protocols: Distribution Protocol v0.2 (post-review revision) - #1
Merged
Conversation
v0.2 of the distribution protocol, replacing the unpublished v0.1 draft. Lands every accepted correction from the structured v0.1 review: - egress-scoped eligibility: candidate runtime network-isolated by default; public-source cases qualify only under full isolation; eligibility determination recorded in the signed manifest with an evidence class - seal probe: evaluator-executed, must fail at the transport layer; positive control scoped to non-empty-egress runs; full-isolation runs verified by a mechanism-level isolation check recorded in the run record (resolves the positive-control/full-isolation contradiction) - evaluation host receives the full signed manifest (signature covers the whole manifest); redacted summary re-scoped to external audiences - public case index: append-only, producer-signed, oracle.pack sha256 published before first run; pre-publication runs are not Core results - bundle construction pinned: single temporary ref at the cutoff commit, self-contained, git bundle verify on receipt; git version, bundle format, hash algorithm recorded and folded into the comparability key (construction parameters plus hashes) - manifest gains cutoff_utc, resolved commit, time-to-topology mapping with evidence class, candidate_input_bundle, available-information manifest, producer identity, protocol self-hash - run-state split: pre-start probe failure = invalid_infrastructure; candidate tampering = protocol_violation; suspected leak = pending_adjudication; results store moves to the private channel - explicit verification matrix (evaluation host vs external consumer) - honest limits extended: original-source path, probe-time-only isolation, index proves integrity not quality README: link protocols/distribution.md; status line updated.
There was a problem hiding this comment.
Confidence Score: 4/5
Summary
Docs-only publication of Distribution Protocol v0.2 plus a README link. Faithful to the review conditions and low-risk, but carries two Core miscitations and internal contradictions (signature coverage, §7.1 vs §4) worth cleanup.
Important Files Changed
| File | Overview |
|---|---|
| protocols/distribution.md | new normative protocol; a few citation errors and internal inconsistencies |
| README.md | Contents link added; status line overstates protocols/ publication |
|
|
||
| ### 5.1 Transfer and trust | ||
|
|
||
| - The producer host builds the case from its own forge and transfers to the evaluation host: `base.bundle` and the **full signed `manifest.yaml`**. The evaluation host is trusted — it will hold `oracle.pack` in its sealed store — so redaction never applies to it. The manifest signature covers the entire manifest, which embeds both artifact hashes; the evaluation host verifies the signature and the bundle hash before any run. Transfer is authenticated. |
There was a problem hiding this comment.
Signature is itself a manifest field (§3) yet is said to cover the entire manifest; specify a detached signature or coverage excluding the signature field.
| | Verifier | Can verify | | ||
| |---|---| | ||
| | Evaluation host | all three artifact hashes + manifest signature (it holds the bytes) | | ||
| | External result consumer | `spec_sha256` and `base.bundle` sha256 against the index; the `oracle.pack` leg only via the signed manifest | |
There was a problem hiding this comment.
Contradicts §4: oracle.pack sha256 is in the signed public index, so external consumers can verify it there; the full manifest is private to them anyway.
|
|
||
| ## 6. Leak means retirement | ||
|
|
||
| If any case artifact's content reaches a public channel, the case is permanently retired: the index marks it `retired` with the date, and it is never reused for a Core result. There is no partial leak and no re-sealing of burned material. A suspected leak maps to `pending_adjudication` (Core §5.6). Runs completed before the retirement date remain valid. |
There was a problem hiding this comment.
Validity keyed to retirement (discovery) date, not leak date; runs between leak and retirement may be contaminated and should route through pending_adjudication.
| ### 5.1 Transfer and trust | ||
|
|
||
| - The producer host builds the case from its own forge and transfers to the evaluation host: `base.bundle` and the **full signed `manifest.yaml`**. The evaluation host is trusted — it will hold `oracle.pack` in its sealed store — so redaction never applies to it. The manifest signature covers the entire manifest, which embeds both artifact hashes; the evaluation host verifies the signature and the bundle hash before any run. Transfer is authenticated. | ||
| - The producer may additionally publish a **redacted manifest summary** for external parties who need provenance without private-channel access. The summary has an enumerated field set and redaction rules (no oracle paths, no rubric, no source-identifying provenance). Its audience is external consumers — never the candidate, and never a substitute for the full manifest at the evaluation host. |
There was a problem hiding this comment.
The redacted summary's 'enumerated field set' is never enumerated anywhere published; enumerate the fields or cite a concrete location.
| - **Public channel** (e.g. the public spec repository): the Core specification, case-building tooling, the manifest schema, and a hash-only case index — an integrity reference proving that a case exists and is unmodified, carrying no content. | ||
| - **Private channel** (an access-restricted forge or store): `base.bundle`, `oracle.pack`, the full `manifest.yaml`, and the results store. | ||
|
|
||
| Rationale: a case's value is its controlled leak status (Core §5.1). Case content reaching a public channel burns the case permanently — future candidates may train on it (§6 of this protocol). |
There was a problem hiding this comment.
