ruv ae073a5646 feat(verify): extend Trust Kill Switch to 9 phases — multi-layer proof ...

The original `verify` script (220 LOC) only validated the v1 Python
signal-processing pipeline. After v0.9.0 (ADR-125) and v0.10.0/v0.11.0
(HOMECORE), the stack has six more proof boundaries that an operator
should be able to verify in one command.

New `verify` (~290 LOC) runs nine phases:

  1. Python pipeline SHA-256 (existing — replays v1 proof)
  2. Production-code mock scan (existing — np.random.rand/randn)
  3. Rust workspace tests        — cargo test --workspace --no-default-features
  4. PyO3 BFLD binding           — cargo check -p wifi-densepose-py
  5. ADR-125 §2.1.d invariant    — identity_risk_score = None in scripts
  6. crates.io publishes         — verifies 12 published crates
  7. npm publishes               — verifies @ruvnet/rvagent
  8. Docker Hub multi-arch       — verifies amd64 + arm64 manifests
  9. HOMECORE binary in image    — runs homecore-server --help inside the image

Flags:
  --quick        skip slow phases (3 + 8 + 9)
  --rust-only    just Phase 3
  --docker-only  just Phases 8 + 9
  --verbose, --audit, --generate-hash pass through to verify.py

Per-phase result is PASS / FAIL / SKIP; SKIP is the honest verdict
when an optional tool (cargo, docker, curl) is absent — no false
green. Final exit is 0 only if every phase that RAN reported PASS.

Empirical (--quick, just now on HEAD 358ca6190):

  PASS Phase 2: no random generators in production code
  PASS Phase 4: wifi-densepose-py compiles cleanly
  PASS Phase 5: identity_risk_score=None at every gateway script
  PASS Phase 6: 12/12 crates on crates.io
       (core 0.3.0, signal 0.3.1, sensing-server 0.3.1, hardware 0.3.0,
        nn 0.3.0, bfld 0.3.0, vitals 0.3.0, wifiscan 0.3.0, train 0.3.1,
        cog-ha-matter 0.3.0, cog-person-count 0.3.0, cog-pose-estimation 0.3.0)
  PASS Phase 7: @ruvnet/rvagent v0.1.0 on npm
  SKIP Phase 9: docker not on this Windows shell PATH
  FAIL Phase 1: v1 pipeline hash mismatch (pre-existing — needs
       `verify --generate-hash` after the latest numpy/scipy bump)

The verify script does its job: Phase 1's FAIL is the proof that the
v1 numerical pipeline has drifted from its last published hash and
needs explicit operator action to regenerate. That is the whole
point of a Trust Kill Switch — fail loud, not silently green.

Co-Authored-By: claude-flow <ruv@ruv.net>

2026-05-26 08:21:18 -04:00

14 KiB

Executable File

Raw Blame History

View Raw