titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

hermes: sign recovery attestations for the target worker

Browse Source
This commit is contained in:
jenkins 2026-09-13 18:07:04 -05:00
parent 743014ca33
commit 9cc49dedeb
2 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
services/hermes/scripts/bootstrap_soteria_publication_retry.py
View File

@ -13,7 +13,7 @@ from pathlib import Path
from typing import Any
import supervisor_state
from execution_pool_protocol import payload_digest, read_key, sign_envelope
from execution_pool_protocol import derive_ordinal_key, payload_digest, read_key, sign_envelope
BOARD = "soteria"
@ -144,7 +144,8 @@ def signed_assignment(pool_database: Path, key_file: Path) -> bytes:
"""Attest the verified retained assignment with the current coordinator key."""
assignment, _raw_sha, attempt = _pool_record(pool_database)
_native_guard()
return json.dumps(sign_envelope(read_key(key_file), "assignment", {
key = derive_ordinal_key(read_key(key_file), ORDINAL)
return json.dumps(sign_envelope(key, "assignment", {
"board": BOARD, "task_id": CHILD, "run_id": RUN_ID,
"worker_ordinal": ORDINAL, "attempt": attempt,
}, assignment), separators=(",", ":"), sort_keys=True).encode()

22
testing/tests/test_hermes_legacy_scm_roots.py
View File

@ -19,6 +19,7 @@ state = _load("supervisor_state")
seed = _load("seed_legacy_scm_roots")
retry = sys.modules["publication_retry"]
bootstrap = _load("bootstrap_soteria_publication_retry")
protocol = sys.modules["execution_pool_protocol"]
class NativeKanban:
@ -137,6 +138,27 @@ def test_publication_bootstrap_accepts_only_the_verified_historical_blocked_run(
bootstrap._native_guard()
def test_publication_bootstrap_assignment_uses_ordinal_authority(tmp_path, monkeypatch):
"""The operator attestation has the source mediator's derived authority."""
master = b"m" * 32
key_file = tmp_path / "pool-key"
key_file.write_bytes(master)
key_file.chmod(0o600)
assignment = {"root_task_id": bootstrap.ROOT, "continuation_kind": "repair"}
monkeypatch.setattr(bootstrap, "_pool_record", lambda _pool: (assignment, "a" * 64, 1))
monkeypatch.setattr(bootstrap, "_native_guard", lambda: None)
envelope = json.loads(bootstrap.signed_assignment(tmp_path / "pool.db", key_file))
derived = protocol.derive_ordinal_key(master, bootstrap.ORDINAL)
assert protocol.verify_envelope(derived, envelope, expected_kind="assignment")["payload"] == assignment
with pytest.raises(protocol.ProtocolError):
protocol.verify_envelope(master, envelope, expected_kind="assignment")
with pytest.raises(protocol.ProtocolError):
protocol.verify_envelope(
protocol.derive_ordinal_key(master, 1), envelope, expected_kind="assignment"
)
def test_publication_retry_is_bound_once_and_never_falls_back_to_a_model(tmp_path, monkeypatch):
"""A mediator receipt can power one fresh ordinal-pinned publication only."""
board, root_id, child_id, baseline, head = (