/runbooks/release-lifecycle.md | 5 ++-- harnesses/antigravity-cli/profile.yaml | 4 +-- harnesses/capability-registry.yaml | 28 +++++++++---------- harnesses/claude-code/profile.yaml | 4 +-- harnesses/codex/profile.yaml | 4 +-- harnesses/cursor-cli/profile.yaml | 4 +-- harnesses/grok-build/profile.yaml | 4 +-- harnesses/opencode/profile.yaml | 4 +-- harnesses/pi/profile.yaml | 4 +-- .../v1/delegated-harness-evidence.schema.json | 2 +- .../v1/harness-runtime-manifest.schema.json | 2 +- schemas/v1/trust-policy.schema.json | 4 ++- 24 files changed, 85 insertions(+), 66 deletions(-) diff --git a/.github/workflows/release-bundle.yml b/.github/workflows/release-bundle.yml index f7acaf7..453b7cd 100644 --- a/.github/workflows/release-bundle.yml +++ b/.github/workflows/release-bundle.yml @@ -25,7 +25,7 @@ on: required: true type: string harness_evidence_bundle_base64: - description: "Base64 tar.gz containing manifest.json and five isolated records (required for stable/frozen)" + description: "Base64 tar.gz containing manifest.json and seven isolated records (required for stable/frozen)" required: false type: string harness_evidence_trust_policy_base64: @@ -107,7 +107,7 @@ jobs: run: | set -euo pipefail if [ -z "$HARNESS_EVIDENCE_BUNDLE_BASE64" ] && [ -z "$HARNESS_EVIDENCE_TRUST_POLICY_BASE64" ]; then - [ "$CHANNEL" = canary ] || { echo "stable/frozen requires signed active-five harness evidence" >&2; exit 1; } + [ "$CHANNEL" = canary ] || { echo "stable/frozen requires signed active-seven harness evidence" >&2; exit 1; } echo "arguments=" >> "$GITHUB_OUTPUT" exit 0 fi diff --git a/core/app/module_release_evidence_test.go b/core/app/module_release_evidence_test.go index 17b1b9b..d1bc907 100644 --- a/core/app/module_release_evidence_test.go +++ b/core/app/module_release_evidence_test.go @@ -92,7 +92,9 @@ func writeEvidenceFixture( Repository: "example-org/example-harnesses", Ref: "refs/tags/v1.0.0", Commit: strings.Repeat("d", 40), }, Modules: map[string]string{ - "claude-code": strings.Repeat("1", 40), "codex": strings.Repeat("2", 40), + "antigravity-cli": strings.Repeat("5", 40), + "claude-code": strings.Repeat("1", 40), "codex": strings.Repeat("2", 40), + "cursor-cli": strings.Repeat("6", 40), "grok-build": moduleSHA, "opencode": strings.Repeat("3", 40), "pi": strings.Repeat("4", 40), }, }, diff --git a/core/app/services.go b/core/app/services.go index 687536a..3ffb119 100644 --- a/core/app/services.go +++ b/core/app/services.go @@ -566,7 +566,7 @@ func (services *Services) BuildReleaseCandidate( Workflow: trust.Source.AllowedWorkflows[0], SourceRef: sourceRef, // The candidate command has no evidence input surface and performs no // publication. Its canary is therefore explicitly provisional; the hosted - // stable/frozen builder still requires the signed active-five manifest. + // stable/frozen builder still requires the signed active-seven manifest. HarnessEvidenceProvisional: options.Channel == "canary", TrackedSources: trackedSources, }, trust, services.Schemas) diff --git a/core/harness/module_bridge_test.go b/core/harness/module_bridge_test.go index 217826f..fd83f09 100644 --- a/core/harness/module_bridge_test.go +++ b/core/harness/module_bridge_test.go @@ -4,6 +4,7 @@ import ( "encoding/json" "os" "path/filepath" + "slices" "testing" "github.com/NDDev-OpenNetwork/github-device-sync/core/domain" @@ -251,8 +252,10 @@ func containsBridgeFinding(findings []domain.Finding, code string) bool { // requiring passing runtime contracts for all seventeen. // // The honest model is delegation, and this pins both halves of it: the report -// names the owner instead of implying a failed attempt, and a profile that -// claims delegation the bridge does not back is rejected. +// names the owner instead of implying a failed attempt, the active-seven may +// be supported only through that explicit owner plus the separate signed +// release gate, and a profile that claims delegation the bridge does not back +// is rejected. func TestSelectedRuntimeValidationReportsDelegationRatherThanSilentSuccess(t *testing.T) { root := repoRootForTest(t) schemas, err := validation.NewSchemaSet() @@ -273,9 +276,12 @@ func TestSelectedRuntimeValidationReportsDelegationRatherThanSilentSuccess(t *te if item.RuntimeEvidenceOwner != "example-org/example-harnesses" { t.Fatalf("%s evidence owner = %q", item.Harness, item.RuntimeEvidenceOwner) } - if item.CapabilityStatus != "provisional" { - t.Fatalf("%s status = %q; delegation registers a harness as available, not supported", - item.Harness, item.CapabilityStatus) + expectedStatus := "provisional" + if slices.Contains(WorkPolicyActiveIDs, item.Harness) { + expectedStatus = "supported" + } + if item.CapabilityStatus != expectedStatus { + t.Fatalf("%s status = %q, want %q", item.Harness, item.CapabilityStatus, expectedStatus) } } } diff --git a/core/harness/registry.go b/core/harness/registry.go index b86a8a1..fd993fd 100644 --- a/core/harness/registry.go +++ b/core/harness/registry.go @@ -35,7 +35,9 @@ var CanonicalIDs = []string{ // WorkPolicyActiveIDs is the global execution/release allowlist. Catalogue // membership is deliberately separate: the other twelve stable identities // remain discoverable but are on-pause. -var WorkPolicyActiveIDs = []string{"claude-code", "codex", "grok-build", "opencode", "pi"} +var WorkPolicyActiveIDs = []string{ + "antigravity-cli", "claude-code", "codex", "cursor-cli", "grok-build", "opencode", "pi", +} func ValidateDeviceSelection(selected []string) []domain.Finding { active := make(map[string]struct{}, len(WorkPolicyActiveIDs)) @@ -407,10 +409,11 @@ func validateProfile( map[string]any{"harness": harnessID, "path": relativePath}, )) } - if profile.Status == "supported" && profile.RuntimeTests.LastResult != "pass" { + if profile.Status == "supported" && profile.RuntimeTests.LastResult != "pass" && + !