Skip to content

Commit 114e37e

Browse files
OgeonX-AiOgeonX-Ai
authored
Merge pull request #2 from Coding-Autopilot-System/evidence/immutable-golden-path
feat: publish immutable golden-path evidence bundle
2 parents f09c271 + c08ba32 commit 114e37e

25 files changed

Lines changed: 1160 additions & 2 deletions

‎.gitattributes‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ Dockerfile text eol=lf
1111
*.toml text eol=lf
1212
*.ps1 text eol=crlf
1313
tests/contracts/cas-contracts/v0.1.0/*.json -text -diff
14+
evidence/verified-local-golden-path-v0.1/artifacts/** -text -diff

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,5 @@ jobs:
2121
- run: python -m ruff check .
2222
- run: python -m mypy
2323
- run: python -m pytest
24+
- run: python -m cas_reference_product.evidence
2425
- run: docker build --platform linux/amd64 -t cas-reference-product:ci .

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,9 @@ The image runs as a non-root user, listens on port `8080`, and provides `/health
6363
- [Architecture](docs/architecture.md)
6464
- [Threat model](docs/threat-model.md)
6565
- [Operations](docs/operations.md)
66+
- [Immutable golden-path case-study evidence](docs/case-study-evidence.md)
6667
- [cas-platform interface](deployment/cas-platform.interface.yaml)
6768

6869
## Security
6970

7071
Report vulnerabilities through GitHub private vulnerability reporting. Do not include credentials or sensitive prompt data in issues.
71-

‎docs/case-study-evidence.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Immutable Golden-Path Evidence
2+
3+
The committed bundle under
4+
`evidence/verified-local-golden-path-v0.1/` is the case-study evidence for one
5+
verified local golden-path execution. It connects four independently versioned
6+
CAS repositories without claiming an Azure deployment.
7+
8+
## What The Bundle Proves
9+
10+
- `cas-reference-product` served the deterministic local workflow over HTTP.
11+
- `cas-evals` evaluated the actual returned output and preserved lifecycle and
12+
trace identifiers.
13+
- The published `cas-contracts` v0.1.0 registry manifest is pinned by SHA-256.
14+
- Every schema digest referenced by that registry manifest is verified before
15+
the canonical records are validated against the exact published schemas.
16+
- The evaluation fixture, normalized evidence, fixture digest, and returned
17+
output digest are verified together.
18+
- The `cas-platform` what-if script is pinned as a non-deploying interface
19+
reference. No what-if output or Azure deployment is claimed.
20+
- Every included artifact digest and immutable source SHA is checked offline in
21+
tests and CI.
22+
23+
The canonical `artifact-manifest.json` and `verification-result.json` conform to
24+
the vendored `cas-contracts` `ArtifactManifest` and `VerificationResult`
25+
schemas. `bundle.json` maps their URN evidence identifiers to committed files
26+
and records the claim boundaries.
27+
28+
## Container Digest Boundary
29+
30+
The bundle does not claim a container image digest. The repository builds a
31+
local image in CI, but it does not publish a reproducible registry artifact
32+
whose digest can be independently resolved. The canonical verification result
33+
therefore marks this check as `skipped` rather than substituting a mutable tag
34+
or local image ID.
35+
36+
## Verify
37+
38+
```powershell
39+
./scripts/validate.ps1
40+
./scripts/verify-evidence.ps1
41+
```
42+
43+
The verifier is network-free. It fails when an artifact changes, a digest is
44+
malformed, a source URI is not pinned to its full commit SHA, the golden result
45+
does not pass exactly one case, or the platform evidence claims deployment.

‎evidence/verified-local-golden-path-v0.1/artifact-manifest.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"kind": "ArtifactManifest",
3+
"correlationId": "cas-reference-product-golden-v0.1",
4+
"promptId": "reference-product-golden-workflow",
5+
"runId": "cas-reference-product-golden-v0.1",
6+
"repo": "Coding-Autopilot-System/cas-reference-product",
7+
"actor": {
8+
"id": "evidence-bundle-ci",
9+
"type": "workflow"
10+
},
11+
"timestamp": "2026-06-13T00:00:00Z",
12+
"schemaVersion": "0.1.0",
13+
"traceContext": {
14+
"traceparent": "00-0f32a2f22b960e873c92cecabc6f8dea-afb7553009ebcb9d-01"
15+
},
16+
"artifacts": [
17+
{
18+
"kind": "source-provenance",
19+
"uri": "urn:cas-evidence:verified-local-golden-path-v0.1:source-provenance",
20+
"sha256": "d621003fea89b9e0a6af8ce87c1e6f60e42ad9a6df5f775a778dcccbafc6aa18"
21+
},
22+
{
23+
"kind": "contract-registry-manifest",
24+
"uri": "urn:cas-evidence:verified-local-golden-path-v0.1:contract-registry-manifest",
25+
"sha256": "92a09b0907e08b022f96b89ce09764b0416d268acc38653e08fd335b5e5198f9"
26+
},
27+
{
28+
"kind": "evaluation-result",
29+
"uri": "urn:cas-evidence:verified-local-golden-path-v0.1:eval-evidence",
30+
"sha256": "6d95d47fbdf422ff8fc3608b53b283e99b3f74b135d3876c7a1a4557dde2a8e7"
31+
},
32+
{
33+
"kind": "evaluation-fixture",
34+
"uri": "urn:cas-evidence:verified-local-golden-path-v0.1:golden-fixture",
35+
"sha256": "667fc47e19c3910dcc202063d8167f1acf6417e4cb35b705f8862a2886c5188a"
36+
},
37+
{
38+
"kind": "platform-what-if-reference",
39+
"uri": "urn:cas-evidence:verified-local-golden-path-v0.1:platform-what-if-reference",
40+
"sha256": "d6c57d4fb80aa168025368134ff8022f3a8328a92936503518e460aef03907ad"
41+
}
42+
]
43+
}

