fix(security): every privileged entrypoint proves its contract's ancestry - #15
Merged
rldyourmnd merged 1 commit intoSep 1, 2026
Merged
Conversation
…stry
Only cd-apply proved that contract_sha is an ancestor of reviewed main.
cd-resume, cd-rollback, cd-verify, cd-evidence and both branches of
cd-plan checked out a caller-supplied commit and executed its composite
action -- resume and rollback on the protected out-of-band runner with
id-token: write behind the cd-apply environment.
Every entrypoint now carries the same hosted authorize-contract job before
anything checks the commit out, the consuming jobs re-compare the
authorized value, and top-level permissions drop to {} with explicit
per-job grants, matching cd-apply's shape exactly.
The gate is enforced three ways so it cannot erode silently again:
validate_module.sh requires the full control set in all six workflows and
counts that no contract checkout outnumbers its authorizations -- removing
one needs line was verified to fail the validator; the structure tests
assert the same properties and prove their own checker rejects a stripped
needs and a stripped comparison; and the ordering check keeps every
authorization ahead of the job it guards.
Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF
rldyourmnd
deleted the
fix/every-privileged-entrypoint-proves-its-contract
branch
September 1, 2026 17:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the critical provenance gap: resume/rollback/verify/evidence and the out-of-band plan branch executed caller-supplied commits on privileged runners with no ancestry proof. All six entrypoints now carry cd-apply's exact hosted authorize-contract gate + re-comparison; validator and structure tests enforce it with verified negative controls (a stripped
needsfails both).https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF