Skip to content

v0.1.25.34 — CyclesEvidence epoch + committed-metadata fix

Choose a tag to compare

View all tags
@amavashev amavashev released this 18 Jun 17:07
· 181 commits to main since this release
v0.1.25.34
4ff7e80
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The CyclesEvidence epoch — synchronous evidence binding + signer-key resolution — plus this cycle's fixes, since v0.1.25.21.

CyclesEvidence (v0.1.25.22–.32)

End-to-end attestation binding for the budget lifecycle:

  • Synchronous evidence_id + cycles_evidence on reserve, fanned out to decide / commit / release and the error artifact — the full lifecycle binding loop.
  • Content-addressed envelope serving (getEvidence, GET /v1/evidence/{id}).
  • Signer JWK Set publication (getEvidenceJwks, GET /v1/.well-known/cycles-jwks.json) — signer-key resolution v0.2.
  • Idempotency-race hardening and byte-parity proven across all five artifact types.

Signer-key rotation (v0.1.25.33)

  • Retired-key rotation history in the published JWK Set, with a fail-safe nbf clamp so the active key can't resolve as valid for pre-rotation evidence.

Fixes

  • v0.1.25.34 — surface commit-time committed_metadata on getReservation (#197; the field was previously persisted but write-only).
  • v0.1.25.31 — suppress duplicate side-effect events on idempotent reserve replay.
  • v0.1.25.16–.19 — supply-chain CVE patches (Tomcat, commons-lang3, Spring Boot).

Evidence is inert by default — operators opt in via EVIDENCE_SIGNING_* / EVIDENCE_SERVER_ID. Pairs with cycles-server-events v0.1.25.14. See AUDIT.md for full per-version detail.

Assets 2
Loading