sandbox-conformance: hold the committed pack to what the builders emit #422
2026-10-21
sandbox-conformance: hold the committed pack to what the builders emit
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 5s
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 51s
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 1m43s
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 1m15s
standards workspaces build + test / proof-rs (proof-conformance, proof/proof-rs, proof-rs, linux, true) (pull_request) Successful in 1m32s
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, sandbox-rs, linux) (pull_request) Successful in 2m27s
standards workspaces build + test / joulecontract-rs (joulecontract/joulecontract-rs, joulecontract-rs, linux-arm64, true) (pull_request) Successful in 1m21s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 7m49s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m1s
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 2m59s
The file-backed checks prove each committed vector file is valid: the
reference recomputes its content ids, envelopes and signatures. Nothing
proved the files were the current output of the builders. When
Attestation gained `mechanism`, its serde form started emitting
`"mechanism": null`, so gen_vectors and the published attestation.json and
negative.json parted. Every check stayed green, because a missing field
defaults on read.
- sandbox-attest: an absent `mechanism` is omitted from the serialized
form, as it is from the signed JCS core (§7.9). The published pack is
then exactly what the builders emit, and its bytes do not change. The
signed core was never affected; it is built by hand.
- sandbox-conformance:
- vectors::rendered() lists every committed file with the exact bytes
gen_vectors writes. gen_vectors now writes from it.
- New test the_committed_pack_is_what_the_builders_emit: the rendered
set is FILES, and each file is byte-identical to the committed one.
Mutation testing: 2 mutants, both killed (`mechanism` serialized as null
again; a file left out of the rendered set).
Verified on the build host: sandbox-rs 435 tests (--locked); every
conformance class; running gen_vectors changes nothing in git; clippy
-D warnings clean on sandbox-conformance and sandbox-attest. Repo checks
pass.
Co-Authored-By: Claude Opus 5.5 <[email protected]>