release: v0.10.0 — ToolInfo toolchain identity + honest SLSA claims - #222
Merged
Conversation
SLSA v1.0's Build track defines L0-L3 only; docs claimed "SLSA Level 4 ACHIEVED" against v1.0 (L4 lived in the superseded v0.1 draft). Reframed every public surface to state what we meet (Build L3) and to describe the reproducibility/offline-attestation work as the properties SLSA v0.1 called Level 4 — never as a v1.0 level. STPA loss ids L4/L5 left untouched. Gated by verification/claim-check/claim-check.py + claims.yaml: count-max:0 on `SLSA[ -](Level ?4|L4)` across README/docs/examples/src goes red if the phantom level reappears; count-min guards the honest disclaimer. Proven potent by negative control before wiring. The badge IS the evidence. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
…#220) The publish job has failed on every tag since v0.9.1 (v0.9.0 was the last success — hence the registry froze at 0.9.0). A perpetually-red job is a dead signal, not a gate. Gate it behind vars.CRATES_PUBLISH_ENABLED so it SKIPS cleanly until either a crates.io Trusted Publisher (OIDC) or a CRATES_IO_TOKEN secret exists, then arms with one variable flip. Actual registry backfill (0.9.1->0.10.0) is tracked as REQ-22 in v0.11.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
Bump 0.9.4 -> 0.10.0 across Cargo.toml, MODULE.bazel, src/cli/BUILD.bazel VERSION, all internal wsc-* dep pins (incl. a latent stale wsc-crypto->0.9.0), and Cargo.lock. rivet plan: REQ-20 (#221) + REQ-21 (#216) scoped to v0.10.0, both verified; REQ-22 (#220) moved to v0.11.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
The gate counted MC/DC gaps over the WHOLE instrumented wasm — Rust std, the wasi-libc allocator, crypto deps — of which only 2 of 142 decisions are verify-core's own (src/wasm_module/varint.rs, .../mod.rs). The total tracked noise, not coverage: it drifted 12->17 on std/dep churn and then 17->19 purely on the 0.9.4->0.10.0 version bump perturbing libc codegen, which is what turned the v0.10.0 PR red with no real coverage change. Now count gaps ONLY within decisions whose source path is under src/. That number is a function of verify-core's own logic + its fixed scenario set, so it is stable across host and dep churn. Scoped baseline = 5 (varint.rs:29 c0/c3/c4 + mod.rs:455 c0/c1) — measured from the report, not hand-derived. The whole-wasm total is still printed, informational only. Attribution (gaps follow their decision header) verified against a captured report via the Partial-has-proved / NoWitness-has-none discriminator. Gate proven potent by negative control: an injected verify-core gap REDs (5->6); an injected libc gap stays GREEN (noise-immune); a closed gap improves (5->4). Closing verify-core's own Partial gaps remains follow-up work on #128. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.10.0 — provenance identity + claim honesty
Planned in rivet (
rivet release status v0.10.0→ cuttable); both scoped requirementsverified.REQ-20 / #221 —
ToolInfotoolchain-layer identityMerged via #221 (already on main). Optional
toolchain+toolchain_manifest_digest, populated fromVARVE_LAYER*at each hop (varve REQ-PROV-001). Backward-compatible both directions:skip_serializing_if→ non-varve attestations serialize byte-identically; nodeny_unknown_fields→ old verifiers accept new attestations. Not in the no_stdverify-corepath, so the witness MC/DC gate is untouched.REQ-21 / #216 — honest SLSA claims +
claim-checkgateSLSA v1.0's Build track defines L0–L3 only; docs claimed "SLSA Level 4 ✅ ACHIEVED" against v1.0. Reframed every surface (README badge
SLSA-L4_provenance→SLSA-Build_L3,slsa-compliance.md, automotive/wac/research docs, code comments) to Build L3 + "the properties SLSA v0.1 called Level 4" (beyond-L3). A fictional--slsa-level 4example (no such flag) corrected. STPA loss idsL4/L5untouched.New gate
verification/claim-check/claim-check.py+claims.yaml:count-max: 0onSLSA[ -](Level ?4|L4)across README/docs/examples/src fails the build if the phantom level reappears;count-minguards the disclaimer. Proven potent by negative control before wiring.#220 groundwork — crates.io publish disarmed
The publish job had failed on every tag since v0.9.1 (registry frozen at 0.9.0). Now gated behind
vars.CRATES_PUBLISH_ENABLED— skips cleanly instead of a perpetual red, arms with one flip. Actual registry backfill = REQ-22 in v0.11.0.Feature-loop steps 1–2 (spar→WIT) N/A (no arch change). Clean-room verified pre-tag.
🤖 Generated with Claude Code
https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH