fix(assurance): repair AF-02 retention and rustls advisory bootstrap

Merged
TH
17d ago
+358-3

Purpose

Resolve the two independently owned assurance blockers that currently form a strict required-check merge cycle on main:

  • #100 — AF-02 historical retained-authority reconstruction fails after Actions artifact 9255732702 aged out of GitHub retention;
  • #99 — RUSTSEC-2026-0285 applies to resolved rustls 0.23.43 through ureq 3.4.0.

These fixes are combined only because the active commandF main assurance ruleset requires rust, assurance-proof, and scorecard with strict required-status-check policy and no bypass actors. Either repair alone remains blocked by the other required check. No gate is waived or bypassed.

Exact scope

This candidate is bounded to five paths:

  • Cargo.lock
  • crates/commandf-pkg/tests/af02_authority_reconstruction.rs
  • specs/017-af-02-retained-authority-durability/spec.md
  • specs/017-af-02-retained-authority-durability/plan.md
  • specs/017-af-02-retained-authority-durability/tasks.md

No product runtime source, Cargo manifest, workflow, ruleset, CF-06 pin, CF-10 corpus, retained-authority source record, authority-baseline schema/snapshot, or shared candidate verifier is changed.

#100 — AF-02 safety model

The repair adds a live-reconstruction-only boundary:

  • the canonical retained contract is still loaded from pinned authority-base commit 54b9772a3b86464da6f395f8ba8371f364c9bb38, exact blob f9c0bc16ac742238c93ff77a85486cd1db5dbcf3;
  • live workflow run 31916124080 must still verify exactly;
  • when the live artifacts API is non-empty, the existing strict verify_artifacts path is unchanged;
  • only exact structurally valid {"total_count":0,"artifacts":[]} from the live historical run is classified as HISTORICAL_UNAVAILABLE;
  • the recorded historical artifact identity/digest remains bound to the pinned canonical retained contract;
  • semantic retained projection still comes from exact immutable manifest/donor Git blobs;
  • generated AF-02 authority baseline must remain byte-identical.

The shared verify_artifacts implementation is unchanged. A regression proves the same empty collection still fails through that shared candidate-input verifier, preventing candidate self-green.

Historical identity remains:

artifact id: 9255732702
artifact name: cf10-real-corpus-evidence
artifact sha256: 9fdde985bb5abbe53ec2bce2dadc5f65c95557f8848c9af68755fc81a45af612
workflow run: 31916124080
retained head: 5fe10d9859407272acf6649fc3e868d3eb2fbd12
retained base: 5cb1a4c3445c0ebd86654cfb467a5e008e801c3e

No replacement artifact identity is invented.

#99 — dependency-security repair

The lockfile candidate was generated by repository-pinned Rust 1.97.1 using:

cargo update -p rustls --precise 0.23.45
cargo metadata --locked --format-version 1

A byte-exact probe required generated Cargo.lock to equal canonical Cargo.lock with only:

rustls 0.23.43
checksum 0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06

->

rustls 0.23.45
checksum 0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634

Generated lock SHA-256:

d7e3050b3ff81fc39db61a0345875de6c0b7bc7ca48cc7f432a1f2ba14653648

Probe run 36618372223 generated, verified, and fast-forwarded commit 3ebe793 onto this branch after an exact target-head guard. That commit changed exactly one file with two insertions and two deletions.

No Cargo manifest change, ureq upgrade, dependency-family refresh, advisory waiver, source change, or unrelated lockfile mutation is authorized.

Prior exact-head evidence

Before the dependency repair was added, AF-02-only head 29184e424d1915bf457b7a3556970566182d20c7 proved #100 independently:

  • ci run 36616122386: SUCCESS, including full tests and AF-02 reconstruction;
  • cf06-oracle 36616122145: SUCCESS;
  • cf11g-context-proof 36616122265: SUCCESS;
  • cf11-multi-version-proof 36616122612: SUCCESS;
  • cf12-impact-proof 36616122546: SUCCESS;
  • cf13-quality-gate-proof 36616122312: SUCCESS;
  • af01-scorecard 36616122631: SUCCESS.

The only red workflows on that head were af01-security and af01-assurance-proof, both independently attributable to #99.

This prior-head evidence proves component isolation; it is NOT reused as final-head merge qualification.

Final qualification required

No final PASS or merge-readiness claim is made until the current exact head proves:

  • bounded five-path compare;
  • exact lockfile delta;
  • full ci / AF-02 baseline equality;
  • af01-security and af01-assurance-proof green with the RustSec advisory absent;
  • all other triggered proof workflows green;
  • substantive review threads dispositioned;
  • Jev independent review where technically executable;
  • Alibaba Open Code Review where technically executable;
  • current protected review/merge governance satisfied.

If Jev or Alibaba OCR cannot execute in the available environment, that limitation will be recorded explicitly; no synthetic PASS will be created.

Automatic CodeRabbit/Qodo/Cubic summaries or statuses are not qualification evidence.

Normal merge only. No rebase, force-push, history rewrite, or required-check bypass.