docs(parity): plan canonique PLAN_PARITE_REPLIT + réconciliation des registres (19 P0, niveaux nommés) - #3
Merged
Conversation
Contributor
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3937071a6c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+442
to
+446
| for (const id of EXPECTED_P0_IDS) { | ||
| if (!presentP0Ids.has(id)) { | ||
| fail('P0_REGISTRY.yaml', `expected P0 "${id}" is MISSING — the registry cannot silently shrink`); | ||
| } | ||
| } |
There was a problem hiding this comment.
When P0_REGISTRY.yaml gains an unexpected P0 ID or a duplicate expected ID, this loop still passes because it only verifies that every expected ID exists. The generator uses the same one-way missingP0Ids check, so registryComplete can be true for a registry with more than the documented 19 P0s, despite the new contract and plan requiring the exact set. Reject unexpected IDs and duplicate IDs (or compare sets and cardinalities) in both enforcement paths.
Useful? React with 👍 / 👎.
Comment on lines
+426
to
+430
| if (typeof entry.targetDate !== 'string' || !ISO_DATE.test(entry.targetDate)) { | ||
| fail( | ||
| file, | ||
| `${id}: targetDate "${entry.targetDate}" forbidden — real ISO date required (or state: ACCEPTED_RISK with owner + expiration + reviewCondition)`, | ||
| ); |
There was a problem hiding this comment.
A syntactically matching but impossible deadline such as 2026-02-30 passes this regex and therefore passes the new CI rule, even though the stated requirement is a real ISO date. The same pattern is used by the changed registry schemas, while this validator only parses schemas rather than applying them, so an invalid calendar date can leave registryComplete true and corrupt deadline/SLA tracking. Parse and round-trip the date (or use a strict date validator) after matching the format.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR formalizes docs/parity/PLAN_PARITE_REPLIT.md as the single canonical parity plan and reconciles the supporting registries/schemas so the repo can compute a stricter, reproducible parity readiness status (moving from a boolean to named readiness levels) with CI-enforced completeness constraints.
Changes:
- Introduces a canonical parity plan document and updates parity status docs/registries to align with it (new claims/sources, expanded P0/UNKNOWN/DECISION registries).
- Reworks parity approval computation/validation: removes
approvalReady, adds 8 named levels +approved.level, enforces exact expected P0 IDs, forbidstargetDate: UNKNOWN, and hashes evidence artifacts. - Updates JSON schemas and generated
APPROVAL_STATUS.jsonto reflect the new v5 evaluation rules.
Reviewed changes
Copilot reviewed 15 out of 18 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/parity/validate-registries.mjs | Adds stricter registry validation (targetDate rules, expected P0 ID completeness, forbids approvalReady, validates named-level consistency). |
| scripts/parity/generate-approval-status.mjs | Computes named-level approval status, evidence hashing, UI vs API proof gaps, triage SLA breaches, and exact P0 set checks. |
| docs/parity/UNKNOWN_REGISTRY.yaml | Expands and tightens unknown tracking; adds ACCEPTED_RISK structure and real ISO target dates. |
| docs/parity/SOURCE_REGISTRY.yaml | Adds new anchored sources (notably cloud/GCP + import providers) to back updated claims. |
| docs/parity/schemas/unknown-registry.schema.json | Updates schema to forbid targetDate: UNKNOWN and require justification fields for ACCEPTED_RISK. |
| docs/parity/schemas/p0-registry.schema.json | Requires ISO targetDate and expands priority range to track the larger P0 set. |
| docs/parity/schemas/approval-status.schema.json | Moves approval status schema to v3 with named levels and forbids approvalReady. |
| docs/parity/PUBLIC_BASELINE_REPLIT_2026.yaml | Adds/updates claims (e.g., RPL-24, GCP-11, GCP-12) with anchored source references. |
| docs/parity/PLAN_PARITE_REPLIT.md | Adds the canonical parity plan document, including measured status excerpt and rules. |
| docs/parity/PARITY_STATUS.md | Updates parity tracking summary to reference the canonical plan + named-level status. |
| docs/parity/P0_REGISTRY.yaml | Expands P0 registry from 4 → 19 entries with ISO target dates and richer tracking fields. |
| docs/parity/DECISION_REGISTRY.yaml | Updates decision entries to align with v5 evaluation (status/targetDate updates, owner decisions). |
| docs/parity/CHANGELOG_AUDIT.md | Records the v5 evaluation changes and registry/plan reconciliation as an append-only audit entry. |
