Skip to content

Commit d5a20d3

Browse files
mokkunsuzuki-codemokkunsuzuki-code
committed
Add Stage352 hybrid signature manifest verification layer
0 parents  commit d5a20d3

74 files changed

Lines changed: 6079 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/stage336-live-intel.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Stage336 Safe Live Intelligence Update
2+
3+
on:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
update-live-intelligence:
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v4
18+
19+
- name: Set up Python
20+
uses: actions/setup-python@v5
21+
with:
22+
python-version: "3.11"
23+
24+
- name: Install dependencies
25+
run: |
26+
python -m pip install --upgrade pip
27+
pip install -r requirements.txt
28+
29+
- name: Run Stage336 safe live intelligence fetcher
30+
run: |
31+
python tools/live_intel_fetcher.py
32+
33+
- name: Commit updated safe intelligence metadata
34+
run: |
35+
git config user.name "github-actions[bot]"
36+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
37+
38+
git add docs/intel/index.html docs/intel/index.json docs/stage336/intel-session.json || true
39+
40+
if git diff --cached --quiet; then
41+
echo "No Stage336 intelligence metadata changes."
42+
else
43+
git commit -m "Stage336: automated safe live intelligence update"
44+
git push
45+
fi

‎.github/workflows/stage342-external-anchor.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Stage342 External Anchor
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- "docs/session/session_manifest.json"
10+
- "docs/session/signed_session_manifest.json"
11+
- "docs/anchors/external_anchor_receipt.json"
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
anchor:
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Build GitHub Actions anchor receipt
25+
run: |
26+
mkdir -p out/anchors
27+
python3 - <<'PY'
28+
import json
29+
import hashlib
30+
import os
31+
from pathlib import Path
32+
from datetime import datetime, timezone
33+
34+
manifest = Path("docs/session/session_manifest.json")
35+
signed = Path("docs/session/signed_session_manifest.json")
36+
37+
def sha256_file(path):
38+
return hashlib.sha256(path.read_bytes()).hexdigest()
39+
40+
receipt = {
41+
"stage": 342,
42+
"type": "github_actions_anchor_receipt",
43+
"repository": os.environ.get("GITHUB_REPOSITORY"),
44+
"run_id": os.environ.get("GITHUB_RUN_ID"),
45+
"run_number": os.environ.get("GITHUB_RUN_NUMBER"),
46+
"workflow": os.environ.get("GITHUB_WORKFLOW"),
47+
"ref": os.environ.get("GITHUB_REF"),
48+
"sha": os.environ.get("GITHUB_SHA"),
49+
"anchored_artifact": "docs/session/session_manifest.json",
50+
"session_manifest_sha256": sha256_file(manifest),
51+
"signed_session_manifest_sha256": sha256_file(signed),
52+
"created_at": datetime.now(timezone.utc).isoformat(),
53+
"meaning": "This receipt anchors the signed verification session manifest to a GitHub Actions run."
54+
}
55+
56+
Path("out/anchors/github_actions_anchor_receipt.json").write_text(
57+
json.dumps(receipt, ensure_ascii=False, indent=2),
58+
encoding="utf-8"
59+
)
60+
PY
61+
62+
- name: Upload anchor artifact
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: stage342-external-anchor-artifacts
66+
path: out/anchors/github_actions_anchor_receipt.json

‎.github/workflows/stage350-enforcement.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Stage350 Supply-Chain Evidence Enforcement
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
workflow_dispatch:
7+
8+
jobs:
9+
enforce:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Run Stage350 Enforcement Session
17+
run: |
18+
python3 scripts/stage350_build_enforcement_session.py
19+
20+
- name: Upload Stage350 Enforcement Evidence
21+
if: always()
22+
uses: actions/upload-artifact@v4
23+
with:
24+
name: stage350-enforcement-evidence
25+
path: |
26+
docs/enforcement/enforcement_session.json
27+
docs/audit/stage350-transparency-log.json

‎.github/workflows/stage351-hybrid-signature-manifest.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Stage351 Hybrid Signature Manifest
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
workflow_dispatch:
7+
8+
jobs:
9+
build-signature-manifest:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Build Stage351 signature manifest
17+
run: |
18+
python3 scripts/stage351_build_hybrid_signature_manifest.py
19+
20+
- name: Upload Stage351 signature manifest
21+
if: always()
22+
uses: actions/upload-artifact@v4
23+
with:
24+
name: stage351-signature-manifest
25+
path: docs/signatures/stage351_signature_manifest.json

‎.github/workflows/stage352-signature-manifest-verification.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Stage352 Signature Manifest Verification
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
workflow_dispatch:
7+
8+
jobs:
9+
verify-signature-manifest:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Verify Stage351 signature manifest
17+
run: |
18+
python3 scripts/stage352_verify_signature_manifest.py
19+
20+
- name: Upload Stage352 verification evidence
21+
if: always()
22+
uses: actions/upload-artifact@v4
23+
with:
24+
name: stage352-signature-manifest-verification
25+
path: docs/signatures/stage352_signature_manifest_verification.json