(profile.RuntimeTests.LastResult == "delegated" && delegated) { findings = append(findings, harnessFinding( "GDS_HARNESS_STATUS_UNPROVEN", - "A harness cannot be supported before its required runtime suite passes.", + "A harness cannot be supported before its runtime suite passes locally or has an explicit delegated evidence owner.", map[string]any{"harness": harnessID, "path": relativePath}, )) } diff --git a/core/harness/work_policy_test.go b/core/harness/work_policy_test.go index 24898eb..56eeb72 100644 --- a/core/harness/work_policy_test.go +++ b/core/harness/work_policy_test.go @@ -3,7 +3,7 @@ package harness import "testing" func TestWorkPolicySeparatesCatalogueActiveAndDeviceSelection(t *testing.T) { - if len(CanonicalIDs) != 17 || len(WorkPolicyActiveIDs) != 5 { + if len(CanonicalIDs) != 17 || len(WorkPolicyActiveIDs) != 7 { t.Fatalf("catalogue=%d active=%d", len(CanonicalIDs), len(WorkPolicyActiveIDs)) } findings := ValidateDeviceSelection([]string{"codex", "zcode"}) @@ -11,6 +11,6 @@ func TestWorkPolicySeparatesCatalogueActiveAndDeviceSelection(t *testing.T) { t.Fatalf("findings=%#v", findings) } if findings := ValidateDeviceSelection(WorkPolicyActiveIDs); len(findings) != 0 { - t.Fatalf("active five rejected: %#v", findings) + t.Fatalf("active seven rejected: %#v", findings) } } diff --git a/core/harnessevidence/evidence.go b/core/harnessevidence/evidence.go index ea06747..437db39 100644 --- a/core/harnessevidence/evidence.go +++ b/core/harnessevidence/evidence.go @@ -15,12 +15,14 @@ import ( "github.com/NDDev-OpenNetwork/github-device-sync/core/trust" ) -var ActiveHarnesses = []string{"claude-code", "codex", "grok-build", "opencode", "pi"} +var ActiveHarnesses = []string{ + "antigravity-cli", "claude-code", "codex", "cursor-cli", "grok-build", "opencode", "pi", +} var immutableCommit = regexp.MustCompile(`^[0-9a-f]{40}$`) // AnchoredIdentity returns producer and module pins only when the independently -// supplied trust policy contains the exact immutable active-five mapping. +// supplied trust policy contains the exact immutable active-seven mapping. func AnchoredIdentity(policy trust.Policy) (string, map[string]string, error) { anchored := policy.HarnessEvidence if anchored == nil || anchored.Producer.Repository == "" || @@ -172,7 +174,7 @@ func (verifier Verifier) VerifyManifest(manifest Manifest, records []Record, exp // EvaluateChannel applies release-channel semantics. Canary may carry an // explicitly provisional subset, but it can never auto-promote. Stable and -// frozen require the exact signed active-five closure. +// frozen require the exact signed active-seven closure. func (verifier Verifier) EvaluateChannel(manifest Manifest, records []Record, expected Expectation) (GateResult, error) { if expected.Channel == "stable" || expected.Channel == "frozen" { if err := verifier.VerifyManifest(manifest, records, expected); err != nil { diff --git a/core/harnessevidence/evidence_test.go b/core/harnessevidence/evidence_test.go index 0079cce..43af4bd 100644 --- a/core/harnessevidence/evidence_test.go +++ b/core/harnessevidence/evidence_test.go @@ -12,7 +12,7 @@ import ( "github.com/NDDev-OpenNetwork/github-device-sync/core/trust" ) -func TestIsolatedEvidenceAndAggregateRequireExactActiveFive(t *testing.T) { +func TestIsolatedEvidenceAndAggregateRequireExactActiveSeven(t *testing.T) { public, private, _ := ed25519.GenerateKey(rand.Reader) now := time.Date(2026, 8, 9, 12, 0, 0, 0, time.UTC) trustVerifier := trust.Verifier{Policy: trust.Policy{SchemaVersion: 1, PolicyID: "harness-test", Identities: []trust.Identity{{ @@ -75,7 +75,7 @@ func TestIsolatedEvidenceAndAggregateRequireExactActiveFive(t *testing.T) { } } -func TestAnchoredIdentityRequiresExactImmutableActiveFive(t *testing.T) { +func TestAnchoredIdentityRequiresExactImmutableActiveSeven(t *testing.T) { commit := strings.Repeat("a", 40) policy := trust.Policy{HarnessEvidence: &trust.HarnessEvidencePolicy{ Producer: trust.ProducerIdentity{ @@ -92,7 +92,7 @@ func TestAnchoredIdentityRequiresExactImmutableActiveFive(t *testing.T) { } delete(policy.HarnessEvidence.Modules, "pi") if _, _, err := AnchoredIdentity(policy); err == nil { - t.Fatal("identity without the exact active-five mapping was accepted") + t.Fatal("identity without the exact active-seven mapping was accepted") } policy.HarnessEvidence.Modules["pi"] = strings.Repeat("z", 40) if _, _, err := AnchoredIdentity(policy); err == nil { diff --git a/core/releasebuilder/workflow_contract_test.go b/core/releasebuilder/workflow_contract_test.go index