Demo page: in-browser verification of committed evidence - #139
Merged
Conversation
…evidence Static GitHub Pages site under demo/: the centerpiece verifies a real committed Ed25519 decision ledger and SHA-256 content bindings in the visitor's browser via WebCrypto; tampering genuinely breaks verification. HMAC seat-packet verification is excluded by design (symmetric — a browser demo would be theater) and deferred to the local fail-closed proof, mirroring sign.mjs's HONEST RESIDUAL threat model. Design direction selected in session; implementation planning and authority remain separate steps.
…style) Also tightens two spec lines found during planning: the generator scenario is the proof's out-of-bounds needs-human path (not in-bounds), and the canonicalization port's true source is forge/operator.mjs's canonical/ entryBytes — the ledger's actual signer — with parity proven end-to-end (operator signs, port must verify) since those routines are module-private.
…oard tampering Ledger sig.signed_fields was unauthenticated (entryBytes strips sig entirely), so tampering it verified as ok — now rejected with unsupported-signed-fields. Also guards beginEdit against re-entrant opens that wiped edited content, and adds keyboard (Enter/Space) activation for click-to-tamper fields so the demo works without a mouse. Reconciles the spec's Testing item 1 with the actual end-to-end operator-parity test.
Clotho's closed-inventory completeness guard (test-inventory) correctly failed CI on the new demo/ package.json: every tracked package dir must be a committed, reviewed classification. demo/ is a sibling static site, not part of the TELOS build-gate spine Clotho weaves, so it is excluded — the same classification as forge, saas-forge, and ai-forge. Enrolling it in the weave (PACKAGE_ROOTS) would be a governance change and is deliberately NOT done here.
…ries, and Iliad deferral registry The owner consciously classified demo/ as package_roots_exclude (the on_new_package rule's required human decision). This propagates that classification to the three records verify-contracts pins: package-roots contract, the excluded-roots comprehension query, and the Iliad deferred_pending_conscious_enrollment registry. Exclusion, not enrollment — enrolling demo/ in the weave would require the full amendment path per the contract's change_rule.
… for demo/ The comprehension gate grades the example correct reader against clotho/memory/comprehension-queries.json; after the demo/ classification its excluded-roots answer was stale, so the entry ritual denied the correct reader (exit 3). verify-contracts: 301/301 locally.
…for demo/ classification clotho/inventory.mjs is in the orchestrator closure, so the demo/ classification changed its content address and the committed self-weave evidence no longer verified (closure-inequality, D33). Regenerated via the full clean-checkout run (ok:true, full package tests, 4554 edges / 1097 nodes — growth is this branch's own docs and records being woven; hub/g2 subjects and risk classes unchanged). Propagated the new snapshot digest to lachesis' snapshot-manifest, golden metrics contract, and test goldens, and rebuilt narcissus/flagship's live-graph projection. Local gates: verify-contracts 301/301; self-weave --verify-committed ok; lachesis 82+18 pass; clotho 14 tests; flagship green; fail-closed proof untouched and passing.
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
A static GitHub Pages site under
demo/whose centerpiece verifies real committed evidence in the visitor's browser: an Ed25519-signed decision ledger (produced once by the actualforge/operator.mjs) and a SHA-256 content-addressed record. Visitors can tamper with any field and watch genuine WebCrypto verification fail —BLOCKED invalid-signature,unsupported-signed-fields, ordigest-mismatch— then reset toVERIFIED.The page claims only what it honestly verifies: HMAC seat packets are symmetric, so browser verification of them would be theater — the page says so and routes that half to the local proof (
node docs/runs/fail-closed-demo/run.mjs), mirroringsign.mjs's HONEST RESIDUAL threat model.Contents
docs/superpowers/specs/2026-07-30-telos-demo-page-design.md,docs/superpowers/plans/2026-07-30-telos-demo-page.mddemo/verify.js— zero-dep port of the operator's canonicalization + WebCrypto verification; parity proven end-to-end (the real operator signs, the port must verify)demo/generate-artifacts.mjs— one-shot generator (throwaway tmpdir; only the public JWK is exported; self-checks before writing)demo/artifacts/— committed evidence (ledger, public key, content-addressed record)demo/index.html+app.js+style.css+build-path.svg— five-section page, no framework, no build step.github/workflows/pages.yml— Pages deploy withenablement: true;ci.ymlgains ademomatrix entry (npm test, Node 18/20)Review trail
Five task-scoped review gates, then a whole-branch review that caught and fixed one Critical (
sig.signed_fieldstamper previously verified as ok — verifier now rejects unexpectedsigned_fields), two Importants (re-entrant edit wiping field values; keyboard-inoperable tamper fields), and a re-review-caught regression in the keyboard fix (keydown bubbling from the edit input). Full suite green; the untouched fail-closed proof still passes.After merge
The Pages workflow self-enables and deploys
https://dsmcewan.github.io/TELOS/. Recommended: run the tamper flows once against the live URL (the visual rendering is the one thing headless checks couldn't cover).🤖 Generated with Claude Code
https://claude.ai/code/session_01GgTCQDAzZUvmEDrVSLuRJs