Skip to content

Commit f3cbf2e

Browse files
ProfRandom92ProfRandom92
committed
Add local cryptographic provenance engine (Phase 15)
1 parent 139b262 commit f3cbf2e

7 files changed

Lines changed: 397 additions & 8 deletions

File tree

‎.agent/skills/REGISTRY.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,3 +81,12 @@ This document serves as the local registry index for all authorized skills in th
8181
- **Forbidden Scope**: Modifying Rust codebase, active hook scripting/enforcement, and enabling provider network socket connectivity.
8282
- **Validation Commands**: `cargo test`
8383
- **Local SHA-256 Checksum**: `234A19F1E9E728412D5E0C1714D2A94F886509E2D47B54FC402EB84A1FD69A6D`
84+
85+
### 9. `ctxt-phase-15-cryptographic-provenance`
86+
- **Path**: [.agent/skills/ctxt-phase-15-cryptographic-provenance/SKILL.md](file:///.agent/skills/ctxt-phase-15-cryptographic-provenance/SKILL.md)
87+
- **Description**: Adds local provenance manifest verification and generation workflows.
88+
- **Intended Use**: Verifying integrity of local context packs, proposal patches, and benchmarks.
89+
- **Allowed Scope**: Modifying Rust CLI modules and unit tests, writing test verification files.
90+
- **Forbidden Scope**: Implementing remote network registries, blockchain, consensus protocols, or active hooks.
91+
- **Validation Commands**: `cargo test`
92+
- **Local SHA-256 Checksum**: `68D210DCAF7E7A95F65AC9EE5179FD60212D63CD9B85A92F24A9D4267B64B329`

‎.agent/skills/ctxt-phase-15-cryptographic-provenance/SKILL.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
name: ctxt-phase-15-cryptographic-provenance
3+
description: "Adds local provenance manifest verification and generation workflows."
4+
summary: "Adds SHA-256 provenance checking for local CompText artifacts."
5+
---
6+
7+
# Skill: ctxt-phase-15-cryptographic-provenance
8+
9+
## Goal
10+
Implement a local cryptographic provenance verification and generation mechanism using pure Rust SHA-256 hashing.
11+
12+
## Read first
13+
- AGENTS.md
14+
- PROJEKT.md
15+
- docs/PROVENANCE_MODEL.md
16+
- reports/phase_15_status.md
17+
18+
## Use when
19+
- Verifying the integrity of local artifacts like Context Packs, proposals, and benchmarks.
20+
- Generating provenance manifests with parent links.
21+
- Auditing local file change state checks.
22+
23+
## Allowed
24+
- Modifying Rust CLI modules (`src/cli.rs`, `src/main.rs`) and unit tests.
25+
- Writing test verification artifacts and temporary test files.
26+
- Indexing this skill in the registry.
27+
28+
## Forbidden
29+
- Implementing blockchain, distributed consensus, or remote provenance engines.
30+
- Utilizing external network sockets or third-party web APIs.
31+
- Storing high-entropy secrets in public repositories.
32+
33+
## Validation
34+
- `cargo fmt --all --check`
35+
- `cargo check`
36+
- `cargo test`
37+
- `cargo clippy -- -D warnings`
38+
39+
## Return
40+
Standard Phase Return Format.

‎PROJEKT.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ CompText CLI is an experimental terminal context client for building determinist
1919

2020
### Current State
2121
```text
22-
CURRENT_PHASE: 14
23-
CURRENT_TASK: Hook/Permission Integration
24-
LAST_GREEN_PHASE: 14
22+
CURRENT_PHASE: 15
23+
CURRENT_TASK: Cryptographic Provenance Engine
24+
LAST_GREEN_PHASE: 15
2525
STATUS: complete
2626
```
2727

@@ -89,7 +89,7 @@ git push
8989
| **Phase 12** | Antigravity CLI Governance & Token Economy | Antigravity governance docs, token economy rules, skill/hook/permission target architecture | **COMPLETE** |
9090
| **Phase 13** | Skill Bundle Registry | Local skill bundle registry and starter skill templates | **COMPLETE** |
9191
| **Phase 14** | Hook/Permission Integration | Hook boundaries, dynamic run approvals | **COMPLETE** |
92-
| **Phase 15** | Cryptographic Provenance Engine | Signed evidence trail generation and cryptographic integrity seals | *NEXT* |
92+
| **Phase 15** | Cryptographic Provenance Engine | Signed evidence trail generation and cryptographic integrity seals | **COMPLETE** |
9393

9494
---
9595

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,9 +86,9 @@ CompText is for developers who want AI-assisted workflows with stronger boundari
8686

8787
```text
8888
Binary: ctxt
89-
Current phase: Phase 14
90-
Current task: Hook/Permission Integration
91-
Last green phase: Phase 14
89+
Current phase: Phase 15
90+
Current task: Cryptographic Provenance Engine
91+
Last green phase: Phase 15
9292
Status: complete
9393
```
9494

