Skip to content

Commit a69df81

Browse files
JacobinwweyJacobinwwey
committed
update a lot
1 parent 1eb7f5c commit a69df81

44 files changed

Lines changed: 23292 additions & 969 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/migration-gates.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ jobs:
2626
command: npm run test:tauri
2727
- suite: mobile-pipeline-contract-suite
2828
command: npm run test:mobile:contracts
29+
- suite: pathbridge-strict-schema-suite
30+
command: npm run verify:pathbridge:strict
31+
- suite: sbom-policy-contract-suite
32+
command: npm run verify:sbom -- --contract-only
33+
- suite: sbom-attestation-policy-contract-suite
34+
command: npm run verify:sbom:attestation -- --contract-only
2935
- suite: sidecar-signature-policy-contract-suite
3036
command: npm run verify:sidecar:signatures -- --contract-only
3137

@@ -42,6 +48,13 @@ jobs:
4248
- name: Install dependencies
4349
run: npm ci
4450

51+
- name: Setup Java 21
52+
if: matrix.suite == 'tauri-rust-suite'
53+
uses: actions/setup-java@v5
54+
with:
55+
distribution: temurin
56+
java-version: '21'
57+
4558
- name: Setup Rust toolchain
4659
if: matrix.suite == 'tauri-rust-suite'
4760
shell: pwsh

‎.github/workflows/npm-publish.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,20 @@ on:
99

1010
env:
1111
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
12+
NOTE_CONNECTION_SBOM_ATTESTATION_KEY_ID: ${{ secrets.SBOM_SIGNING_KEY_ID }}
13+
NOTE_CONNECTION_SBOM_SIGNING_PRIVATE_KEY_PEM: ${{ secrets.SBOM_SIGNING_PRIVATE_KEY_PEM }}
14+
NOTE_CONNECTION_SBOM_SIGNING_PUBLIC_KEY_PEM: ${{ secrets.SBOM_SIGNING_PUBLIC_KEY_PEM }}
15+
NOTE_CONNECTION_SBOM_ATTESTATION_ALLOWED_KEY_IDS: ${{ secrets.SBOM_SIGNING_ALLOWED_KEY_IDS }}
16+
NOTE_CONNECTION_SBOM_ATTESTATION_REVOKED_KEY_IDS: ${{ secrets.SBOM_SIGNING_REVOKED_KEY_IDS }}
17+
NOTE_CONNECTION_SBOM_ATTESTATION_MIN_RSA_BITS: "2048"
18+
NOTE_CONNECTION_SBOM_ATTESTATION_MIN_ROTATION_OVERLAP_HOURS: "24"
19+
NOTE_CONNECTION_SBOM_ATTESTATION_ENABLE_TRANSPARENCY_LOG: "true"
20+
NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_LOG_PATH: "build/sbom/attestation-transparency-log.jsonl"
21+
NOTE_CONNECTION_RELEASE_COMMIT_SHA: ${{ github.sha }}
22+
NOTE_CONNECTION_RELEASE_GIT_TAG: ${{ github.ref_name }}
23+
NOTE_CONNECTION_RELEASE_REF: ${{ github.ref }}
24+
NOTE_CONNECTION_RELEASE_RUN_ID: ${{ github.run_id }}
25+
NOTE_CONNECTION_RELEASE_REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
1226

1327
jobs:
1428
publish:
@@ -31,6 +45,81 @@ jobs:
3145
- name: Build
3246
run: npm run build
3347

