ci: repo-wide green — workflow and chart fixes by fraware · Pull Request #136 · SentinelOps-CI/provability-fabric

fraware · 2026-06-17T09:28:22Z

Summary

Documentation Build (branch-protection required): stop deploying/pushing from docs-build.yaml on main; deployment stays in docs-deploy.yaml with Pages enablement: true.
CodeQL / marketplace UI: add missing babel-plugin-transform-remove-console (+ lockfile) so JS builds succeed; remove broken codeql-database artifact download from security-gates.
SBOM Security Gate: install Syft/Grype into isolated temp dirs (fixes find /tmp permission failures).
Multi-Architecture Build: generate workspace Cargo.lock before Docker staging (lockfile is gitignored).
Performance Gate: use Criterion minimum --sample-size 10 (was 5).
PF CI reusable workflow: drop invalid GITHUB_TOKEN secret passthrough; caller uses secrets: inherit.
Integration Tests: install Kind in workflow; admission Helm chart now includes ServiceAccount + self-signed TLS secret; HPA disabled by default.

Test plan

CI required checks
Documentation Build
smoke / evidence-schema-only (if evidence paths touched)
CodeQL Security Analysis
SBOM Security Gate
Multi-Architecture Build & Deploy
Performance Gate (bench path)
Integration Tests
PF Reusable CI Caller / pf-ci workflow validation

Unblock branch-protection and push workflows: docs build no longer deploys on main, Syft/Grype install into isolated dirs, multi-arch generates Cargo.lock, CodeQL gets missing babel plugins and drops broken artifact gate, performance gate uses Criterion minimum sample size, pf-ci stops passing GITHUB_TOKEN as a reusable secret, integration installs Kind and admission Helm chart ships TLS/ServiceAccount.

github-actions · 2026-06-17T09:28:31Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Skip dependency review when the repo dependency graph is disabled, make docs-deploy succeed when Pages is unavailable, fix replay docker invocation and pf-ci docker setup, and replace broken SLO nightly jobs with a working k6 gate.

github-actions · 2026-06-17T09:44:20Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T09:51:34Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T10:07:56Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T10:09:24Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T10:17:43Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

The simple replay bundle now uses TRACE-REPLAY-KIT event traces with type function_call; update the import assertion accordingly.

Avoid apt/gpg keyserver failures (No dirmngr) on GitHub runners by matching the install path used in slo-gates.

github-actions · 2026-06-17T12:26:02Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

pf-ci builds with per-crate Docker contexts; member crates ship Cargo.toml only.

github-actions · 2026-06-17T12:58:02Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T13:13:50Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

edition2024 crates such as idna_adapter require a newer toolchain than 1.75/1.82; align attestor, sidecar, egress-firewall, and related images.

Gate on critical CVEs only, ignore SPDX OR GPL expressions, fetch full history for SBOM diff, and make compliance report resilient to missing PR comment permissions.

Use single-platform load on PRs, isolate fuzz crate from workspace, install Lean via elan, exclude optional SDK from rust-tests, and cap criterion smoke runtime.

Use docker compose, batch GPG keygen for DSAR tests, run privacy load via metrics and Rust tests, and align replay low-view threshold with platform defaults.

Admission controller probes expected /healthz on HTTPS; serve it and give probes startup slack so integration installs can become ready.

Emit CI verification log lines from conformance tests, allow post-approval signatures up to N-of-M, and report zero scheduler reorder violations.

Remove unused imports, stabilize hook dependencies, and satisfy CI treat-warnings-as-errors for CodeQL and marketplace builds.

github-actions · 2026-06-18T06:52:12Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Compare replay CERTs per bundle, bump runtime Docker builders to rustc 1.86, run fuzz on nightly, vendor mathlib in policy-gates, and ignore RUSTSEC-2026-0182 for wasmtime 15.x.

github-actions · 2026-06-18T07:03:43Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Fix replay bundle zip paths, set rustup default for cargo-fuzz, bump runtime builders to 1.88 for actix, and fix marketplace Dashboard ledger stats plus passWithNoTests.

github-actions · 2026-06-18T07:05:57Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T09:17:20Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T09:30:26Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T09:47:39Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-18T09:48:41Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

