Hugging Face's logo

Snapkitty
/
pax-coder

custom
code
sovereign-compute
Model card Files
xet
 Community
pax-coder / PHASE_2_PLAN.md
SNAPKITTYWEST's picture
SNAPKITTYWEST
chore: push pax-coder from SNAPKITTYWEST GitHub
ef6eb55 verified
preview code
|
Raw
History Blame Contribute Delete
2.84 kB

PAX-Coder Phase 2: ADR-Governed Verification & Authorization

Status: In Progress
Started: 2026-08-18
Goals:

  1. Refactor verify-clone for ADR-0001 (integrity-only, no authorization logic)
  2. Create verify-release for ADR-0002 (explicit authorization boundary)
  3. Add test suite (6 tests minimum)
  4. Enable CI gate enforcement

Step 1: Refactor verify-clone (ADR-0001)

Current: Mixed integrity + authorization logic
Target: Pure integrity verification, non-destructive, repeatable

Changes:

  • Remove any authorization checks
  • Explicit success/failure only
  • All 9 checks pass independently
  • No degraded mode on partial verification
  • Output stable across runs

Key invariant: Run twice, get same result both times

Step 2: Create verify-release (ADR-0002)

New script: verify-release
Purpose: Explicit authorization boundary

Design:

  • Phase 1: Integrity check (calls verify-clone)
  • Phase 2: Authorization check (separate function)
    • Requires server capability OR held secret
    • Returns AUTHORIZATION_REQUIRED if missing
    • Clear error message
    • No fallback execution

Example output:

INTEGRITY_VERIFIED: Clone is authentic
AUTHORIZATION_REQUIRED: Protected operation requires external capability
  → Contact release authority for authorization token
  → See: docs/adr/0006-server-challenge-protocol.md

Step 3: Test Suite

6 tests minimum:

  1. test_integrity_verification_independent
  2. test_authorization_required_for_protected_ops
  3. test_modified_file_detected
  4. test_signature_validation
  5. test_no_silent_corruption
  6. test_private_key_not_distributed

Location: scripts/test_verification.sh

Step 4: CI Enforcement

Add to .github/workflows/adr-validation.yml:

  • Run verify-clone on every commit
  • Reject if integrity fails
  • ADR compliance check

ADR Constraints During Phase 2

From ADR-0007 (Codex Security Preservation):

  • ✓ Read applicable ADRs first
  • ✓ Pass CI validation
  • ✓ Preserve existing artifacts (all 55 files)
  • ✓ Document security claims clearly
  • ✗ Do not silently ignore violated ADRs
  • ✗ Do not delete or rename artifacts
  • ✗ Do not implement unspecified security properties

Success Criteria

  • verify-clone output stable (run twice = same result)
  • verify-release has explicit authorization boundary
  • All 6 tests pass
  • No files deleted or weakened
  • ADR constraints maintained
  • CI can enforce ADR violations
  • Documentation updated

Commits

Will create new commits for:

  1. verify-clone refactor
  2. verify-release implementation
  3. test suite
  4. CI configuration

Each commit includes verification that ADR constraints are maintained.