48+
- name: Generate release SBOM
49+
run: npm run generate:sbom
50+
51+
- name: Verify SBOM policy gate
52+
run: npm run verify:sbom -- --strict 1
53+
54+
- name: Validate SBOM signing key pair configuration
55+
shell: bash
56+
run: |
57+
KEY_ID="$(printf '%s' "${NOTE_CONNECTION_SBOM_ATTESTATION_KEY_ID}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
58+
ALLOWED_KEY_IDS="$(printf '%s' "${NOTE_CONNECTION_SBOM_ATTESTATION_ALLOWED_KEY_IDS}" | tr -d '[:space:]')"
59+
REVOKED_KEY_IDS="$(printf '%s' "${NOTE_CONNECTION_SBOM_ATTESTATION_REVOKED_KEY_IDS}" | tr -d '[:space:]')"
60+
61+
if [ -n "${NOTE_CONNECTION_SBOM_SIGNING_PRIVATE_KEY_PEM}" ] && [ -z "${NOTE_CONNECTION_SBOM_SIGNING_PUBLIC_KEY_PEM}" ]; then
62+
echo "SBOM signing configuration is invalid: private key is set but public key is missing." >&2
63+
exit 1
64+
fi
65+
if [ -z "${NOTE_CONNECTION_SBOM_SIGNING_PRIVATE_KEY_PEM}" ] && [ -n "${NOTE_CONNECTION_SBOM_SIGNING_PUBLIC_KEY_PEM}" ]; then
66+
echo "SBOM signing configuration is invalid: public key is set but private key is missing." >&2
67+
exit 1
68+
fi
69+
if [ -n "${NOTE_CONNECTION_SBOM_SIGNING_PRIVATE_KEY_PEM}" ] && [ -z "${KEY_ID}" ]; then
70+
echo "SBOM signing configuration is invalid: signing key-id is required when signing keys are set." >&2
71+
exit 1
72+
fi
73+
if [ -n "${KEY_ID}" ] && [ -n "${REVOKED_KEY_IDS}" ] && [[ ",${REVOKED_KEY_IDS}," == *",${KEY_ID},"* ]]; then
74+
echo "SBOM signing configuration is invalid: configured key-id is listed as revoked." >&2
75+
exit 1
76+
fi
77+
if [ -n "${KEY_ID}" ] && [ -n "${ALLOWED_KEY_IDS}" ] && [[ ",${ALLOWED_KEY_IDS}," != *",${KEY_ID},"* ]]; then
78+
echo "SBOM signing configuration is invalid: configured key-id is not listed in allowed key IDs." >&2
79+
exit 1
80+
fi
81+
82+
- name: Generate SBOM attestation
83+
env:
84+
NOTE_CONNECTION_SBOM_ATTESTATION_ALLOW_UNSIGNED: ${{ secrets.SBOM_SIGNING_PRIVATE_KEY_PEM == '' }}
85+
NOTE_CONNECTION_SBOM_ATTESTATION_ENABLE_TRANSPARENCY_LOG: "true"
86+
NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_LOG_PATH: "build/sbom/attestation-transparency-log.jsonl"
87+
run: npm run generate:sbom:attestation
88+
89+
- name: Materialize SBOM signing keyring policy (optional)
90+
if: ${{ secrets.SBOM_SIGNING_KEYRING_JSON != '' }}
91+
shell: bash
92+
env:
93+
SBOM_SIGNING_KEYRING_JSON: ${{ secrets.SBOM_SIGNING_KEYRING_JSON }}
94+
run: |
95+
mkdir -p build/sbom
96+
printf '%s' "${SBOM_SIGNING_KEYRING_JSON}" > build/sbom/signing-keyring.json
97+
98+
- name: Verify SBOM attestation policy gate
99+
env:
100+
NOTE_CONNECTION_REQUIRE_SBOM_ATTESTATION_SIGNATURE: ${{ secrets.SBOM_SIGNING_PUBLIC_KEY_PEM != '' }}
101+
NOTE_CONNECTION_SBOM_ATTESTATION_REQUIRE_SIGNED_KEY_ID: ${{ secrets.SBOM_SIGNING_PUBLIC_KEY_PEM != '' }}
102+
NOTE_CONNECTION_SBOM_SIGNING_PUBLIC_KEYRING_FILE: ${{ secrets.SBOM_SIGNING_KEYRING_JSON != '' && 'build/sbom/signing-keyring.json' || '' }}
103+
NOTE_CONNECTION_SBOM_ATTESTATION_REQUIRE_PROVENANCE: "true"
104+
NOTE_CONNECTION_SBOM_ATTESTATION_EXPECT_REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
105+
NOTE_CONNECTION_SBOM_ATTESTATION_EXPECT_RELEASE_COMMIT_SHA: ${{ github.sha }}
106+
NOTE_CONNECTION_SBOM_ATTESTATION_EXPECT_RELEASE_GIT_TAG: ${{ github.ref_name }}
107+
NOTE_CONNECTION_SBOM_ATTESTATION_EXPECT_RELEASE_REF: ${{ github.ref }}
108+
NOTE_CONNECTION_SBOM_ATTESTATION_EXPECT_RELEASE_RUN_ID: ${{ github.run_id }}
109+
NOTE_CONNECTION_SBOM_KEYRING_REQUIRE_SCHEMA_PIN: ${{ secrets.SBOM_SIGNING_KEYRING_JSON != '' }}
110+
NOTE_CONNECTION_SBOM_KEYRING_EXPECT_SCHEMA: "noteconnection/sbom-keyring/v1"
111+
NOTE_CONNECTION_SBOM_KEYRING_EXPECT_VERSION: "1"
112+
NOTE_CONNECTION_SBOM_ATTESTATION_REQUIRE_TRANSPARENCY_LOG: "true"
113+
NOTE_CONNECTION_SBOM_ATTESTATION_VERIFY_TRANSPARENCY_LOG_INCLUSION: "true"
114+
NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_REQUIRE_SCHEMA_PIN: "true"
115+
NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_EXPECT_SCHEMA: "noteconnection/sbom-attestation-transparency/v1"
116+
NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_EXPECT_VERSION: "1"
117+
NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_LOG_PATH: "build/sbom/attestation-transparency-log.jsonl"
118+
run: npm run verify:sbom:attestation -- --strict 1 --allow-missing 0
119+
120+
- name: Enforce strict PathBridge inbound schema gate
121+
run: npm run verify:pathbridge:strict
122+
34123
- name: Enforce strict wasm parity gates
35124
run: npm run test:wasm:parity:gates
36125

