Skip to content

v0.20.0 — Isolated Pass-Capable Executor

Choose a tag to compare

View all tags
@Alajmah Alajmah released this 21 Jun 00:49
· 177 commits to master since this release
v0.20.0
7444f87

v0.20.0 — Isolated Pass-Capable Executor

This is the milestone release. verified and review_ready are now legitimately reachable under a strict proof chain.

What this release delivers

For the first time, the full repair pipeline is operationally pass-capable:

detected → evidence_collected → proposed → verified → review_ready → approved → applied

A pass receipt is accepted only when:

  1. The backend is explicitly pass-authorized (docker-executor only)
  2. Valid durable backend isolation evidence exists for that backend and image digest
  3. The receipt binds to the exact same image identity and locked proposal inputs
  4. Every validation command completed successfully under the verified isolated backend

PRs Shipped

# Title Commit
54 Executor backend abstraction + Docker/Podman implementation 0226a8b
55 E2E isolation evidence + immutable OCI image identity f689f88
56 Pass-capable unlock: backend evidence gate, docker-executor enabled 5411c67

New Infrastructure

  • ExecutorBackend abstraction: Contract-based backend selection with describe() / run()
  • docker-executor: Full container isolation (--network=none, --read-only, --user, --cpus, --memory, --pids-limit)
  • node-executor: Host spawn (always inconclusive, not pass-capable)
  • Image identity: GITWIRE_VALIDATOR_IMAGE_REF config, parseImageReference(), isDigestPinned()
  • Runtime inspection: inspectContainerImage(), verifyImageIdentity(), computeInspectionHash()
  • Isolation probes: 10 required probes (network, credentials, non-root, read-only, limits, socket)
  • Backend evidence store: Durable, audit-complete, content-addressed
  • Migration 036: backend_isolation_evidence table with inspection columns
  • Verifier check 3e: Backend evidence gate wired into lifecycle verifier

Test Coverage

60 suites, 2,196 tests — all green.

Production Deployment

Before pass-capable execution works in production:

  1. Build a real validator image and set GITWIRE_VALIDATOR_IMAGE_REF
  2. Run isolation probes and store backend evidence
  3. Configure Docker/Podman with the required isolation flags

Non-blocking follow-up

Make runtime_version binding symmetric between receipt and evidence (currently checked only when both sides present).

Assets 2
Loading