ef8291f26b
The four gates this session built (spec coverage, contract discharge, two-stage review, attested build) were each a gate an integrator MAY run. The lane between them is the failure mode: nothing forced all four, so an artifact could reach production having passed three and skipped one. This crate closes that lane. ReleaseCertificate is the single object that makes the gate TOTAL: certify() succeeds iff all four canonical gates are present, each once, and all satisfied — otherwise it returns a Refusal naming exactly which gates are missing, failed, or duplicated (a doubled review cannot stand in for a missing build). Two terminal states, no third: certified, or refused-with-the-reason. There is no representation of a partial release. The same-repo gates are type-safe: GateOutcome::from_coverage / from_approval DERIVE satisfied from the real Coverage / Approval verdicts — it cannot be asserted. Cross-standard gates (contract, build) are composed from their own verifiers' verdict + binding evidence address, because those standards hash in different schemes (SHA-256 vs BLAKE3); the certificate binds the address rather than re-hashing across schemes. verify() re-checks totality, not just the signature — a certificate tampered to flip a gate fails even if the signature held. The irreducible residue is named on purpose: the certificate binds to the exact spec it was judged against, so the one place a human must look — "is this the right spec?" — is isolated and signed, and everything else carries a proof. This is the architectural form of "no unaccounted failure": the elimination of the ship-anyway lane, not the impossible claim of zero failure. Runnable: `cargo run -p joule-code-release --example release` (certify with four gates, refuse with one failed). 6 tests; example + clippy clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
48 lines
2 KiB
Rust
48 lines
2 KiB
Rust
//! The total door, demonstrated: the same release passed twice — once with
|
|
//! all four gates satisfied (certified), once with one gate failed (refused,
|
|
//! with the gate named). There is no third outcome.
|
|
//!
|
|
//! Run: `cargo run -p joule-code-release --example release`
|
|
|
|
use ed25519_dalek::SigningKey;
|
|
use joule_code_release::{certify, Gate, GateOutcome, ReleaseRequest, ALG_ED25519};
|
|
|
|
fn request(certifier: &SigningKey, build_ok: bool) -> ReleaseRequest {
|
|
ReleaseRequest {
|
|
alg: ALG_ED25519,
|
|
subject: "settlement batch writer".into(),
|
|
artifact: "build:9f2c…".into(),
|
|
spec: "blake3:1a7e…".into(),
|
|
outcomes: vec![
|
|
GateOutcome::contract(true, "sha2-256:deadbeef"),
|
|
GateOutcome::attested_build(build_ok, "build:9f2c…"),
|
|
// (spec-coverage and review outcomes would be derived from real
|
|
// Coverage / Approval verdicts; shown here as their satisfied form)
|
|
GateOutcome { gate: Gate::SpecCoverage, satisfied: true, evidence: "blake3:1a7e…".into() },
|
|
GateOutcome { gate: Gate::Review, satisfied: true, evidence: "blake3:op-44".into() },
|
|
],
|
|
certifier: certifier.verifying_key().to_bytes(),
|
|
}
|
|
}
|
|
|
|
fn main() {
|
|
let key = SigningKey::from_bytes(&[7u8; 32]);
|
|
|
|
println!("— all four gates satisfied —");
|
|
match certify(request(&key, true), &key).unwrap() {
|
|
Ok(cert) => {
|
|
let id = cert.verify().unwrap();
|
|
println!(" CERTIFIED · release {} · vouches for {}", id.as_str(), cert.request.artifact);
|
|
for o in &cert.request.outcomes {
|
|
println!(" ✓ {:<18} {}", o.gate.label(), o.evidence);
|
|
}
|
|
}
|
|
Err(refusal) => println!(" {refusal}"),
|
|
}
|
|
|
|
println!("\n— same release, the build gate fails —");
|
|
match certify(request(&key, false), &key).unwrap() {
|
|
Ok(_) => println!(" CERTIFIED (should not happen)"),
|
|
Err(refusal) => println!(" {refusal}\n → the artifact does not exist as far as production is concerned."),
|
|
}
|
|
}
|