[ai-mountain]

Summary

B5 PR 3b, stacked on #1933. It binds the enforcement probe runner and the probe images. Peyton's decisions:

• "In PR 3, bind the exact release-recorded probe-runner binary digest. Retain the source-tree hash and source revision as supporting provenance, but runtime acceptance must pin the binary that actually ran."
• "'Every language image' means every image named by the approved profile, using the same approved limits/timeouts but each language's canonical, explicitly recorded test command. Rust-specific arguments are fine only when pinned in the profile/approval and verified; do not force a false common argv."

Default-off. It adds no host workflow, collection, approval or activation.

Status: both parts are pushed.

Stack update (2026-09-16, a41dabdfc)

Merged #1933 556cc9cc4 (Peyton's 2026-09-16 approval decisions: curator signature verified over the exact stored approval bytes with strict, non-canonical parsing; Docker server_version observed rather than enforced on the host; approval validity capped at 24 h). One README table conflict resolved (kept this PR's enforcement_images_sha256 pin plus #1933's wording). No other fallout; the enforcement-images set and release index remain canonical documents. Tests: native Python suites (evidence, preflight, matrix, release, probe runner, probe workflow, qualification) 548 passed, 2 skipped; go test -p 2 ./internal/codingenforcement/... ./cmd/dittobench-coding-enforcement-probe/ ok; ruff, format, mypy, gofmt clean.

Review update (2026-09-15): independent adversarial review

Rebased onto #1933 9b7fb9902. The fixes:

• Rust test commands are verified, not just pinned (9666d0f12). The image set accepted any bounded Rust argv. Its vector, test fixture and CI template pinned --crate subject commands that codingexecutor.rustCommand refuses.
  • Go (catalog.RustTestArgv) and Python now require each Rust test command to be the driver's authority command: dittobench-test-driver --group <its own group> --authority <relative .json> --authority-sha256 <hex>.
  • A new codingexecutor test checks the offline check against rustCommand on the shared vector, which gains nine Rust refusal cases.
  • A common argv is refused for Rust.
• check-approval checks approval images against the release index (0edebfb42). It compared only approval_sha256. The host's release_policy also requires image_ref, config_digest and driver_profile to equal the index, so a mismatched approval passed offline and was refused on-host.
• Tests that passed without their guard (b45616087).
  • Removing the record-to-release-index check still passed, because the preflight check names the same field.
  • Removing the probe runner measurement check still passed, because a later image lookup also failed.
  • Both tests now assert the exact refusal.
• Docs (62b7ee2ea). /proc/self/exe is a self-report, and the verifier can't tell it from a collector measurement. PR4/PR5 collectors must hash the file they execute from outside the runner and refuse a differing self-report.
• Tests:
  • Python native, probe and workflow suites: 656 passed, 3 skipped.
  • Go: go test -p 2 on codingenforcement/..., codingexecutor, codinghostedworker and the probe command. vet is clean, including -tags native_probe_integration.

Part 1: probe runner binary binding

• Release. The native runtime bundle builds bin/dittobench-coding-enforcement-probe with the worker's static flags. It smoke-checks the binary (no arguments exits 1 with its usage error) and requires it as an executable amd64 ELF. The release set (now dittobench-coding-native-release-set-v3) records runtime.probe_runner_sha256 from the bundle manifest. native.release_policy accepts v3 only.
• Measured on host. The runner hashes /proc/self/exe, the executable image actually running, and reports probe_runner_binary_sha256. The rootless CI job compares it with an independent sha256sum of the binary it built.
• Evidence. The ambiguous tools.runner_sha256 is now tools.probe_runner_source_sha256: supporting provenance, still computed from the reviewed checkout. New tools.probe_runner_binary_sha256 must equal the release index's runtime.probe_runner_sha256.
  • verify, review and check-approval require --release-index. Records must name the index's exact digest, and their source revision, runtime archive and image approvals must match it.
  • approval.runner_sha256 still names only run.py.
• Refusal tests:
  • an operator-built binary, and the source hash or runtime archive passed off as the binary;
  • the old runner_sha256 key;
  • index drift, and record release fields that differ from the index;
  • a v2, non-canonical or malformed index, and a probe runner digest equal to the worker's;
  • a missing --release-index, and a missing, non-executable or non-ELF probe binary in the bundle.

