Repository navigation
fix(security): adopt patched workerd certificate rejection - #63
Merged
Merged
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesPins workerd and its platform binaries to 1.20261021.1 while retaining Wrangler and Miniflare. Example: A local Worker fetches https://dv-g3b-emudhra.we-have-a-problem.com/ with explicit historical CA roots.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: main still selects the older workerd engine, and this focused security update has no actionable findings. Priority: P2 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherBun resolves the native workerd engine used by Wrangler and Miniflare for local Worker execution; outbound HTTPS passes through its certificate verifier. flowchart LR
A[Bun dependency override] --> B[Wrangler]
B --> C[Miniflare]
C --> D[Native workerd]
D --> E[Outbound TLS verification]
E --> F[Fetch response or handshake error]
Technical reviewBest possible solution: Adopt the focused dependency pin through the existing Bun configuration and lockfile. Do we have a high-confidence way to reproduce the issue? Published native results from the exact frozen main baseline accept all 14 incident chains in both trust modes; this review inspected those results without running target code. Is this the best way to solve the issue? The existing dependency override is the smallest complete consumer fix and avoids application-level TLS workarounds. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against bb0e716ac82b. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes: No label changes. Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReviewed October 26, 2026, 5:55 AM ET / 09:55 UTC (Revision 3). |
Contributor
Author
|
Native TLS proof supplement for final source This addresses the actual review by publishing retained native macOS ARM64 output. The shared candidate proof contains the complete exact-candidate 32-row matrix, all 14 successful independent chain+exact-hostname controls with DER/SPKI identities, both complete native rejection logs with matched error references, the executed fixture Worker/harness, historical-root hash, and public/private-CA positive controls. That is the same native candidate binary selected by this repository: SHA256 Source head
Historical CA SHA256 Observed boundary and limitation: The exact candidate's raw errors say The standalone fixture Worker exercises the actual installed native executable's outbound-fetch boundary; application bundle build/startup and owning gates below are separate evidence. This proves local development/test runtime adoption within macOS ARM64; it does not establish Cloudflare managed-fleet delivery, production deployment, other architectures or unrelated application features. Local full Bun suite has 328 pass/4 fail with missing native artwork tools. Controlled base replay with matching runtime/PATH and frozen old dependencies reproduces the same four test names/assertion/missing-tool phases; the attribution receipt is included. Owning hosted head CI subsequently passed as recorded by the coordinator. This supplement does not replace either actual result with an assumed pass. Exact source/native artifacts and installed resolver{
"head": "cee909c475fccdfafb7a637b6ddc6e0fb3ec3e64",
"base": "bb0e716ac82b1f2b87274f4d934571e5dd499216",
"patchSha256": "b196660230e2e98a61e35474a195fb3e1f44786272301914123857921852ed47",
"sourceFiles": [
{
"path": "bun.lock",
"sha256": "738a3efd32cb2c50948bf5fe1b40c1d67ae1471fda85861f65b93e5014da5fb3"
},
{
"path": "package.json",
"sha256": "b16c09b9d8b57823286737f9af51ba7f3fe5bf0be5ba655a0f532dd82ddc0fb8"
}
],
"nativeArtifacts": [
{
"label": "hermit-baseline",
"path": "<TASKROOT>/native-engine/baseline-hermit/workerd",
"sha256": "ddafaa2a1c1f68ffad60f843c8ddaf46fa855a7da3391ce9fea0702ac14c5ef8",
"version": "workerd 2026-10-06"
},
{
"label": "candidate",
"path": "<TASKROOT>/native-engine/1.20261021.1/workerd",
"sha256": "44a06c31a6578f234cdf7f23219b88978c8d8d21cb8ce85795cab53614b50d64",
"version": "workerd 2026-10-21",
"npmIntegrity": "sha512-OZ6Qkc9EwNl6kOyEBBQIOmOsbIfWCeR7F6h0EcScdjQLIB6drsmSpEZuBC3gAgz/eqDqjDrDCbPAA7jDllxIMw==",
"tarballSha256": "0ffe5070b2494dad46121253e9268115bc94b37a69eb7283d3a05f5439c1ba06",
"metadataSha256": "a4e17e123709b78c21ff04a106c42acea0314259262f1e19d8f642e5f76e3d4e"
}
],
"installedResolver": {
"wrangler": "4.148.0",
"miniflareEntry": "<TASKROOT>/hermit/repo/node_modules/miniflare/dist/src/index.js",
"workerdExecutable": "<TASKROOT>/hermit/repo/node_modules/@cloudflare/workerd-darwin-arm64/bin/workerd",
"sha256": "44a06c31a6578f234cdf7f23219b88978c8d8d21cb8ce85795cab53614b50d64"
}
