Bind lifecycle operability evidence to deployment authority

[seonghobae]

Problem

#561 now has deterministic remote Durable Object operability evidence validation on protected main, but that evaluator explicitly validates evidence self-consistency only. Shape-valid lifecycle metrics can therefore be fabricated unless the retained evidence is bound to the canonical immutable deployment and to an independently verified evidence artifact.

RED → causal repair

This lane started from protected main@86fa0b2f662adc18f75a34e0fd1ff9682decaa4b with a regression requiring a provenance-bound evaluator; protected source had no such function.

The repair now:

• keeps evaluateExternalExtensionLifecycleOperabilityEvidence as the lifecycle content/denominator/recovery validator;
• reuses evaluateAcquisitionDeploymentEvidence as the single canonical release/deployment/governance/Sigstore authority rather than copying its truth;
• requires lifecycle protected_main_sha and deployed_worker_sha to equal the exact canonical deployment commit;
• requires a separately computed retained-byte SHA-256 and a trusted-workflow lifecycle verification receipt bound to the same release tag, commit and deployment workflow run;
• fails closed for deployment authority failure, revision mismatch, evidence digest mismatch, or signer/predicate/OIDC/workflow mismatch.

The first implementation revision that only matched lifecycle SHA to deployment SHA was reviewed as insufficient because an attacker could forge metrics while reusing the real deployed SHA. The current exact adds the independent lifecycle-artifact receipt boundary instead of treating a matching commit string as producer authentication.

Remaining acceptance

This Draft does not close #561 and does not claim production deployment or release readiness. A descriptor-safe CLI/producer path still must compute the lifecycle evidence SHA-256 from the exact retained bytes, obtain/retain the cryptographic verification receipt, and then feed this gate. Actual remote Durable Object p95/storage/contention/recovery evidence tied to a real immutable release remains required.

Summary by CodeRabbit

• 새 기능

  • 외부 확장 수명주기 운영성 증거를 배포 권한 및 검증된 증명 영수증과 연계해 검증합니다.
  • 배포 커밋, 증거 무결성, 릴리스 출처, 서명 워크플로 및 실행 정보를 종합적으로 확인하고 결과와 실패 내역을 제공합니다.

• 테스트

  • 정상적인 배포 증거를 수락하고 커밋·다이제스트 불일치, 출처 오류 및 신뢰할 수 없는 서명자를 거부하는 검증을 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8c079778-15ad-459d-b5c9-7503560c0cf8

📥 Commits

Reviewing files that changed from the base of the PR and between 86fa0b2 and 5b55ba6.

📒 Files selected for processing (2)

• scripts/lib/external-extension-lifecycle-deployment-authority.mjs
• test/external-extension-lifecycle-operability-provenance.test.ts

---

📝 Walkthrough

Walkthrough

외부 확장 수명주기 증거를 배포 권한과 검증된 영수증에 연결하는 평가 함수를 추가했습니다. 배포 커밋, digest, 릴리스 provenance, 서명 워크플로 불일치와 정상 결합을 검증하는 테스트를 추가했습니다.

Changes

외부 확장 증명서 기반 운영성 검증

Layer / File(s)	Summary
배포 권한 결합 평가 scripts/lib/external-extension-lifecycle-deployment-authority.mjs	수명주기 증거와 인수 배포 권한을 평가합니다. 배포 revision, 커밋 SHA, 영수증 스키마, 검증 상태, 저장소, 릴리스 태그, digest, 서명 워크플로 및 OIDC 정보를 검증합니다. 결과는 최대 12개의 실패 코드와 함께 PASS 또는 FAIL로 반환됩니다.
증명서 결합 검증 test/external-extension-lifecycle-operability-provenance.test.ts	정상적인 증명서 결합을 통과시킵니다. 커밋, digest, 릴리스 태그 및 신뢰된 서명 워크플로 불일치를 실패로 처리하는지 검증합니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant DeploymentAuthorityEvaluator
  participant LifecycleEvidenceEvaluator
  participant AttestationReceipt
  Caller->>DeploymentAuthorityEvaluator: 배포 권한 및 배포 증거 전달
  DeploymentAuthorityEvaluator-->>Caller: 배포 권한 평가 결과
  Caller->>LifecycleEvidenceEvaluator: 수명주기 증거 평가
  LifecycleEvidenceEvaluator->>AttestationReceipt: 영수증 필드 일치 여부 검증
  AttestationReceipt-->>LifecycleEvidenceEvaluator: 영수증 검사 결과
  LifecycleEvidenceEvaluator-->>Caller: PASS 또는 FAIL와 실패 코드 반환

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gap/lifecycle-operability-provenance-binding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}