refactor(release): break the nvattest proof-host import cycle
Audit follow-up to 52d03fd07, 63f871c94, and 4d95e0d45. Two findings were real;
three were assessed and rejected with reasons recorded below.
Binding nvattest into the proof-host channel created an import cycle:
release_nvattest_proof imported TARGET_POLICY from release_proof_host, and
release_proof_host then needed nvattest validators back, which was papered over
with two function-local lazy imports. TARGET_POLICY and TARGET_ENV_KEYS now live
in scripts/release_target_policy.py, a neutral module both import at top level.
The lazy imports are gone, every import site was updated directly, and nothing
is re-exported. release_nvattest_proof's import line changed; its internals did
not.
Also removed two dead locals in the candidate driver: proof_paths, which was
populated and silenced with an underscore assignment, and the unused return of
the target-proof lane call, whose receipts are written to the output paths
passed in and validated later by the shared report path.
Rejected findings, for the record:
- Transparency receipt validators are looser than the driver's inventory gate,
but that path is unreachable: transparency obtains its CandidateReport from
run_recover, which validates the evidence inventory exactly in both
directions, and CandidateReport has no other producer. Adding a redundant
guard would contradict the trust-internal-code invariant.
- The target names in docs/CHANNEL_ADAPTERS.md are pre-existing config-schema
examples naming lane keys operators must type literally, not drift-prone
prose.
- The AGENTS.md inventory-exactness statement is accurate, because the driver
enforces it.
Canonical make ci passes at 15894 passed, 17 skipped. The earlier per-slice runs
used make test-only, which runs neither the formatter check nor ruff; both are
clean now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
refactor(release): break the nvattest proof-host import cycle
Audit follow-up to 52d03fd07, 63f871c94, and 4d95e0d45. Two findings were real;
three were assessed and rejected with reasons recorded below.
Binding nvattest into the proof-host channel created an import cycle:
release_nvattest_proof imported TARGET_POLICY from release_proof_host, and
release_proof_host then needed nvattest validators back, which was papered over
with two function-local lazy imports. TARGET_POLICY and TARGET_ENV_KEYS now live
in scripts/release_target_policy.py, a neutral module both import at top level.
The lazy imports are gone, every import site was updated directly, and nothing
is re-exported. release_nvattest_proof's import line changed; its internals did
not.
Also removed two dead locals in the candidate driver: proof_paths, which was
populated and silenced with an underscore assignment, and the unused return of
the target-proof lane call, whose receipts are written to the output paths
passed in and validated later by the shared report path.
Rejected findings, for the record:
- Transparency receipt validators are looser than the driver's inventory gate,
but that path is unreachable: transparency obtains its CandidateReport from
run_recover, which validates the evidence inventory exactly in both
directions, and CandidateReport has no other producer. Adding a redundant
guard would contradict the trust-internal-code invariant.
- The target names in docs/CHANNEL_ADAPTERS.md are pre-existing config-schema
examples naming lane keys operators must type literally, not drift-prone
prose.
- The AGENTS.md inventory-exactness statement is accurate, because the driver
enforces it.
Canonical make ci passes at 15894 passed, 17 skipped. The earlier per-slice runs
used make test-only, which runs neither the formatter check nor ruff; both are
clean now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
refactor(release): break the nvattest proof-host import cycle
Audit follow-up to 52d03fd07, 63f871c94, and 4d95e0d45. Two findings were real;
three were assessed and rejected with reasons recorded below.
Binding nvattest into the proof-host channel created an import cycle:
release_nvattest_proof imported TARGET_POLICY from release_proof_host, and
release_proof_host then needed nvattest validators back, which was papered over
with two function-local lazy imports. TARGET_POLICY and TARGET_ENV_KEYS now live
in scripts/release_target_policy.py, a neutral module both import at top level.
The lazy imports are gone, every import site was updated directly, and nothing
is re-exported. release_nvattest_proof's import line changed; its internals did
not.
Also removed two dead locals in the candidate driver: proof_paths, which was
populated and silenced with an underscore assignment, and the unused return of
the target-proof lane call, whose receipts are written to the output paths
passed in and validated later by the shared report path.
Rejected findings, for the record:
- Transparency receipt validators are looser than the driver's inventory gate,
but that path is unreachable: transparency obtains its CandidateReport from
run_recover, which validates the evidence inventory exactly in both
directions, and CandidateReport has no other producer. Adding a redundant
guard would contradict the trust-internal-code invariant.
- The target names in docs/CHANNEL_ADAPTERS.md are pre-existing config-schema
examples naming lane keys operators must type literally, not drift-prone
prose.
- The AGENTS.md inventory-exactness statement is accurate, because the driver
enforces it.
Canonical make ci passes at 15894 passed, 17 skipped. The earlier per-slice runs
used make test-only, which runs neither the formatter check nor ruff; both are
clean now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
solpbc.org