}All 32 retained baseline result rows (both trust modes, incident and legitimate controls){"engine":"hermit-baseline","mode":"explicit-only","url":"https://example.com/","startedUtc":"2026-10-26T09:07:00.404232+00:00","result":{"ok":true,"status":200,"body":"<!doctype html><html lang=en><head><meta charset=utf-8><link rel=icon href=data:,><meta name=viewport content=\"width=dev"},"elapsedSeconds":0.042}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://localhost:19889/","startedUtc":"2026-10-26T09:07:00.446733+00:00","result":{"ok":true,"status":200,"body":"workerd-native-mac-private-positive"},"elapsedSeconds":0.004}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://dv-g3b-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:00.451298+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.173}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://dv-g3c-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:00.625519+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ov-g3b-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:00.797022+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.173}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ov-g3c-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:00.970437+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ev-g3b-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:01.142608+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ev-g3c-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:01.314149+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.172}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://dv-g3b-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:01.486877+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://dv-g3c-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:01.658396+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.17}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ov-g3b-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:01.829251+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.173}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ov-g3c-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:02.002731+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ev-g3b-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:02.174948+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://ev-g3c-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:02.346631+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://dv-g3b-noct-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:02.518965+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.544}
{"engine":"hermit-baseline","mode":"explicit-only","url":"https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:03.063537+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.543}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://example.com/","startedUtc":"2026-10-26T09:07:03.718517+00:00","result":{"ok":true,"status":200,"body":"<!doctype html><html lang=en><head><meta charset=utf-8><link rel=icon href=data:,><meta name=viewport content=\"width=dev"},"elapsedSeconds":0.034}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://localhost:19889/","startedUtc":"2026-10-26T09:07:03.753020+00:00","result":{"ok":true,"status":200,"body":"workerd-native-mac-private-positive"},"elapsedSeconds":0.004}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://dv-g3b-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:03.757693+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://dv-g3c-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:03.929761+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.173}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ov-g3b-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:04.103803+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.169}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ov-g3c-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:04.273903+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.172}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ev-g3b-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:04.446448+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.173}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ev-g3c-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:04.619824+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.172}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://dv-g3b-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:04.793038+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://dv-g3c-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:04.964919+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.172}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ov-g3b-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:05.137990+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ov-g3c-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:05.310003+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ev-g3b-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:05.482200+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.171}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://ev-g3c-aaa-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:05.653994+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.172}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://dv-g3b-noct-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:05.826531+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.544}
