Skip to content

feat(sensitive): record credential-free handle lifecycle evidence - #45

Open
seonghobae wants to merge 30 commits into
mainfrom
feat/sensitive-handle-lifecycle-evidence
Open

feat(sensitive): record credential-free handle lifecycle evidence#45
seonghobae wants to merge 30 commits into
mainfrom
feat/sensitive-handle-lifecycle-evidence

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Partial implementation of #10.

Buyer/security gap

The lifecycle value must remain inseparable from the exact credential-free SensitiveAccessEvidence receipt that authorized opaque-handle use, and derived handle authority must not outlive an explicit retention deadline on that receipt. Review also exposed the audit-boundary case where revocation at the exact expiry second must remain recordable without extending authority.

Implemented boundary

The current branch:

  • embeds the complete credential-free SensitiveAccessEvidence receipt in lifecycle input/evidence;
  • accepts lifecycle issuance only for an exact OpaqueHandleOnly access decision;
  • requires handle issuance at or after the trusted access-decision epoch;
  • enforces positive lifetime, nonzero maximum uses, and resolution_count <= maximum_uses;
  • when the retained access receipt has retention_deadline_epoch_seconds, requires handle expiry to be at or before that deadline so derived opaque authority cannot outlive its governing receipt;
  • accepts revocation from issuance through the exact expiry second, while rejecting revocation before issuance or after expiry;
  • derives request/decision identity from the retained receipt; and
  • stores neither the opaque handle token nor the protected value.

Test-first lineage

The access-receipt binding repair was established with formatted RED head 8f6dd06cc5c585c82bd80e5db63c96b92f078ae2 and CI 32733942382 / Rust job 97452317960, which failed at the missing production API boundary before the receipt-binding implementation landed.

The exact-expiry revocation regression was established at test-only head 6643516aae6574d0b780d0ff4d255d6ba6d38bd9; CI 32741131834 / Rust job 97475604577 reached the intended RED with InvalidLifecycle. Current code accepts issued <= revoked <= expires only as lifecycle/audit evidence; values after expiry remain fail closed.

The later retention-boundary review was resolved by changing production behavior rather than by treating receipt and handle lifetimes as independent: current code caps expires_epoch_seconds at the receipt retention deadline when one exists. The current informational review confirms revocation remains transitively inside that deadline because revocation is bounded by handle expiry.

Exact-current state and evidence

Protected main is exact b05d5acca82b9d916ada2c8e82f59f92a89817e1. Current unchanged contributor head is exact 4b1a99a0e0373fd232f8ebb5dc77e0e144642312; GitHub reports the PR open, Ready, and mergeable against that live base.

On this exact head:

  • CI 32813260113: success;
  • Rust contracts job 97696578001: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success;
  • Production coverage job 97696577660: success, including exact owned-production function/line/region/branch enforcement;
  • exact coverage artifact 9550566160, exact-coverage-4b1a99a0e0373fd232f8ebb5dc77e0e144642312, digest sha256:893f0e0099306cb2b55a1c865488d856c646c0b34ba043b2805e7adcfad7a5f6;
  • SAST Semgrep 32813260146: success;
  • Security Scan 32813260152: success; and
  • all current inline review threads are resolved.

The skipped nightly materializer is not passing evidence. Formal review history contains automated comments and predecessor-head OpenCode change requests; there is no qualifying independent current-head APPROVED review. No predecessor, skipped, cancelled, absent, stale, synthetic, status-only, or model-only evidence is promoted.

Explicit non-scope

This remains credential-free evidence, not the trusted broker. It does not implement opaque-handle token storage, protected-value storage/encryption/KMS, protected-value resolution/fill, durable/cross-process transactionality, authenticated workload identity, atomic reservation/enforcement, model/provider/region disclosure policy, or durable hash-chained audit persistence. Those controls remain open under #10.

Protected-main AGENTS.md prohibits this scheduled writer from merging, self-approving, altering workflows, adding secrets, weakening checks, force-pushing, destructively rebasing, tagging, or publishing. This PR must not close #10 or be called shipped before protected integration and all applicable unchanged-head gates pass together.

@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d82a7759-fc43-4cd5-bc02-da487ec69a52

📥 Commits

Reviewing files that changed from the base of the PR and between bf20f31 and 6e615ec.

📒 Files selected for processing (1)
  • crates/originweave-evidence/src/sensitive_access.rs
🚧 Files skipped from review as they are similar to previous changes (1)
  • crates/originweave-evidence/src/sensitive_access.rs

📝 Walkthrough

Walkthrough

민감 핸들의 발급, 만료, 사용량, 해지 상태를 기록하는 증거 타입을 추가했다. 입력 검증과 상태 조회 API를 제공한다. 식별자와 수명주기 범위 오류 및 민감값 비노출을 테스트한다.