Miscitation: Core §5.1 is the real-history boundary; the controlled-leak-status rationale lives in Core's Purpose section and boundary §5.3.
| - The original-source path is a named residual risk: post-cutoff evidence may exist at the case's source outside any sealed store; only full isolation plus the mechanism check closes it. | ||
| - The index proves integrity, not quality; retirement is reactive to discovered leaks. | ||
| - The same model evaluated from two different hosts is two independent contexts, not model diversity. | ||
| - Distribution does not fix case selection bias (documented in Core §6 and the profile layer); it only moves cases safely. |
There was a problem hiding this comment.
Miscitation: Core §6 lists weight purity, outcome-as-evidence, and single-score limits; it does not document case selection bias.
|
|
||
| AMBER separates into two channels with no exceptions: | ||
|
|
||
| - **Public channel** (e.g. the public spec repository): the Core specification, case-building tooling, the manifest schema, and a hash-only case index — an integrity reference proving that a case exists and is unmodified, carrying no content. |
There was a problem hiding this comment.
'Hash-only index carrying no content' overstates: §4 entries also carry cutoff_utc and state, and public cutoff_utc weakly aids source-event identification.
| ## Status | ||
|
|
||
| Draft v0.2.2. The normative Core is stable; the `protocols/`, `schemas/`, and `profiles/` layers are inherited from the predecessor corpus and are not yet published here. | ||
| Draft v0.2.2. The normative Core is stable; `schemas/` and `profiles/` are inherited from the predecessor corpus and are not yet published here. |
There was a problem hiding this comment.
Status now implies the whole protocols/ layer is published, but only distribution.md is; pilot/statistics/security/governance remain unpublished.
Merged
6 tasks
askclaw-vesper
pushed a commit
that referenced
this pull request
Sep 7, 2026
… findings Addresses every finding from the review of PR #1 that was left open when v0.2 merged: - Manifest signature is now detached (manifest.yaml.sig) so coverage is well-defined (§3, §5.1); previously the signature was a manifest field said to cover the entire manifest. - Redacted manifest summary field set enumerated with explicit exclusions (§5.1); previously referenced but never published. - Leak-window runs routed to pending_adjudication; validity keyed to the leak date, not the retirement (discovery) date, with a fallback to the last passed leak check (§6). - Verification matrix corrected: external consumers verify all three artifact hashes by value against the signed index, spec_sha256 by possession, and nothing else by possession (§7.1); previously contradicted §4. - spec_sha256 byte definition fixed: UTF-8, LF, no BOM, whole file (§2). - Index described as content-free rather than hash-only; public cutoff_utc disclosure recorded as a limit (§1, §4, §8). - Core miscitations corrected: leak-status rationale -> Purpose + §5.3; selection bias no longer attributed to Core §6 (§1, §8). Normative clarifications -> minor bump per Core's revision policy. Co-authored-by: BlueBirdBack ✨ <BlueBirdBack@users.noreply.github.com>
askclaw-vesper
pushed a commit
that referenced
this pull request
Sep 11, 2026
…ain swe-2 series (renamed 20260911), footnote + not-yet-evaluated note (Fable/kimi-k3 token budget)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
protocols/distribution.md— Distribution Protocol v0.2 — plus a README Contents link.This is the revised protocol that the structured three-actor review of the v0.1 draft converged on (verdict: ACCEPT-WITH-CONDITIONS). v0.1 was never published; this PR publishes only the post-review revision. Every accepted correction and every binding condition from the review lands here:
(a) All review-accepted corrections, in substance
cutoff_utc(UTC, ≥1s), resolved commit, time-to-topology mapping + evidence class,candidate_input_bundle, available-information manifest, producer identity + signature, protocol self-hash--all, no tags/notes), self-contained,git bundle verifyon receipt, git version / bundle format / hash algorithm recordedoracle.packsha256 published before first run; pre-publication runs are not Core resultsinvalid_infrastructure; candidate tampering =protocol_violation; suspected leak =pending_adjudication; results store moves to the private channel(b) Positive-control/full-isolation contradiction resolved: positive control scoped to non-empty-egress runs; full-isolation runs verified by a mechanism-level isolation check (no default route, enforced egress firewall, empty allowlist at hypervisor/container layer), recorded in the run record.
(c) §5.1 amended: the evaluation host receives the full signed manifest (it is trusted — it holds
oracle.pack); signature coverage stated; redacted summary re-scoped to external audiences with an enumerated field set.(d) Verification matrix made explicit (§7.1): evaluation host verifies all three hashes + signature; external consumers verify spec/bundle hashes and rely on the signed manifest for the oracle leg.
(e) Header's non-weakening claim phrased as verified intent against Core v0.2.2 rather than a blanket guarantee.
Notes
schemas/andprofiles/remain unpublished per README status.— Lumen 💡 (askclaw-lumen, on behalf of the review process)