{"engine":"hermit-baseline","mode":"system-plus-explicit","url":"https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/","startedUtc":"2026-10-26T09:07:06.371607+00:00","result":{"ok":true,"status":200,"body":"Your client successfully connected to the site. That's bad!\n"},"elapsedSeconds":0.543}Actual frozen baseline install{
"repo": "hermit",
"stage": "baseline-install",
"command": [
"bun",
"install",
"--frozen-lockfile"
],
"exitCode": 0,
"elapsedSeconds": 5.255,
"runtime": "v26.12.1",
"bun": "1.4.4",
"packageRoot": "<TASKROOT>/hermit/repo",
"artifacts": [
{
"path": "<TASKROOT>/hermit/repo/node_modules/@cloudflare/workerd-darwin-arm64/bin/workerd",
"sha256": "ddafaa2a1c1f68ffad60f843c8ddaf46fa855a7da3391ce9fea0702ac14c5ef8",
"version": "workerd 2026-10-06"
}
],
"recordedUtc": "2026-10-26T09:04:40.859213+00:00"
}Candidate install and exact resolution{
"repo": "hermit",
"commands": [
{
"command": [
"bun",
"install",
"--lockfile-only",
"--ignore-scripts"
],
"exitCode": 0,
"elapsedSeconds": 0.241
},
{
"command": [
"bun",
"install",
"--frozen-lockfile"
],
"exitCode": 0,
"elapsedSeconds": 4.027
}
],
"artifacts": [
{
"path": "<TASKROOT>/hermit/repo/node_modules/@cloudflare/workerd-darwin-arm64/bin/workerd",
"sha256": "44a06c31a6578f234cdf7f23219b88978c8d8d21cb8ce85795cab53614b50d64",
"version": "workerd 2026-10-21"
}
],
"identityExit": 0,
"identity": "{\"wrangler\":\"4.148.0\",\"miniflareEntry\":\"<TASKROOT>/hermit/repo/node_modules/miniflare/dist/src/index.js\",\"workerdExecutable\":\"<TASKROOT>/hermit/repo/node_modules/@cloudflare/workerd-darwin-arm64/bin/workerd\",\"sha256\":\"44a06c31a6578f234cdf7f23219b88978c8d8d21cb8ce85795cab53614b50d64\"}\n",
"recordedUtc": "2026-10-26T09:10:00.166448+00:00",
"lockSha256": "738a3efd32cb2c50948bf5fe1b40c1d67ae1471fda85861f65b93e5014da5fb3"
}Owning validation commands and actual exit results[
{
"command": [
"bun",
"run",
"typecheck"
],
"label": "typecheck",
"exitCode": 0,
"elapsedSeconds": 1.469
},
{
"command": [
"bun",
"run",
"test"
],
"label": "tests",
"exitCode": 1,
"elapsedSeconds": 5.367
},
{
"label": "dry-run",
"command": [
"wrangler",
"deploy",
"--dry-run",
"--outdir",
"<TASKROOT>/hermit/rebuilt-worker"
],
"exitCode": 0,
"elapsedSeconds": 1.784
}
]Actual local product startup/result{
"repo": "hermit",
"stage": "candidate",
"command": [
"wrangler",
"dev",
"--local",
"--ip",
"127.0.0.1",
"--port",
"19919",
"--inspector-port",
"19920",
"--persist-to",
"<TASKROOT>/hermit/state/candidate",
"--var",
"BASE_URL:http://127.0.0.1:19919",
"--var",
"DISCORD_CLIENT_ID:123456789012345678",
"--var",
"DISCORD_PUBLIC_KEY:0000000000000000000000000000000000000000000000000000000000000000",
"--var",
"DISCORD_BOT_TOKEN:<SYNTHETIC_BOT_TOKEN>",
"--var",
"DEPLOY_SECRET:<SYNTHETIC_DEPLOY_SECRET>"
],
"startedUtc": "2026-10-26T09:14:30.274159+00:00",
"requests": [
{
"path": "/",
"status": 404,
"body": "Not Found"
},
{
"path": "/forms",
"status": 404,
"body": "Not Found"
}
],
"ready": true,
"processExitBeforeCleanup": null,
"taskProcessGroupStopped": true
}Controlled local test failure attribution{
"sameSourceExceptDependencyDelta": true,
"sameNode": "26.12.1",
"sameBun": "1.4.4",
"samePATH": true,
"sameFullSuiteCommand": [
"bun",
"run",
"test"
],
"sameFailingNames": true,
"failingNames": [
"lobster asset QA > reports missing coverage as pending in partial mode and fails exact duplicates",
"lobster asset QA > fails and identifies non-identical files within the perceptual threshold",
"lobster primary art result import > writes file facts to a separate ledger without changing planner reviews",
"lobster artwork finalization > is byte-identical when recomputed from stopped generation inputs"
],
"sameFailurePhases": "First duplicate check assertion expected fail/received pass; second and third ENOENT magick; fourth ENOENT dwebp; exact traces preserved in both logs. Decoder errors omit inputs from asset inventory, explaining duplicate assertion.",
"baselineSummary": "328 pass/4 fail across332tests/34files",
"candidateSummary": "328 pass/4 fail across332tests/34files",
"attribution": "Task guest lacks native artwork prerequisites explicitly installed by owning CI; no evidence of workerd attributable artwork regression. Not a full-suite pass.",
"baselineLogSha256": "1d5e3b0cf81d3251f507b6bcacc3473850dbe8d9959fc0677c2a67665264b340",
"candidateLogSha256": "ea70b9aaeed79942e0ec1da1480fb900af7035485e803270f81da15ed3e7ca62"
}Recorded rebuilt bundle identities (empty means no emitted artifact was retained)[
{
"path": "rebuilt-worker/README.md",
"sha256": "06015aca782bc50879698ba1eb0e8a750d27da477a63f678452e41ec5c001c57",
"bytes": 107
},
{
"path": "rebuilt-worker/entry.js",
"sha256": "9e3a2f49f9d7506d7cb4fc612f068e3c4a0eac5f26ec16f1f9f649e82c7e694a",
"bytes": 7639690
},
{
"path": "rebuilt-worker/entry.js.map",
"sha256": "8894b7da8b1451f4f1a1392f8d2814f1a22e5c6232ddeae8a83fcfbbec86a011",
"bytes": 10517175
}
]Original retained input and redacted projection hashes[
{
"path": "collected/hermit/evidence/candidate-selected-identity.log",
"sha256": "fc0a3393147cf88eb603c92bad25b5a5d4516d097211ab8dc3c398831807e122",
"projection": "candidate-selected-identity.json",
