b2release

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 17, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const FallbackDrillSchema = "agentsql.b2.protocol3-fallback-drill/v1"
View Source 
const GateEvidenceSchema = "agentsql.b2.ga-evidence/v1"

Variables

View Source 
var RequiredFallbackScenarios = []FallbackScenario{
	ScenarioRuntimeMissing,
	ScenarioExtensionMissing,
	ScenarioAttestationMismatch,
	ScenarioLeaseLost,
	ScenarioActivationFailed,
	ScenarioNativeUnhealthy,
	ScenarioShadowDivergence,
}

Functions

func VerifyFallbackEvidence 

func VerifyFallbackEvidence(evidencePath string, evidence *GateEvidence, trustedPublicKey string) error

VerifyFallbackEvidence cryptographically binds the drill to its report. Relative report paths are resolved next to the GA evidence file.

func VerifyReferencedArtifacts 

func VerifyReferencedArtifacts(evidencePath string, evidence *GateEvidence) []error

VerifyReferencedArtifacts refuses checkbox-only evidence. Attack and SLO entries must point to parseable, passing reports whose raw file digest is the digest recorded in the release manifest.

Types

type ActivationEvidence 

type ActivationEvidence struct {
	DryRunObserved       bool   `json:"dry_run_observed"`
	TwoPhaseVerified     bool   `json:"two_phase_verified"`
	StrongETag           string `json:"strong_etag,omitempty"`
	CapabilityProbe      bool   `json:"capability_probe"`
	StagingRows          int64  `json:"staging_rows"`
	WildcardPolicies     int64  `json:"wildcard_policies"`
	UnhealthyEnrollments int64  `json:"unhealthy_enrollments"`
	MySQLEnabled         bool   `json:"mysql_enabled"`
	MySQLWatcherReady    bool   `json:"mysql_watcher_ready"`
	MySQLInspectorReady  bool   `json:"mysql_inspector_ready"`
	MySQLThreatAccepted  bool   `json:"mysql_threat_model_accepted"`
}

type ArtifactEvidence 

type ArtifactEvidence struct {
	Protocol3BundleComplete bool     `json:"protocol3_bundle_complete"`
	Signed                  bool     `json:"signed"`
	SBOM                    bool     `json:"sbom"`
	Provenance              bool     `json:"provenance"`
	Versions                []string `json:"versions,omitempty"`
}

type EvidenceItem 

type EvidenceItem struct {
	Complete bool   `json:"complete"`
	Artifact string `json:"artifact,omitempty"`
	Digest   string `json:"digest,omitempty"`
}

type FallbackCase 

type FallbackCase struct {
	Scenario              FallbackScenario `json:"scenario"`
	ObservedRoute         FallbackRoute    `json:"observed_route"`
	ExpectedRoute         FallbackRoute    `json:"expected_route"`
	AttestationID         string           `json:"attestation_id"`
	NoSilentAllow         bool             `json:"no_silent_allow"`
	NoUnauthorizedColumns bool             `json:"no_unauthorized_columns"`
	Recovered             bool             `json:"recovered"`
	Reactivated           bool             `json:"reactivated"`
	Passed                bool             `json:"passed"`
}

type FallbackDrillReport 

type FallbackDrillReport struct {
	Schema         string         `json:"schema"`
	CreatedAt      time.Time      `json:"created_at"`
	ArtifactDigest string         `json:"artifact_digest"`
	Cases          []FallbackCase `json:"cases"`
	Passed         bool           `json:"passed"`
	EvidenceID     string         `json:"evidence_id"`
	SignerKeyID    string         `json:"signer_key_id"`
	Signature      string         `json:"signature"`
}

func BuildFallbackDrill 

func BuildFallbackDrill(artifactDigest string, createdAt time.Time, cases []FallbackCase) (FallbackDrillReport, error)

func (*FallbackDrillReport) Sign 

func (report *FallbackDrillReport) Sign(privateKey ed25519.PrivateKey) error

func (FallbackDrillReport) Verify 

func (report FallbackDrillReport) Verify(publicKey ed25519.PublicKey) error

type FallbackRoute 

type FallbackRoute string
const (
	RouteClosed     FallbackRoute = "closed"
	RouteTableLevel FallbackRoute = "table_level"
	RouteFailClosed FallbackRoute = "fail_closed"
)

func ExpectedFallback 

func ExpectedFallback(scenario FallbackScenario) FallbackRoute

ExpectedFallback encodes the asymmetric safety rule. A missing runtime or failed activation is allowed to preserve the pre-existing table-level path only before B2 classification. Once protocol 3 was active, lease loss must remain on the B2 route and fail closed. Native-only faults may use the independently attested closed subset; divergence itself is never allowed.

type FallbackScenario 

type FallbackScenario string
const (
	ScenarioRuntimeMissing      FallbackScenario = "protocol3_runtime_missing"
	ScenarioExtensionMissing    FallbackScenario = "native_extension_missing"
	ScenarioAttestationMismatch FallbackScenario = "native_version_or_hash_mismatch"
	ScenarioLeaseLost           FallbackScenario = "heartbeat_or_lease_lost"
	ScenarioActivationFailed    FallbackScenario = "activation_failed"
	ScenarioNativeUnhealthy     FallbackScenario = "native_unhealthy"
	ScenarioShadowDivergence    FallbackScenario = "shadow_divergence"
)

type GateEvidence 

type GateEvidence struct {
	Schema             string             `json:"schema"`
	GeneratedAt        time.Time          `json:"generated_at"`
	Commit             string             `json:"commit"`
	Version            string             `json:"version"`
	ProductionFlagsOff bool               `json:"production_flags_off"`
	ZeroUnauthorized   bool               `json:"zero_unauthorized_references"`
	AttackMatrix       EvidenceItem       `json:"attack_matrix"`
	SLO                EvidenceItem       `json:"slo"`
	Fallback           EvidenceItem       `json:"fallback"`
	Activation         ActivationEvidence `json:"activation"`
	Artifacts          ArtifactEvidence   `json:"artifacts"`
	M2SignedOff        bool               `json:"m2_signed_off"`
	M3SignedOff        bool               `json:"m3_signed_off"`
	VersionBumped      bool               `json:"version_bumped"`
	ReleaseBundleReady bool               `json:"release_bundle_ready"`
}

func LoadEvidence 

func LoadEvidence(path string) (GateEvidence, error)

type GateMode 

type GateMode string
const (
	GateModeDryRun     GateMode = "dry-run"
	GateModeActivation GateMode = "activation"
	GateModeGA         GateMode = "ga"
)

type GateResult 

type GateResult struct {
	Schema      string    `json:"schema"`
	EvaluatedAt time.Time `json:"evaluated_at"`
	Mode        GateMode  `json:"mode"`
	Conclusion  string    `json:"conclusion"`
	Ready       bool      `json:"ready"`
	Mutated     bool      `json:"mutated"`
	Missing     []string  `json:"missing,omitempty"`
	Disclaimer  string    `json:"disclaimer"`
}

func Evaluate 

func Evaluate(evidence GateEvidence, mode GateMode, now time.Time) GateResult

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.