‎TODO.md‎

Lines changed: 66 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,73 @@
1-
# 2026-03-11 v1.5.56 - High-Priority Fixrisk Issue Closure (Runtime + Mobile E2E + Compliance)
1+
# 2026-03-12 v1.5.57 - Fixrisk High-Priority Closure Plan (Live)
22

33
## English Document
44

55
### Objective
6-
Close the outstanding `fixrisk_TODO` issue tracks with enforceable code, contracts, and CI coverage while preserving large-graph readiness (>10k nodes / >1M edges).
7-
8-
### Completed in This Iteration
9-
- [x] Startup/runtime memory safety remains adaptive (`scripts/start-server.js`, `scripts/lib/runtime-memory-policy.js`).
10-
- [x] PathBridge inbound payload policy remains large-graph aware (`src/core/PathBridge.ts`).
11-
- [x] Added adaptive HTTP request-body spool threshold policy in `src/server.ts`.
12-
- [x] New controls: `NOTE_CONNECTION_REQUEST_BODY_SPOOL_THRESHOLD_KB`, `NOTE_CONNECTION_REQUEST_BODY_SPOOL_STRICT`.
13-
- [x] Runtime diagnostics now expose spool threshold source/recommended/effective values.
14-
- [x] Closed runtime eval/pkg risk for critical paths.
15-
- [x] Added `src/pkg.snapshot.safety.contract.test.ts`.
16-
- [x] Provisioned Detox contract pipeline.
6+
Complete and verify all `fixrisk_TODO` closure items with executable checks, keeping robustness for large-graph workloads (>10k nodes / >1M edges).
7+
8+
### Verified Closure Snapshot
9+
- [x] FR-001 .. FR-008 closed by code/contracts.
10+
- [x] FR-010 closed by pipeline migration to Node24-compatible action runtime (`actions/checkout@v5`, `actions/setup-node@v5` + force flag).
11+
- [x] FR-011 closed by Java 21 gate hardening:
12+
- [x] Android prereq checker now supports Java 21 candidate discovery (env slots + common local install paths, including Android Studio JBR).
13+
- [x] Migration gate provisions Java 21 for tauri-rust suite.
14+
- [x] Deferred hardening slice completed for stricter IPC schema guards on known PathBridge envelope families (`src/core/PathBridge.ts` + contracts).
15+
- [x] Deferred hardening policy slice completed:
16+
- [x] Unknown bridge type strict-reject policy is now supported (`NOTE_CONNECTION_BRIDGE_REJECT_UNKNOWN_TYPES`).
17+
- [x] Strict `configure` schema mode is now supported (`NOTE_CONNECTION_BRIDGE_STRICT_CONFIG_SCHEMA`).
18+
- [x] Deferred hardening configure-value slice completed:
19+
- [x] `configure.layout` is now enum-validated (`vertical`/`horizontal`/`radial`/`orbital`).
20+
- [x] `configure.background` now enforces safe `.exr`/`.hdr` filename rules (no traversal/path separators).
21+
- [x] `configure.bg_brightness` and `configure.reader_media_scale` now enforce runtime-safe ranges.
22+
- [x] `configure.targetId` and `configure.target_id` must match when both are present.
23+
- [x] Deferred hardening strict-policy gate slice completed:
24+
- [x] Added executable strict PathBridge verifier (`npm run verify:pathbridge:strict`).
25+
- [x] Migration/publish workflows now run a dedicated strict PathBridge schema gate.
26+
- [x] Added strict gate contract coverage (`src/pathbridge.strict.policy.contract.test.ts`).
27+
- [x] Deferred hardening mobile memory ceiling slice completed:
28+
- [x] Runtime heap policy now distinguishes `desktop`/`android`/`ios` platform ceilings.
29+
- [x] iOS Jetsam tier support added (`NOTE_CONNECTION_IOS_JETSAM_TIER`).
30+
