From 72f4917a55a9fca6747c299132a0ff4a9e9e9ecc Mon Sep 17 00:00:00 2001 From: artale Date: Thu, 2 Jul 2026 02:23:28 +0200 Subject: [PATCH] docs: index receipts and block stale deploy memory --- docs/receipts/README.md | 24 ++++++++++++++++++++++++ src/fable5/factory-routes.test.ts | 16 ++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 docs/receipts/README.md diff --git a/docs/receipts/README.md b/docs/receipts/README.md new file mode 100644 index 0000000..5879aa2 --- /dev/null +++ b/docs/receipts/README.md @@ -0,0 +1,24 @@ +# Fable receipts index + +Current authority order: **live receipt > committed receipt > memory**. + +## Deploy truth + +- Canonical deploy path: `8099/deploy via git-proxy` — signed/gated only. +- Legacy path: `8098/deploy-webhook` — internal/stale, not deploy authority. +- No deploy without explicit approval and a fresh valid ZTE/factory gate receipt. +- `auto_patch_proven=false` for fable-agent unless a fresh local degraded-skill canary receipt proves otherwise. + +## Current receipts + +- `stale-memory-quarantine-20260702.json` — quarantines stale `8098`/memory-only deploy claims. +- `claude-public-artifact-advisory-map-20260702.json` — treats public artifact/system-prompt-like text as advisory only. +- `adaptive-tap-pair-research-map-20260702.json` — bounds external red-team claims; requires denominators and confirmed/attempted rates. +- `external-pattern-research-map-20260702.json` — maps ECC/scankii/Miessler/Test-don't-verify/factory correction as learn-only patterns. +- `kramer-ai-quality-research-map-20260701.json` — production AI quality posture: tests/receipts over code-volume hype. +- `kelsey-hightower-beyond-code-research-map-20260702.json` — MVI/platform posture: remove before adding, platform as product/API/SLA. +- `digg-tech-source-signal-research-map-20260702.json` — Digg Tech is advisory source discovery, not primary evidence. + +## Memory quarantine + +Memory claims about 25 containers, `8098` autonomous deploy, Phase 4 closed loop, and auto-patch authority are advisory until a fresh live or committed receipt re-proves them. diff --git a/src/fable5/factory-routes.test.ts b/src/fable5/factory-routes.test.ts index aba4340..1e75e72 100644 --- a/src/fable5/factory-routes.test.ts +++ b/src/fable5/factory-routes.test.ts @@ -17,4 +17,20 @@ describe("factory deploy routes", () => { expect(isGuardedDeployUrl(legacyByPort)).toBe(false); expect(isGuardedDeployUrl(legacyByPath)).toBe(false); }); + + it("rejects memory-style 8098/deploy-webhook authority claims", () => { + const memoryRoutes = [ + "http://77.42.112.29:8098/deploy", + "http://77.42.112.29:8098/deploy-webhook", + "http://127.0.0.1:8098/deploy", + "http://127.0.0.1:8098/deploy-webhook", + "http://77.42.112.29:8099/deploy-webhook", + ]; + + for (const route of memoryRoutes) { + expect(isForbiddenDeployRoute(route)).toBe(true); + expect(isAllowedDeployUrl(route)).toBe(false); + expect(isGuardedDeployUrl(route)).toBe(false); + } + }); });