Repository navigation
Evidence Authority And Cleanup
The protected evidence envelope retains the qualification and candidate identities; host/guest lane and actual host build; manifest, image and installer digests; the source and artifact digest of each applicable resolved direct and transitive bootstrap dependency; phase and observer provenance; the verified VM UUID and generation; control-boundary and continuity evidence; and cleanup outcomes. The two end-to-end lanes also retain the runner-distribution identity, registration scope and runner ID, and probe run/attempt/job ID, challenge, and response. Runner and probe records are not applicable to the public-only lane. Each source and independent verification result is identifiable. This is a logical evidence inventory, not yet a complete private wire schema: define its exact versioned fields, lane applicability, canonicalization, and trust and transport protocol before implementation. Missing applicable data, unverifiable origin, fields outside the selected schema, or a cross-record mismatch cannot become a pass. No credentials, activation values, private keys, raw guest captures, VM media, or known-hosts contents belong in this envelope or a summary.
The only publishable qualification summary is a UTF-8 JSON object without
a byte-order mark or duplicate member names and with exactly these fields:
schemaVersion = projectbuddy/release-qualification-summary@1;
qualificationId = a canonical UUIDv4 string; candidateCommit = the
full lowercase commit SHA; lane = one of the three matrix IDs; outcome
= PASS, FAIL, or UNKNOWN; and reasonCodes = an array without
duplicates sorted in ASCII lexicographical order. Allowed reason codes are
INVALID_PROOF, MISSING_PROOF,
IDENTITY_MISMATCH, PROBE_FAILED, UNSAFE_BOUNDARY,
CONTINUITY_UNKNOWN, OPERATION_UNKNOWN, CLEANUP_INCOMPLETE,
DEPENDENCY_UNKNOWN, and DEADLINE_EXCEEDED. PASS requires an empty
array; FAIL or UNKNOWN requires at least one reason. Reject extra or
mistyped fields. The public-only lane never claims a runner result. A
summary is not itself proof: an independent verifier must authenticate
and reconcile the protected records to which it refers. The storage and
attestation backend are not selected, and summary publication itself
needs approval.
Classify a confirmed failed requirement as FAIL; otherwise use UNKNOWN
when a required observation, protection, terminal outcome, or cleanup
cannot be established; use PASS only when every applicable check passes.
Preserve all applicable reason codes. FAIL does not mean an in-flight VM
operation has terminated. Earlier failed or ambiguous attempts remain in
history, and a new qualification cannot proceed past unresolved
obligations merely by generating a new ID.
The same-identity adversary includes deliberate bypass by other processes under the host identity, including a separate service identity if one is used. Host administrators/root are trusted not to bypass the boundary. File modes, ACLs, a cooperative UUID lock, or a configuration-directory change alone do not prove exclusive access. Establish and independently verify an enforceable boundary over the VM's relevant control and storage paths, inherited or transferred handles, and operations already accepted before the boundary closed. Establish it before the first protected mutation and maintain it through identity-sensitive observations, runner proof, cleanup, and evidence finalization; a gap cannot be repaired by a later healthy observation alone. If admission, continuous coverage, operation terminality, or snapshot quiescence is unknown, no dependent VM mutation or qualification pass is allowed. No mechanism is selected or proven.
Protect continuity against rollback of host-local storage: an older valid record, missing state, or an untrusted authority cannot establish current genesis, erase a pending operation, or revive a revoked result. An independently rollback-resistant authority or equivalent proven design must preserve the necessary history and obligations. A hash, MAC, local duplicate, random challenge, or cooperative lock alone is not that proof. The host-specific access boundary and continuity backend are feasibility gates for all three qualification lanes.
Plan cleanup before the first live action. After a lane's required
observations, or following a failure or interruption, reconcile in-flight
operations, verify the exact test-owned runner and VM where present, and
deregister, remove qualification-owned temporary credential copies or
secrets, and power off and destroy only the authorized disposable
resources, where present. Do not remove a shared or source credential.
Record independent cleanup evidence.
Never interrupt a healthy live snapshot or infer commitment from a
numbered inventory entry; use CurrentSnapshotName and
CurrentSnapshotUUID plus terminal-operation evidence. Unsafe or
ambiguous cleanup remains pending and blocks a pass.