| # PAX-Coder Phase 2: ADR-Governed Verification & Authorization | |
| **Status:** In Progress | |
| **Started:** 2026-08-18 | |
| **Goals:** | |
| 1. Refactor verify-clone for ADR-0001 (integrity-only, no authorization logic) | |
| 2. Create verify-release for ADR-0002 (explicit authorization boundary) | |
| 3. Add test suite (6 tests minimum) | |
| 4. Enable CI gate enforcement | |
| --- | |
| ## Step 1: Refactor verify-clone (ADR-0001) | |
| **Current:** Mixed integrity + authorization logic | |
| **Target:** Pure integrity verification, non-destructive, repeatable | |
| Changes: | |
| - Remove any authorization checks | |
| - Explicit success/failure only | |
| - All 9 checks pass independently | |
| - No degraded mode on partial verification | |
| - Output stable across runs | |
| **Key invariant:** Run twice, get same result both times | |
| --- | |
| ## Step 2: Create verify-release (ADR-0002) | |
| **New script:** verify-release | |
| **Purpose:** Explicit authorization boundary | |
| Design: | |
| - Phase 1: Integrity check (calls verify-clone) | |
| - Phase 2: Authorization check (separate function) | |
| - Requires server capability OR held secret | |
| - Returns AUTHORIZATION_REQUIRED if missing | |
| - Clear error message | |
| - No fallback execution | |
| **Example output:** | |
| ``` | |
| INTEGRITY_VERIFIED: Clone is authentic | |
| AUTHORIZATION_REQUIRED: Protected operation requires external capability | |
| → Contact release authority for authorization token | |
| → See: docs/adr/0006-server-challenge-protocol.md | |
| ``` | |
| --- | |
| ## Step 3: Test Suite | |
| 6 tests minimum: | |
| 1. test_integrity_verification_independent | |
| 2. test_authorization_required_for_protected_ops | |
| 3. test_modified_file_detected | |
| 4. test_signature_validation | |
| 5. test_no_silent_corruption | |
| 6. test_private_key_not_distributed | |
| Location: scripts/test_verification.sh | |
| --- | |
| ## Step 4: CI Enforcement | |
| Add to .github/workflows/adr-validation.yml: | |
| - Run verify-clone on every commit | |
| - Reject if integrity fails | |
| - ADR compliance check | |
| --- | |
| ## ADR Constraints During Phase 2 | |
| From ADR-0007 (Codex Security Preservation): | |
| - ✓ Read applicable ADRs first | |
| - ✓ Pass CI validation | |
| - ✓ Preserve existing artifacts (all 55 files) | |
| - ✓ Document security claims clearly | |
| - ✗ Do not silently ignore violated ADRs | |
| - ✗ Do not delete or rename artifacts | |
| - ✗ Do not implement unspecified security properties | |
| --- | |
| ## Success Criteria | |
| - [ ] verify-clone output stable (run twice = same result) | |
| - [ ] verify-release has explicit authorization boundary | |
| - [ ] All 6 tests pass | |
| - [ ] No files deleted or weakened | |
| - [ ] ADR constraints maintained | |
| - [ ] CI can enforce ADR violations | |
| - [ ] Documentation updated | |
| --- | |
| ## Commits | |
| Will create new commits for: | |
| 1. verify-clone refactor | |
| 2. verify-release implementation | |
| 3. test suite | |
| 4. CI configuration | |
| Each commit includes verification that ADR constraints are maintained. | |