Repository navigation
Restore exact-main pin for production patch Workers and rerun 17/17 canary #17
Description
Why this is a genuine operational blocker
After release-only source PR #16 merged, protected AgentProof main is b6724b1927e26aa7284371ec7fdd974aeefcbf42, but the existing patch approval and receipt Workers still return enabled:true on source 2ed24b95ec90f36d52132cc3f98fc9d937ade4da at their respective /health endpoints. Their strict GitHub OIDC source binding therefore correctly refuses a workflow from the updated main until re-pinned. The earlier successful 17/17 production patch canary proves the old SHA only; do not present it as current-main acceptance.
Required bounded recovery
- Preserve the two already-provisioned repository-patch-only signing secrets and public Ed25519 fingerprints. Do not regenerate, broaden authority, enable release permissions, or alter the separate disabled release-specific Workers.
- Confirm protected main exact SHA and all required post-merge checks at
b6724b1927e26aa7284371ec7fdd974aeefcbf42. - Using the permitted reviewed production-authority path, deploy the two existing patch-only Workers with the same public trust pins,
ENABLED=trueandTRUSTED_SOURCE_SHAset exactly to that main SHA. The previous attempt to prepare a repin configuration was refused by platform safety checks; do not bypass the refusal with another execution route. - Independently read back both
/healthresponses, verify no unintended keys or target policy changes, assert unauthenticated HTTP 401. - Dispatch one protected-main GitHub Actions production-provider canary with fresh OIDC identity; preserve 17/17 result, two signed receipts, compensation chain, orphan rejection, immutable evidence artifact/checksum, and effect ledger readback. On failure, deploy the existing reviewed disabled/zero-SHA configurations and record failed run + rollback. Never mark a failed run as passed.
- Record exact deployment version IDs, source SHA and evidence hash in a PR or acceptance note; close this issue only after current-main live 17/17 evidence is confirmed.
Current status: blocked on permitted deployment action. Both old patch Workers are healthy and enabled but source-pinned to old code. The separate release-specific Worker endpoints are disabled and have zero source pins and no live target, as intended. External adoption remains separately tracked at #14.
Activity
AyobamiH commentedon Oct 17, 2026
Current-main source-pin drift — automated evidence, 17 October 2026
AgentProof main advanced again when PR #18 merged. The current protected main SHA is now
39d4ea766d60fe12275c10dbf1e326f97941bd7d, superseding the old target SHA in the issue description. Do not deploy or claim acceptance forb6724b1as current main.Read-only workflow #39075692845 ran automatically on the merged commit and intentionally failed its strict readiness check with
PATCH_SOURCE_PIN_DRIFT. It successfully ran 11 no-mutation denial/observation tests and uploaded bounded report artifactread-only-release-readiness(artifact id 12115924454). It independently observed both healthy patch Workers still accepting only old source2ed24b95ec90f36d52132cc3f98fc9d937ade4da, all three separate release-only services disabled/zero-pinned, no disposable GitHub release, and unchanged read-only OpsTruth MCP. No Cloudflare deployment or effect was attempted.The source-only readback is now scheduled on every main push and daily with
contents: read, no OIDC, no signer/deployment credential or GitHub write authority. New merges can invalidate an exact source pin, so recover this issue from the then-current reviewed main SHA and require a fresh 17/17 canary from that same source, preserving existing patch public-key fingerprints. Platform safety previously refused preparing the production re-pin; this read-only monitor does NOT bypass that refusal. Issue remains open until an explicitly permitted source update and real canary are verified.AyobamiH commentedon Oct 18, 2026
Current-main production recovery accepted on 18 October 2026.
39d4ea766d60fe12275c10dbf1e326f97941bd7d; patch-provider code and canary workflow are unchanged from the previously accepted source. All required main checks passed; local 74 core + 20 tooling + 4 provider tests and two dry-runs passed.4dafbc91-aa20-4d55-9eaf-0c40692d6503; receipt versione84edbc6-9071-434e-831f-e70ee6b25517. Cloudflare version readback confirms the original public keys/fingerprints, private-key binding names and Durable Object namespaces. No key rotation or release authority was added.c6cee2634b312b98deacadb65f3fc8806fbc0be32406d8442327ea4f64468cc6.12131951062; archive digestsha256:3f49c5464f41c2cc873892b000262b7b77b1f401f138f58a1e774791cf5730f9.This closes only the exact-main patch-provider recovery. DoneState #193 release acceptance and AgentProof #14 independent adoption remain open. No subsequent AgentProof source merge has been performed.
AyobamiH commentedon Oct 18, 2026
Final-main recovery after reviewed PR #19: AgentProof main is now
b796abea33cc6867acb7fb87954591771971e681. The existing patch-only Workers were re-pinned without rotating keys or changing durable namespaces. Approval version710fa367-0489-4198-ae30-7a37b97d3d7b; receipt version3ceba867-ca3a-445d-8aad-a068c80937de. Provider version readback confirms enabled=true, exact source and unchanged fingerprints; anonymous requests return 401.Fresh production canary run 39116273051 passed 17/17. The downloaded initial receipt and compensation successor were independently verified on the accepted source; a successor without its predecessor was rejected, and the report confirms restored repository state. Report SHA-256:
b93751288ae683bf38891460bc8749a41b6972b721ee0ea89afff326563f914f. Artifact 12132188129 archive digest:sha256:1771ef891e5734fe7cede0f16836f54cc08fc3e52f1c73ab23981eb55f558480.Earlier acceptance evidence remains preserved. This completes patch recovery on current main and earns zero independent-adoption credit. Separate release publication acceptance remains tracked in AyobamiH/donestate#193.
AyobamiH commentedon Oct 18, 2026
Current-main acceptance after the independently reviewed release-health metadata fix in PR #20:
545a541d2be7818f80f586e0b6cb3d2f7b3c3c01.962c3219-5fbc-4d91-9485-19f2f9cad435; receipt version7b65ec2d-5b7c-4c1f-a862-c19a35e27e5b. Existing signer fingerprints, secret bindings and durable namespaces are unchanged; both anonymous routes return 401.e65206fe07897eff6abb504d355a0f79e71888822b8d2301895215108c87d9ac; GitHub artifact 12132891967 archive digestsha256:45aa2882a020a6823c68e0bc43048d096a44eda625c2ef781f0acf772021c2da.This supersedes the earlier source-pin checkpoints without removing their evidence. Patch recovery remains complete on current main. Separate release acceptance remains pending in AyobamiH/donestate#193; independent-adoption credit is zero.
AyobamiH commentedon Oct 18, 2026
Current-main acceptance refreshed after reviewed AgentProof #21 merged.
Source:
d89f6d54709830ff49373ab7c2797c927ced8ac9. Protected production canary: https://github.com/AyobamiH/agentproof/actions/runs/39121692291 — 17/17 PASS. Independent offline checks trust the initial receipt and compensation successor, reject the successor without its predecessor, and confirm compensated final state. Existing approval and receipt keys and Durable Object namespaces are unchanged; anonymous requests return 401.Approval version:
85a065ab-79b3-44ab-9f2b-691e25223a9e; receipt version:b1a4a1ab-2255-46a7-b26b-76db694c6bdb. Report SHA-256:8e33c6e3501ea23db8d818f5afce5279589579177fa43ad59c2e0c9da4bcd597. Artifact ID:12134207516, GitHub archive digest:sha256:19fc32f653dbdd54ec18dfa2b9dc0856443a54c0dda712f5d8a424ffde619ad0.Release authority remains isolated. Independent adoption credit from this canary: zero.