Revised per PR #480 (#5607 owner clarification + #5608 codex resolution;
#5612 directs the update):
- The audit row no longer implies upstream observation or agent-only
authorship. Reworded the guarantee: the row cryptographically binds
commit bytes (control-plane-RECOMPUTED SHA) to access to the activation
signing key, and binds that key to control-plane-owned activation
metadata. An agent can sign arbitrary contents but cannot verify as a
different activation or choose the recorded metadata.
- Control plane accepts gateway-delivered opaque bytes, independently
recomputes the Git object ID, verifies the embedded signature against
the activation key, and stamps its own metadata. Trusts no gateway
SHA/key/verdict/metadata. No upstream fetch.
- Purged overclaims: removed "a compromised gateway cannot fabricate an
audit binding" (the sidecar holds the signing capability, so it can —
and that's acceptable under the intended guarantee), plus "accepted
push" / "introduced upstream" framing.
- Resolved the control-plane-transport open question in-PRD (was left
open; codex asked to resolve): transport is gateway bytes +
recompute + verify; mirror-read is no stronger.
Issue: #423
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Revised per PR #480 review (#5590 + didericis-codex review on d8362ec):
- Remove author/committer enforcement entirely (#5590). The gate no
longer matches identity fields; author/committer are recorded as
claims in the audit store. Drop the git-gate.signing.enforce knob
(which also resolves codex issue 1: a knob that weakened the stated
guarantee). Add a "Deferred: identity enforcement" section noting it
as a possible future add. Rename PRD/file to "signed commits & audit
attribution" since identity is no longer guaranteed.
- Fix control-plane vs data-plane verification (codex issue 2, PRD 0070):
git-gate (data plane) does a synchronous pre-forward SIGNATURE check
only; the orchestrator/control plane (sole owner of bot-bottle.db)
independently re-verifies each signature before writing attributed_commit.
A gateway assertion alone never creates an audit row. New "Trust
boundary" + "Control-plane verification & recording" sections.
- Reframe the guarantee to signed provenance + host-owned, independently
verified audit record; ADR 0002 "claimed, not vouched" posture kept.
- attributed_commit now records claimed author/committer columns.
Issue: #423
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
didericis-claude