ee72863..df96f62 100644 --- a/core/releasebuilder/workflow_contract_test.go +++ b/core/releasebuilder/workflow_contract_test.go @@ -94,7 +94,7 @@ func TestHostedReleaseWorkflowUsesOutputOutsideSourceRoot(t *testing.T) { `path: ${{ runner.temp }}/gds-release-output`, `${{ runner.temp }}/gds-release-output/release-evidence`, `HARNESS_EVIDENCE_TRUST_POLICY_DIGEST: ${{ vars.HARNESS_EVIDENCE_TRUST_POLICY_DIGEST }}`, - `stable/frozen requires signed active-five harness evidence`, + `stable/frozen requires signed active-seven harness evidence`, `--harness-evidence-directory $EVIDENCE_INPUT_ROOT/records`, `RELEASE_SEQUENCE: ${{ inputs.release_sequence }}`, `canary) release_flags=(--prerelease) ;;`, diff --git a/docs/adr/0035-agent-first-explicit-control-plane.md b/docs/adr/0035-agent-first-explicit-control-plane.md index 67cefd8..3aaaab2 100644 --- a/docs/adr/0035-agent-first-explicit-control-plane.md +++ b/docs/adr/0035-agent-first-explicit-control-plane.md @@ -25,10 +25,11 @@ performance gates, and device intent as a proxy for current device truth. - Required check contexts are generated from an allowlisted security workflow policy, exact caller pins, and content-digested reusable workflow facts. - The harness catalogue remains seventeen identities. Work-policy active is - exactly claude-code, codex, grok-build, opencode, and pi. Every harness emits + exactly antigravity-cli, claude-code, codex, cursor-cli, grok-build, opencode, + and pi. Every harness emits isolated signed exact-version evidence; a separately signed manifest binds the aggregate. Canary may be provisional and never auto-promotes. Stable/frozen - require all five. + require all seven. - Device operational truth is SQLite plus signed compact evidence. Read paths are offline by default and report claim-specific freshness; apply re-reads. - Cross-repository plans are dependency DAGs. Automatic compensation is valid @@ -44,7 +45,7 @@ Mutation callers must migrate from a string reference to a signed approval JSON file and configure a public trust policy. State schema v8 adds plan enablement, device evidence, and telemetry outbox tables. Plan v1 now emits declared write sets; old durable plans without them require re-planning rather than migration. -Stable/frozen release construction is unavailable until a signed active-five +Stable/frozen release construction is unavailable until a signed active-seven evidence directory and trust policy are supplied. `zcode` remains catalogued and may remain installed as `installed-paused`, but it diff --git a/docs/contracts/agent-control-plane-v1.md b/docs/contracts/agent-control-plane-v1.md index e14682a..a0ddcac 100644 --- a/docs/contracts/agent-control-plane-v1.md +++ b/docs/contracts/agent-control-plane-v1.md @@ -19,7 +19,7 @@ The following invariants are fail-closed: - Ruleset updates preserve all externally managed and unknown writable JSON. If full privileged observation or lossless representation is unavailable, write is refused. -- Stable/frozen bundle manifests bind a verified active-five harness evidence +- Stable/frozen bundle manifests bind a verified active-seven harness evidence manifest digest. Canary evidence gaps remain visible as provisional and cannot auto-promote. - Operational identifiers may be exported. Credentials, signatures, private diff --git a/docs/contracts/harness-adapters-v1.md b/docs/contracts/harness-adapters-v1.md index d3c9cc3..808f257 100644 --- a/docs/contracts/harness-adapters-v1.md +++ b/docs/contracts/harness-adapters-v1.md @@ -58,18 +58,20 @@ Validity and renderability are different questions. | Harness | Instruction projection | Skill discovery | Explicit-only control | Runtime status | |---|---|---|---|---| -| Antigravity CLI | workspace-root `AGENTS.md` | `.agents/skills` | profile exclusion | provisional | -| Claude Code | `.claude/CLAUDE.md` | project/plugin skills | `disable-model-invocation` | provisional | -| Codex | root-to-CWD `AGENTS.md` | `.agents/skills` and plugins | `agents/openai.yaml` | provisional | -| Cursor CLI | workspace-root `AGENTS.md` | `.cursor/skills` | profile exclusion | provisional | -| Grok CLI | root-to-CWD `AGENTS.md` | `.grok/skills`, user `.agents/skills` | profile exclusion | provisional | +| Antigravity CLI | workspace-root `AGENTS.md` | `.agents/skills` | profile exclusion | supported, delegated evidence | +| Claude Code | `.claude/CLAUDE.md` | project/plugin skills | `disable-model-invocation` | supported, delegated evidence | +| Codex | root-to-CWD `AGENTS.md` | `.agents/skills` and plugins | `agents/openai.yaml` | supported, delegated evidence | +| Cursor CLI | workspace-root `AGENTS.md` | `.cursor/skills` | profile exclusion | supported, delegated evidence | +| Grok CLI | root-to-CWD `AGENTS.md` | `.grok/skills`, user `.agents/skills` | profile exclusion | supported, delegated evidence | | Kimi Code | native project `AGENTS.md` (order runtime-gated) | `.agents/skills`, `.kimi-code/skills` | `disable-model-invocation` | provisional | | MiMo Code | workspace-root `AGENTS.md` | `.mimocode/skills`, `.agents/skills`, `.claude/skills` | profile exclusion | provisional | -| OpenCode | root-to-CWD `AGENTS.md` | `.agents/skills`, `.opencode/skills`, `.claude/skills` | profile