Skip to content

[authentication/1.3] Keep operator recovery keys outside server state - #47

Open
omry wants to merge 1 commit into
pr42from
pr47
Open

omry wants to merge 1 commit into
pr42from
pr47

Conversation

@omry

@omry omry commented Oct 20, 2026 •

Copy link
Copy Markdown
Owner

Offline authority initialization now creates or explicitly reuses an operator-held recovery file outside server state. Separate recovery signing and backup decryption keys remain external; the server registers public recovery trust and a separate backup-origin signer in schema 3.

Publish external custody before initialized state. Preserve private material across failed setup and reconcile the exact interrupted hard-link pair without accepting unrelated aliases. Keep runtime authentication and recovery activation for later slices.

Validation: 1257 native Python tests passed, lint/type checks, Go tests/vet, website build, cryptography 42 compatibility, and Python/Go key-format probe passed. DBB and full local review approved the exact candidate after the crash-retry repair. Native Windows CI remains required on the published PR.


Offline authority initialization now creates or explicitly reuses an operator-held recovery file outside server state. Separate recovery signing and backup decryption keys remain external; the server registers public recovery trust and a separate backup-origin signer in schema 3.

Publish external custody before initialized state. Preserve private material across failed setup and reconcile the exact interrupted hard-link pair without accepting unrelated aliases. Keep runtime authentication and recovery activation for later slices.

Validation: 1257 native Python tests passed, lint/type checks, Go tests/vet, website build, cryptography 42 compatibility, and Python/Go key-format probe passed. DBB and full local review approved the exact candidate after the crash-retry repair. Native Windows CI remains required on the published PR.
@omry
omry changed the base branch from main to pr42 October 20, 2026 18:42
@omry
omry added this pull request to stack #43 October 20, 2026 18:42
@gitar-bot

gitar-bot Bot commented Oct 20, 2026 •

Copy link
Copy Markdown
Code Review ✅ Approved

🔴 High risk · Registering recovery-signing and backup-decryption trust could expose backup contents or enable unauthorized identity recovery if operator keys leak.

Offline authority initialization now creates or explicitly reuses an operator-held recovery file outside server state, with the server registering only public recovery trust and a separate backup-origin signer in schema 3. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Oct 20, 2026 •

