keyring: admit credential authority regression repairs #1

Merged

linus merged 4 commits from feature/code-review-regression-contracts into main

2026-07-28 22:28:29 -05:00

linus commented

2026-07-28 22:27:09 -05:00

Owner

Summary

repair the frozen credential-authority regression contract set, including identity, audit, expiry, payload-integrity, restore, revocation, and race failures;
record the V1 owner-decision packet without accepting or inventing R01-R16 decisions;
admit the deterministic frozen-remediation closeout with two independent CLEAN reviews;
remove false LLM/refresh/API-key access-mode advertisements and align manifest, README, and Lua gRPC vocabulary with executable service contract tables.

Verification

green verifier negative self-tests: normal and caller umask 0777;
complete green verifier: normal and caller umask 0777;
all 132 required frozen identities and exact 20-run focused race gate;
focused descriptor/runtime truth tests, 20 repetitions;
full ordinary suite and full race suite;
go vet ./..., formatting, JSON, workflow, working/index diff checks;
two fresh independent whole-branch cold admission reviews.

Canonical state and limits

both root features remain in_progress;
all five V1 contract families remain blocked;
R01-R16 remain unresolved;
credential-authority.contract-and-advertisement-truth remains planned;
the local rpc_plugin_system replacement remains a separate authority-integration dependency;
no root closure, overall V1/A-grade claim, release, or deployment is included.

Base: c7f7b75c6a1653f40bde1de44cc292a21145d591

Head: 88068c8773ea1db584655d0832cd81f6c492ad8e

## Summary - repair the frozen credential-authority regression contract set, including identity, audit, expiry, payload-integrity, restore, revocation, and race failures; - record the V1 owner-decision packet without accepting or inventing R01-R16 decisions; - admit the deterministic frozen-remediation closeout with two independent CLEAN reviews; - remove false LLM/refresh/API-key access-mode advertisements and align manifest, README, and Lua gRPC vocabulary with executable service contract tables. ## Verification - green verifier negative self-tests: normal and caller umask `0777`; - complete green verifier: normal and caller umask `0777`; - all 132 required frozen identities and exact 20-run focused race gate; - focused descriptor/runtime truth tests, 20 repetitions; - full ordinary suite and full race suite; - `go vet ./...`, formatting, JSON, workflow, working/index diff checks; - two fresh independent whole-branch cold admission reviews. ## Canonical state and limits - both root features remain `in_progress`; - all five V1 contract families remain blocked; - R01-R16 remain unresolved; - `credential-authority.contract-and-advertisement-truth` remains planned; - the local `rpc_plugin_system` replacement remains a separate authority-integration dependency; - no root closure, overall V1/A-grade claim, release, or deployment is included. Base: `c7f7b75c6a1653f40bde1de44cc292a21145d591` Head: `88068c8773ea1db584655d0832cd81f6c492ad8e`

linus added 4 commits

2026-07-28 22:27:09 -05:00

keyring: repair credential authority contract regressions 2b07ac429b

workflow: record V1 owner-decision packet 538b8cd62b

workflow: admit credential authority remediation closeout b7648baf71

keyring: align tool advertisements with runtime 88068c8773

linus merged commit 2476cc7ea3 into main

2026-07-28 22:28:29 -05:00

linus referenced this pull request from a commit

2026-07-28 22:28:31 -05:00

Merge PR #1: admit credential authority regression repairs