Phase 6: immutable audited 31-payload candidate

.github/workflows/phase6-candidate-gate.yml

@@ -0,0 +1,160 @@
+name: Phase 6 immutable candidate gate
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - 'catalog/**'
+      - 'schema/**'
+      - 'scripts/**'
+      - 'tests/**'
+      - 'requirements-ci.txt'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: phase6-candidate-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  assemble-and-verify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
+    steps:
+      - name: Check out exact candidate source
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install verifier dependencies and validate exact build set
+        run: |
+          python3 -m pip install --requirement requirements-ci.txt
+          python3 scripts/generate_phase6_buildset.py --check
+          python3 scripts/phase6_candidate.py validate-buildset --build-set catalog/buildsets/initial-warehouse-v1.json --require-git-ancestry
+      - name: Capture and verify live audited-input metadata
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: python3 scripts/github_phase6.py capture-inputs --build-set catalog/buildsets/initial-warehouse-v1.json --output input-live-metadata.json
+      - name: Download exact Phase-3p proof-data artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33170546601
+          artifact-ids: 9685464135
+          merge-multiple: true
+          path: input-artifacts/phase3p-proof-data
+      - name: Download exact Phase-4 Celestia appd artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33177534764
+          artifact-ids: 9688244894
+          merge-multiple: true
+          path: input-artifacts/phase4-celestia-appd-linux-arm64
+      - name: Download exact Phase-4 Celestia node artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33177534764
+          artifact-ids: 9688243729
+          merge-multiple: true
+          path: input-artifacts/phase4-celestia-node-linux-arm64
+      - name: Download exact Phase-4 Midnight node artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33177534764
+          artifact-ids: 9688330126
+          merge-multiple: true
+          path: input-artifacts/phase4-node-linux-arm64
+      - name: Download exact Phase-4 toolkit Linux amd64 artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33177534764
+          artifact-ids: 9688263793
+          merge-multiple: true
+          path: input-artifacts/phase4-toolkit-linux-amd64
+      - name: Download exact Phase-4 toolkit Linux arm64 artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33177534764
+          artifact-ids: 9688255774
+          merge-multiple: true
+          path: input-artifacts/phase4-toolkit-linux-arm64
+      - name: Download exact Phase-4 toolkit macOS arm64 artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33177534764
+          artifact-ids: 9689647047
+          merge-multiple: true
+          path: input-artifacts/phase4-toolkit-macos-arm64
+      - name: Download exact Phase-5 verified indexer aggregate
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: 33176004154
+          artifact-ids: 9690093579
+          merge-multiple: true
+          path: input-artifacts/phase5-indexer
+      - name: Assemble and non-executingly verify exact candidate
+        run: |
+          set -euo pipefail
+          python3 scripts/phase6_candidate.py assemble --build-set catalog/buildsets/initial-warehouse-v1.json --input-root input-artifacts --output verified-content --result-output candidate-verification.json
+          python3 scripts/phase6_candidate.py verify --build-set catalog/buildsets/initial-warehouse-v1.json --content verified-content
+      - name: Retain exact verified content for a fresh job
+        id: upload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: phase6-pr-verified-content-${{ github.sha }}
+          path: verified-content/
+          if-no-files-found: error
+          retention-days: 7
+          compression-level: 0
+          overwrite: false
+
+  fresh-non-executing-verifier:
+    needs: assemble-and-verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Check out exact candidate source
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        with:
+          persist-credentials: false
+      - name: Install verifier dependencies
+        run: python3 -m pip install --requirement requirements-ci.txt
+      - name: Redownload exact staged content by artifact ID
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: ${{ github.run_id }}
+          artifact-ids: ${{ needs.assemble-and-verify.outputs.artifact-id }}
+          merge-multiple: true
+          path: verified-content
+      - name: Stream and verify every payload/member without execution
+        run: |
+          python3 -m pip install --requirement requirements-ci.txt
+          python3 scripts/phase6_candidate.py verify --build-set catalog/buildsets/initial-warehouse-v1.json --content verified-content

