Repository navigation
Beta gap closure a1 a7 - #2
Merged
Merged
Conversation
DEMO_SEED in kernel-arm/src/capabilities.rs issues and verifies every capability token and had no compile-time barrier, unlike the x86 kernel. Add the insecure-demo-keys feature (on by default) and a compile_error! when it is disabled, and a kernel-arm CI step that asserts the --no-default-features build fails with that message. This only stops the demo key shipping by accident; it is not key provisioning.
…MARSHAL is unreachable Deleting a profile is irreversible and reactivation restores service, the same shape as the usage reset that already failed closed. Both are now denied and WORM-audited (authorized=false) when MARSHAL is unreachable, instead of being admitted ungoverned. esim.enable, mvno.bind_profile and mvno.suspend_account stay fail-open, as does x86 spawn_instance. Decision recorded in ADR 0008. Only esim "enable" is named fail-open; any other eSIM op fails closed, so a future op string is not ungoverned by default. The plain-boot (no proxy) EL0 walk changes accordingly: the account stays Suspended, the profile stays Disabled, both SYS_SIM_DELETE calls are denied, and the CI assertions in both plain boots are updated to match. The Enabled-delete rejection and the Deleted state are no longer reachable in a no-proxy boot and remain covered by the sim.rs host tests.
ADR 0007 keeps dry_run: true until operator identity exists and records
that the audited CITADEL source ignores the flag (it still evaluates in
full and appends to WORM) while CITADEL's own docs describe it as a
simulation and a CITADEL_DRY_RUN_ALLOWED=false 400 that the source does
not implement. The "400 on dry-run" hazard is reworded as documented but
not observed.
ADR 0008 records esim.delete and mvno.reactivate_account failing closed.
Fail-open counts ("five of six", "mostly fails open") become three of six
across STATUS, BETA_CRITERIA, the Beta release notes draft, the
enforcement policy and ADRs 0003 and 0006. CHANGELOG gains Unreleased
entries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
it is ok for all the left things we forgot along the way