docs(pg-ledger): two-tier value-bearing provenance ledger design + governed playbook - #229
Merged
Conversation
…verned playbook Design for a Postgres provenance ledger that makes runs inspectable and reproducible without weakening the value-free wire/monitor: - tier 1 (value-free chain) unchanged; tier 2 records the filtered var_values per step, envelope-encrypted at rest (recipient-set DEKs: node-only standalone, +mothership at fleet join), with values_sha committed into the tier-1 chain. - govd sole DB writer; exod gets no DSN (authority = its signed envelope in-row). - standalone holds its own (sqlite run_values); PG sidecar + logical replication only at fleet join; mothership INITIATES the subscribe (= admission). - tailnet = reachability, not authorization: bind tailscale iface only, admission is registration + pg_hba cert + subscribe, each layer severs a node alone. - raw-bytes + JSONB dual columns (JSONB does not preserve hash-able bytes). Companion playbook (docs/pg-provenance-ledger.playbook.json) fires the validator GATES (modelcheck/py_qc/mutate/sec/redteam/conform/chaos) against the working tree — the work is kernel edits, gated, not cws-addperk scaffolding. Baseline governed dry-run via cws:cws-pm/run: 25/25 validate structurally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Design + governed playbook for a two-tier provenance ledger that makes each run's tool-use inspectable and reproducible without weakening cyberware's value-free wire/monitor.
chain.jsonl) unchanged — stays the artifact of record and the only thing on the wire/monitor.var_valuesper step, envelope-encrypted at rest (recipient-set DEKs — node-only standalone, +mothership at fleet join), withvalues_shacommitted into the tier-1 chain so inputs become tamper-evident.run_values); PG sidecar + logical replication materialize only at fleet join; the mothership initiates the subscribe (= admission).Files
docs/pg-provenance-ledger.md— design (9 tested invariants, verified code anchors, crypto, M0–M3), matching theper-actor-acl-design.mdhouse pattern.docs/pg-provenance-ledger.playbook.json— the 25-task governed board (fires the validator gates against the working tree; the work is kernel edits, gated, notcws-addperkscaffolding).Validation
Baseline governed dry-run via
cws:cws-pm/run: 25/25 tasks validate structurally through govd.🤖 Generated with Claude Code