Help us shape the future of Go! Take the 2026 Go Developer Survey

b2release

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const FallbackDrillSchema = "agentsql.b2.protocol3-fallback-drill/v1"
View Source 
const GateEvidenceSchema = "agentsql.b2.ga-evidence/v1"

Variables

View Source 
var RequiredFallbackScenarios = []FallbackScenario{
	ScenarioRuntimeMissing,
	ScenarioExtensionMissing,
	ScenarioAttestationMismatch,
	ScenarioLeaseLost,
	ScenarioActivationFailed,
	ScenarioNativeUnhealthy,
	ScenarioShadowDivergence,
}

Functions

func VerifyFallbackEvidence 

func VerifyFallbackEvidence(evidencePath string, evidence *GateEvidence, trustedPublicKey string) error

VerifyFallbackEvidence cryptographically binds the drill to its report. Relative report paths are resolved next to the GA evidence file.

func VerifyReferencedArtifacts 

func VerifyReferencedArtifacts(evidencePath string, evidence *GateEvidence) []error

VerifyReferencedArtifacts refuses checkbox-only evidence. Attack and SLO entries must point to parseable, passing reports whose raw file digest is the digest recorded in the release manifest.

Types

type ActivationEvidence 

type ActivationEvidence struct {
	DryRunObserved       bool   `json:"dry_run_observed"`
	TwoPhaseVerified     bool   `json:"two_phase_verified"`
	StrongETag           string `json:"strong_etag,omitempty"`
	CapabilityProbe      bool   `json:"capability_probe"`
	StagingRows          int64  `json:"staging_rows"`
	WildcardPolicies     int64  `json:"wildcard_policies"`
	UnhealthyEnrollments int64  `json:"unhealthy_enrollments"`
	MySQLEnabled         bool   `json:"mysql_enabled"`
	MySQLWatcherReady    bool   `json:"mysql_watcher_ready"`
	MySQLInspectorReady  bool   `json:"mysql_inspector_ready"`
	MySQLThreatAccepted  bool   `json:"mysql_threat_model_accepted"`
}

type ArtifactEvidence 

type ArtifactEvidence struct {
	Protocol3BundleComplete bool     `json:"protocol3_bundle_complete"`
	Signed                  bool     `json:"signed"`
	SBOM                    bool     `json:"sbom"`
	Provenance              bool     `json:"provenance"`
	Versions                []string `json:"versions,omitempty"`
}

type EvidenceItem 

type EvidenceItem struct {
	Complete bool   `json:"complete"`
	Artifact string `json:"artifact,omitempty"`
	Digest   string `json:"digest,omitempty"`
}

type FallbackCase 

type FallbackCase struct {
	Scenario              FallbackScenario `json:"scenario"`
	ObservedRoute         FallbackRoute    `json:"observed_route"`
	ExpectedRoute         FallbackRoute    `json:"expected_route"`
	AttestationID         string           `json:"attestation_id"`
	NoSilentAllow         bool             `json:"no_silent_allow"`
	NoUnauthorizedColumns bool             `json:"no_unauthorized_columns"`
	Recovered             bool             `json:"recovered"`
	Reactivated           bool             `json:"reactivated"`
	Passed                bool             `json:"passed"`
}

type FallbackDrillReport 

type FallbackDrillReport struct {
	Schema         string         `json:"schema"`
	CreatedAt      time.Time      `json:"created_at"`
	ArtifactDigest string         `json:"artifact_digest"`
	Cases          []FallbackCase `json:"cases"`
	Passed         bool           `json:"passed"`
	EvidenceID     string         `json:"evidence_id"`
	SignerKeyID    string         `json:"signer_key_id"`
	Signature      string         `json:"signature"`
}

func BuildFallbackDrill 

func BuildFallbackDrill(artifactDigest string, createdAt time.Time, cases []FallbackCase) (FallbackDrillReport, error)

func (*FallbackDrillReport) Sign 

func (report *FallbackDrillReport) Sign(privateKey ed25519.PrivateKey) error

func (FallbackDrillReport) Verify 

func (report FallbackDrillReport) Verify(publicKey ed25519.PublicKey) error

type FallbackRoute 

type FallbackRoute string
const (
	RouteClosed     FallbackRoute = "closed"
	RouteTableLevel FallbackRoute = "table_level"
	RouteFailClosed FallbackRoute = "fail_closed"
)

func ExpectedFallback 

func ExpectedFallback(scenario FallbackScenario) FallbackRoute

ExpectedFallback encodes the asymmetric safety rule. A missing runtime or failed activation is allowed to preserve the pre-existing table-level path only before B2 classification. Once protocol 3 was active, lease loss must remain on the B2 route and fail closed. Native-only faults may use the independently attested closed subset; divergence itself is never allowed.

type FallbackScenario 

type FallbackScenario string
const (
	ScenarioRuntimeMissing      FallbackScenario = "protocol3_runtime_missing"
	ScenarioExtensionMissing    FallbackScenario = "native_extension_missing"
	ScenarioAttestationMismatch FallbackScenario = "native_version_or_hash_mismatch"
	ScenarioLeaseLost           FallbackScenario = "heartbeat_or_lease_lost"
	ScenarioActivationFailed    FallbackScenario = "activation_failed"
	ScenarioNativeUnhealthy     FallbackScenario = "native_unhealthy"
	ScenarioShadowDivergence    FallbackScenario = "shadow_divergence"
)

type GateEvidence 

type GateEvidence struct {
	Schema             string             `json:"schema"`
	GeneratedAt        time.Time          `json:"generated_at"`
	Commit             string             `json:"commit"`
	Version            string             `json:"version"`
	ProductionFlagsOff bool               `json:"production_flags_off"`
	ZeroUnauthorized   bool               `json:"zero_unauthorized_references"`
	AttackMatrix       EvidenceItem       `json:"attack_matrix"`
	SLO                EvidenceItem       `json:"slo"`
	Fallback           EvidenceItem       `json:"fallback"`
	Activation         ActivationEvidence `json:"activation"`
	Artifacts          ArtifactEvidence   `json:"artifacts"`
	M2SignedOff        bool               `json:"m2_signed_off"`
	M3SignedOff        bool               `json:"m3_signed_off"`
	VersionBumped      bool               `json:"version_bumped"`
	ReleaseBundleReady bool               `json:"release_bundle_ready"`
}

func LoadEvidence 

func LoadEvidence(path string) (GateEvidence, error)

type GateMode 

type GateMode string
const (
	GateModeDryRun     GateMode = "dry-run"
	GateModeActivation GateMode = "activation"
	GateModeGA         GateMode = "ga"
)

type GateResult 

type GateResult struct {
	Schema      string    `json:"schema"`
	EvaluatedAt time.Time `json:"evaluated_at"`
	Mode        GateMode  `json:"mode"`
	Conclusion  string    `json:"conclusion"`
	Ready       bool      `json:"ready"`
	Mutated     bool      `json:"mutated"`
	Missing     []string  `json:"missing,omitempty"`
	Disclaimer  string    `json:"disclaimer"`
}

func Evaluate 

func Evaluate(evidence GateEvidence, mode GateMode, now time.Time) GateResult

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.