Changes

민감 핸들 수명주기 증거

Layer / File(s) Summary
수명주기 증거 계약
crates/originweave-evidence/src/sensitive_handle_lifecycle.rs, crates/originweave-evidence/src/lib.rs
SensitiveHandleLifecycleEvidenceInputSensitiveHandleLifecycleEvidence를 추가했다. 식별자, 시간, 사용량, 해지 상태 조회 메서드를 crate 루트에서 공개했다.
입력 검증 및 생성
crates/originweave-evidence/src/sensitive_access.rs, crates/originweave-evidence/src/sensitive_handle_lifecycle.rs
valid_identifier를 crate 내부에서 사용할 수 있도록 변경했다. 식별자와 발급·만료 시간, 사용량, 해지 시간을 검증한다. 검증 실패 시 InvalidIdentifier 또는 InvalidLifecycle 오류를 반환한다.
수명주기 검증 테스트
crates/originweave-evidence/tests/sensitive_handle_lifecycle_evidence.rs
정상 변환과 상태 조회를 검증한다. 민감값 비노출과 잘못된 식별자, 시간, 사용량, 해지 시간의 거부를 검증한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Mergeability Score: ⚪ Minimal · up to 6e615

This localized evidence-only change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Possibly related PRs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning [#10]의 가치 비저장 수명 주기 증거 일부는 구현했지만 권한 부여, 저장, 암호화, 집행 등 핵심 목표는 구현하지 않았습니다. PR을 #10의 부분 구현으로 명확히 분리하거나, 미구현된 권한 부여·저장·암호화·집행 요구사항을 추가로 구현하세요.
✅ Passed checks (4 passed)
Check name Status Explanation
Out of Scope Changes check ✅ Passed 변경 사항은 민감한 핸들의 수명 주기 증거 타입, 검증 보조 함수, 관련 테스트 범위에 한정됩니다.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 민감한 핸들의 자격 증명 없는 수명 주기 증거 기록이라는 주요 변경 사항을 정확하고 간결하게 설명합니다.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/sensitive-handle-lifecycle-evidence

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae seonghobae changed the title test(sensitive): add handle lifecycle evidence contract feat(sensitive): record credential-free handle lifecycle evidence Aug 10, 2026
coderabbitai[bot]

This comment was marked as resolved.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b.

  • Head SHA: 6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b

  • Workflow run: 31695895087

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 4b1a99a0e0373fd232f8ebb5dc77e0e144642312
  • Workflow run: 32966308213
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 4b1a99a0e0373fd232f8ebb5dc77e0e144642312.

  • Head SHA: 4b1a99a0e0373fd232f8ebb5dc77e0e144642312

  • Workflow run: 32966308213

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (6 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (6 files)"]
  R1 --> V1["required checks"]
Loading

Copy link
Copy Markdown
Contributor Author

@opencode-agent

Fresh exact-head review requested for 6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b. The currently returned formal CHANGES_REQUESTED is bound to this same head but cites a prior coverage-evidence failure; the current exact-head check inventory now returns coverage-evidence and opencode-review as completed success. Re-evaluate the exact current head without transferring predecessor or status-only evidence, and preserve fail-closed review/approval semantics.

@cursor

cursor Bot commented Aug 16, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@seonghobae
seonghobae dismissed opencode-agent[bot]’s stale review August 17, 2026 00:19

Dismissed as predecessor-head infrastructure evidence after fresh exact-head revalidation. The review evaluated head 6e615ec and requested changes solely because coverage-evidence failed. Current PR head is dbd2342; its coverage-evidence check 95236160868 and opencode-review check 95238407732 both completed successfully. This dismissal does not create or substitute for the independent current-head/latest-push APPROVED review required by live organization ruleset 18156473.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head dbd23423ac4eb1f5ffb8a9e4d81861d09bb0c2a0.

  • Head SHA: dbd23423ac4eb1f5ffb8a9e4d81861d09bb0c2a0

  • Workflow run: 32042551936

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]
Loading

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 604ed74ba5b3a54c2aa7155bf1379c8f10245a9f.

  • Head SHA: 604ed74ba5b3a54c2aa7155bf1379c8f10245a9f

  • Workflow run: 32796079389

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (6 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (6 files)"]
  R1 --> V1["required checks"]
Loading

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

Open in Devin Review

Comment thread crates/originweave-evidence/src/sensitive_handle_lifecycle.rs

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 4b1a99a0e0373fd232f8ebb5dc77e0e144642312.

  • Head SHA: 4b1a99a0e0373fd232f8ebb5dc77e0e144642312

  • Workflow run: 32966308213

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (6 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (6 files)"]
  R1 --> V1["required checks"]
Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Enterprise Gap] Preserve operational PII through policy-bound disclosure instead of blanket masking

1 participant