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:5310faeabb49a8d1ee5a2ac3d594d60620ddb4f7ebfec3b0dcc7e93ed2d2f079",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:95080c8129b4da2db4db318d829532ce16d721ef805c4a756c90a714c0262483",
          "closure_identity": "sha256:bf19ba331a437147b3f5a21c4bc8f9459a90f5f9ee379d23e862968e82ae2f53",
          "document_identity": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
          "sidecar_identity": "sha256:79c904f72e578226e1651232379c453990fac14a2735deda6b872acf2cd1d28c"
        },
        {
          "baseline_identity": "sha256:ad1ec634421f4d4b16b5cb61c07844e945fa11d0737e7e59757b3b3aabbf21ce",
          "closure_identity": "sha256:bf19ba331a437147b3f5a21c4bc8f9459a90f5f9ee379d23e862968e82ae2f53",
          "document_identity": "sha256:c576091af919c3ec99f0e0edb5795cf4e7bd37a44415ae24742393822317ad3d",
          "sidecar_identity": "sha256:3c969d1c7722b7db806221b23c15d19e577c5e6ad472ba56f7714af25d9cba19"
        },
        {
          "closure_identity": "sha256:bf19ba331a437147b3f5a21c4bc8f9459a90f5f9ee379d23e862968e82ae2f53",
          "document_identity": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
          "sidecar_identity": "sha256:b02245b52befcecf939bd2373a16912cad483a5a100c7f5733856cd39b4921b5"
        }
      ],
      "candidate_revision_fingerprint": "sha256:5310faeabb49a8d1ee5a2ac3d594d60620ddb4f7ebfec3b0dcc7e93ed2d2f079",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118818853685
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 118822949627
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 118822949573
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 118822951409
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 118822951194
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 118822949614
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 118822949912
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 118822948122
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 118822948221
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 118822949249
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 118823024859
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 118822948909
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 118823008949
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:2af22156cbf3390466d37031623c328363bb42a7e17a55cb10733e29f060e15a",
      "review_request": {
        "body_digest": "sha256:34ebe7ca58281fe8e608a0da59ae75f125a494ebabf88b8187abeb4c67cc82a6",
        "id": 6298594902
      },
      "review_result": {
        "body_digest": "sha256:8e27f555cf6e72019d909972fcad3eaf0993b954c09f73b26c4526660011396a",
        "id": 6298661756
      }
    },
    "evidence_fingerprint": "sha256:841aa35eb99a34e4cbf49820e04c143abb819f2efbd527a76a9054b72bd9e6d0",
    "head_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
    "operation_identity": "sha256:2af22156cbf3390466d37031623c328363bb42a7e17a55cb10733e29f060e15a",
    "review_request_id": 6298594902,
    "review_result_id": 6298661756,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:5310faeabb49a8d1ee5a2ac3d594d60620ddb4f7ebfec3b0dcc7e93ed2d2f079",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 118818853685
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux arm64",
      "run_id": 118822949627
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux x64",
      "run_id": 118822949573
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows arm64",
      "run_id": 118822951409
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows x64",
      "run_id": 118822951194
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS arm64",
      "run_id": 118822949614
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS x64",
      "run_id": 118822949912
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.10",
      "run_id": 118822948122
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.11",
      "run_id": 118822948221
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.12",
      "run_id": 118822949249
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.14",
      "run_id": 118823024859
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python lint",
      "run_id": 118822948909
    },
    {
      "conclusion": "SUCCESS",
      "name": "Website",
      "run_id": 118823008949
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "name": "Gitar",
          "run_id": 118818853685,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/runs/118818853685"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 118815603177,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603177"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 118815603271,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603271"
        },
        {
          "name": "Platform Windows arm64",
          "run_id": 118815603295,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603295"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 118815602995,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815602995"
        },
        {
          "name": "Platform macOS arm64",
          "run_id": 118815602896,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815602896"
        },
        {
          "name": "Platform macOS x64",
          "run_id": 118815603000,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603000"
        },
        {
          "conclusion": "FAILURE",
          "name": "Python 3.10",
          "run_id": 118815603199,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603199"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 118815603448,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603448"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 118815603631,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603631"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 118815603062,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815603062"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 118815602957,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815602957"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 118815602683,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118815602683"
        }
      ],
      "head_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "id": "sha256:bd17b525af969c32de58487e90a4088305cbd9859cd53ae54031474b3c4a9185",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "failure"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118818853685,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/118818853685"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 118822949627,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822949627"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 118822949573,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822949573"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 118822951409,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822951409"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 118822951194,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822951194"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 118822949614,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822949614"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 118822949912,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822949912"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 118822948122,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822948122"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 118822948221,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822948221"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 118822949249,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822949249"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 118823024859,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118823024859"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 118822948909,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118822948909"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 118823008949,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39477049113/job/118823008949"
        }
      ],
      "head_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "id": "sha256:caeaac136d7d0a03ffd118a504fb8f83205fc93cb7fac228bd6a980e8288ffb3",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr42",
    "base_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
    "body_digest": "sha256:9d3572a9d4a6f37ba941d37d702c769d3fbc75e2ee29f18cc73842010ccd12e2",
    "diff_digest": "sha256:daf389b1e9a3b5f67b1d0ae29f18f7d438815e62261960c241e26b21bc7b8daa",
    "head_ref": "pr47",
    "head_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
    "pr": 47,
    "repository": "omry/arbiter",
    "scope_authority": [
      {
        "digest": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
        "path": "docs/authentication/high-level-design.md"
      },
      {
        "digest": "sha256:c576091af919c3ec99f0e0edb5795cf4e7bd37a44415ae24742393822317ad3d",
        "path": "docs/authentication/implementation-plan.md"
      },
      {
        "digest": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
        "path": "docs/authentication/requirements.md"
      }
    ],
    "title_digest": "sha256:9dae6a261968db27e8ae4a77b9ac2404c5acd6b8ffbe0a88b300a9bc0a06ce36"
  },
  "record_version": 6,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-20T18:42:08Z",
      "base_ref": "pr42",
      "base_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "body_digest": "sha256:34ebe7ca58281fe8e608a0da59ae75f125a494ebabf88b8187abeb4c67cc82a6",
      "created_at": "2026-10-20T18:49:28Z",
      "head_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "id": 6298594902,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr42",
      "base_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "body_digest": "sha256:8e27f555cf6e72019d909972fcad3eaf0993b954c09f73b26c4526660011396a",
      "commit_id": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "id": 6298661756,
      "inline_message_ids": [],
      "request_comment_id": 6298594902,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-20T18:52:35Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:5310faeabb49a8d1ee5a2ac3d594d60620ddb4f7ebfec3b0dcc7e93ed2d2f079",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:daf389b1e9a3b5f67b1d0ae29f18f7d438815e62261960c241e26b21bc7b8daa",
      "finding_ids": [],
      "invariants": [
        "External operator private keys stay outside server state; exact reviewed custody/public-trust setup remains unchanged",
        "All selected CI must succeed before approval"
      ],
      "outcome": "same-head-needs-retry",
      "proposed_fix_paths": [],
      "resulting_head": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "review_observation_id": null,
      "review_request_id": 6298594902,
      "review_result_id": 6298661756,
      "reviewed_head": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "root_cause": "Remote code review clean. Python3.10 CI hit unchanged cancellation-capacity test two-second timeout; exacttest and full native3.10 suite pass, no1.3 defect reproduced. Treat as retryable CI observation, retain failure and demand successful remote retry. No source correction or synchronization.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:daf389b1e9a3b5f67b1d0ae29f18f7d438815e62261960c241e26b21bc7b8daa",
      "finding_ids": [],
      "invariants": [
        "External operator private keys stay outside server state; exact reviewed custody/public-trust setup remains unchanged",
        "All selected CI must succeed before approval"
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "review_observation_id": null,
      "review_request_id": 6298594902,
      "review_result_id": 6298661756,
      "reviewed_head": "823f498776bb9e7a8799e7518929f4470ad65a19",
      "root_cause": "No source findings or changes. Exact clean remote review remains attributable and current; full local validation passes; all13 latest applicableCI nowpass including successfulPython3.10retry; exact committed-byteDBBfinalvalidation dischargesWindowscondition. No sourcecorrection or synchronization.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 20, 2026 18:47
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-20T18:52:37.163833Z 823f498 Manual request
🔒 Security Review ✅ Completed 2026-10-20T18:55:20.050585Z 823f498 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 20, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review 823f498

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 823f498776

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved PR passed review and required checks

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant