chore: harden send sandbox evidence package v2
This commit is contained in:
zhaoyilun
@@ -58,7 +58,7 @@ N13/N14/N15 are pre-business validation results. They can help identify UI eleme
|
||||
|
||||
## Current loop
|
||||
|
||||
Current loop: `R6i B-route connector adapter shell complete; next R6j online sandbox-send recording package v2`.
|
||||
Current loop: `R6j online sandbox-send recording package v2 complete; next R6k returned sandbox evidence intake v2`.
|
||||
|
||||
Active continuous execution plan: `docs/superpowers/plans/2026-07-10-r6f-r14-continuous-execution-plan.md`.
|
||||
|
||||
@@ -239,8 +239,8 @@ Continuous execution plan R6f-R14 is approved and execution has started:
|
||||
- Plan file: `docs/superpowers/plans/2026-07-10-r6f-r14-continuous-execution-plan.md`.
|
||||
- Scope: 15 ordered rounds covering send-message connector/gate hardening, send-file preview/idempotency/package, receive-file download preview, receive-message reconciliation, end-to-end business smoke, and release-candidate report.
|
||||
- Execution rule after approval: one round at a time, status-card update, verification, commit, push, then continue automatically until an evidence-only blocker requires user action.
|
||||
- Last completed round: R6i B-route connector adapter shell.
|
||||
- Next active round: R6j online sandbox-send recording package v2.
|
||||
- Last completed round: R6j online sandbox-send recording package v2.
|
||||
- Next active round: R6k returned sandbox evidence intake v2.
|
||||
|
||||
R6g send audit and idempotency replay diagnostics is complete:
|
||||
|
||||
@@ -268,3 +268,13 @@ R6i B-route connector adapter shell is complete:
|
||||
- The shell does not start sidecars, load DLLs, click/type UI, replay network traffic, or upload files.
|
||||
- Standard verification still reports 9 tools and `production_send_enabled=false`.
|
||||
- Next node: R6j online sandbox-send recording package v2.
|
||||
|
||||
R6j online sandbox-send recording package v2 is complete:
|
||||
|
||||
- `scripts\verify-send-sandbox-gate-package.ps1` now requires strict-v2 files and field markers.
|
||||
- `scripts\package-send-sandbox-gate.ps1` now emits `RETURN-CHECKLIST-V2.md`, `SANDBOX-SEND-INPUTS.schema.json`, `CREATE-RETURN-ZIP.ps1`, and strict-v2 fields in the input template.
|
||||
- `CREATE-RETURN-ZIP.ps1` refuses to create a return zip if after-recorder output or strict-v2 operator fields are missing.
|
||||
- `scripts\validate-returned-send-sandbox-package.ps1` supports `-ZipPath` and `-StrictV2`.
|
||||
- `scripts\test-validate-returned-send-sandbox-package.ps1` proves the existing partial package remains `partial_use_only` and fails strict-v2.
|
||||
- Standard verification still reports 9 tools and `production_send_enabled=false`.
|
||||
- Next node: R6k returned sandbox evidence intake v2.
|
||||
|
||||
@@ -439,18 +439,25 @@ When a returned package comes back, validate it before treating it as evidence:
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\validate-returned-send-sandbox-package.ps1 -PackagePath C:\Users\zhaoy\Downloads\1631.zip
|
||||
```
|
||||
|
||||
For R6j strict-v2 packages, use:
|
||||
|
||||
```powershell
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\validate-returned-send-sandbox-package.ps1 -ZipPath C:\Users\zhaoy\Downloads\isphere-send-sandbox-return-20260710-180000.zip -StrictV2
|
||||
```
|
||||
|
||||
The current partial returned package `C:\Users\zhaoy\Downloads\1631.zip` validates as:
|
||||
|
||||
```json
|
||||
{
|
||||
"partial_evidence_usable": true,
|
||||
"r6d_gate_pass": false,
|
||||
"strict_v2_pass": false,
|
||||
"production_send_enabled": false,
|
||||
"decision": "partial_use_only"
|
||||
}
|
||||
```
|
||||
|
||||
Use `partial_use_only` to continue local sandbox-only connector-shell and idempotency/audit work. Do not enable production send from a partial package. Full pass still requires after-recorder output and manual send timestamps.