‎evidence/verified-local-golden-path-v0.1/artifacts/contract-registry-manifest.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"version": "0.1.0",
3+
"schemas": [
4+
{
5+
"id": "https://schemas.coding-autopilot.dev/v0.1/artifact-manifest.schema.json",
6+
"path": "artifact-manifest.schema.json",
7+
"sha256": "2864e3ef2c7ab8114395d15a2f6b4b1e832049c0a3a2b8a1165ba287f61caa06"
8+
},
9+
{
10+
"id": "https://schemas.coding-autopilot.dev/v0.1/common.schema.json",
11+
"path": "common.schema.json",
12+
"sha256": "c7ce72a6f5da8394e48f2421820588a8142546962e05152997bd1e6ced994928"
13+
},
14+
{
15+
"id": "https://schemas.coding-autopilot.dev/v0.1/evaluation-result.schema.json",
16+
"path": "evaluation-result.schema.json",
17+
"sha256": "be6d3216c95cfa6d2ccda908ff089010765b1c70223a920bfe3cb70a0cd24df5"
18+
},
19+
{
20+
"id": "https://schemas.coding-autopilot.dev/v0.1/policy-decision.schema.json",
21+
"path": "policy-decision.schema.json",
22+
"sha256": "21a66d651f5c0190fe0b50b81350ab32d29190d1c44719e2584628a8e0e6614f"
23+
},
24+
{
25+
"id": "https://schemas.coding-autopilot.dev/v0.1/prompt-envelope.schema.json",
26+
"path": "prompt-envelope.schema.json",
27+
"sha256": "baf043344abe6bf9afbc31272bef8034ec46ffc4d3fc799a41fead002b7274d6"
28+
},
29+
{
30+
"id": "https://schemas.coding-autopilot.dev/v0.1/run-event.schema.json",
31+
"path": "run-event.schema.json",
32+
"sha256": "6e96cb3e690ab4fcbcbe75005b27c14d83595c4951cabc35bed86b41fc2f0a7f"
33+
},
34+
{
35+
"id": "https://schemas.coding-autopilot.dev/v0.1/verification-result.schema.json",
36+
"path": "verification-result.schema.json",
37+
"sha256": "3ef6085b19c726204b65c9f8fd815a8aa0dcda6a8db82acdbd61e56bce45b4c9"
38+
},
39+
{
40+
"id": "https://schemas.coding-autopilot.dev/v0.1/work-request.schema.json",
41+
"path": "work-request.schema.json",
42+
"sha256": "7a6d5aee580d0198336c704cd9b154bc6c08bca15ec77be9c5db965cf54a9606"
43+
}
44+
]
45+
}

‎evidence/verified-local-golden-path-v0.1/artifacts/contracts/artifact-manifest.schema.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://schemas.coding-autopilot.dev/v0.1/artifact-manifest.schema.json",
4+
"title": "ArtifactManifest",
5+
"type": "object",
6+
"allOf": [
7+
{
8+
"$ref": "common.schema.json#/$defs/lifecycleMetadata"
9+
},
10+
{
11+
"type": "object",
12+
"required": [
13+
"kind",
14+
"artifacts"
15+
],
16+
"properties": {
17+
"kind": {
18+
"const": "ArtifactManifest"
19+
},
20+
"artifacts": {
21+
"type": "array",
22+
"minItems": 1,
23+
"items": {
24+
"$ref": "common.schema.json#/$defs/evidence"
25+
}
26+
}
27+
}
28+
}
29+
],
30+
"unevaluatedProperties": false
31+
}

