Verifier assurance programme (OVK-VA) - #17
Open
fraware wants to merge 22 commits into
Open
Conversation
Keep VA baseline runs, evidence packs, and editor backups out of the tree so assurance work stays reviewable without shipping local check debris.
Establish the verifier-assurance architecture decision, programme baseline, and which adapters are in or out of scope before landing implementation slices.
Bind verifier-assurance to a documented pcs-core commit so profile hashing, validation, and optional extras resolve the same merge gate locally and in CI.
Extend capability models and registry validation so adapters can declare assurance claims without changing ordinary-only backends that omit the section.
Capture redacted verifier configuration and export PCS verifier profiles so assurance runs can bind evidence to a reproducible snapshot identity.
Persist invocation provenance, guarantee clamping, and pack layout so assurance outcomes are attributable and independently inspectable.
Centralize snapshot, invoke, and evidence-pack production behind one path used by CLI, replay, and conformance without touching ordinary ovk check.
Re-execute recorded invocations against the same snapshot digests so reviewers can confirm reproducibility without trusting a single CI host.
Apply typed profile mutations so conformance and adversarial checks can detect brittle or overfitted verifier configurations.
Provide common snapshot and evidence plumbing so individual assurance backends stay thin and consistent with the runner contract.
Expose authoritative auth-state predicates as an assurance-capable backend for opt-in verifier runs with snapshot and evidence support.
Wrap offline pytest suites as assurance backends so test evidence can participate in PCS-bound packs without entering ordinary lane routing.
Run Rego policy checks under assurance mode so policy decisions export snapshot-bound evidence separate from ordinary self-protection routing.
Bridge Lean/pf-core proof obligations into assurance runs so formal backends can declare guarantees and produce PCS-compatible evidence.
Compare before/after SQLite states under assurance mode so data-plane obligations can emit reproducible evidence packs.
Host stochastic model judging behind explicit assurance claims so non-deterministic backends abstain honestly and still produce inspectable packs.
Register assurance adapters in an isolated registry so they never mix into ordinary lane evaluation while remaining discoverable from verifier tooling.
Ship runnable PCS evidence-pack examples and a harness so adapters can prove snapshot, replay, and mutation expectations against the programme contract.
Normalize external adjudicator outputs into redacted, digest-addressed artifacts so human or tool judgments attach cleanly to evidence packs.
Add describe, snapshot, run, validate-evidence, replay, and mutate commands as an opt-in surface that leaves ordinary ovk check paths unchanged.
Point operators at the opt-in assurance surface, PCS pin, and programme changelog while clarifying that ordinary check paths remain the default.
Verify pin digests, run assurance tests, and exercise PCS conformance so verifier-assurance regressions cannot land unnoticed beside ordinary CI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ovk verifierCLI.ovk check/ MCP / Action paths unchanged; assurance requires the documented pcs-core pin.tests/assurance, PCS conformance) plus guide, threat-model, and index updates.Test plan
assurancejob green on this branchpytest tests/assurance -qwithOVK_PCS_CORE_PATHpointing at the pinned pcs-core checkoutovk verifier describe/run/replayagainstexamples/assurance/ovk checkand existing unit/gates jobs still pass