|
||||
Use `partial_use_only` to continue local sandbox-only connector-shell and idempotency/audit work. Do not enable production send from a partial package. Full pass still requires after-recorder output, manual send timestamps, and the R6j strict-v2 fields: `operator_started_at_local`, `operator_clicked_send_at_local`, `operator_observed_success_at_local`, `before_recorder_present`, `after_recorder_present`, `success_ack_or_sent_record_present`, and `duplicate_second_send_attempted=false`.
|
||||
|
||||
The fixture test for the current partial package is:
|
||||
|
||||
|
||||
@@ -57,6 +57,8 @@ recorder/variants/ISphereLiveProbeRecorder-x86.exe
|
||||
| --- | --- |
|
||||
| `README.txt` | Explains local login limitation, online sandbox requirement, and one-send rule. |
|
||||
| `OPERATOR-STEPS.md` | Step-by-step operator procedure. |
|
||||
| `RETURN-CHECKLIST-V2.md` | Strict-v2 return checklist with required manual timestamps and before/after evidence flags. |
|
||||
| `SANDBOX-SEND-INPUTS.schema.json` | Machine-readable schema for the strict-v2 operator input fields. |
|
||||
| `SANDBOX-SEND-INPUTS.template.json` | Template for sandbox target, content hash, idempotency key, and observed result. |
|
||||
| `EXPECTED-RETURN-FILES.txt` | Return package acceptance checklist. |
|
||||
| `RUN-RECORDING-SUITE.bat` | Top-level guided before/manual-send/after/return-zip flow. |
|
||||
@@ -67,7 +69,8 @@ recorder/variants/ISphereLiveProbeRecorder-x86.exe
|
||||
| `run-before-recorder.bat` | Runs read-only recorder before the manual sandbox send. |
|
||||
| `run-after-recorder.bat` | Runs read-only recorder after the manual sandbox send. |
|
||||
| `compute-content-hash.ps1` | Computes SHA256 for the exact test message body. |
|
||||
| `make-return-zip.ps1` | Creates the return zip after before/after recordings and input JSON are present. |
|
||||
| `CREATE-RETURN-ZIP.ps1` | Strict-v2 return zip creator; refuses missing after-recorder output or required v2 fields. |
|
||||
| `make-return-zip.ps1` | Compatibility wrapper that calls `CREATE-RETURN-ZIP.ps1`. |
|
||||
|
||||
## Operator rules
|
||||
|
||||
@@ -81,6 +84,13 @@ DO_NOT_SEND_SECOND_TIME
|
||||
content_sha256
|
||||
idempotency_key
|
||||
success_ack_or_sent_record
|
||||
operator_started_at_local
|
||||
operator_clicked_send_at_local
|
||||
operator_observed_success_at_local
|
||||
before_recorder_present
|
||||
after_recorder_present
|
||||
success_ack_or_sent_record_present
|
||||
duplicate_second_send_attempted
|
||||
```
|
||||
|
||||
Required online procedure:
|
||||
@@ -92,8 +102,9 @@ Required online procedure:
|
||||
5. Record `success_ack_or_sent_record`.
|
||||
6. Do not send a second copy.
|
||||
7. Continue the guided flow, or run `02-run-after-recorder.bat`.
|
||||
8. Continue the guided flow, or run `03-make-return-zip.bat`.
|
||||
9. Return the generated zip.
|
||||
8. Set the strict-v2 booleans in `SANDBOX-SEND-INPUTS.json`: `before_recorder_present=true`, `after_recorder_present=true`, `success_ack_or_sent_record_present=true`, and `duplicate_second_send_attempted=false`.
|
||||
9. Continue the guided flow, or run `03-make-return-zip.bat`.
|
||||
10. Return the generated zip.
|
||||
|
||||
## Safety boundary
|
||||
|
||||
@@ -118,6 +129,7 @@ R6c can pass only after a returned package proves all of the following:
|
||||
- observed success/ack or local sent-record evidence;
|
||||
- confirmation that no second send was made;
|
||||
- before/after read-only recorder outputs are present.
|
||||
- strict-v2 fields are complete: `operator_started_at_local`, `operator_clicked_send_at_local`, `operator_observed_success_at_local`, `before_recorder_present`, `after_recorder_present`, `success_ack_or_sent_record_present`, and `duplicate_second_send_attempted=false`.
