refactor(validator): make relay the only recurring SN39 posture - #157
Conversation
Make the signed-feed shadow relay the only recurring SN39 writer posture while preserving the bounded UID30 launch and finalized recovery contracts. Remove obsolete authority and self-compose profiles, feed-down escalation, unsafe journal reset guidance, and alternate publisher services. Add a no-write install verifier, enforce one origin worker, and document the dated UID124 zero-burn proof without claiming token earnings.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_017ab735-4757-4456-a4fd-4ab02128ad1e) |
Python 3.11/3.12 failed on `ruff format --check` for the two new thin-suite files. Wrap long lines only; no behavior change. Co-authored-by: Ancient Runner <wallscaler@users.noreply.github.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_511a92fa-05ed-4e4d-a8c0-f34a05ed9289) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9a29ce29d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if isinstance(provenance, dict) and "feed_down_fallback" in provenance: | ||
| raise ValueError( | ||
| "[provenance].feed_down_fallback was removed; a missing feed now " | ||
| "always fails closed without changing submission authority" |
There was a problem hiding this comment.
On an upgraded host whose existing TOML still contains [provenance].feed_down_fallback, this unconditional loader check also breaks cathedral-validator status: _cmd_status calls _resolve_serve_config, so it raises an uncaught ValueError before reading the journal, even though status is documented as journal-only and does not use this runtime option. Reject the retired key on serve/launch paths while allowing status to extract its journal and interval settings.
Useful? React with 👍 / 👎.
|
Squash-merged #157 to Exact-head CI on
Honesty: relay/shadow is the only recurring SN39 posture; UID124 remains a dated zero-burn proof; no SN70 ownership; no Fast-as-TDX claim. CyberGym #146/#147, UID30 launch, wallets, and PolarIS prod were not touched. |
|
Post-merge live gate (source is on Do not cut over a live recurring writer until the signed HTTPS feed is actually answering. When the feed is healthy:
cathedral.computer catalog is unchanged (Fast Persistent Hetzner $0.15 available, no receipt; one-shot Fast off; Sealed live_testing; GPU unavailable). PolarIS prod stays Gathering facts here; not treating this as the final live state. |
Status ignores leftover [provenance].feed_down_fallback so it can read the journal. Serve, preflight-launch, and reconcile-launch still reject the retired key. A missing feed still fail-closes. Tiny follow-up to #157; not a reopen. No CyberGym, UID30, wallet, or live-writer changes.
2 participants
Outcome targets
What changed
Compatibility boundaries
Verification
Merge gate
Merge only when:
Post-merge outcome
A validator operator sees one recurring SN39 path. A dead feed stops writes instead of switching modes. Historical launch recovery remains possible. Publisher deployment exposes one canonical service and one worker. Existing journals stay intact.
Note
High Risk
This changes mainnet weight-submission posture (removes recurring authority/self-compose and feed-down escalation) and publisher systemd layout, so mis-upgraded hosts could stop writing or run duplicate origins until legacy units are retired.
Overview
Makes the signed HTTPS shadow relay the only supported recurring SN39 writer.
cathedral-validator servenow rejects non-shadow provenance and drops--mode/--provenanceplusfeed_down_fallback; a bad or missing feed fails closed with no escalation to independent recomputation. Authority-labelled paths stay internal for bounded UID30 launch and read-only journal recovery.Operator and deploy surface is narrowed to one profile and one origin publisher. Removes authority/self-compose TOML profiles,
MINER_VALIDATOR.md, provenance catch-up docs, andinit-clean-journal.sh; documents the finalized UID124 launch vector and warns against blind--broadcast. Publisher packaging collapses tocathedral-scorer-sn39with a fixed single worker; legacy publisher units/envs and journal-init helpers are deleted. Immutable install gains a read-onlyverifymode; liveness checks dropWAITING_FOR_JOB; new recurring authorizations are thin-lane only.Reviewed by Cursor Bugbot for commit c2e7e9a. Bugbot is set up for automated code reviews on this repo. Configure here.