Wire policy-gates DFA export through core/lean-libs ExportDFA, align allowlist and dfa Lean setup with vendored mathlib, make proof-and-comment epoch fetch non-fatal, restore ActionDSL prefix proof, and build egress-firewall images without optional hyperscan on musl.

github-actions · 2026-06-18T09:53:17Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Use generalizing induction and rcases on the LogSpend conjunct so lean-style builds on Lean 4.7.

github-actions · 2026-06-18T09:59:23Z

❌ Allowlist Sync Validation Failed

The runtime allowlist is out of sync with Lean proofs. Please run:

python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.json

Then commit the updated allowlist to ensure runtime configuration matches formal specifications.

github-actions · 2026-06-18T10:09:30Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-18T10:16:01Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T10:26:55Z

❌ Allowlist Sync Validation Failed

The runtime allowlist is out of sync with Lean proofs. Please run:

python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.json

Then commit the updated allowlist to ensure runtime configuration matches formal specifications.

Replace invalid ? placeholders with a generalizing induction proof so lean-style and allowlist-sync Lean builds succeed on Lean 4.7.

Use cluster_name kind so kind load and cleanup target the cluster created by helm/kind-action instead of the default chart-testing name.

Ship prisma schema in the ledger runner image, start index-simple in CI, replace stale ExportDFA with ActionDSL.Safety export, and write real sha256 sidecar after lake exe export.

github-actions · 2026-06-18T11:26:20Z

❌ Allowlist Sync Validation Failed

The runtime allowlist is out of sync with Lean proofs. Please run:

python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.json

Then commit the updated allowlist to ensure runtime configuration matches formal specifications.

github-actions · 2026-06-18T11:26:27Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T11:42:42Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-18T11:45:47Z

❌ Allowlist Sync Validation Failed

The runtime allowlist is out of sync with Lean proofs. Please run:

python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.json

Then commit the updated allowlist to ensure runtime configuration matches formal specifications.

github-actions · 2026-06-18T12:00:48Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T12:14:01Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-18T12:20:56Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

Add a Fabric aggregator module, resolve budget_ok naming conflicts, repair Budget imports, and fix ExportDFA JSON export for the policy gates DFA build.

Require core/lean-libs from my-agent and test-new-user-agent proofs, and replace placeholder my-agent Spec theorems with a proven budget verification theorem.

Regenerate the sidecar allowlist from current Lean sources so allowlist sync validation matches the workspace proof surface.

Generate Prisma client during image build, start index-simple after migrate deploy, and wait for healthy Postgres in CI compose.

Wait for Redis before starting attestor, load local Kind images with Never pull policy, and provision Postgres plus migrations for ledger in pf-ci and rbac workflows.

Add the privacy test names expected by CI and make the load test wait for sidecar metrics before running targeted cargo tests.

github-actions · 2026-06-18T12:37:53Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-18T12:56:31Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

Split Fabric and Budget lake roots so cfg helpers no longer duplicate ActionDSL generics, and restore the main ExportDFA entrypoint for DFA export.

fraware added 2 commits June 17, 2026 02:48

ci: fix replay bundle schema and k6 install on runners

bf97a3e

ci: fix k6 timing header lookup for mock PF server

0254303

fraware added 2 commits June 17, 2026 02:55

ci: fix lowview oracle CLI in replay runner

e539668

ci: fix DFA equivalence cargo test filter

91c4b0f

fraware added 2 commits June 17, 2026 03:58

test(evidence): align KIT trace import test with event schema

3762f39

The simple replay bundle now uses TRACE-REPLAY-KIT event traces with type function_call; update the import assertion accordingly.

ci: install k6 from GitHub release in perf smoke

60f7ef0

Avoid apt/gpg keyserver failures (No dirmngr) on GitHub runners by matching the install path used in slo-gates.

ci: stop requiring Cargo.lock in runtime Rust images

2fb4e12

pf-ci builds with per-crate Docker contexts; member crates ship Cargo.toml only.

fraware added 7 commits June 17, 2026 23:50

ci: bump runtime Rust Docker images to 1.85

9c1fcbe

edition2024 crates such as idna_adapter require a newer toolchain than 1.75/1.82; align attestor, sidecar, egress-firewall, and related images.

