Repository navigation
Ticket 0007b: anchor emission at the kernel witness seal point - #318
Conversation
Wire cog_anchor::Anchorer into cog-cli at one seal point (kernel witness build), proving the full emission pattern: config, verify->anchor ordering, pending marker, unconfigured notice; opt-in and strictly additive. - `cog anchor init --anchor-key --anchor-log`: generates the 64-hex Ed25519 key via cog-anchor, opens the log (auto-genesis), prints the verifying key. Refuses an existing key (fail-CLOSED identity). - Kernel witness build: when anchoring is configured, verify THEN anchor (reuses verify_kernel_witness_run; an unverified bundle is never anchored). On any anchor failure, write deterministic pending-anchor.json beside the manifest, warn loudly (naming `cog anchor init`), and keep the seal successful (fail-OPEN emission). Unconfigured builds are byte-identical to before plus a stderr notice -- verification does not run when there is nothing to anchor. - Minimal config: deadbolt-anchor.toml [anchor] signing_key_path/log_path in the cwd; explicit flags override. Dev-grade local custody. - cog-cli reaches the log ONLY through cog-anchor; magpie-log keeps exactly one direct dependent. Other four seal points deferred to 0008-anchor-fanout. Implemented by Codex (gpt-5.5) via delegation; Claude-reviewed. Verify-gating (verify only when anchoring is configured) was a reviewer fix on Codex's diff. 6 anchor + 19 kernel_witness tests green; clippy -D warnings clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4648dce6c9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| // Anchoring is intended (fully or partially configured). Normative ordering: | ||
| // verify, THEN anchor — an unverified bundle is never anchored. | ||
| let verify_report = verify_kernel_witness_run(run); |
There was a problem hiding this comment.
When the run's kernel_decision_report.json is a symlink/reparse point, the normal verify kernel-witness path refuses the run via preflight_kernel_witness_source_artifacts before calling verify_kernel_witness_run, but this new anchor gate calls the library verifier directly and will follow the symlink and append an anchor. That means kernel witness build --anchor-* can record a SegmentAnchored event for a run that the CLI verifier rejects, so the verify-before-anchor guarantee is weaker than the actual verifier users run.
Useful? React with 👍 / 👎.
| let config = match read_anchor_config() { | ||
| Ok(config) => config, | ||
| Err(err) => return AnchorPathResolution::Failed(err), |
There was a problem hiding this comment.
When a malformed deadbolt-anchor.toml is present in the current directory, this early config read returns Failed before checking whether both --anchor-key and --anchor-log were supplied. In that scenario cog anchor init --anchor-key ... --anchor-log ... fails, and kernel witness build --anchor-* skips otherwise usable explicit paths and emits a pending marker instead of anchoring, even though complete flag values should not need the config file.
Useful? React with 👍 / 👎.
| let verifying_key = generate_key_file(&paths.key_path).map_err(|err| match err { | ||
| AnchorError::Key(message) => format!("anchor_init_key_refused: {message}"), | ||
| other => format!("anchor_init_key_failed: {other}"), | ||
| })?; | ||
| Anchorer::open(&paths.log_path, &paths.key_path) | ||
| .map_err(|err| format!("anchor_init_log_open_failed: {err}"))?; |
There was a problem hiding this comment.
If the key path is writable but the log path cannot be opened (for example its parent directory is missing, or an existing log was created with a different key), this writes a brand-new key file and then returns anchor_init_log_open_failed. A subsequent cog anchor init after fixing the log path still refuses the existing key, leaving the init command unable to complete without manual key deletion/recreation.
Useful? React with 👍 / 👎.
1 participant
What
Ticket 0007b — wires
cog_anchor::Anchorerinto cog-cli at one seal point (the kernel witness build), proving the full emission pattern before0008-anchor-fanoutreplicates it to the other four.cog anchor init --anchor-key <path> --anchor-log <path>— generates the bare 64-lowercase-hex Ed25519 key viacog-anchor, opens the log (auto-genesis), prints the verifying key. Refuses an existing key (fail-closed identity).verify_kernel_witness_run; an unverified bundle is never anchored). On any anchor failure: deterministicpending-anchor.jsonbeside the manifest + loud warning namingcog anchor init, and the seal still succeeds (fail-open emission).deadbolt-anchor.toml([anchor] signing_key_path/log_path) in the cwd; explicit flags override. Dev-grade local custody.cog-anchor;magpie-logkeeps exactly one direct dependent.Review (independently verified)
cargo test -p cog-cli anchor)kernel_witnesstests (regression)-D warnings(cog-cli)magpie_logimported directly in cog-cliAnchorercargo tree -i magpie-logInvariants confirmed: verify-gate is fail-closed (corrupt root → no log, no marker,
Err); fail-open emission / fail-closed identity per the ratified 0007b §Decision;pending-anchor-v1marker carries exactly the five fields +error, no timestamps; canonicalization profile read from the manifest, not hardcoded.Reviewer fix applied on the worker's diff
Codex originally ran verification unconditionally at the top of the emission path — so an unconfigured build also verified, and a verify failure would have changed the build's exit vs. pre-seam behavior. Reordered to resolve anchoring config first: unconfigured → notice + return without verifying; verify runs only when an anchor is actually pending. Restores exact "unconfigured == old behavior + notice" and drops redundant work. (All 19 kernel_witness tests still green.)
Note
Config lives at
deadbolt-anchor.tomlin the current working directory — dev-grade and documented incoghelp text; CWD-relative is a touch fragile but adequate for this stage.Provenance
Implemented by Codex (gpt-5.5) via the delegation wrapper; ticket authored, diff reviewed, and the verify-gating fix applied by Claude. Human is the merge authority.
🤖 Generated with Claude Code