aaronrene / knowtation public
2026-08-01-sec-kn-4c-b-bv-round1-pass.md markdown
73 lines 9.7 KB
Raw
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 9 days ago

Build verification — SEC-KN-4c-b round 1

Verdict: pass Frozen spec: docs/SEC-KN-4C-MIGRATION-HOOK-RESTORE-FREEZE.md (frozen: true; freeze review pass 2026-08-01, artifact_digest sha256:67d6a9f1a0c92b4ab7d7a9d35623862f27f3d35ac856c2ce6989f57d3641bbe3) Diff scope: Muse commit ec1e80b32f4a… on feat/sec-kn-4c-land, cut from Muse main tip 4179ed46ffe3…. muse diff main HEAD touches exactly five files:

  1. hub/icp/src/hub/Migration.mo — actor hook restored to identity on StableStorage; module header rewritten to the post-T1 invariant
  2. scripts/verify-canister-migration.mjs — two contract flips (identity domain check; TODO forbidden / SEC-KN-4c mention required)
  3. test/sec-kn-4-delegation-principal-binding.test.mjs — 4C-R6 assertion flip + title rename
  4. test/sec-kn-4c-migration-hook-restore.test.mjs — new seven-tier suite (4C-R7)
  5. docs/SEC-KN-4C-MIGRATION-HOOK-RESTORE-FREEZE.md — freeze artifact carried onto branch (new relative to main)

Governance docs (docs/ROADMAP.md, docs/OVERSEER-HANDOVER.md) are intentionally absent from this commit — they land in the closing SD-17 commit after this verdict, per the review instructions. Not a finding.

Reviewer posture: independent (thinking-high); did not author the build. All evidence below re-run in this session, 2026-08-01.

Requirement verification (4C-R1 … 4C-R9)

Req Verdict Evidence (file+line, this branch tip)
4C-R1 identity hook PASS hub/icp/src/hub/Migration.mo:455-457 — public func migration(old : { var storage : StableStorage }) : { var storage : StableStorage } { old }. No StableStorageV7 actor-hook domain and no _proposalV7ToCurrent call anywhere in the public hook (hook is the final declaration, lines 452–458).
4C-R2 TODO removed, locator kept PASS rg 'TODO\(SEC-KN-4c\)' hub/ → no matches. Non-TODO SEC-KN-4c locator comments at Migration.mo:10 and Migration.mo:454.
4C-R3 historical helpers kept PASS _proposalV7ToCurrent at Migration.mo:417-450 (sets created_by = "" at :448, private, uncalled by hook); _proposalBeforeEnrichToCurrent :271-303 and _proposalV4ToV5 :306-338 both return ProposalRecordV7; StableStorageV5/V6/V7 pins on [ProposalRecordV7] at :237-260.
4C-R4 header invariant PASS Migration.mo:8-12 — states one-time V7→created_by (T1), identity thereafter (SEC-KN-4c / T4), and that pre-created_by canisters must install the one-shot StableStorageV7 WASM first (git history).
4C-R5 verify-script flips PASS scripts/verify-canister-migration.mjs:49-51 requires identity domain (exact substring — cannot match the old StableStorageV7 } domain); :101-107 requires _proposalV7ToCurrent + SEC-KN-4c mention + !includes('TODO(SEC-KN-4c)'); old actor-hook-V7 check removed (diff), V7 retained only as historical type check :60-63. npm run canister:verify-migration exit 0 re-run this session.
4C-R6 SEC-KN-4 unit flip PASS test/sec-kn-4-delegation-principal-binding.test.mjs:453-469 — identity-domain assert.match (:459-462), _proposalV7ToCurrent retained (:457), assert.doesNotMatch on TODO(SEC-KN-4c) (:463), V5/V6/V7→ProposalRecordV7 pins kept (:455-456, :464-468), title renamed off “+ TODO(SEC-KN-4c)” (:453).
4C-R7 seven tiers PASS test/sec-kn-4c-migration-hook-restore.test.mjs — unit :48-83, integration (real dfx build --check hub, scrubbed env) :88-101, e2e :106-111, stress :116-122, data-integrity :127-137, performance :142-149, security :154-167. All seven tiers named; 11/11 green re-run this session.
4C-R8 no redeploy PASS Reviewer re-read live state this session: dfx canister --network ic info rsovz-byaaa-aaaaa-qgira-cai → Module hash: 0x039360a0985c79e2ec993e0d0b81dc6e6b85e4d924c1123f5d1af26cdfd69bae (matches frozen expected); GET /health → {"ok":true,"gateway_auth_configured":true}. Hash unchanged from the 2026-07-28 T4 record — consistent with no redeploy. No deploy artifacts in the diff.
4C-R9 hard stops PASS Diff limited to the five files above; no posture/env/gate flips, no F7 files, no P6 claims, no PR/merge activity in the commit. P6 remains UNVERIFIED; F7 parked.