exclusion | provisional | -| Pi | parent-chain `AGENTS.md` | `.agents/skills`, `.pi/skills` | `disable-model-invocation` | provisional | +| OpenCode | root-to-CWD `AGENTS.md` | `.agents/skills`, `.opencode/skills`, `.claude/skills` | profile exclusion | supported, delegated evidence | +| Pi | parent-chain `AGENTS.md` | `.agents/skills`, `.pi/skills` | `disable-model-invocation` | supported, delegated evidence | | ZCode | workspace-root `AGENTS.md` | `.zcode/skills`, managed user skills | manual `$skill` | provisional | -This table records official documentation claims, not runtime support. +The seven supported rows use a declared delegated evidence owner. Stable and +frozen releases still require fresh signed evidence for the exact active-seven +closure; catalogue-only rows remain provisional and on-pause. ## Validation diff --git a/docs/runbooks/release-lifecycle.md b/docs/runbooks/release-lifecycle.md index cc99c84..b10cccc 100644 --- a/docs/runbooks/release-lifecycle.md +++ b/docs/runbooks/release-lifecycle.md @@ -29,7 +29,8 @@ proven: - `scripts/validate_release.sh` passes; - `stable` and `frozen` receive an isolated signed evidence archive for exactly - `claude-code`, `codex`, `grok-build`, `opencode`, and `pi`, plus its public + `antigravity-cli`, `claude-code`, `codex`, `cursor-cli`, `grok-build`, + `opencode`, and `pi`, plus its public trust policy; - repository variable `HARNESS_EVIDENCE_TRUST_POLICY_DIGEST` pins the exact `sha256:` digest of that independently distributed public trust policy; @@ -58,7 +59,7 @@ The repository is private (ADR 0033) and owned by the example-org organization, so `actions/attest` provenance and SBOM attestation is an available release path — keyless Sigstore attestation works for private repositories as long as the workflow holds `id-token: write`. -Canary may omit active-five evidence only as explicitly provisional and cannot +Canary may omit active-seven evidence only as explicitly provisional and cannot auto-promote. Stable/frozen verify the aggregate signature, every isolated record, exact executable/module/root versions, GDS profile and bridge digests, freshness (maximum 72 hours), and the complete active set. Only signed artifacts diff --git a/harnesses/antigravity-cli/profile.yaml b/harnesses/antigravity-cli/profile.yaml index 5b79e87..9e9accb 100644 --- a/harnesses/antigravity-cli/profile.yaml +++ b/harnesses/antigravity-cli/profile.yaml @@ -3,11 +3,11 @@ schema_version: 1 harness_profile: id: "antigravity-cli" product: "antigravity-cli" - status: "provisional" + status: "supported" aliases: - "antigravity" capability_version: "2026-07-11" - verified_at: "2026-07-11" + verified_at: "2026-08-28" official_sources: - "https://antigravity.google/docs/skills?app=antigravity-ide" - "https://antigravity.google/docs/cli-reference" diff --git a/harnesses/capability-registry.yaml b/harnesses/capability-registry.yaml index d39da6c..9cbdb54 100644 --- a/harnesses/capability-registry.yaml +++ b/harnesses/capability-registry.yaml @@ -2,31 +2,31 @@ schema_version: 1 harnesses: - id: "antigravity-cli" - status: "provisional" + status: "supported" profile: "harnesses/antigravity-cli/profile.yaml" - verified_at: "2026-07-11" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: - "antigravity" - id: "claude-code" - status: "provisional" + status: "supported" profile: "harnesses/claude-code/profile.yaml" - verified_at: "2026-07-11" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: [] - id: "codex" - status: "provisional" + status: "supported" profile: "harnesses/codex/profile.yaml" - verified_at: "2026-07-11" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: [] - id: "cursor-cli" - status: "provisional" + status: "supported" profile: "harnesses/cursor-cli/profile.yaml" - verified_at: "2026-07-11" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: [] @@ -45,9 +45,9 @@ harnesses: legacy_aliases: [] - id: "grok-build" - status: "provisional" + status: "supported" profile: "harnesses/grok-build/profile.yaml" - verified_at: "2026-07-26" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: [] @@ -87,16 +87,16 @@ harnesses: legacy_aliases: [] - id: "opencode" - status: "provisional" + status: "supported" profile: "harnesses/opencode/profile.yaml" - verified_at: "2026-07-11" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: [] - id: "pi" - status: "provisional" + status: "supported" profile: "harnesses/pi/profile.yaml" - verified_at: "2026-07-11" + verified_at: "2026-08-28" runtime_evidence: "delegated" legacy_aliases: [] diff --git a/harnesses/claude-code/profile.yaml b/harnesses/claude-code/profile.yaml index a7dc30c..82bb318 100644 --- a/harnesses/claude-code/profile.yaml +++ b/harnesses/claude-code/profile.yaml @@ -3,10 +3,10 @@ schema_version: 1 harness_profile: id: "claude-code" product: "claude-code" - status: "provisional" + status: "supported" aliases: [] capability_version: "2026-07-11" - verified_at: "2026-07-11" + verified_at: "2026-08-28" official_sources: - "https://code.claude.com/docs/en/memory" - "https://code.claude.com/docs/en/skills" diff --git a/harnesses/codex/profile.yaml b/harnesses/codex/profile.yaml index 0f402ba..8930832 100644 --- a/harnesses/codex/profile.yaml +++ b/harnesses/codex/profile.yaml @@ -3,10 +3,10 @@ schema_version: 1 harness_profile: id: "codex" product: "codex" - status: "provisional" + status: "supported" aliases: [] capability_version: "2026-07-11" - verified_at: "2026-07-11" + verified_at: "2026-08-28" official_sources: - "https://developers.openai.com/codex/guides/agents-md" - "https://developers.openai.com/codex/skills" diff --git a/harnesses/cursor-cli/profile.yaml b/harnesses/cursor-cli/profile.yaml index db482be..6248e99 100644 --- a/harnesses/cursor-cli/profile.yaml +++ b/harnesses/cursor-cli/profile.yaml @@ -3,10 +3,10 @@ schema_version: 1 harness_profile: id: "cursor-cli" product: "cursor-cli" - status: "provisional" + status: "supported" aliases: [] capability_version: "2026-07-11" - verified_at: "2026-07-11" + verified_at: "2026-08-28" official_sources: - "https://docs.cursor.com/en/cli/using" - "https://docs.cursor.com/en/cli/overview" diff --git a/harnesses/grok-build/profile.yaml b/harnesses/grok-build/profile.yaml index 1a9c9ab..1a30f00 100644 --- a/harnesses/grok-build/profile.yaml +++ b/harnesses/grok-build/profile.yaml @@ -3,10 +3,10 @@ schema_version: 1 harness_profile: id: "grok-build" product: "grok-build" - status: "provisional" + status: "supported" aliases: [] capability_version: "2026-07-26" - verified_at: "2026-07-26" + verified_at: "2026-08-28" official_sources: - "https://x.ai/cli" - "https://github.com/xai-org/grok-build" diff --git a/harnesses/opencode/profile.yaml b/harnesses/opencode/profile.yaml index da0c9cc..01efe7d 100644 --- a/harnesses/opencode/profile.yaml +++ b/harnesses/opencode/profile.yaml @@ -3,10 +3,10 @@ schema_version: 1 harness_profile: id: "opencode" product: "opencode" - status: "provisional" + status: "supported" aliases: [] capability_version: "2026-07-11" - verified_at: "2026-07-11" + verified_at: "2026-08-28" official_sources: - "https://opencode.ai/docs/rules/" - "https://opencode.ai/docs/skills/" diff --git a/harnesses/pi/profile.yaml b/harnesses/pi/profile.yaml index 2ac14f9..c52c747 100644 --- a/harnesses/pi/profile.yaml +++ b/harnesses/pi/profile.yaml @@ -3,10 +3,10 @@ schema_version: 1 harness_profile: id: "pi" product: "pi" - status: "provisional" + status: "supported" aliases: [] capability_version: "2026-07-11" - verified_at: "2026-07-11" + verified_at: "2026-08-28" official_sources: - "https://pi.dev/docs/latest/usage" - "https://pi.dev/docs/latest/skills" diff --git a/schemas/v1/delegated-harness-evidence.schema.json b/schemas/v1/delegated-harness-evidence.schema.json index 61ca298..22fea5b 100644 --- a/schemas/v1/delegated-harness-evidence.schema.json +++ b/schemas/v1/delegated-harness-evidence.schema.json @@ -1 +1 @@ -{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://github.com/NDDev-OpenNetwork/github-device-sync/schemas/v1/delegated-harness-evidence.schema.json","title":"Isolated signed delegated harness runtime evidence v1","type":"object","additionalProperties":false,"required":["payload","evidence_digest","signature"],"properties":{"payload":{"type":"object","additionalProperties":false,"required":["schema_version","evidence_id","harness_id","harness_root_sha","module_sha","profile_digest","bridge_digest","executable_version","platform","suite_version","suite_cases_digest","result","generated_at","expires_at","actor_id"],"properties":{"schema_version":{"const":1},"evidence_id":{"type":"string","minLength":1},"harness_id":{"enum":["claude-code","codex","grok-build","opencode","pi"]},"harness_root_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"module_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"profile_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"bridge_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"executable_version":{"type":"string","minLength":1},"platform":{"type":"object","additionalProperties":false,"required":["os","architecture","device_class"],"properties":{"os":{"type":"string","minLength":1},"architecture":{"type":"string","minLength":1},"device_class":{"type":"string","minLength":1}}},"suite_version":{"type":"string","minLength":1},"suite_cases_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"result":{"const":"pass"},"generated_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"actor_id":{"type":"string","minLength":1}}},"evidence_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"signature":{"$ref":"device-evidence.schema.json#/$defs/signature"}}} +{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://github.com/NDDev-OpenNetwork/github-device-sync/schemas/v1/delegated-harness-evidence.schema.json","title":"Isolated signed delegated harness runtime evidence