.github/workflows/phase6-live-verification.yml

@@ -0,0 +1,121 @@
+name: Phase 6 published-candidate live verification
+
+on:
+  workflow_run:
+    workflows: ['Immutable forge candidate']
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+  attestations: read
+
+concurrency:
+  group: phase6-published-candidate-live-verification
+  cancel-in-progress: false
+
+jobs:
+  verify-published-candidate:
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'workflow_dispatch' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - name: Check out exact candidate commit
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          persist-credentials: false
+      - name: Download exact post-publication handoff
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          github-token: ${{ github.token }}
+          repository: acedward/midnight-binary-forge
+          run-id: ${{ github.event.workflow_run.id }}
+          name: published-candidate-initial-warehouse-v1
+          path: handoff
+      - name: Download released envelope and attestation bundle
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          TAG="$(jq -r '.tag' handoff/published.json)"
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern 'promotion-envelope-initial-warehouse-v1.json' --pattern 'attestation-initial-warehouse-v1.sigstore.json' --dir transport
+      - name: Verify attestation, immutable release, and independent byte read-back
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import sys
+          from pathlib import Path
+          sys.path.insert(0, 'scripts')
+          import canonical_json
+          envelope = canonical_json.load_json(Path('transport/promotion-envelope-initial-warehouse-v1.json'))
+          Path('promotion-claims-initial-warehouse-v1').write_bytes(canonical_json.canonical_bytes(envelope['claims']))
+          PY
+          gh attestation verify promotion-claims-initial-warehouse-v1 --repo "$GITHUB_REPOSITORY" --bundle transport/attestation-initial-warehouse-v1.sigstore.json --predicate-type 'https://github.com/acedward/midnight-binary-forge/predicates/promotion-envelope/v1'
+          python3 scripts/github_phase6.py capture-live --envelope transport/promotion-envelope-initial-warehouse-v1.json --bundle transport/attestation-initial-warehouse-v1.sigstore.json --run-id "${{ github.event.workflow_run.id }}" --output live-evidence.json
+          python3 scripts/canonical_json.py verify-live transport/promotion-envelope-initial-warehouse-v1.json transport/attestation-initial-warehouse-v1.sigstore.json live-evidence.json --require-staging-live
+      - name: Retain canonical live verification evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: phase6-published-live-evidence-${{ github.event.workflow_run.id }}
+          path: live-evidence.json
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
+          overwrite: false
+
+  recover-post-publication-handoff-loss:
+    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'workflow_dispatch' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      actions: read
+      attestations: read
+    steps:
+      - name: Check out exact failed candidate commit
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install verifier dependencies
+        run: python3 -m pip install --requirement requirements-ci.txt
+      - name: Classify and reconstruct only an existing exact immutable publication
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          python3 scripts/github_phase6.py recover-publication \
+            --run-id "${{ github.event.workflow_run.id }}" \
+            --expected-head "${{ github.event.workflow_run.head_sha }}" \
+            --build-set-id initial-warehouse-v1 \
+            --output-dir recovered
+      - name: Cryptographically verify recovered original-run claims attestation
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          cp -- recovered/promotion-claims-initial-warehouse-v1.json recovered/promotion-claims-initial-warehouse-v1
+          gh attestation verify recovered/promotion-claims-initial-warehouse-v1 \
+            --repo "$GITHUB_REPOSITORY" \
+            --bundle recovered/attestation-initial-warehouse-v1.sigstore.json \
+            --predicate-type 'https://github.com/acedward/midnight-binary-forge/predicates/promotion-envelope/v1'
+          rm -- recovered/promotion-claims-initial-warehouse-v1
+          python3 scripts/github_phase6.py verify-recovery \
+            --claims recovered/promotion-claims-initial-warehouse-v1.json \
+            --draft recovered/draft.json \
+            --envelope recovered/promotion-envelope-initial-warehouse-v1.json \
+            --bundle recovered/attestation-initial-warehouse-v1.sigstore.json \
+            --evidence recovered/recovered-publication.json
+      - name: Retain canonical read-only recovered-publication evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: phase6-recovered-publication-${{ github.event.workflow_run.id }}
+          path: recovered/
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
+          overwrite: false