Repository navigation
Verify content-addressed Issue lifecycle preflight evidence #608
Description
Parent
What to build
Add the read-only verify operation for the bundle produced by #607. It validates the exact file set, canonical JSON, SHA-256 sidecars, schema and repository/controller scope, API and page inventory, object counts, and default-branch identity. Optional live verification independently re-reads GitHub and rejects any mutable or provenance drift.
Acceptance criteria
- Local verification rejects missing, extra, symlinked, non-canonical, tampered, or digest-mismatched bundle entries.
- Manifest schema, repository/controller/target/exclusions, API/media versions, page inventory, counts, and preflight identity are validated fail-closed.
- Live verification re-fetches the complete Capture content-addressed Issue lifecycle preflight evidence #607 graph and rejects default-branch, pagination/header, Issue/PR metadata, relationship, comment/event, check, or status drift.
- Focused tests prove valid independent readback, tamper rejection, scope/schema mismatch rejection, incomplete pagination rejection, and zero GitHub writes.
Blocked by
#607 must merge first.
Out of scope
- Capturing the bundle owned by Capture content-addressed Issue lifecycle preflight evidence #607.
- Producing a restoration plan owned by the dependent follow-up issue.
- Executing or authorizing metadata mutation, correcting the 54 legacy violations, or changing Enable the Issue Lifecycle required check after a green observation window #460/branch protection.
Activity
proerror77 commentedon Aug 2, 2026
Agent Brief
Category: enhancement
Summary: Independently verify a captured Issue-lifecycle evidence bundle
Prerequisite readback: Native blocker #607 is CLOSED with completion evidence; #608 remains a direct child of #455. No existing lifecycle
verifyimplementation or matching rejected request was found.Current behavior:
The repository-native CLI can capture a canonical, content-addressed Issue/PR graph, but it cannot independently prove that a retained bundle is structurally complete, canonical, scope-bound, untampered, or still equal to live GitHub state.
Desired behavior:
Add
verifyto the existing preflight CLI. Local verification must be the default and perform zero GitHub calls. Optional--liveverification must reuse the complete read-only capture path and fail closed on any graph, branch, page/header, count, or provenance drift. Both modes must perform zero writes.Key interfaces:
verify --bundle DIR --repo OWNER/REPO --controller NAME— exact local file/digest/canonical/schema/scope verification--live— opt-in independent GitHub readback; never a mutation authorityCanonicalrepresentation — no new service, format, or dependencyTDD seams:
ghboundary only for opt-in live verification and zero-write proofAcceptance criteria:
--liveindependently re-reads the complete graph and rejects any mutable or provenance drift.Out of scope:
Capture changes, #609 restoration planning, a formal retained evidence bundle/PR, any GitHub metadata mutation, the 54 legacy violations, #459 execution, #460/branch protection, deployment/runtime resources, and Agent-led CEX PRD work.
fix: bind lifecycle verification to captured graph
fix: preserve lifecycle evidence provenance
fix: enforce lifecycle evidence page size
fix: bind lifecycle verification to captured graph
fix: preserve lifecycle evidence provenance
fix: enforce lifecycle evidence page size
fix: compare lifecycle evidence bytes
fix: validate lifecycle evidence identities
test: reuse legacy provenance mutation
Verify content-addressed Issue lifecycle evidence (#621)
proerror77 commentedon Aug 2, 2026
Completion evidence
Acceptance checks: PR #621 merged to main from exact head
071a2194a74c643a279a2573527f148867811da8at squash merge commit612d0f9a57130d9f708f055d625b83b6839a1816; local verification now fails closed on exact file set, raw-byte canonical JSON including non-ASCII content, SHA-256 sidecars, schema and repository/controller scope, graph identity, REST and GraphQL pagination/header provenance, counts, and default-branch identity; optional live verification independently re-reads GitHub and rejects metadata, relationship, comment/event, check/status, pagination, and provenance drift while performing zero writes; focused fixtures cover valid independent readback, tamper/scope/schema mismatch, incomplete or forged pagination, wrong-host/cross-repository identity, real commit-status shape, and 10 live counterexamples with their expected failure reasons; preflight, lifecycle audit/contract/workflow/reconciliation/status-reconciliation, Rust scope selector, Ruby/Bash syntax, shellcheck, scoped actionlint, and diff checks passed; Matt Standards and Spec reviews each reported 0 findings; required Monorepo CI gate, Prediction Markets CI gate, and Security Summary Report checks succeeded; all six review threads are resolved; the remote head branch was deleted automatically and local tracking refs were pruned. No full repository live capture/readback was executed because the estimated 3,304 primary REST reads and about 6,608 reads with stability repetition exceed the 5,000-request quota; this execution was explicitly out of scope, and the existing four-file #607 format cannot independently recompute every per-page body_sha256 without a separate evidence-format contract.Result: passed