- [x] Added iOS memory-bound contract coverage (`src/runtime.heap.policy.contract.test.ts`).
31+
- [x] Deferred hardening SBOM attestation slice completed:
32+
- [x] Added SBOM attestation generator (`npm run generate:sbom:attestation`).
33+
- [x] Added SBOM attestation verifier with strict mode (`npm run verify:sbom:attestation -- --strict 1`).
34+
- [x] Migration/publish workflows now include SBOM attestation policy gates.
35+
- [x] Release workflow now validates signing key-pair completeness and auto-enforces signature requirement when signing keys are provisioned.
36+
- [x] Signed attestation key-id lifecycle policy is now enforced (required key-id + allowlist/revocation checks) with contract coverage.
37+
- [x] Multi-key trust policy is now enforced (minimum RSA strength + rotation overlap + optional keyring policy file) with contract coverage.
38+
- [x] Signed-attestation provenance linkage is now enforced (immutable release metadata expectations + keyring schema/version pin checks) with contract coverage.
39+
- [x] Signed-attestation transparency inclusion policy is now enforced (append-only ledger + inclusion proof chain checks + schema/version pinning) with contract coverage.
40+
- [x] Deferred hardening slice completed for SBOM policy:
41+
- [x] CycloneDX SBOM generator script is now available (`npm run generate:sbom`).
42+
- [x] SBOM policy verifier is now available with strict mode (`npm run verify:sbom -- --strict 1`).
43+
- [x] Migration/publish workflows now enforce SBOM policy contracts.
44+
- [ ] FR-009 remains pending only on real-device operational evidence (tooling already closed).
45+
46+
### Remaining High-Priority Work (FR-009 Ops Closure)
47+
1. Device acceptance gate
48+
- Run `node scripts/verify-capacitor-device-acceptance.js`.
49+
- Ensure an online authorized physical Android device is connected (emulator targets are rejected by default).
50+
- Use `NOTE_CONNECTION_ALLOW_EMULATOR_EVIDENCE=1` only for non-production emulator experiments.
51+
2. Large-graph evidence capture
52+
- Set:
53+
- `NOTE_CONNECTION_EVIDENCE_NODE_COUNT=10000`
54+
- `NOTE_CONNECTION_EVIDENCE_EDGE_COUNT=1000000`
55+
- Run `node scripts/capture-capacitor-device-evidence.js`.
56+
3. Strict evidence verification
57+
- Set:
58+
- `NOTE_CONNECTION_REQUIRE_LARGE_GRAPH_EVIDENCE=1`
59+
- `NOTE_CONNECTION_MIN_EVIDENCE_NODE_COUNT=10000`
60+
- `NOTE_CONNECTION_MIN_EVIDENCE_EDGE_COUNT=1000000`
61+
- Run `node scripts/verify-capacitor-evidence-freshness.js`.
62+
4. Consolidated closure check
63+
- Run `node scripts/verify-fixrisk-issues.js --strict-pending`.
64+
- Run `node scripts/run-fixrisk-ops-closure.js`.
65+
66+
### Robustness Guardrails
67+
- Keep adaptive memory policy enabled (`scripts/lib/runtime-memory-policy.js`) for large-graph bursts.
68+
- Keep bounded request-body + spool policy active in server runtime.
69+
- Maintain strict contract suite baseline (`node node_modules/jest/bin/jest.js --runInBand`).
70+
- Godot SVG limitation remains active: do not depend on direct SVG import in Godot runtime paths.
1771
- [x] Added `.detoxrc.json`, `e2e/*`, `scripts/verify-detox-pipeline.js`, `scripts/run-detox-e2e.js`.
1872
- [x] Added CI workflow `.github/workflows/mobile-e2e-detox-contracts.yml`.
1973
- [x] Added contract test `src/detox.pipeline.contract.test.ts`.

0 commit comments

Comments
 (0)