ci: harden SBOM gate downstream jobs

4f33e20

Gate on critical CVEs only, ignore SPDX OR GPL expressions, fetch full history for SBOM diff, and make compliance report resilient to missing PR comment permissions.

ci: fix multiarch, fuzz, lean, and bench workflows

fe0409b

Use single-platform load on PRs, isolate fuzz crate from workspace, install Lean via elan, exclude optional SDK from rust-tests, and cap criterion smoke runtime.

ci: fix redteam, privacy, and replay test jobs

b6f5854

Use docker compose, batch GPG keygen for DSAR tests, run privacy load via metrics and Rust tests, and align replay low-view threshold with platform defaults.

fix(admission): add /healthz for Helm readiness

b52c55d

Admission controller probes expected /healthz on HTTPS; serve it and give probes startup slack so integration installs can become ready.

fix: paper-conformance markers and break-glass signatures

d8e08f1

Emit CI verification log lines from conformance tests, allow post-approval signatures up to N-of-M, and report zero scheduler reorder violations.

fix(marketplace/ui): resolve ESLint build failures

c2a4c34

Remove unused imports, stabilize hook dependencies, and satisfy CI treat-warnings-as-errors for CodeQL and marketplace builds.

ci: fix replay oracle, Rust 1.86 images, fuzz nightly, lean vendor

adb662b

Compare replay CERTs per bundle, bump runtime Docker builders to rustc 1.86, run fuzz on nightly, vendor mathlib in policy-gates, and ignore RUSTSEC-2026-0182 for wasmtime 15.x.

ci: Rust 1.88 images, replay zip path, fuzz default nightly

389e306

Fix replay bundle zip paths, set rustup default for cargo-fuzz, bump runtime builders to 1.88 for actix, and fix marketplace Dashboard ledger stats plus passWithNoTests.

proofs: fix ActionDSL prefix-closed lemma

34c4e91

Use generalizing induction and rcases on the LogSpend conjunct so lean-style builds on Lean 4.7.

fraware added 3 commits June 18, 2026 03:33

proofs: repair ActionDSL prefix-closed theorem

11d52e2

Replace invalid ? placeholders with a generalizing induction proof so lean-style and allowlist-sync Lean builds succeed on Lean 4.7.

ci: align heartbeat Kind cluster name

b8e8ee8

Use cluster_name kind so kind load and cleanup target the cluster created by helm/kind-action instead of the default chart-testing name.

ci: fix ledger CI image and ExportDFA on Lean 4.7

22b59c3

Ship prisma schema in the ledger runner image, start index-simple in CI, replace stale ExportDFA with ActionDSL.Safety export, and write real sha256 sidecar after lake exe export.

fraware added 6 commits June 18, 2026 05:28

proofs: fix ExportDFA and Fabric package for Lean 4.7

c47e419

Add a Fabric aggregator module, resolve budget_ok naming conflicts, repair Budget imports, and fix ExportDFA JSON export for the policy gates DFA build.

proofs: wire agent bundles to core Fabric package

11956c9

Require core/lean-libs from my-agent and test-new-user-agent proofs, and replace placeholder my-agent Spec theorems with a proven budget verification theorem.

policy: sync allowlist.json with Lean proof exports

c383f24

Regenerate the sidecar allowlist from current Lean sources so allowlist sync validation matches the workspace proof surface.

runtime: fix ledger CI image startup

4f2941c

Generate Prisma client during image build, start index-simple after migrate deploy, and wait for healthy Postgres in CI compose.

ci: stabilize Kind attestor and ledger deploys

ec53cdf

Wait for Redis before starting attestor, load local Kind images with Never pull policy, and provision Postgres plus migrations for ledger in pf-ci and rbac workflows.

privacy: add CI epsilon guard tests and load retry

aeb811b

Add the privacy test names expected by CI and make the load test wait for sidecar metrics before running targeted cargo tests.

fix(lean): resolve Budget/ActionDSL clashes and restore ExportDFA CLI

297ff90

Split Fabric and Budget lake roots so cfg helpers no longer duplicate ActionDSL generics, and restore the main ExportDFA entrypoint for DFA export.

Conversation

fraware commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fraware commented Jun 17, 2026 •

edited

Loading