CCodeWhale Botfeat(cloud-facts): pin the first production trust anchor
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(cloud-facts): pin the first production trust anchor Both trust tables were empty, which made the entire cloud-facts layer inert: with no active key ticket() returns RefreshError::Inert, so refresh and maybe_load_persisted_cache bail before reading anything, and configure() publishes CloudFactsState::Inert. Nothing downstream of that could run, however complete it was. And it was complete. Slice 1 (#5752) already shipped verification, scoping, the overlay, the catalog patch semantics, the full consumer wiring, the website transport and the publish tool. A signed fact lands on ProviderModelOffering.limits in provider_lake.rs:764-812 and mints RouteLimits, which route_budget.rs:47-51 consults *before* the fallback chain that currently ends at LEGACY_DEEPSEEK_CONTEXT_WINDOW_TOKENS. The gap was never schema or consumer. It was that no key existed. Anchor cwf-2026-09, Ed25519, generated by the founder with facts-publish.mjs keygen. The private half lives outside every repository at mode 0600 and was never read into this session: only the public half was derived locally, and only the public half is committed. Both tables carry the same key — check-cloud-facts.mjs now reports OK (facts_version=1, 1 active production keys), up from 0. Why this has to land in the release rather than after it: a shipped binary can only trust a key it was compiled with. There is no in-band command that installs or widens trust, and CODEWHALE_CLOUD_FACTS_PATH verifies against this same table, so a local envelope is not an escape hatch either. A client that ships without the anchor can never be served a fact until it is replaced. Pinning it now is what makes delivery possible at all; it does not by itself deliver anything. Still required before any fact reaches a user, and all of it is founder authority: deploy SUPABASE_URL and the publication migration, confirm facts_current grants and RLS, then separately approve signing and publish a payload at a facts_version above the channel floor (1 today). This commit approves trust in a key. It does not approve a publication, and none has occurred. cargo test -p codewhale-config --locked cloud_facts test result: ok. 30 passed; 0 failed; 668 filtered out cargo test -p codewhale-cloud-facts --locked test result: ok. 17 passed; 0 failed node web/scripts/check-cloud-facts.mjs check-cloud-facts: OK (facts_version=1, 1 active production keys) cargo check --workspace --all-targets --locked: 0 errors, 0 warnings No new tests: the existing cloud-facts suite already covers verification, scoping and the empty-table inert path, and the parity gate is the check that matters for a two-table anchor. Refs: Linear SHA-6398, GitHub #5752. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X57KRgwqYkmmtVQScczqiL | 1 个月前 |