|
||||
|
||||
## Current decision
|
||||
|
||||
@@ -126,3 +138,14 @@ R6c local-preparation slice is complete, including the consolidated recording su
|
||||
Production `isphere_send_message` remains blocked.
|
||||
|
||||
Next node: **R6d returned sandbox evidence intake** after the user returns the generated package.
|
||||
|
||||
## R6j strict-v2 package hardening
|
||||
|
||||
R6j upgrades the recording package so the previously missing R6d evidence cannot be omitted silently:
|
||||
|
||||
- `scripts\verify-send-sandbox-gate-package.ps1` now requires `RETURN-CHECKLIST-V2.md`, `SANDBOX-SEND-INPUTS.schema.json`, `CREATE-RETURN-ZIP.ps1`, and all strict-v2 field names.
|
||||
- `CREATE-RETURN-ZIP.ps1` refuses to create the return zip unless before/after recorder directories contain files and strict-v2 fields are present.
|
||||
- `scripts\validate-returned-send-sandbox-package.ps1` accepts `-ZipPath` and `-StrictV2`; strict mode exits non-zero when the returned package does not prove the full gate.
|
||||
- The older partial package `C:\Users\zhaoy\Downloads\1631.zip` remains `partial_use_only` and `strict_v2_pass=false`.
|
||||
|
||||
Current decision: production `isphere_send_message` remains blocked. The next returned package must be generated from the R6j strict-v2 package to pass the full gate.
|
||||
|
||||
@@ -362,7 +362,7 @@ git push gitea main
|
||||
- `success_ack_or_sent_record_present=true`
|
||||
- `duplicate_second_send_attempted=false`
|
||||
|
||||
- [ ] **Step 1: Add v2 manifest assertions to package verifier**
|
||||
- [x] **Step 1: Add v2 manifest assertions to package verifier**
|
||||
|
||||
```powershell
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-send-sandbox-gate-package.ps1
|
||||
@@ -370,11 +370,11 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-send-sandbox-
|
||||
|
||||
Expected before implementation: FAIL because v2 required returned fields are not enforced.
|
||||
|
||||
- [ ] **Step 2: Add v2 checklist to package builder**
|
||||
- [x] **Step 2: Add v2 checklist to package builder**
|
||||
|
||||
Update package contents to include `RETURN-CHECKLIST-V2.md`, `SANDBOX-SEND-INPUTS.schema.json`, and a stricter `CREATE-RETURN-ZIP.ps1` that refuses to package if after-recorder output is missing.
|
||||
|
||||
- [ ] **Step 3: Add validator strict mode**
|
||||
- [x] **Step 3: Add validator strict mode**
|
||||
|
||||
Add parameter:
|
||||
|
||||
@@ -384,7 +384,7 @@ param([string]$ZipPath, [switch]$StrictV2)
|
||||
|
||||
`-StrictV2` exits non-zero if any required returned field is absent.
|
||||
|
||||
- [ ] **Step 4: Verify and commit**
|
||||
- [x] **Step 4: Verify and commit**
|
||||
|
||||
```powershell
|
||||
git diff --check
|
||||
@@ -400,6 +400,14 @@ git push gitea main
|
||||
|
||||
**Acceptance gate:** A generated package can no longer omit the R6d missing after-recorder/timestamp fields.
|
||||
|
||||
**R6j Result:**
|
||||
|
||||
- `scripts\verify-send-sandbox-gate-package.ps1` first failed against the old package because `RETURN-CHECKLIST-V2.md` was missing.
|
||||
- `scripts\package-send-sandbox-gate.ps1` now emits `RETURN-CHECKLIST-V2.md`, `SANDBOX-SEND-INPUTS.schema.json`, `CREATE-RETURN-ZIP.ps1`, and strict-v2 fields in `SANDBOX-SEND-INPUTS.template.json`.
|
||||
- `CREATE-RETURN-ZIP.ps1` refuses to build a return zip when after-recorder output, strict-v2 timestamps, success evidence, or no-duplicate confirmation are missing.
|
||||
- `scripts\validate-returned-send-sandbox-package.ps1` now supports `-ZipPath` and `-StrictV2`.
|
||||
- Existing partial package validation remains `partial_use_only`; strict-v2 validation exits non-zero for that partial package.
|
||||
|
||||
---
|
||||
|
||||
### R6k: Returned sandbox evidence intake v2
|
||||
|
||||
Reference in New Issue
Block a user