[dinakarjs]

Problem and change

The measurement error documentation covered input files only, omitted TPM/NV failure paths and described startup aborts without the existing development-mode exception. The registry and decision table now cover code/configuration/policy inputs, TPM open errors, NV define/read/validation/extend/chain failures, truncated values and certify failures.

Production startup aborts; CMCP_DEV_MODE logs a warning and continues without establishing a successful gateway measurement. Recovery guidance distinguishes restoring measured inputs from investigating TPM/NV access, configuration and state, and preserves the warning against inferring TPM replacement or rotating a signing key merely from this code. Sealed-key recovery remains separate. The failure-mode metadata is updated to 1 November 2026.

Three consistency tests protect exact registry columns, both modes in the decision table, the section heading and the substantive recovery text. This documents existing behavior; runtime, TEE, signing and recovery mechanisms are unchanged. Existing BOM and CRLF formatting are retained.

Validation — 1 November 2026

Head: 694cd63ad1ae268581df03be50f2ff88966dff0d; tree: 9b0b2ae67ef8111b41230d7ae2f6a233acea58dd.

• Hash-locked Linux/Python 3.12 development environment with this checkout installed: 2,606 unit tests passed / 8 skipped; focused registry/measurement/report-binding suite: 99 passed.
• Seven independent documentation mutations (status, log level, decision row, recovery safeguard, TPM trigger, dev-mode sentence and section heading) each fail a new assertion. Original docs restored before final validation.
• Ruff, strict mypy (77 source files), configured Bandit and changed-file whitespace checks pass, treating existing CRLF endings as line endings.
• Separate docs environment follows the workflow's sequential docs/runtime lock installs. Strict MkDocs build and documented quickstart checks pass, retaining software-only verification limits.
• Both local environments needed socksio 1.0.0 for the host's configured SOCKS proxy. This is an environment-only addition; no dependency/source workaround is committed.

Hosted validation and independent review of this new head remain required. Prepared with OpenAI Codex; DCO-signed. No merge, release or hardware result claimed.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

@rajnisht7 Please review the existing MEASUREMENT_UNAVAILABLE error registry entry, recovery guidance and consistency test at current head 17449cdcb75cb17bd244ecef0a3b10b93ff31700. This PR is now ready for independent review, and the existing reviewer requests are populated. All returned current-head technical workflows succeed (validation evidence); the PR description records the prior local tests and their revisions.

No runtime, TEE or key-rotation behavior change. Please review the documented existing behavior and its regression rather than infer new recovery guarantees.

Please identify any remaining change required or disposition this bounded contribution. This request does not claim independent approval, a new full-suite rerun, or merge readiness. Prepared with OpenAI Codex.

[rajnisht7]

The overall changes and direction looks good, a few things needs to be addressed:

• docs are too narrow- MeasurementUnavailable is also raised for TPM/NV failures (index define/read/validate, TPM2_NV_Extend, chain mismatch, certify failure, truncated value, TPM open errors, etc.). The current text only talks about “code/configuration/policy inputs” and “restore readable/supported inputs”, which doesn’t cover the TPM path.

• dev mode is missing- _degrade_measurement only aborts in production. With CMCP_DEV_MODE it logs a warning and continues. The new section says “Startup aborts” with no qualification.

• Decision Table is incomplete-the document says it covers every failure scenario, but MEASUREMENT_UNAVAILABLE is not in the table (only in the appended section).

• Test doesn’t actually guard the recovery guidance, it only checks that the code string appears somewhere in failure-modes.md. The recovery sentences, the section heading, and a Decision Table row could all be removed and the test would still pass. The '500' / 'FATAL' checks are also just substrings.

• Metadata is stale. Last updated: 2026-06-04 should be bumped.

also kindly broaden the description + recovery guidance to include the TPM/NV cases, note the dev-mode path, add the Decision Table row, and make the test assert the actual recovery wording (and ideally the exact registry columns).

[dinakarjs]

@rajnisht7 requesting current-head re-review at 694cd63ad1ae268581df03be50f2ff88966dff0d.

The registry, decision table and recovery section now cover TPM/NV failures and the existing production-fatal versus dev-warning/continue paths. The metadata date and exact registry columns are corrected. Three tests protect substantive recovery guidance; seven independent documentation omissions fail them. Local evidence: 2,606 unit tests, 99 focused tests, strict docs build and quickstart checks. Please confirm whether your five documentation findings are satisfied or identify any remaining correction. Runtime and recovery mechanisms are unchanged.

All returned current-head technical workflows pass. Validation details and limitations are in the PR description; this follow-up does not claim another local suite run or independent approval. Prepared with OpenAI Codex.

[drk-ram]

Read the registry text against src/cmcp_runtime/startup.py at 694cd63ad1ae268581df03be50f2ff88966dff0d, not only against the new string tests.

_degrade_measurement is fatal in production: _fatal("MEASUREMENT_UNAVAILABLE", ..., action="startup_aborted") and then sys.exit(1). With config.dev_mode it logs a warning and returns, and that warning already says the platform will not attest what code is running. _measure_gateway and _extend_measurement both route MeasurementUnavailable through that function. A missing tpm2-pytss, and any other exception leaving the ESAPI session, is wrapped into MeasurementUnavailable before the call, so those are not a separate startup path the new section forgets. The decision-table row and "Measurement unavailable at startup" match that split. The tests bind the code and HTTP status to MeasurementUnavailable.code and http_status rather than to a copied string, and they lock the phrases that would otherwise drift: do not infer TPM replacement, do not rotate a signing key from this code alone, sealed-key recovery stays on FM-1b. That is the right kind of documentation test.

The recovery boundary is the part I want preserved in any later edit. draft-durga-agent-tx-compensation-lease-00, and the fail-closed measurements in TR-2026-01 (DOI: 10.5281/zenodo.23735274) and TR-2026-03 (DOI: 10.5281/zenodo.23775009), treat an unavailable measurement as a refusal to proceed, not as a signal that authorizes compensation. MEASUREMENT_UNAVAILABLE must not be read as "the TPM was replaced" and must not be used as the reason to rotate or unseal a signing key. The new section says that, and it keeps sealed-key recovery on FM-1b. Dev-mode continuation is not a measured gateway and must not be written into a claim. The table says that too.

One non-blocking observation. The error-code status cell is 500 / startup, because the class carries HTTP 500 while the production path exits before it serves traffic. The test locks that wording. Keep the slash. A later edit that normalizes the cell to 500 would hide the abort.

Approving. This documents the existing boundary. It does not add a recovery action, and it should not.

[carloshvp]

Reviewed commit 694cd63ad1ae268581df03be50f2ff88966dff0d.

The error registry now matches the existing startup boundary: production refuses unavailable measurement, while development emits the warning and continues without measured provenance. Recovery requires correcting the measurement path; the text does not imply automatic trust reset or key rotation.

Validation: all three measurement-error registry tests passed locally; checked the registry wording against the startup and measurement code.