Non-tautology check (V3)

The suites fail on the pre-4c source shape (reasoned from assertions against the old hunk visible in muse diff main HEAD):

  • Old hook domain was migration(old : { var storage : StableStorageV7 }). The identity regex (test/sec-kn-4c-migration-hook-restore.test.mjs:28-29) requires StableStorage \} — StableStorageV7 } cannot match (next char after StableStorage is V, not space). assert.match fails.
  • Old source contained TODO(SEC-KN-4c) → assert.doesNotMatch at :59 and sec-kn-4…test.mjs:463 fail; verify-script check :101-107 fails (!includes('TODO(SEC-KN-4c)')).
  • Old hook body mapped proposalEntries via Array.map and _proposalV7ToCurrent → stress (:117-121) and data-integrity (:134-135) doesNotMatch assertions fail. publicMigrationHookSource (:39-43) slices from public func migration( to EOF, so hook-scoped assertions cannot be satisfied by historical helpers.
  • The integration tier executes a real dfx build --check hub (1524 ms observed) — not a mock.

Checklist V1–V8

# Check Result
V1 All frozen deliverables exist at spec-named paths PASS — all five files present on branch tip; none are stubs
V2 Public APIs match frozen interfaces PASS — hook signature byte-matches 4C-R1; verify script exits 0/1 per contract
V3 Tests cover the frozen matrix, non-tautological PASS — seven tiers named and green; fail on pre-4c shape (see above)
V4 No scope creep PASS — diff is exactly the five files; no extra features
V5 No silent deletion of frozen requirements PASS — historical helpers/type pins retained per 4C-R3; only the actor-hook wiring changed
V6 Governance docs truthful PASS (pending SD-17 close) — ROADMAP/HANDOVER not yet updated; commit message says “BV review pending before DONE”, which is honest. Note: untracked docs/KNOWTATION-ROADMAP.md and backups/pre-t1-snapshot-20260728T205623Z/ in the working tree must be resolved in the closing governance commit (tree must not be dirty at session end).
V7 No secrets / injection surfaces / unsafe defaults PASS — secret-pattern scan of full diff: no matches; security tier asserts no literal secret assignment and no X-User-Id authorship path; dfx build --check warnings (M0155) are pre-existing in untouched main.mo lines
V8 Claims match verifiable state PASS — every build-session claim reproduced this session: new suite 11/11, SEC-KN-4 suite 31/31, verify-migration exit 0, dfx build --check hub exit 0, live hash + health independently re-read and matching. Honesty module not enabled in this repo — no ledger append required; claims↔evidence binding recorded here per skill rule 5.

Findings

None. (Per 4C-R0, findings require file+line citations; no citable defect was found.)

Honest summary

What actually shipped on feat/sec-kn-4c-land (one Muse commit ec1e80b32f4a… over main tip 4179ed46…): the actor upgrade hook in hub/icp/src/hub/Migration.mo:455-457 was restored from the one-shot V7→created_by map to identity on StableStorage, with the module header (:1-14) rewritten to document the post-T1 invariant and the one-shot path for pre-created_by canisters; the historical _proposalV7ToCurrent map (:417-450) and V5/V6/V7 type pins were kept but disconnected from the hook. scripts/verify-canister-migration.mjs flipped two contracts (:49-51, :101-107) so it now requires the identity domain and forbids the TODO marker, and exits 0 on this tree. The SEC-KN-4 unit assertion flipped accordingly (test/sec-kn-4-delegation-principal-binding.test.mjs:453-469, 31/31 green), and a new named seven-tier suite test/sec-kn-4c-migration-hook-restore.test.mjs (11/11 green, including a real scrubbed-env dfx build --check hub) pins the restore. The live canister was not redeployed: the reviewer independently re-read module hash 0x039360a0… (matches frozen expected) and health {"ok":true,"gateway_auth_configured":true} this session. Remaining before DONE: SD-17 closing commit (ROADMAP + OVERSEER-HANDOVER + this review doc), then Tier-3/SD-21 Muse main + muse-mirror land (D5, D6).

Evidence

type sha256 ref notes
test_output 5ece0de51c902be2c5fbc0009ae1c00149a8bccbee297f13fea6bbea2bdb8e61 node --test test/sec-kn-4c-migration-hook-restore.test.mjs 11/11 pass, 7 suites, exit 0
test_output 66f9a814f08a82db0216fcde7411007255a099c38962da6e8878537271287621 node --test test/sec-kn-4-delegation-principal-binding.test.mjs 31/31 pass, exit 0
test_output 4e18b19bf67184b800506814ac75e35bd244e78387fdf99b1a788f10a44bab9b npm run canister:verify-migration exit 0, “OK (Migration.mo + main.mo contracts)”
test_output 3dba26cfb85e3e4b9fea40bd2b53ce67feda774bdeb9728d2841b17d41d6b7f3 env -i … dfx build --check hub (hub/icp) exit 0; pre-existing M0155 warnings only
deploy_health d91bff94784e126c3e7f2c26c133abb81dfb849f00c57a49983d4a614bc46cc1 dfx canister --network ic info rsovz-byaaa-aaaaa-qgira-cai Module hash 0x039360a0985c79e2ec993e0d0b81dc6e6b85e4d924c1123f5d1af26cdfd69bae
deploy_health 9e185e862b3eaa8d33adb25c4193073c9c9821e9935a01f7c81f0a3ebb11622c GET https://rsovz-byaaa-aaaaa-qgira-cai.raw.icp0.io/health {"ok":true,"gateway_auth_configured":true}
diff 35e9545a3a99d253778c10ab1b6098a17c7730140e1dd531bdce56ef87c6266b muse diff main HEAD --text 563 lines; five files

Reviewer: independent build-verification session (thinking-high posture), 2026-08-01.

File History 1 commit
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 9 days ago