Complete ceremony workflows and add public archive verification - #33
Merged
Conversation
mellowcroc
changed the title
…-workflow # Conflicts: # cmd/relay/role_flow_catalog.go
mellowcroc
marked this pull request as ready for review
September 9, 2026 06:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Complete guided custody and publication steps, preserve mirror history, and add public ceremony archive verification. The guided workflow now prepares signed handoffs/receipts before computation and acceptance, publishes phase-ending records before dependent work, and exposes tiny-circuit public-proof generation. Mirror synchronization retains and authenticates historical chain prefixes and rejects conflicting or unsafe inventory entries.
Add
relay pack-ceremony --manifest FILE --root PUBLIC_DIR --out FILEandrelay verify-ceremony --archive FILE. Packing uses an explicit public-file inventory and refuses overwrites or changed files. Verification rejects missing/tampered files, traversal, links, ambiguous manifests and unlisted entries; then uses the installed release-pinned proof tool to authenticate the definition, verify the release, independently replay both phases, and verify production approval. Approval must be GO for the exact verified release manifest. No archive-supplied code executes, no private key is needed, and no audit is signed. Website-hosted identity is the explicit trust source.Validation:
go test ./...andgo vet ./...passed, including archive boundaries, tampering, packing selection, mandatory replay, missing production approval, NO-GO, and mismatched-release cases. The companion proof-tool signed lifecycle test passed real unsigned replay and tampering rejection. The extended full Docker ceremony/archive lane was attempted but stopped at the existing host-swap guard before contributions; it has not passed on this host. No production guard was bypassed. Existing optional integration lanes remain opt-in.Release dependency: proof-tool #22 is merged and published as
mpc-ci-74967b28765db94919bf7e1e8253c0690ba87b2c. Both architecture pins now reference those assets; checksums and GitHub provenance were verified against the exact main commit and publishing workflow. The new CI lane runs the complete Docker ceremony and public archive replay on a disposable no-swap host, using real future Quicknet rounds. It retains the normal contributor guard and makes no claim of independent human operators or cloud transport. The automated tiny-circuit test waits across whole-second contribution timestamps to preserve chronology. The final head requires this lane and the private Tessera integration check to pass before release.Tessera #3 supplies public record exports and an operator-provisioned verification-package download. Existing frozen software bindings are not relaxed or migrated.