feat(sync): add verifiable global-sync foundation#1985

Merged

gltanaka merged 128 commits into

mainfrom

codex/issue-1932-verifiable-goal

Jul 12, 2026

Commits on Jul 12, 2026

feat: add verifiable global sync foundation

Greg Tanaka
authored and
Greg Tanaka
committed
feat: enforce canonical sync proof boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix: harden sync transaction destination writes

Greg Tanaka
authored and
Greg Tanaka
committed
fix: block unstaged protected sync mutations

Greg Tanaka
authored and
Greg Tanaka
committed
feat: bind candidate wheel to sync certificate

Greg Tanaka
authored and
Greg Tanaka
committed
docs: record round nine sync blockers

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce foundation CI regressions

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): resolve foundation CI regressions

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce remaining CodeQL alerts

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): eliminate remaining CodeQL alerts

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce remaining foundation regressions

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): restore foundation compatibility boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce xhigh review findings

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): harden xhigh certification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce xhigh re-review findings

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close xhigh re-review gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix: harden sync certification harness

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce top-level pytest probe shadow

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): load pytest collection probe by absolute path

Greg Tanaka
authored and
Greg Tanaka
committed
test(heal): reproduce manual-merge operation failure

Greg Tanaka
authored and
Greg Tanaka
committed
fix(heal): skip manual-merge terminal operations

Greg Tanaka
authored and
Greg Tanaka
committed
fix: harden candidate lifecycle wheel install

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): cover pytest support isolation gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind pytest support and private home

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce unbound candidate wheel provenance

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind candidate wheel to certified source

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): verify candidate provenance in certificate paths

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): isolate protected pytest execution

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): align verifier fixture with provenance policy

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): keep runner contract lint-clean

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce CLI candidate replay gap

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): wire candidate replay ledger in certify

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce concurrent candidate replay race

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): make candidate replay ledger atomic

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce historical provenance expiry

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): validate historical provenance at observation time

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce protected pytest closure gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): protect exact-head pytest closure

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce unmeasured lifecycle runtime lock

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind measured lifecycle runtime inputs

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): keep hardened foundation lint-clean

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce round-nine trust-boundary gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close provenance and support-closure gaps

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce sandbox loader and replay gaps

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): require lifecycle measurement schema

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): enforce verifiable execution and replay boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): expose remaining verification boundary gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): require portable verifiable boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): define protected replay root boundary

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): anchor candidate replay storage at protected root

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): expose round 11 trust boundary gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close round 11 verification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): expose round 13 verification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close round 13 verification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): ignore reaped supervised processes

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): provision hosted runner sandbox with sudo

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce protected runner review gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close protected runner review gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): repair Linux smoke workflow syntax

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): drop sandbox privileges after mounts

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preopen private sandbox mounts

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): stage private sandbox bind sources

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): create isolated mount ancestry

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): retain host uid in protected namespace

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve runtime loader mount aliases

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): mount exact protected repository inputs

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): mount checker collection probe

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): add focused protected runner CI lane

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce next review boundary gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close next review trust boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce five review findings

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close five verification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve worker outcomes across checker boundary

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): retain protected collection diagnostics

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce exhaustive review findings

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close exhaustive verification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): separate candidate result channels

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve legacy policy fast path

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): bound canonical policy activation

Greg Tanaka
authored and
Greg Tanaka
committed
ci: bound broad unit suite with measured margin

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): cache committed policy activation

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce high review boundary gaps

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close high review verification boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce CLI preflight state writes

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preflight CLI before state bookkeeping

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): reproduce remaining high review boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close remaining high review boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve protected pytest diagnostics

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): cover complete trusted runtime boundaries

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind protected runtime and signer containment

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): mount post-drop sandbox executable

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve sandbox loader mount paths

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): tolerate unsupported host tool permissions

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): gate signer containment on Linux

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve interpreter mount spelling

Greg Tanaka
authored and
Greg Tanaka
committed
perf(sync): cache measured runtime closure digest

Greg Tanaka
authored and
Greg Tanaka
committed
perf(sync): retain runtime byte-change invalidation

Greg Tanaka
authored and
Greg Tanaka
committed
perf(sync): cache released runtime path discovery

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): mount interpreter libraries and elevate signer scope

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): cover resolved runtime library mounts

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind resolved runtime dependencies

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): place signer readiness marker outside tmpfs

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): cover measured loader search paths

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): expose measured loader directories

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): prevent mocked runtime cache poisoning

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preserve protected execution diagnostics

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): retain checker diagnostics outside candidate files

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): retain bound directory ancestry

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind resolved nested interpreters

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): cover interpreter sandbox mount destinations

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): bind runtime paths at namespace spellings

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): cover limited command interpreter mount

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): mount limited command interpreter

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): expose protected collection failures early

Greg Tanaka
authored and
Greg Tanaka
committed
perf(sync): hash measured runtime concurrently

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): expose trusted collection probe

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): create trusted junit channel before binding

Greg Tanaka
authored and
Greg Tanaka
committed
perf(sync): deduplicate measured runtime roots

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): restore protected imports and signer readiness

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): stream contained signer diagnostics

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): retain signer timeout diagnostics

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): isolate protected signer containment smoke

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): preserve signer startup failure diagnostics

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): expose signer readiness after tmp isolation

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): verify detached signer by host pid

Greg Tanaka
authored and
Greg Tanaka
committed
test(sync): detect detached signer by command marker

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): close pytest shadow and replay aliases

Greg Tanaka
authored and
Greg Tanaka
committed
fix(sync): preload trusted collection probe

Greg Tanaka
authored and
Greg Tanaka
committed

Uh oh!

Commits

Commits on Jul 12, 2026