sandbox-conformance: hold the committed pack to what the builders emit #422
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/sandbox-vector-drift"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The file-backed checks prove each committed vector file is valid: the reference recomputes its content ids, envelopes and signatures. Nothing proved the files were the current output of the builders.
So when
Attestationgainedmechanism, its serde form started emitting"mechanism": null, andgen_vectorsand the publishedattestation.jsonandnegative.jsonparted. Every check stayed green, because a missing field defaults on read.Changes
mechanismis omitted from the serialized form, as it already is from the signed JCS core (§7.9).vectors::rendered()lists every committed file with the exact bytesgen_vectorswrites, andgen_vectorsnow writes from it.the_committed_pack_is_what_the_builders_emit, checks that the rendered set isFILESand that each file is byte-identical to the committed one.Verification (build host)
--locked), and every conformance class passes.gen_vectors: running it changes nothing in git.-D warningsis clean.mechanismserialized asnullagain, and a file left out of the rendered set.🤖 Generated with Claude Code
The file-backed checks prove each committed vector file is valid: the reference recomputes its content ids, envelopes and signatures. Nothing proved the files were the current output of the builders. When Attestation gained `mechanism`, its serde form started emitting `"mechanism": null`, so gen_vectors and the published attestation.json and negative.json parted. Every check stayed green, because a missing field defaults on read. - sandbox-attest: an absent `mechanism` is omitted from the serialized form, as it is from the signed JCS core (§7.9). The published pack is then exactly what the builders emit, and its bytes do not change. The signed core was never affected; it is built by hand. - sandbox-conformance: - vectors::rendered() lists every committed file with the exact bytes gen_vectors writes. gen_vectors now writes from it. - New test the_committed_pack_is_what_the_builders_emit: the rendered set is FILES, and each file is byte-identical to the committed one. Mutation testing: 2 mutants, both killed (`mechanism` serialized as null again; a file left out of the rendered set). Verified on the build host: sandbox-rs 435 tests (--locked); every conformance class; running gen_vectors changes nothing in git; clippy -D warnings clean on sandbox-conformance and sandbox-attest. Repo checks pass. Co-Authored-By: Claude Opus 5.5 <[email protected]>