v1","type":"object","additionalProperties":false,"required":["payload","evidence_digest","signature"],"properties":{"payload":{"type":"object","additionalProperties":false,"required":["schema_version","evidence_id","harness_id","harness_root_sha","module_sha","profile_digest","bridge_digest","executable_version","platform","suite_version","suite_cases_digest","result","generated_at","expires_at","actor_id"],"properties":{"schema_version":{"const":1},"evidence_id":{"type":"string","minLength":1},"harness_id":{"enum":["antigravity-cli","claude-code","codex","cursor-cli","grok-build","opencode","pi"]},"harness_root_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"module_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"profile_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"bridge_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"executable_version":{"type":"string","minLength":1},"platform":{"type":"object","additionalProperties":false,"required":["os","architecture","device_class"],"properties":{"os":{"type":"string","minLength":1},"architecture":{"type":"string","minLength":1},"device_class":{"type":"string","minLength":1}}},"suite_version":{"type":"string","minLength":1},"suite_cases_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"result":{"const":"pass"},"generated_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"actor_id":{"type":"string","minLength":1}}},"evidence_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"signature":{"$ref":"device-evidence.schema.json#/$defs/signature"}}} diff --git a/schemas/v1/harness-runtime-manifest.schema.json b/schemas/v1/harness-runtime-manifest.schema.json index 7f420f6..fe19142 100644 --- a/schemas/v1/harness-runtime-manifest.schema.json +++ b/schemas/v1/harness-runtime-manifest.schema.json @@ -1 +1 @@ -{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://github.com/NDDev-OpenNetwork/github-device-sync/schemas/v1/harness-runtime-manifest.schema.json","title":"Signed active harness evidence manifest v1","type":"object","additionalProperties":false,"required":["payload","manifest_digest","signature"],"properties":{"payload":{"type":"object","additionalProperties":false,"required":["schema_version","manifest_id","harness_root_sha","channel","generated_at","expires_at","actor_id","evidence"],"properties":{"schema_version":{"const":1},"manifest_id":{"type":"string","minLength":1},"harness_root_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"channel":{"enum":["canary","stable","frozen"]},"generated_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"actor_id":{"type":"string","minLength":1},"evidence":{"type":"array","maxItems":5,"uniqueItems":true,"items":{"type":"object","additionalProperties":false,"required":["harness_id","evidence_digest"],"properties":{"harness_id":{"enum":["claude-code","codex","grok-build","opencode","pi"]},"evidence_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"}}}}}},"manifest_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"signature":{"$ref":"device-evidence.schema.json#/$defs/signature"}}} +{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://github.com/NDDev-OpenNetwork/github-device-sync/schemas/v1/harness-runtime-manifest.schema.json","title":"Signed active harness evidence manifest v1","type":"object","additionalProperties":false,"required":["payload","manifest_digest","signature"],"properties":{"payload":{"type":"object","additionalProperties":false,"required":["schema_version","manifest_id","harness_root_sha","channel","generated_at","expires_at","actor_id","evidence"],"properties":{"schema_version":{"const":1},"manifest_id":{"type":"string","minLength":1},"harness_root_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"channel":{"enum":["canary","stable","frozen"]},"generated_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"actor_id":{"type":"string","minLength":1},"evidence":{"type":"array","maxItems":7,"uniqueItems":true,"items":{"type":"object","additionalProperties":false,"required":["harness_id","evidence_digest"],"properties":{"harness_id":{"enum":["antigravity-cli","claude-code","codex","cursor-cli","grok-build","opencode","pi"]},"evidence_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"}}}}}},"manifest_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"signature":{"$ref":"device-evidence.schema.json#/$defs/signature"}}} diff --git a/schemas/v1/trust-policy.schema.json b/schemas/v1/trust-policy.schema.json index 266cbd0..57cf02a 100644 --- a/schemas/v1/trust-policy.schema.json +++ b/schemas/v1/trust-policy.schema.json @@ -26,10 +26,12 @@ "modules": { "type": "object", "additionalProperties": false, - "required": ["claude-code", "codex", "grok-build", "opencode", "pi"], + "required": ["antigravity-cli", "claude-code", "codex", "cursor-cli", "grok-build", "opencode", "pi"], "properties": { + "antigravity-cli": {"$ref": "common.schema.json#/$defs/sourceCommit"}, "claude-code": {"$ref": "common.schema.json#/$defs/sourceCommit"}, "codex": {"$ref": "common.schema.json#/$defs/sourceCommit"}, + "cursor-cli": {"$ref": "common.schema.json#/$defs/sourceCommit"}, "grok-build": {"$ref": "common.schema.json#/$defs/sourceCommit"}, "opencode": {"$ref": "common.schema.json#/$defs/sourceCommit"}, "pi": {"$ref": "common.schema.json#/$defs/sourceCommit"} From e9a820a455e8dcfbcdcd2fbfe201a6c9102c9a44 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 28 Aug 2026 08:49:23 +0500 Subject: [PATCH 2/3] chore(gds): synchronize active-seven projections --- .gds/bundle.lock.yaml | 10 +++++----- .github/workflows/gds-ci.yml | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index c6cec75..cb2312d 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -5,14 +5,14 @@ bundle: version: "0.4.0-dev" release_sequence: 0 