commit 08749c18cd98f32e507251b9e5336290449bfce2
parent d46e868dd309904bd6f500849d3efc25b78f4a23
Author: triesap <tyson@radroots.org>
Date: Mon, 7 Sep 2026 04:31:28 +0000
fix: align Step 304 tool authority
- Keep the manifest-owned Rust tool as the governed payload claim.
- Retain the separately hash-pinned frozen Nix client verification.
- Rebind the verifier digest after the authority correction.
- Preserve the already-green artifact admission scope.
Diffstat:
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/contracts/rshr-202-step-304-gates.v1.json b/contracts/rshr-202-step-304-gates.v1.json
@@ -1 +1 @@
-{"gate_command_contract":[{"argv_template":["cargo","extbuild","run","--","cargo","run","--offline","--locked","-q","-p","xtask","--","rshr-step-304-gate","--step={step}","--check-id={check_id}","--source-revision={source_revision}","--source-tree={source_tree}","--candidate-digest={candidate_digest}","--platform=macos_aarch64","--execution-request-sha256={execution_request_sha256}"],"assertion_id":["step_304_gate_01_054db63c65f921ecba1c1bf416d680ee7ef880bdcf90cf6dc152677a03dd129a"],"check_id":"gate-01-054db63c65f921ecba1c1bf416d680ee7ef880bdcf90cf6dc152677a03dd129a","environment_authority":{"cache_policy_id":"rshr-200-step-287-cache-policy.v1","cache_policy_sha256":"3e81d178bce97b6c349dfbb00c68fd6f620ac00b1a1c8d37b12e9998f3c9eaaa","cadence_policy_id":"rshr-200-step-287-cadence-policy.v1","cadence_policy_sha256":"d24903df8659ee3772297c84994911efe7d21cb8b988320ddc6ddce0431892a1","isolation":"extbuild_host_constrained","network":"disabled","network_policy_id":"none","network_policy_sha256":"none","resource_policy_id":"rshr-200-step-287-resource-policy.v1","resource_policy_sha256":"05d3c7a89185d3c55678d97955193fce2ed92b1eee5af99083d77ea64c98d14e"},"environment_names":["EXT_BUILD_CONFIG","EXT_BUILD_MACHINE_CONFIG","EXT_BUILD_ROOT","HOME","PATH","RUSTUP_TOOLCHAIN","TMPDIR"],"gate_definition_sha256":"054db63c65f921ecba1c1bf416d680ee7ef880bdcf90cf6dc152677a03dd129a","required_platforms":["macos_aarch64"],"required_tools":["nix","rustc"],"result_schema":"radroots.services-hardening.rshr-200-step-check-result.v1","schema":"radroots.services-hardening.rshr-200-step-check-command.v1","step":304,"verifier_path":"tools/xtask/src/rshr_202_step_304_gate.rs","verifier_sha256":"dbb03dea8c0b7f48d9de622baa9e24f0aeccc1d7fc68082c50c5ba9d1d42fc50"}],"schema":"radroots.lib.rshr-202-step-304-gates.v1","step":[304]}
+{"gate_command_contract":[{"argv_template":["cargo","extbuild","run","--","cargo","run","--offline","--locked","-q","-p","xtask","--","rshr-step-304-gate","--step={step}","--check-id={check_id}","--source-revision={source_revision}","--source-tree={source_tree}","--candidate-digest={candidate_digest}","--platform=macos_aarch64","--execution-request-sha256={execution_request_sha256}"],"assertion_id":["step_304_gate_01_054db63c65f921ecba1c1bf416d680ee7ef880bdcf90cf6dc152677a03dd129a"],"check_id":"gate-01-054db63c65f921ecba1c1bf416d680ee7ef880bdcf90cf6dc152677a03dd129a","environment_authority":{"cache_policy_id":"rshr-200-step-287-cache-policy.v1","cache_policy_sha256":"3e81d178bce97b6c349dfbb00c68fd6f620ac00b1a1c8d37b12e9998f3c9eaaa","cadence_policy_id":"rshr-200-step-287-cadence-policy.v1","cadence_policy_sha256":"d24903df8659ee3772297c84994911efe7d21cb8b988320ddc6ddce0431892a1","isolation":"extbuild_host_constrained","network":"disabled","network_policy_id":"none","network_policy_sha256":"none","resource_policy_id":"rshr-200-step-287-resource-policy.v1","resource_policy_sha256":"05d3c7a89185d3c55678d97955193fce2ed92b1eee5af99083d77ea64c98d14e"},"environment_names":["EXT_BUILD_CONFIG","EXT_BUILD_MACHINE_CONFIG","EXT_BUILD_ROOT","HOME","PATH","RUSTUP_TOOLCHAIN","TMPDIR"],"gate_definition_sha256":"054db63c65f921ecba1c1bf416d680ee7ef880bdcf90cf6dc152677a03dd129a","required_platforms":["macos_aarch64"],"required_tools":["rustc"],"result_schema":"radroots.services-hardening.rshr-200-step-check-result.v1","schema":"radroots.services-hardening.rshr-200-step-check-command.v1","step":304,"verifier_path":"tools/xtask/src/rshr_202_step_304_gate.rs","verifier_sha256":"bcb7b0613d5a91dfe2e6306bfa76d46d902cb5013f0be234b0f843e6681f2a27"}],"schema":"radroots.lib.rshr-202-step-304-gates.v1","step":[304]}
diff --git a/tools/xtask/src/rshr_202_step_304_gate.rs b/tools/xtask/src/rshr_202_step_304_gate.rs
@@ -181,7 +181,7 @@ fn expected_contract(verifier_sha256: &str) -> Value {
"environment_names": ["EXT_BUILD_CONFIG", "EXT_BUILD_MACHINE_CONFIG", "EXT_BUILD_ROOT", "HOME", "PATH", "RUSTUP_TOOLCHAIN", "TMPDIR"],
"gate_definition_sha256": GATE_DIGEST,
"required_platforms": ["macos_aarch64"],
- "required_tools": ["nix", "rustc"],
+ "required_tools": ["rustc"],
"result_schema": "radroots.services-hardening.rshr-200-step-check-result.v1",
"schema": "radroots.services-hardening.rshr-200-step-check-command.v1",
"step": STEP,