‎evidence/verified-local-golden-path-v0.1/artifacts/contracts/common.schema.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://schemas.coding-autopilot.dev/v0.1/common.schema.json",
4+
"title": "CAS Common Definitions",
5+
"$defs": {
6+
"actor": {
7+
"type": "object",
8+
"additionalProperties": false,
9+
"required": ["id", "type"],
10+
"properties": {
11+
"id": { "type": "string", "minLength": 1, "maxLength": 256 },
12+
"type": {
13+
"type": "string",
14+
"enum": ["human", "agent", "service", "workflow"]
15+
},
16+
"displayName": { "type": "string", "minLength": 1, "maxLength": 256 }
17+
}
18+
},
19+
"traceContext": {
20+
"type": "object",
21+
"additionalProperties": false,
22+
"required": ["traceparent"],
23+
"properties": {
24+
"traceparent": {
25+
"type": "string",
26+
"pattern": "^[\\da-f]{2}-[\\da-f]{32}-[\\da-f]{16}-[\\da-f]{2}$"
27+
},
28+
"tracestate": { "type": "string", "maxLength": 512 }
29+
}
30+
},
31+
"lifecycleMetadata": {
32+
"type": "object",
33+
"required": [
34+
"correlationId",
35+
"promptId",
36+
"runId",
37+
"repo",
38+
"actor",
39+
"timestamp",
40+
"schemaVersion",
41+
"traceContext"
42+
],
43+
"properties": {
44+
"correlationId": { "type": "string", "minLength": 1, "maxLength": 128 },
45+
"promptId": { "type": "string", "minLength": 1, "maxLength": 128 },
46+
"runId": { "type": "string", "minLength": 1, "maxLength": 128 },
47+
"repo": {
48+
"type": "string",
49+
"pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$"
50+
},
51+
"actor": { "$ref": "#/$defs/actor" },
52+
"timestamp": { "type": "string", "format": "date-time" },
53+
"schemaVersion": { "const": "0.1.0" },
54+
"traceContext": { "$ref": "#/$defs/traceContext" }
55+
}
56+
},
57+
"evidence": {
58+
"type": "object",
59+
"additionalProperties": false,
60+
"required": ["kind", "uri"],
61+
"properties": {
62+
"kind": { "type": "string", "minLength": 1, "maxLength": 64 },
63+
"uri": { "type": "string", "format": "uri" },
64+
"sha256": { "type": "string", "pattern": "^[\\da-f]{64}$" }
65+
}
66+
}
67+
}
68+
}

‎evidence/verified-local-golden-path-v0.1/artifacts/contracts/evaluation-result.schema.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://schemas.coding-autopilot.dev/v0.1/evaluation-result.schema.json",
4+
"title": "EvaluationResult",
5+
"type": "object",
6+
"allOf": [
7+
{
8+
"$ref": "common.schema.json#/$defs/lifecycleMetadata"
9+
},
10+
{
11+
"type": "object",
12+
"required": [
13+
"kind",
14+
"evaluator",
15+
"outcome",
16+
"metrics"
17+
],
18+
"properties": {
19+
"kind": {
20+
"const": "EvaluationResult"
21+
},
22+
"evaluator": {
23+
"type": "string",
24+
"minLength": 1,
25+
"maxLength": 256
26+
},
27+
"outcome": {
28+
"enum": [
29+
"passed",
30+
"failed",
31+
"inconclusive"
32+
]
33+
},
34+
"metrics": {
35+
"type": "object",
36+
"minProperties": 1,
37+
"additionalProperties": {
38+
"type": "number"
39+
}
40+
}
41+
}
42+
}
43+
],
44+
"unevaluatedProperties": false
45+
}

‎evidence/verified-local-golden-path-v0.1/artifacts/contracts/policy-decision.schema.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://schemas.coding-autopilot.dev/v0.1/policy-decision.schema.json",
4+
"title": "PolicyDecision",
5+
"type": "object",
6+
"allOf": [
7+
{
8+
"$ref": "common.schema.json#/$defs/lifecycleMetadata"
9+
},
10+
{
11+
"type": "object",
12+
"required": [
13+
"kind",
14+
"decision",
15+
"policyVersion",
16+
"reasons"
17+
],
18+
"properties": {
19+
"kind": {
20+
"const": "PolicyDecision"
21+
},
22+
"decision": {
23+
"enum": [
24+
"allow",
25+
"deny",
26+
"require-approval"
27+
]
28+
},
29+
"policyVersion": {
30+
"type": "string",
31+
"minLength": 1,
32+
"maxLength": 64
33+
},
34+
"reasons": {
35+
"type": "array",
36+
"minItems": 1,
37+
"items": {
38+
"type": "string",
39+
"minLength": 1,
40+
"maxLength": 1000
41+
}
42+
}
43+
}
44+
}
45+
],
46+
"unevaluatedProperties": false
47+
}

0 commit comments

Comments
 (0)