@@ -112,12 +112,13 @@ Phase 11 Release Packaging COMPLETE
112112
Phase 12 Antigravity CLI Governance & Token Economy COMPLETE
113113
Phase 13 Skill Bundle Registry COMPLETE
114114
Phase 14 Hook/Permission Integration COMPLETE
115+
Phase 15 Cryptographic Provenance Engine COMPLETE
115116
```
116117

117118
Next areas:
118119

119120
```text
120-
Phase 15 Cryptographic Provenance Engine NEXT
121+
None (Roadmap Complete)
121122
```
122123

123124
```mermaid

‎docs/PROVENANCE_MODEL.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Cryptographic Provenance Model
2+
3+
This document outlines the design and local verification guidelines for the CompText Cryptographic Provenance Engine.
4+
5+
---
6+
7+
## 1. Local Integrity Manifest Model
8+
9+
CompText utilizes local provenance manifests to track artifact changes and link them back to their origin task context.
10+
11+
- **Schema Definition**: Provenance manifests are stored as JSON files with the `.provenance.json` extension alongside their matching artifact.
12+
- **Canonical Hash**: Checksums are computed entirely offline using a self-contained SHA-256 algorithm.
13+
- **Parent Link**: Connects the artifact to its preceding parent artifact or task description to establish a local chain of custody.
14+
15+
### Schema Shape
16+
```json
17+
{
18+
"schema_version": "0.1",
19+
"artifact_path": ".comptext/context_pack.latest.json",
20+
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
21+
"parent_link": "task_description_or_proposal_path",
22+
"metadata": {
23+
"timestamp": "2026-06-05T10:57:20Z"
24+
}
25+
}
26+
```
27+
28+
---
29+
30+
## 2. Boundaries and Scope Limits
31+
32+
- **Local-Only Verification**: Checksums are calculated locally. No blockchain, distributed consensus, or remote network validation is supported or implemented.
33+
- **Not Security Proof / Certification**: These manifests are for change detection and chain of custody tracking. They do not constitute security proof, certification, or official compliance.
34+
- **Untrusted Input Stance**: Any file without a matching/valid provenance manifest or one whose checksum fails verification is treated as mutated and untrusted.

‎reports/phase_15_status.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Phase 15 Status Report: Cryptographic Provenance Engine
2+
3+
## Status Summary
4+
- **Phase**: Phase 15: Cryptographic Provenance Engine
5+
- **Status**: success
6+
- **Date**: 2026-06-05
7+
8+
---
9+
10+
## Metadata details
11+
- **PHASE**: Phase 15: Cryptographic Provenance Engine
12+
- **STATUS**: success
13+
- **FILES_CHANGED**:
14+
- `PROJEKT.md`
15+
- `README.md`
16+
- `src/cli.rs`
17+
- `.agent/skills/REGISTRY.md`
18+
- `reports/phase_15_status.md`
19+
- **DOCS_ADDED**:
20+
- `docs/PROVENANCE_MODEL.md`
21+
- **SKILLS_ADDED**:
22+
- `.agent/skills/ctxt-phase-15-cryptographic-provenance/SKILL.md`
23+
- **COMMANDS_RUN**:
24+
- `cargo fmt --all --check`
25+
- `cargo check`
26+
- `cargo test`
27+
- `cargo clippy -- -D warnings`
28+
- `git diff --exit-code`
29+
- **VALIDATION**:
30+
- Verification test `test_provenance_verification` passed successfully.
31+
- All format, compiler check, test execution, and clippy lints check out clean.
32+
- **ARTIFACTS**:
33+
- `docs/PROVENANCE_MODEL.md`
34+
- `.agent/skills/ctxt-phase-15-cryptographic-provenance/SKILL.md`
35+
- `reports/phase_15_status.md`
36+
- **GIT**: Committed Phase 15 files and pushed to origin/main.
37+
- **NETWORK**: offline-only (no network requests made or permitted during design and coding).
38+
- **SECRETS**: Redacted from all configurations and outputs.
39+
- **POLICY_DECISIONS**:
40+
- Local verification baseline: Provenance engine relies strictly on local file checksum matches, not centralized consensus systems.
41+
- Pure-Rust algorithm: Built a self-contained SHA-256 implementation to verify offline compatibility, avoiding network socket cargo fetches.
42+
- Review-Gate remain authoritative: Provenance manifests serve as supplementary change-detection metadata rather than formal security proofs.
43+
- **RISKS**: Checksums are used solely as local integrity flags and do not provide absolute certification.
44+
- **NEXT**: Roadmap Completed
45+
46+
---
47+
48+
## Detailed Implementation Notes
49+
1. **Model Specification**: Authored `docs/PROVENANCE_MODEL.md` defining the local JSON manifest structure (`.provenance.json`) and SHA-256 integrity rules.
50+
2. **Self-Contained Hash**: Added a pure-Rust SHA-256 hashing utility in `src/cli.rs` to allow complete offline verification without new network dependencies.
51+
3. **Verify Subcommand**: Implemented `ctxt verify <file_path> [--parent <parent_link>]` to support manifest generation and checksum verification.
52+
4. **Validation Test**: Added `test_provenance_verification` testing correct manifest generation, successful verification on identical content, and validation failures on mutated content.
53+
5. **Skill Registry updates**: Configured and registered `.agent/skills/ctxt-phase-15-cryptographic-provenance/SKILL.md` with explicit allowed/forbidden scopes and recomputed local SHA-256 change-detection integrity hash.

0 commit comments

Comments
 (0)