Part 2: per-language probe images and commands

• Image set. dittobench-coding-native-enforcement-images-v1 is canonical, with closed keys.
  • It binds grading_profile_sha256: the approved profile whose limits, timeouts, command IDs and expected totals every language shares.
  • It names go, node, python and rust exactly once. Each has a distinct OCI manifest image_digest, its own build_argv, and its own test_argv for hidden and visible.
  • Every argv is 1 to 64 printable arguments with a bare non-shell executable, and test commands must use dittobench-test-driver. Rust arguments such as --crate or --out-dir are fine because the set records them.
  • Go (catalog.ParseEnforcementImages) and Python parse one shared vector with 16 refusal cases.
• Manifest image digest is bound. GradingProfile.EnforcementProbeManifest now takes the pinned language entry. It applies that language's commands, keeps the profile's limits, timeouts, IDs and totals, never mutates the approved profile through shared slices, and refuses a manifest whose image differs from the pinned one.
  • The runner drops --image and reads --enforcement-images. It refuses a set for another profile, and a manifest or resolved repository digest other than the pinned one. --language only narrows which pinned languages are observed.
  • The rootless CI job fills a committed template with its synthetic python digest. The Python live test checks the report's set digest, image digests and argv against that file.
• Evidence. Resource and pre-exec records carry inputs.enforcement_images_sha256 (catalog inputs updated). The verifier requires:
  • the set names the supplied grading profile;
  • every language image is the release index's released image;
  • the grading profile's own image is exactly one released language, whose recorded commands equal the profile's.
  • review/check-approval need --enforcement-images. The approval pins the set in profile_pins.enforcement_images_sha256, and the approval vector was repinned.
• Refusal tests:
  • a set for another profile, an unreleased image, python commands that differ from the profile, and a profile image that is not a released language;
  • a missing image set document;
  • a mismatched enforcement-images pin at check-approval;
  • Go-side missing or renamed groups, an untrusted driver, a tag instead of a digest, a set naming another profile, an unknown or repeated language, and a runner whose binary can't be measured.
  • Explicitly recorded identical or Rust-specific argv are accepted.

Tests (part 1)

• Python: evidence 365 passed; release, runtime bundle, matrix and preflight 147 passed; probe runner and workflow 8 passed, 2 live skips; all workflow suites 69 passed. ruff, format and mypy clean.
• Go: go test -p 2 ./internal/codingenforcement/... ./cmd/dittobench-coding-enforcement-probe/; gofmt and vet clean. The golden record was repinned.

Tests (after part 2)

• Python: evidence 375 passed; release, preflight, matrix, qualification, image import, runtime bundle, probe runner and all workflow suites 296 passed, 3 skipped (the local Docker import opt-in and the 2 live report tests). ruff, format and mypy clean.
• Go: go test -p 2 ./internal/codingenforcement/... ./internal/codinghostedworker/ ./cmd/dittobench-coding-enforcement-probe/; vet clean, including -tags native_probe_integration.

Residuals

• The per-language commands for the real hostile fixtures are placeholders in tests. The actual per-language argv is recorded when the fixtures land (PR 5), and Peyton reviews them as part of the pinned set.
• The source-tree roots still cover only the runner, probe and catalog trees (provenance only).
• A lying binary could report another digest. The future collector must also measure the file it executes; PR 4/5 must do this.
• The runtime bundle schema string stays v2, but now requires the probe binary, so bundles built before this change are refused.

No collection, host run, approval or activation is requested.

🤖 Generated with Claude Code

Note

Add probe-runner binary and enforcement-image profile to v3 release index

• Upgrades the native release-set schema from v2 to v3 and records a separate probe-runner executable digest read from the runtime manifest, distinct from the worker digest.
• Introduces a canonical per-language enforcement-image document that pins image digests, build commands, and test commands for Go, Node, Python, and Rust; the probe reads this document instead of accepting caller-supplied image digests.
• Adds probe.RunningExecutableSHA256 so the probe measures its own running binary and reports the digest in live observations and evidence records.
• Builds the enforcement-probe as a static Go binary in the runtime Dockerfile, includes it in the bundle archive, and validates its ELF header and executable manifest entry.
• Risk: release-policy validation now rejects v2 schemas; the observe-requested-config command removes the direct --image flag and requires --enforcement-images and --repository arguments instead.

^{Macroscope summarized 32e8c87.}

[github-actions]

No dashboard preview for this commit. This PR resolved to preview profiles stack with no dashboard profile: it changes no apps/platform/dashboard/ path, so there is no dashboard build to publish. Profile selection fails closed rather than guessing, which is why a PR touching no recognized runtime path still reads as stack.

Stack previews are never automatic. A maintainer can provision one for this PR:

gh workflow run preview-stack.yml -f pr=1934                    # provision
gh workflow run preview-stack.yml -f pr=1934 -f action=retire   # free the slot

It runs on the default branch, resolves the head commit from the API, and comments dashboard, Platform, and isolated Backroom URLs once readiness succeeds. profile defaults to auto, which picks stack-copy when the PR touches apps/platform/alembic/. Eight slots cap every active preview; a re-dispatch reuses the slot this PR already holds. Reconciliation keeps it while the PR is open, up to a 24-hour lease cap, and retires it four hours after the PR closes.

Exact SHA: 32e8c87d3c115843d7978fcf14abf9b9cf72b7b6

[Peyton-Spencer]

Open Code Review pass completed at a41dabdfce6b8fc22373254ca2e30d1998160621 using z-ai/glm-5.3-flash through Ditto’s Code Review endpoint. Coverage: 34/34 added, modified, renamed, or type-changed files in the PR diff.

Model candidates were checked against the source; independently confirmed actionable findings, if any, are posted separately as inline review comments. This was a static review; no PR code or test suite was executed. This comment is not a merge approval.

[ditto-code]

Ditto Review · Beta

Review completed for 32e8c87d3c115843d7978fcf14abf9b9cf72b7b6.

No actionable findings in the reviewed files. This is not an approval or proof that the PR is bug-free.

Configure Ditto Review. Inference is billed through your Ditto Router endpoint; targeted verification is included during beta.