‎.gitignore‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
core/
2+
private_core/
3+
private/
4+
secrets/
5+
keys/
6+
*.key
7+
*.pem
8+
*.p12
9+
*.env
10+
.env
11+
.DS_Store
12+
13+
.venv/
14+
venv/
15+
__pycache__/
16+
*.pyc
17+
18+
*.bak
19+
*.backup
20+
backup_*/
21+
downloaded_*_artifact/
22+
23+
execution_session.json
24+
execution_session.json.sig
25+
26+
data/
27+
tools/
28+
29+
/audit/
30+
intelligence/
31+
32+
!docs/audit/
33+
!docs/audit/stage350-transparency-log.json

‎.nojekyll‎

Whitespace-only changes.

‎LICENSE‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
MIT License
2+
3+
Copyright (c) 2025 Motohiro Suzuki
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software.
10+
11+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

‎README.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Stage352: Hybrid Signature Manifest Verification Layer
2+
3+
Stage352 extends Stage351 by verifying the hybrid signature manifest.
4+
5+
## What Stage352 Verifies
6+
7+
- `docs/signatures/stage351_signature_manifest.json` exists
8+
- `docs/enforcement/enforcement_session.json` exists
9+
- Stage351 required fields are present
10+
- Stage351 `session_sha256` matches Stage350 `session_sha256`
11+
- `canonical_payload_sha256` is recomputed and checked
12+
- `signature_manifest_sha256` is recomputed and checked
13+
- CI / local context is consistent
14+
- Sigstore OIDC requirement is consistent
15+
- PQC ML-DSA `intent_only` state is not falsely treated as a real signature
16+
- Missing signatures are not claimed as verified
17+
- Private keys and raw secrets are not referenced
18+
19+
## Public Evidence
20+
21+
- `docs/signatures/stage352_signature_manifest_verification.json`
22+
23+
## Decision Model
24+
25+
- `accept_metadata_only`: local metadata-only manifest is structurally valid and hash-bound
26+
- `accept`: CI context and required signature conditions are satisfied
27+
- `warn`: non-critical inconsistency
28+
- `reject`: hash mismatch, structure mismatch, or fake PQC/signature claim
29+
- `block`: CI requires Sigstore OIDC but it is missing
30+
31+
## Safety Boundary
32+
33+
Stage352 does not publish private keys, raw secrets, fake signatures, or unverified PQC claims.

‎docs/anchors/external_anchor_receipt.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"stage": 342,
3+
"type": "external_anchor_receipt",
4+
"engine": "External Anchor Layer",
5+
"source_stage": 341,
6+
"anchored_artifact": "docs/session/session_manifest.json",
7+
"session_manifest_sha256": "0c8048d70faf08816e0829e1b50727ef82a3d7d94fe19d8c8e5b692ed6121be3",
8+
"signed_session_manifest": "docs/session/signed_session_manifest.json",
9+
"signed_session_manifest_sha256": "1ef840e0fbd9013dde9319b860b8914f2f8f242e3645be23730b9bc62e41dfed",
10+
"checkpoint_witness": {
11+
"ok": true,
12+
"status": "checkpoint_witness_created",
13+
"checkpoint_witness": "docs/checkpoints/checkpoint_witness.json"
14+
},
15+
"open_timestamps": {
16+
"ok": true,
17+
"status": "ots_created",
18+
"ots_file": "docs/session/session_manifest.json.ots",
19+
"ots_sha256": "bcfdf48f5430af53259776e1b1fddf7eb1d0952c03a89fc9aab24aff271bd96e"
20+
},
21+
"github_actions_anchor": {
22+
"status": "pending_until_push_and_workflow_run",
23+
"intent_file": "docs/anchors/github_actions_anchor_intent.json",
24+
"workflow": ".github/workflows/stage342-external-anchor.yml"
25+
},
26+
"sigstore_bundle": {
27+
"present": true,
28+
"bundle_file": "docs/anchors/session_manifest.sigstore.bundle",
29+
"bundle_sha256": "b6dfdb0f9955b1ac0b3d73f5a0e325dcc41c32e8a30ba301c03ab53f0d638dc0"
30+
},
31+
"safety_boundary": {
32+
"private_keys_published": false,
33+
"attack_code_published": false,
34+
"dangerous_prompts_published": false,
35+
"exploit_payloads_published": false,
36+
"automated_attack_logic_published": false
37+
},
38+
"created_at": "2026-06-06T04:28:14.524443+00:00",
39+
"meaning": "Stage342 externally anchors the signed verification session manifest through checkpoint witness, OTS support, GitHub Actions anchor intent, and external anchor receipt."
40+
}

0 commit comments

Comments
 (0)