channel: "development" - source_tree_digest: "sha256:1aa9237afbbce4e74a7e2580ad22601a8ce2c2c5046cb797e6cfc82aa8320e2d" - digest: "sha256:eda29a8be938e2ea6dd85b28b9e0bb30cec155ea31386cfd2b043ce8b959cc66" + source_tree_digest: "sha256:c12d3daeb066a15285643d59edeebaa81723aa09e78b1648272ae21cf0690028" + digest: "sha256:682f3ca19b186896d4c3674ef42168fc6c0ddfb4ceb2559e2f53725a8c027ec6" projection: - input_digest: "sha256:491245684963cbacff4fe8c5c3b828b5f367b08bda217a264d7617b592cfeff3" - output_digest: "sha256:be645e1600d99a870a126567eb5ec2690c3faec7664d8196eebdea567b458d1c" + input_digest: "sha256:d1081525c7ada255a326a23a712a8349b31df97efdc4f405ce6560d9d0fff0dd" + output_digest: "sha256:c0b3446abdb68e5edea9e9254f768996749e44caf7c432fea345361a3de2d57c" files: - path: ".gds/compiled-policy.json" digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:3994ebccb515b10763ecbe69b4a31fc8e34a09adf7e5543a10c8716b761e4e1c" + digest: "sha256:500895ef32c6899163da96242797c48d3fb6250d1e2025f85a281e4fded72cf9" diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 332568b..4750fc9 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -1,8 +1,8 @@ # GENERATED FILE - DO NOT EDIT DIRECTLY # generator: gds # bundle: 0.4.0-dev -# source-tree-digest: sha256:1aa9237afbbce4e74a7e2580ad22601a8ce2c2c5046cb797e6cfc82aa8320e2d -# input-digest: sha256:491245684963cbacff4fe8c5c3b828b5f367b08bda217a264d7617b592cfeff3 +# source-tree-digest: sha256:c12d3daeb066a15285643d59edeebaa81723aa09e78b1648272ae21cf0690028 +# input-digest: sha256:d1081525c7ada255a326a23a712a8349b31df97efdc4f405ce6560d9d0fff0dd # output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49 # edit-source: # - .gds/repository.yaml From 4f6184383c57a47c779dfa1d22caa81196ebcaa8 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 28 Aug 2026 08:59:03 +0500 Subject: [PATCH 3/3] fix(harness): preserve opaque vendor versions --- core/harnessevidence/evidence.go | 4 ++-- core/harnessevidence/evidence_test.go | 6 +++--- schemas/v1/delegated-harness-evidence.schema.json | 2 +- .../schemas/v1/valid-delegated-harness-evidence.json | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/core/harnessevidence/evidence.go b/core/harnessevidence/evidence.go index 437db39..463c21d 100644 --- a/core/harnessevidence/evidence.go +++ b/core/harnessevidence/evidence.go @@ -11,7 +11,6 @@ import ( "time" "github.com/NDDev-OpenNetwork/github-device-sync/core/canonicaljson" - "github.com/NDDev-OpenNetwork/github-device-sync/core/semver" "github.com/NDDev-OpenNetwork/github-device-sync/core/trust" ) @@ -20,6 +19,7 @@ var ActiveHarnesses = []string{ } var immutableCommit = regexp.MustCompile(`^[0-9a-f]{40}$`) +var executableVersion = regexp.MustCompile(`^[0-9A-Za-z][0-9A-Za-z._+-]{0,127}$`) // AnchoredIdentity returns producer and module pins only when the independently // supplied trust policy contains the exact immutable active-seven mapping. @@ -123,7 +123,7 @@ func (verifier Verifier) Verify(record Record, expected Expectation) error { p.ProfileDigest != expected.ProfileDigests[p.HarnessID] || p.BridgeDigest != expected.BridgeDigests[p.HarnessID] || p.ExecutableVersion != expected.ExecutableVersions[p.HarnessID] || - !semver.Valid(p.ExecutableVersion) || + !executableVersion.MatchString(p.ExecutableVersion) || p.Result != "pass" || p.GeneratedAt.After(expected.Now) || !expected.Now.Before(p.ExpiresAt) || p.ExpiresAt.Sub(p.GeneratedAt) > 72*time.Hour || p.Platform.OS == "" || p.Platform.Architecture == "" || p.SuiteVersion == "" || p.SuiteCasesDigest == "" { diff --git a/core/harnessevidence/evidence_test.go b/core/harnessevidence/evidence_test.go index 43af4bd..6af5e45 100644 --- a/core/harnessevidence/evidence_test.go +++ b/core/harnessevidence/evidence_test.go @@ -66,12 +66,12 @@ func TestIsolatedEvidenceAndAggregateRequireExactActiveSeven(t *testing.T) { } expected.ModuleSHAs[wrongModule.Payload.HarnessID] = wrongModule.Payload.ModuleSHA invalidVersion := records[0] - invalidVersion.Payload.ExecutableVersion = "null" - expected.ExecutableVersions[invalidVersion.Payload.HarnessID] = "null" + invalidVersion.Payload.ExecutableVersion = "bad version" + expected.ExecutableVersions[invalidVersion.Payload.HarnessID] = "bad version" invalidVersion.EvidenceDigest, _ = canonicaljson.Digest(invalidVersion.Payload) invalidVersion.Signature = sign(t, private, "gds-harness-runtime-evidence/v1", invalidVersion.Payload) if err := verifier.Verify(invalidVersion, expected); err == nil { - t.Fatal("signed non-semver executable version was accepted") + t.Fatal("signed unsafe executable version was accepted") } } diff --git a/schemas/v1/delegated-harness-evidence.schema.json b/schemas/v1/delegated-harness-evidence.schema.json index 22fea5b..bcd57ba 100644 --- a/schemas/v1/delegated-harness-evidence.schema.json +++ b/schemas/v1/delegated-harness-evidence.schema.json @@ -1 +1 @@ -{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://github.com/NDDev-OpenNetwork/github-device-sync/schemas/v1/delegated-harness-evidence.schema.json","title":"Isolated signed delegated harness runtime evidence