v0.23.0 — executor-service validator execution model

v0.23.0 — Executor-service validator execution model

Contents

Executor service — isolated validator execution behind a private HTTP API. The app container has zero Docker authority; the executor-service compose sibling owns the CT-local Docker socket and runs pinned validator images.

Backend-level reachability — pass-capability derivation keyed by backend_id (rev 3 amendment). The kind-level logic was unsafe once executor-service and docker-executor both map to container-runtime.

Receipt evidence binding — executor reports are verifiable evidence: executor_report_hash + executor_report_ref persisted durably; verifier resolves the ref, recomputes the hash, and compares before accepting pass. Persistence failure on a pass path downgrades to inconclusive.

Compose topology — gitwire-executor-service as a compose sibling with Docker socket mounted into executor only. App has no socket mount.

Validator image source — node:20-bookworm-slim with baseline repo at /opt/gitwire-base + deterministic workspace merge entrypoint.

Safety invariants

local-process never pass-capable
pass evidence requires live pass-capable backend + complete validator identity
executor reports are verifiable (ref resolves, hash recomputes)
uncaughtException → one shutdown attempt → process exits

Proof command set (v0.23.0)

• lint ✅
• test ✅
• build ✅
• typecheck ❌ (no root script — not supported in v0.23.0)

Known limitations

• Production CI-evidence envelope uses semantic IDs not in executor allowlist (Task 9 reconciles)
• DB-backed executor report recompute first exercised end-to-end in this release
• typecheck not supported
• Validator image must be built and pushed from the release commit