spec: [GATED DRAFT] flip #47/#52 verifierStatus stub->live (machine-log settlement) - #233
Draft
LamaSu wants to merge 1 commit into
Draft
Conversation
…ement) Gateway #230 persists each kernel's registered secp256k1 signing address (proof-of-possession) and pcc-oracle #13 wires the #47 ident.registered_key resolver + #52 machine.execution_log chain-signature verifier against it. Both primitives' verifier machinery is now implemented and oracle-enforced, so flip verifierStatus stub->live to match. #55 process.batch_record is left untouched (does not compose #52 at runtime). Updates the three spec-test assertions that counted/checked verifierStatus membership (LIVE_FIRST_CLASS list + title, the industrial-primitives stub check, and the report-only eligibility stub-advisory check) to match. DRAFT — gated on deploy order (see PR body): do not merge until Gateway #230 + pcc-oracle #13 are merged AND deployed, and device-side registration-proof activation is resolved. implementer-spec-charlie (Ralph-loop implementer, /go harness)
This was referenced Jul 10, 2026
LamaSu
added a commit
that referenced
this pull request
Jul 11, 2026
…ism) The ready-but-gated core: verifyDeviceSignedEvidence (registered-signer #47 -> Ed25519 verify), the composite gate (machine.execution_log #52 verifierStatus live AND SEAM2_DEVICE_EVIDENCE_SETTLEMENT flag, both default OFF), and resolveSettlementEvidence (fails closed to the gateway anchor). Reads the #52 verifierStatus, never flips it — #233 stays stubbed. implementer-seam2
LamaSu
added a commit
that referenced
this pull request
Jul 11, 2026
…hs (gated) Path 1 (operator-relay POST /api/operator/evidence): capture the node's REAL device Ed25519 signature + real bundleHash instead of the 'operator-relay-auto' placeholder. Stored tier stays 0 on purpose — unverified evidence supports only the tier-0 floor; the resume-settlement '?? latestBundle.assuranceTier' fallback must not escalate release tier from an unverified claim (fails closed). Path 2 (paid-job-flow /complete): resolveSettlementEvidence chooses the anchor. Gate CLOSED by default (#52 verifierStatus stub AND SEAM2 flag unset) => gateway fallback, byte-identical to before. Gate open => device hash+signature anchors, after verifying against the kernel's registered signer. Fails closed. Adds registeredSignerInputFromColumns helper. #233/verifierStatus untouched. implementer-seam2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE until ALL of the following hold (deploy order D1):
Flipping verifierStatus→live affects the gateway ELIGIBILITY LINT only; the oracle enforces #52 independently (separate repo, no @pcc dep) and already fails closed for unregistered signers. #55 is intentionally excluded (does not compose #52 at runtime). This PR is DRAFT until the boxes are checked.