v1","type":"object","additionalProperties":false,"required":["payload","evidence_digest","signature"],"properties":{"payload":{"type":"object","additionalProperties":false,"required":["schema_version","evidence_id","harness_id","harness_root_sha","module_sha","profile_digest","bridge_digest","executable_version","platform","suite_version","suite_cases_digest","result","generated_at","expires_at","actor_id"],"properties":{"schema_version":{"const":1},"evidence_id":{"type":"string","minLength":1},"harness_id":{"enum":["antigravity-cli","claude-code","codex","cursor-cli","grok-build","opencode","pi"]},"harness_root_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"module_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"profile_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"bridge_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"executable_version":{"type":"string","minLength":1},"platform":{"type":"object","additionalProperties":false,"required":["os","architecture","device_class"],"properties":{"os":{"type":"string","minLength":1},"architecture":{"type":"string","minLength":1},"device_class":{"type":"string","minLength":1}}},"suite_version":{"type":"string","minLength":1},"suite_cases_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"result":{"const":"pass"},"generated_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"actor_id":{"type":"string","minLength":1}}},"evidence_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"signature":{"$ref":"device-evidence.schema.json#/$defs/signature"}}} +{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://github.com/NDDev-OpenNetwork/github-device-sync/schemas/v1/delegated-harness-evidence.schema.json","title":"Isolated signed delegated harness runtime evidence v1","type":"object","additionalProperties":false,"required":["payload","evidence_digest","signature"],"properties":{"payload":{"type":"object","additionalProperties":false,"required":["schema_version","evidence_id","harness_id","harness_root_sha","module_sha","profile_digest","bridge_digest","executable_version","platform","suite_version","suite_cases_digest","result","generated_at","expires_at","actor_id"],"properties":{"schema_version":{"const":1},"evidence_id":{"type":"string","minLength":1},"harness_id":{"enum":["antigravity-cli","claude-code","codex","cursor-cli","grok-build","opencode","pi"]},"harness_root_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"module_sha":{"$ref":"common.schema.json#/$defs/sourceCommit"},"profile_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"bridge_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"executable_version":{"type":"string","pattern":"^[0-9A-Za-z][0-9A-Za-z._+-]{0,127}$"},"platform":{"type":"object","additionalProperties":false,"required":["os","architecture","device_class"],"properties":{"os":{"type":"string","minLength":1},"architecture":{"type":"string","minLength":1},"device_class":{"type":"string","minLength":1}}},"suite_version":{"type":"string","minLength":1},"suite_cases_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"result":{"const":"pass"},"generated_at":{"type":"string","format":"date-time"},"expires_at":{"type":"string","format":"date-time"},"actor_id":{"type":"string","minLength":1}}},"evidence_digest":{"$ref":"common.schema.json#/$defs/sha256Digest"},"signature":{"$ref":"device-evidence.schema.json#/$defs/signature"}}} diff --git a/tests/fixtures/schemas/v1/valid-delegated-harness-evidence.json b/tests/fixtures/schemas/v1/valid-delegated-harness-evidence.json index 8c0011d..f09a7c0 100644 --- a/tests/fixtures/schemas/v1/valid-delegated-harness-evidence.json +++ b/tests/fixtures/schemas/v1/valid-delegated-harness-evidence.json @@ -1 +1 @@ -{"payload":{"schema_version":1,"evidence_id":"harness-evidence-1","harness_id":"codex","harness_root_sha":"0123456789abcdef0123456789abcdef01234567","module_sha":"0123456789abcdef0123456789abcdef01234567","profile_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","bridge_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","executable_version":"1.0.0","platform":{"os":"linux","architecture":"amd64","device_class":"desktop-builds"},"suite_version":"v1","suite_cases_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","result":"pass","generated_at":"2026-08-09T18:00:00Z","expires_at":"2026-08-10T18:00:00Z","actor_id":"automation:harness-evidence"},"evidence_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","signature":{"algorithm":"ed25519","key_id":"harness-2026","value":"AA"}} +{"payload":{"schema_version":1,"evidence_id":"harness-evidence-1","harness_id":"cursor-cli","harness_root_sha":"0123456789abcdef0123456789abcdef01234567","module_sha":"0123456789abcdef0123456789abcdef01234567","profile_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","bridge_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","executable_version":"2026.08.25-3e8eec8","platform":{"os":"linux","architecture":"amd64","device_class":"desktop-builds"},"suite_version":"v1","suite_cases_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","result":"pass","generated_at":"2026-08-09T18:00:00Z","expires_at":"2026-08-10T18:00:00Z","actor_id":"automation:harness-evidence"},"evidence_digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","signature":{"algorithm":"ed25519","key_id":"harness-2026","value":"AA"}}