test(provenance): demonstrate canonical identity reference - #58
Merged
Conversation
zoeyrose
marked this pull request as ready for review
August 13, 2026 08:51
zoeyrose
added a commit
to atrinik/atrinik
that referenced
this pull request
Aug 13, 2026
## Summary - define the coordinator-owned versioned public provenance identity schema, reviewer-key roster, and canonical synthetic-only registry - verify reviewer signatures over attestations and exact component scope, including an authenticated synthetic/production boundary - add bounded offline validation for canonical digests, trusted-ref current revocation, freshness, status transitions, immutable ancestry, shallow/graft/replace defenses, and component references - govern restricted evidence custody, publication authorization, correlation review, retention, correction, withdrawal, compromise, and migration - demonstrate component-owned references in atrinik/client#58 and atrinik/server#85 without copying the canonical registry or aliases Closes #378. ## Delivery coordinates - Base: `main` at `f0d1225791da7484e9456b39104cc30b0c77fe52` - Head: `feat/privacy-preserving-provenance-registry` at `13cc2fce5` - Client demonstration: atrinik/client#58 (closes atrinik/client#57) - Server demonstration: atrinik/server#85 (closes atrinik/server#84) ## Privacy and trust boundaries - Checked-in identities and demonstrations are synthetic and confer no rights over real material. - Confidential mappings, contact data, raw evidence, salts, private keys, and private review notes are forbidden from the public registry and CI output. - Production confidential reconciliation fails closed until the documented restricted store, teams, key custody, and audit controls are operational. - Component records authenticate exact source, destination, transformation, evidence pin, and synthetic boundary; current canonical revocation or mutation is loaded from the trusted ref and overrides a historical active pin. - Production references require a canonical non-shallow coordinator checkout and a pinned revision already reachable from `origin/main`. The explicit feature-ref mode is labeled non-authorizing and exists only for audit. ## Validation - complete wrapper suite — 580 passed - focused provenance suite — 33 passed - aggregate coverage — 81%; Codecov patch gate passed - client and server strict local positive/negative reference suites — passed - client and server foundation checks — passed - coordinator audit against both published component records — 2 records and 2 references valid, visibly non-authorizing - `shellcheck` for changed native shell validators — passed - `git diff --check` in all three repositories — passed - `python3 -m compileall -q atrinik atrinik_workspace tests` — passed - guidance inventory — passed - manifest and supply-chain validation — 20 components and 105 dependencies valid - latest-head CodeQL, integration, Python/actions analysis, title, and Codecov patch checks — passed ## Verification Audit the exact synthetic demonstrations from the issue worktree: ```sh ./atrinik provenance validate \ --reference /path/to/client/provenance/identity-reference.synthetic.json \ --reference /path/to/server/provenance/identity-reference.synthetic.json \ --non-authorizing-audit-ref origin/feat/privacy-preserving-provenance-registry ``` Because Atrinik uses squash merges, these exact synthetic records intentionally remain non-authorizing: their intermediate pinned commit will not become an `origin/main` ancestor. Any production record must be reviewed and signed only after its coordinator revision is already reachable from the trusted main ref. Post-merge production-path verification is tracked in #386. Runtime verification is not applicable: this changes a local policy/schema validator and creates no profile, topology, service, state, scenario, or mutable server data. ## Review status Multiple independent review/fix cycles identified trust-boundary, authorization, freshness, transition, schema-parity, native-shape, correlation, bounded-Git, and test-quality issues. All are fixed and validated. Final coordinator, client, and server whole-diff reviews report zero actionable findings, and all latest-head checks pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #57.
Depends on atrinik/atrinik#381.
Privacy boundary
This record is authenticated as synthetic test evidence and grants no rights over real material. The component does not copy the canonical registry, reviewer roster, aliases, contact data, or restricted identity evidence.
Validation
tools/test-provenance-identity-reference.sh— passedtools/check-foundations.sh— passedshellcheck tools/check-provenance-identity-reference.sh tools/test-provenance-identity-reference.sh— passedgit diff --check— passedtools/validate.shrun completed Rust compilation and all unit/doc tests, then stopped at missing local prerequisitecargo-denyVerification
This exact fixture remains a visibly non-authorizing audit after coordinator PR #381 is squash-merged because its intermediate pinned commit will not become an
origin/mainancestor. A production record must instead pin and authenticate a coordinator revision already reachable from the trusted main ref.