| docs/parity/baseline/sources/2026-07-17-import-from-providers.md | Adds the hashed snapshot evidence backing the updated import-provider claim. |
| docs/parity/APPROVAL_STATUS.json | Regenerates computed approval status to schema v3 with named levels and evidence hashes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+419
to
+431
| const acceptedRisk = | ||
| entry.state === 'ACCEPTED_RISK' && entry.owner && entry.expiration && entry.reviewCondition; | ||
|
|
||
| if (acceptedRisk) { | ||
| return; | ||
| } | ||
|
|
||
| if (typeof entry.targetDate !== 'string' || !ISO_DATE.test(entry.targetDate)) { | ||
| fail( | ||
| file, | ||
| `${id}: targetDate "${entry.targetDate}" forbidden — real ISO date required (or state: ACCEPTED_RISK with owner + expiration + reviewCondition)`, | ||
| ); | ||
| } |
Comment on lines
+419
to
+420
| const acceptedRisk = | ||
| entry.state === 'ACCEPTED_RISK' && entry.owner && entry.expiration && entry.reviewCondition; |
Comment on lines
20
to
+22
| status: OPEN | ||
| nextAction: "Trancher : intake curé (parité) vs self-service modéré (décision E-CODE chiffrée)" | ||
| targetDate: UNKNOWN | ||
| nextAction: "Rapprocher de DEC-OWNER-GALLERY-OPTION-B (« option B » confirmée par Avi le 17/07) — inscrire le contenu exact via UNK-GALLERY-OPTION-B-CONTENT puis clore" | ||
| targetDate: "2026-07-24" |
…stres (19 P0, niveaux nommés, corrections sourcées) - PLAN_PARITE_REPLIT.md = LE plan canonique (structure imposée §0-§12), supersède le v5 hors-repo ; correction par remplacement, jamais par variante. - Corrections factuelles hashées : import 12 entrées dont Previous Agent export (RPL-24) ; Cloud Run multi-région reclassé GCP-11 (service health, GA 29/06/2026 per release notes ; divergence lecture owner consignée ; fallback+exit exigés quoi qu'il en soit) ; AR attachments Preview (GCP-12) ; « cinq familles » de collecte. Snapshots GCP assainis (clés web publiques AIza caviardées avant hash — secret-scan). - P0_REGISTRY 4→19 : les 15 P0 de l'audit v3 tracés individuellement ; ensemble EXACT vérifié en CI ; statut déclaré = plancher du rollup. - targetDate UNKNOWN interdit (schémas v2 + validateur) ; UNKNOWN_REGISTRY 11→19 (gates bêta, ACCEPTED_RISK justifiés). - OWNER_DECISION D1-D6 + fichiers de suivi versionnés + Gallery option B, citations verbatim. - approvalReady SUPPRIMÉ (faux positif) → 8 niveaux nommés + approved.level (contigu) ; preuves hashées (evidenceSha256) ; triage SLA bloquant ; uiGaps (preuve API ≠ preuve UI). État mesuré : approved.level=architectureContracted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
openaxcloud
force-pushed
the
docs/plan-parite-replit-canonique
branch
from
July 17, 2026 10:51
3937071 to
9ac8f23
Compare
Contributor
…t-scan) + auto-assainissement du collecteur - Triage un à un : jeton client public Datadog (pricing ×2) + _key interne CMS (gallery-detail) — faux positifs, aucun secret réel, pas de rotation. - Valeurs caviardées, sha256 recalculés (SOURCE_REGISTRY + manifest 16/07, entrées annotées « snapshot assaini »). - collect-baseline.mjs caviarde désormais ces motifs publics AVANT écriture/hash (évite la réintroduction par le cron quotidien) ; aucun motif de vrai secret n'est masqué. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
This was referenced Jul 19, 2026
openaxcloud
added a commit
that referenced
this pull request
Jul 19, 2026
… 16/07 + auto-assainissement du collecteur (#10) Triage un à un : jeton client public Datadog (pricing ×2) + _key interne CMS (gallery-detail) — faux positifs, aucun secret réel, pas de rotation. Valeurs caviardées, sha256 recalculés (SOURCE_REGISTRY + manifest 16/07). collect-baseline.mjs caviarde désormais ces motifs publics AVANT écriture/hash (évite la réintroduction par le cron quotidien) ; aucun motif de vrai secret n'est masqué. Identique au commit 9eab299 de la PR #3 (hashes identiques). Co-authored-by: Avi <avi@snatchbot.me> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Jul 31, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 3, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 4, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 4, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 4, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 4, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 5, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 5, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 5, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openaxcloud
