Repository navigation
Vendor V7 Cloudflare Access evidence policy bundle - #22
Merged
firegrass merged 1 commit intoOct 20, 2026
Merged
Conversation
BKLG-20261019-emfa. Follow ADR-0071 V7-owned evidence and ADR-0236 admitted packet authority. Copy the full bundle byte-for-byte from merged liskov-rs 13f039d41b8febf36db37844a7a61cc405fcec79; sourceDigest sha256:eb606519f755169179b09b7cdf287799e6b0450d99b412ca0f852600d4b94847. Exercise producer matching, absent, hostname and path evidence vectors through the existing adapter; pin manifest/artifact hashes and retain publication refusal. Full local gate passed on tree 5796022; rebuilt distributions unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vendor the complete policy-client bundle from liskov-rs commit
13f039d41b8febf36db37844a7a61cc405fcec79(producer PR #1826) for BKLG-20261019-emfa. V7 materialization now retains matching server-resolved Cloudflare Access evidence and rejects absent, hostname-mismatched, or path-mismatched observations with the producer's diagnostic codes and pointers.The regression tests exercise those producer vectors through the existing adapter and pin the complete bundle's manifest and artifact hashes. The bundle source digest is
sha256:eb606519f755169179b09b7cdf287799e6b0450d99b412ca0f852600d4b94847.The complete producer bundle also includes previously introduced V8 authored validation: V8 documents can now pass manifest validation and reach the upload-intent and non-source artifact paths. Source publication remains refused through the unchanged publication pairs. This accompanies the byte-for-byte producer bundle and should be retained in the BKLG-20261001-l5zm handoff. V7 publication and activation remain disabled.
Validation: the configured local gate passed, and independent review approved commit
981ebdfd4b1bcafd058c7235d34839d0d2231292, tree57960225b9e2681cda5ad4e0d0ddb0df3252edc8. Review independently reran frozen dependency installation, typecheck, all tests (90 JavaScript and 10 Python), Python compilation, build, andcheck:diston an export of that exact tree. The rebuilt distributions were byte-identical. All five vendored files match the producer, and replacing the Wasm with the old artifact correctly fails the bundle hash check.