Portable authenticated worker identity: semantic identity plus audit-only aliases for the primary-QRF worker binding (fixes #863) - #871

Merged

MaxGhenis merged 56 commits into

mainfrom

f1-portable-worker-identity

Sep 5, 2026

Commits on Sep 4, 2026

chore: start F1 portable identity progress journal
MaxGhenis
committed
7910d0c
docs: record F1 identity implementation map
MaxGhenis
committed
ec066ca
test: specify portable worker identity semantics
MaxGhenis
committed
6c96cb7
test: specify legacy scoring identity attestation
MaxGhenis
committed
8f14fde
docs: record F1 fail-before evidence
MaxGhenis
committed
e764dbc
feat: authenticate portable primary worker identity
MaxGhenis
committed
2bc201e
feat: gate portable identity compatibility scoring
MaxGhenis
committed
acf5434
feat: mirror portable worker identity in US specs
MaxGhenis
committed
814d917
test: refresh portable worker identity pins
MaxGhenis
committed
a549cb9
docs: explain portable worker authentication
MaxGhenis
committed
d786374
fix: preserve worker identity in exact-k receipts
MaxGhenis
committed
ff3d255
fix: authenticate wheel-installed worker dependencies
MaxGhenis
committed
90c3c57
test: retain nested release verdict coverage
MaxGhenis
committed
eed45be
fix: normalize worker audit path aliases
MaxGhenis
committed
c90bc80
docs: state portable identity threat boundary
MaxGhenis
committed
52e85a4
Finish F1 verification: resolver bindings are not authored digests, the builder fake binds its manifest payload, re-pin the resource-semantics and full-checkpoint identities, regenerate coverage ev…
MaxGhenis
committed
921a8d5
Worker identity: accept byte-identical shadowed namespace roots and uv 0.12's major.minor pyvenv version
MaxGhenis
committed
5e6c895
Re-pin the spec-engine identities for the rebased tree
MaxGhenis
committed
ee7906d
Classify worker_identity.py as a reviewed non-registry runtime module; bind the preflight fake's manifest payload
MaxGhenis
committed
656dc88
Keep the worker execution binding out of the spec-engine inventory digests
MaxGhenis
committed
b26708a
Start Sol round-one progress journal
MaxGhenis
committed
597cf72
Add fail-before regressions for Sol worker findings
MaxGhenis
committed
71dbe29
Require the complete schema-9 stacked envelope
MaxGhenis
committed
41e7aee
Disable and authenticate Torch backend autoload
MaxGhenis
committed
b8fd0eb
Bind the Python runtime and clean import closure
MaxGhenis
committed
a0ec4f8
Cache the immutable worker identity test fixture
MaxGhenis
committed
62f1d3e
Cache the canonical H5 worker fixture
MaxGhenis
committed
3d5a1b9
Reuse real worker bindings in pin checks
MaxGhenis
committed
3cbb5a9
Move Torch autoload guard to worker bootstrap
MaxGhenis
committed
32ce6f5
docs: initialize Astra worker identity fix journal
MaxGhenis
committed
b0c5ab7
test: reproduce worker startup and stale bytecode identity gaps
MaxGhenis
committed
4380745
fix: disable Torch autoload before stacked worker startup
MaxGhenis
committed
b131afb
fix: isolate probe and worker from existing bytecode caches
MaxGhenis
committed
4a575d7
test: reuse pristine worker identities in artifact validation fixtures
MaxGhenis
committed
aa2d6a7
test: reuse worker identity across tail control mutations
MaxGhenis
committed
f5042e8
docs: record unchanged spec pins and completed verification suites
MaxGhenis
committed
59ce4d5
docs: finalize Astra worker identity verification report
MaxGhenis
committed
61392cd

Commits on Sep 5, 2026

fix(stacked-spine): report the retained sidecar's digest on checkpoint resume
MaxGhenis
committed
50c9232
docs: start PR 871 CI crawl fix journal
MaxGhenis
committed
e804f48
docs: record slow worker identity baseline
MaxGhenis
committed
c48a220
docs: record complete first-200 slow baseline
MaxGhenis
committed
3399281
test: reproduce repeated worker identity computation
MaxGhenis
committed
3e18c9e
perf: memoize worker attestations and prime real test identities
MaxGhenis
committed
c0cb126
docs: record worker selector speedup and review
MaxGhenis
committed
5726d41
docs: keep verification journal current
MaxGhenis
committed
c8b831c
docs: record complete stacked-spine verification
MaxGhenis
committed
eaf1058
docs: record indirect bundle identity caller
MaxGhenis
committed
2927d87
docs: record initial us-qs build verification
MaxGhenis
committed
94d52a2
docs: record us-qs frame verification
MaxGhenis
committed
964581c
docs: record us-am build verification
MaxGhenis
committed
635135d
docs: record successful initial CI process groups
MaxGhenis
committed
8952df0
test: expose unprimed spec-bundle worker identity
MaxGhenis
committed
a42ed4c
test: prime worker identity before cached bundle generation
MaxGhenis
committed
7ea6a25
docs: record final bundle verification progress
MaxGhenis
committed
08010cf
docs: record final us-qs build verification
MaxGhenis
committed
fc4f8a4
docs: complete worker identity performance fix report
MaxGhenis
committed
d653c07