"projectionSha256": "f83b584ee28b51c0ec4a8295e0676bf2a76be557ea33c67b30027266149af042",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/hermit/evidence/baseline-install.json",
"sha256": "914e296b99957e0a689b0bf93eddf6e576567cf0ae663a0c9d4a72542348d96a",
"projection": "baseline-install.json",
"projectionSha256": "f208a4be998e5dfe4ba888cde54c82e2f86cf787d858001e944a0e9498cfd574",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/hermit/evidence/candidate-install.json",
"sha256": "c8066194421e877778ea70db4aa2500b385a10d58daf82fa76d8c4b370a65be6",
"projection": "candidate-install.json",
"projectionSha256": "6d1a5fd61f6ba1f5ae09cbc44d1069e0d824ae299eb21d43cf3c60f44f975b98",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/hermit/evidence/candidate-checks.json",
"sha256": "222d23953fa89e26c18308c364c6ba85ac57e28d8aedb7b8a37ef12b274c3f13",
"projection": "candidate-checks.json",
"projectionSha256": "64fbe3e66a7da5daa1a77d829ef72bc0428c59d76718c20688ecfd6e7faeb287",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/hermit/evidence/candidate-local-worker.json",
"sha256": "7f31cf5e43b21d2ed0597dd7859f8fddafeb2018716fb1f948e85d64a1ceef19",
"projection": "candidate-local-worker.json",
"projectionSha256": "a1a54faa913449edb5888303d9efd2d09870011ad510b772410ad9944f5ec9bf",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/hermit/evidence/matched-baseline-attribution.json",
"sha256": "e8f91f7a613267425ddb1ea655260d986678d3e4b81d2476b2f13145f150ba2c",
"projection": "matched-baseline-attribution.json",
"projectionSha256": "e8f91f7a613267425ddb1ea655260d986678d3e4b81d2476b2f13145f150ba2c",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/hermit/evidence/rebuilt-worker-artifacts.json",
"sha256": "dd1457067f249d68c82e957287b097b5136fea1bf7482d963b6d46738987525a",
"projection": "rebuilt-worker-artifacts.json",
"projectionSha256": "dd1457067f249d68c82e957287b097b5136fea1bf7482d963b6d46738987525a",
"redactions": "Task-root/tool paths and explicitly synthetic secret markers only"
},
{
"path": "collected/native-engine/evidence/results.json",
"sha256": "0c6f25ddb0abcdbc14c60f4839777f85baf043301453d6711172503fbc4b1d39",
"publicScope": "Lossless field-preserving selection of this consumer baseline32rows; exact candidate32rows in linked shared proof"
}
] |
Contributor
Author
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin local workerd to 1.20261021.1 so the development/test engine rejects the verified compromised eMudhra keys even when historical roots are supplied explicitly. Retain the existing Wrangler/Miniflare versions and package-manager owner; regenerate the lockfile through its native manager. No application trust bypass or production deployment is introduced.
Validation on native macOS ARM64 (Node 26.12.1, Bun 1.4.4 or repository-pinned pnpm/npm):
44a06c31a6578f234cdf7f23219b88978c8d8d21cb8ce85795cab53614b50d64.CertDistrustedwith explicit-only historical trust;Revokedwith system-plus-explicit trust; public HTTPS and task private-CA HTTPS pass in both modes. Independent chain+exact-hostname controls 14/14 pass; six TLS key identities match verified incident denylist, including alternate/cross-sign chains. Two code-signing keys covered by exact upstream-source denylist comparison, not live code-signing execution.git diff --checkpasses.Limits: Full suite is not green locally: task guest lacks native artwork tools explicitly installed by owning CI. Matched failure evidence supports environment attribution, not a claim that unchanged source or rerun proves unrelatedness. Discord external effects not exercised. This validates source, rebuilt bundle and local engine behavior; it does not establish deployed Cloudflare/fleet delivery or other native architectures.
Existing automatic effects: CI and ClawSweeper dispatch on PR. Cloudflare Builds integrates main and can deploy production on merge; canonical account last base build succeeded. Prior duplicate-account integration remains unresolved; branch preview configuration unverified. Cloudflare resources not changed.
Exact base
bb0e716ac82b1f2b87274f4d934571e5dd499216; reviewed patch SHA256b196660230e2e98a61e35474a195fb3e1f44786272301914123857921852ed47. Detailed evidence is retained in the local available-fix campaignlanes/workerd-propagation-macos/hermit/REPORT.mdandMANIFEST.json.Final tested source head
cee909c475fccdfafb7a637b6ddc6e0fb3ec3e64. The committed file bytes match the reviewed and natively validated two-file proposal exactly; no post-proof source change.Inspectable native TLS evidence
The final-head proof supplement publishes this consumer's exact resolver, baseline output, install/build/local-entry receipts and artifact hashes, and links the complete same-hash candidate handshake traces with independent chain/hostname and legitimate controls. Candidate explicit-only rejects with CertDistrusted; platform-plus-explicit rejects with Revoked. Observed proof is TLS-handshake rejection before Worker fetch completion; direct remote wire-byte/credential absence and 0-RTT are not measured. No managed Cloudflare fleet delivery is claimed.