Repository navigation
id: F12.17 trust and provenance — module signatures against an admin trust list #1069
Description
F12.17 — Trust and provenance
From the Phase 12 plan (.opencode/plans/phase-12-platform-flexibility.md, workstream G):
Verify module signatures against an admin trust list, extend the observed provenance (#225) with a compiler version, and record the trust decision in the journal. This is trust, not only observation.
Exit: an unsigned module is refused when the trust list is non-empty.
Coordination (2026-10-26 reprioritization, per Drew): every id roadmap item now has its own GitHub issue, and priority encodes the order: (1) the path to Phase 12 — now + priority/high; (2) Phase 12 itself — next; (3) Phase 13 and long-term ideas — priority/low. The dashboard mirrors this list (org Project "Developing Today" #4, Area id-train; Grist Program roadmap, Area id). If this item turns out to be blocked, wrong, or superseded, park or close it with a note rather than letting it stall the queue — dropping an issue is always allowed; silently stalling is not.
Acceptance criteria
- An unsigned module is refused when the admin trust list is non-empty, demonstrated by a test.
- Observed provenance (feat(id): record world module build provenance #225) is extended with a compiler version.
- The trust decision is recorded in the journal.
- Tests cover the empty-trust-list case (no refusal) as well as the non-empty case.
Activity
developing-today commentedon Oct 27, 2026
CODE-213
dezren39 commentedon Oct 27, 2026
Intake review
Related: Provenance base: #225 · Phase 12 plan workstream G (
.opencode/plans/phase-12-platform-flexibility.md)Notes: F12.17, Phase 12 (
nextband in Drew's reprioritization). The body's Exit line is the core criterion; the acceptance list above adds the empty-list guard case so the refusal can't over-fire. Still live — filed 2026-10-27, no implementation PR exists yet.Risks: Trust enforcement that refuses in the wrong cases would brick module loading; the empty-list case is the safety valve and needs its own test.
Suggested approach: Start from #225's provenance record shape; add signature verification at module load, journal the decision at the same point.
Labels were already normalized by the filer (kind, source/human, status/needs-triage, priority, effort, app/id all present); this pass appended the acceptance criteria above and adds
meta/enriched.🤖 Agent note · filed
dezren39 commentedon Nov 1, 2026
🤖 Agent note · done
queue/queued.Triage verdict — CONFIRMED, not implemented at current main
Verified 2026-11-01 against
origin/main=efc4e182:pkgs/id/src/commands/world.rs:609surfacesactive_module_provenance;cli.rs:2063reads a world's provenance from its journal (the feat(id): record world module build provenance #225 lineage). Nothing extends it with a compiler version.pkgs/id/src: "trust" hits are access control (access.rstrusted keys), envelope payload signatures, and the invite trust anchor; "admin" hits are the world-admin token (guest capability minting) and group admins. Neither concept gates module loading.sandbox.rs,commands/world.rs) and are activated without any signature-vs-list verification — the F12.17 exit ("an unsigned module is refused when the trust list is non-empty") has no code behind it, and no trust decision is journaled.Route
Enqueued a follow-up packet (kind small_fix, medium risk): trust list + signature verification at module activation (refuse unsigned/untrusted when non-empty; unchanged behavior when empty), compiler version in module provenance, journal-recorded trust decisions, and tests for the empty / unsigned-refused / trusted-accepted cases. The packet notes this is the full effort/l slice and instructs a split on this issue over a stall if it outgrows one timebox.
179 remaining items
dezren39 commentedon Nov 2, 2026
agent-note:v1
event: parked
task: 6097 (repo-health-code-pilot, repo-worker-code; OpenChamber scheduled lane; session ses_e5e643a149effez7y048t7YbXQ)
state: Queue task 6097 parked for 30 minutes. Fresh metadata-only check confirms issue #1069 OPEN and authored/assigned to Drewry Pope (dezren39), and named PR #4263 OPEN and authored by the same owner. This ownership hard stop remains. No PR content, checks, reviews, branch, or worktree inspected; no changes made.
resume: Only after explicit ownership release or handoff; revalidate issue/PR and restrictions before any work.
dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up (resume) — ownership park corrected, merging
held/user/owned/do-not-merge/do-not-auto-editabsent). PR feat(id): compiler-version provenance + journal-recorded trust decisions (#1069) #4263 is a fleet PR: its body names queue task 6097 and its branch isqueue/6097-1069-remainder— assignment/authorship under the shared dezren39 account is not Drew ownership (same false positive corrected on tasks 5190/5893/5196 earlier today). The "explicit ownership release" park condition is therefore not a real gate.feat(id): compiler-version provenance + journal-recorded trust decisi…
dezren39 commentedon Nov 2, 2026
🤖 Agent note · done — all acceptance criteria landed
SourceBuildProvenance.compiler_version, serde-default for journal compat, probed inworld_compile::compile()) + journal-recorded trust decisions (JournalEntry::ModuleTrustDecisionat the install trust gate).