pushed a commit
that referenced
this pull request
Aug 5, 2026
Answers the four reserves that refused PR #47, with REAL before/after E2E proof on actual GCS + Kubernetes (not the memory adapters that were rejected). 1. Write barrier (#1): eraseSubjectStorage now calls WriteBarrierPort.freeze BEFORE any delete; a freeze failure aborts the erasure (nothing deleted, not verified) so nothing is recreated between erase/verify and the tombstone. Prod path: workspace-manager POST /workspaces/:id/freeze (revoke agent token + stop pod). 2. Real disappearance (#2): verification re-checks the LIVE backend — GCS list, and a new GET /workspaces/:id/pvc-exists that does a real — never the workspace row's DELETED status (a partial k8s delete can leave a PVC). 3. By data subject (#3): the inventory is per-subject — the subject's sole-org buckets AND their per-user workspace in EVERY project they touched (sole-org + collaborator, via ProjectCollaborator), not just one main workspaceId. 4. Real proof (#4): two replayable, hashed E2Es under WIF-proof guardrails (dedicated test resources, no persistent keys, ~$0, full teardown): - GCS: GcsObjectStorage → eraseSubjectStorage against a throwaway bucket in the test project ecode-proof-b906ss; 3 objects → bucket+objects gone. - Kubernetes: a real Bound PVC on a throwaway local kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command. cluster → deleted → verified gone via live (kind, not GKE, so $0 — no cost sign-off needed per the guardrail). Artifacts + SHA256 in docs/deploy-evidence/2026-07-23-physical-purge-e2e/. Removes the old in-memory proof the expert rejected. Module + route + real-Postgres suites green (33 tests). PROVEN_REVIEW_PENDING. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Quoi
docs/parity/PLAN_PARITE_REPLIT.md= LE plan canonique unique (structure imposée §0 Métadonnées → §12 Limites connues). SupersèdePLAN_PARITE_REPLIT_v5.md(hors repo, sha256cd7ec771…). Règle inscrite en tête : correction PAR REMPLACEMENT, jamais de variante_v6/_FINALconcurrente.Corrections factuelles (toutes ancrées sur snapshots hashés committés)
Previous Agent exportetEmpty(claimRPL-24, snapshot2026-07-17-import-from-providers.md). L'ancien comptage à 11 est remplacé.GCP-11(source cloud). Service health automatise failover/failback. Statut mesuré : GA le 29/06/2026 (release notes hashées) ; la page produit du 17/07 ne porte pas de bannière Pre-GA.CHANGELOG_AUDIT; traitement fail-closed inchangé : fallback + exit strategy exigés quoi qu'il en soit.GCP-12) → fallback BinAuthz/Container Analysis + ORAS + exit strategy obligatoires.Registres
P0_REGISTRY4 → 19 entrées : les 15 P0 du dernier audit tracés individuellement (P0-V3-01…15: description, source, owner, statut, targetDate ISO, commit, reviewer, preuve, dépendances, condition de clôture). La CI compare l'ensemble EXACT attendu (EXPECTED_P0_IDS) — un ID absent casse le build. 4 restent OPEN (collecteur CI, remix licence/PII, import connecteurs, promotion AR live) ; le rollup respecte le déclaré comme plancher.targetDate: UNKNOWNinterdit (schémas v2 + validateur) : date ISO réelle ouACCEPTED_RISKjustifié (owner + expiration + reviewCondition).UNKNOWN_REGISTRY11 → 19 (capacités gate-bêta, D2 tranché → suivi d'application).DECISION_REGISTRY: 8OWNER_DECISIONavec citations verbatim — D1 (« Merge toi meme et verifie les commits… »), D2–D6 (approuvés « Oui » le 17/07, contenu = document expert), fichiers de suivi versionnés, Gallery option B (contenu exact à inscrire sans réinterprétation :UNK-GALLERY-OPTION-B-CONTENT).Statut — faux positif tué
approvalReadyest SUPPRIMÉ et interdit par le validateur. Remplacé par 8 niveaux nommés +approved.level(plus haut niveau CONTIGU) :documentReady → registryComplete → architectureContracted → implementationReady → verticalReady → betaReady → publicLaunchReady → parityBaselineReady. Nouveaux contrôles calculés : artefacts de preuve présents ET hashés (evidence[].evidenceSha256), triage SLA bloquant (jours ouvrés), preuve API ≠ preuve UI (uiGaps= publish, rollback), gates bêta = UNKNOWNs de capacité.État mesuré (reproductible) :
approved.level = architectureContracted—implementationReadybloqué par 4 P0 OPEN ;betaReadypar 6 capacités gate ;parityBaselineReadypar le triage PENDING des claims RPL-20/21/22.Vérification
Zone respectée : documentation + outillage registres uniquement (aucun code produit, aucune route Gallery, aucune migration).
🤖 Generated with Claude Code