T54 Execution Package Builder and Verifier Validation
Scope
- Task: T54 — Implement Execution Package builder and verifier
- Requirements: VES-SPC-001…005 and VES-HOF-001/003…004
- Commit target:
feat(evidence): add execution packages
- Focused evidence: 70 cases (31 unit/property and 39 security)
- Required minimum: 40 unit/property/security cases
- Spec deviations: none
T54 creates a backend-neutral, content-addressed, Ed25519-sealed Execution Package that closes requirements, decisions, tasks, completed evidence, derived pending work, context and discovery artifacts, data and seed artifacts, logical capability requirements, gates, approvals, claims, budgets, completion criteria, and the canonical destination. It binds the exact source, policy, Skill lock, context, data-access, effect, verification, destination, capability, budget, and evidence state required for portable continuation. Verification authenticates the artifact before semantic use, reconstructs pending work in a clean process, and reports deterministic field-specific invalidations that revoke prior readiness.
Deterministic gates
| Command |
Result |
node --test tests/unit/execution-package.test.mjs tests/security/execution-package-security.test.mjs |
PASS — 70 passed, 0 failed/skipped |
node --test tests/architecture/*.test.mjs |
PASS — 10 passed, 0 failed/skipped |
node scripts/gate.mjs security |
PASS — format, lint, typecheck/build, 1,602 unit/property, 10 architecture, 248 qualification, 636 security, and 104 fault cases |
Adequacy matrix
| Done-when criterion / spec AC |
Exact assertion evidence |
Spec-defined outcome |
Result |
| Package is a complete backend-neutral execution closure |
tests/unit/execution-package.test.mjs:16-27; fixture schema exercised by all 70 cases |
Signed payload contains portable logical requirements and bindings, without selecting a provider, model, session, credential, or local path |
PASS |
| Pending work derives only from tasks and completed evidence |
tests/unit/execution-package.test.mjs:28-77,188-193; tests/security/execution-package-security.test.mjs:91-111,157-172 |
Dependency closure is deterministic; forged completion or pending-work claims fail closed |
PASS |
| Clean-process reconstruction is identical |
tests/unit/execution-package.test.mjs:37-46 |
A verifier using only the package, trust root, and current logical state derives the same first pending task and pending set |
PASS |
| Canonical identity is stable under set permutation |
tests/unit/execution-package.test.mjs:78-97 |
Equivalent unordered inputs and repeated builds yield byte-identical sealed artifacts |
PASS |
| Every execution-relevant mutation changes identity |
tests/unit/execution-package.test.mjs:103-132 |
Version, contract, source, requirement, task, and gate mutations produce a different content address |
PASS |
| Bound changes invalidate exact fields |
tests/unit/execution-package.test.mjs:134-187 |
Every policy/Skill/context/data/effect/verification/destination/capability/budget/evidence/source change reports the complete canonical field set and invalidates Approval |
PASS |
| Requirement and task graph are closed and executable |
tests/security/execution-package-security.test.mjs:49-104 |
Open assumptions, imprecise acceptance, unknown references, cycles, duplicates, and invalid completion closure cannot be sealed |
PASS |
| Provider/session/secret/path material is prohibited |
tests/security/execution-package-security.test.mjs:14-47 |
Closed recursive schema rejects provider/backend/model/session/thread/turn/transcript/credential/token/local-path fields and absolute machine paths |
PASS |
| Authentication precedes semantic comparison |
tests/security/execution-package-security.test.mjs:112-172 |
Signature, payload digest, envelope shape, and derived-claim failures return before current-state invalidations are considered |
PASS |
| Cross-Workspace verification is non-disclosing |
tests/security/execution-package-security.test.mjs:173-193 |
Foreign Workspace state reports only Workspace invalidation and never reveals foreign source identities |
PASS |
| Current state grants no undeclared authority |
tests/security/execution-package-security.test.mjs:138-145,194-202 |
Null/malformed or extra authority fields fail closed with a stable current-state error |
PASS |
| Storage is canonical, atomic, idempotent, and no-clobber |
tests/unit/execution-package.test.mjs:195-236; tests/security/execution-package-security.test.mjs:203-230 |
Canonical bytes publish exactly once; concurrent identical writes converge; conflicts, linked roots, unsafe IDs, and digest drift fail without overwrite |
PASS |
| Returned artifacts cannot be mutated in process |
tests/unit/execution-package.test.mjs:98-102,195-207 |
Build and load results are recursively frozen |
PASS |
Necessary-test reverse map
| Test group |
Maps to |
Keep |
| Unit construction and derivation |
Complete closure, content identity, pending-task reconstruction, dependency readiness |
Yes |
| Unit mutation and invalidation matrix |
Exact binding coverage, Approval invalidation, deterministic ordering |
Yes |
| Unit storage cases |
Canonical bytes, deep immutability, atomic concurrency, idempotency, no-clobber conflict behavior |
Yes |
| Security closed-schema cases |
Requirement/task closure, forbidden private fields, absolute-path denial, malformed input behavior |
Yes |
| Security integrity cases |
Signature-first verification, payload integrity, derived-work integrity, source-evidence binding |
Yes |
| Security boundary/storage cases |
Workspace non-disclosure, current-state authority denial, path/link/content-address defenses |
Yes |
Non-shallow checks
- The package stores logical role and capability requirements, never a provider or model selection. A successor machine can resolve its own qualified Driver and Model Capability Passport without changing the execution contract.
- Pending tasks are not trusted serialized authority. The verifier derives them again from the canonical task graph and source-bound completed evidence, then rejects any signed package whose claim differs.
- Every execution-relevant environment dependency has a separate digest binding. Invalidation therefore names the smallest exact changed field instead of collapsing unrelated drift into a generic stale result.
- A foreign Workspace comparison intentionally returns only
workspaceId. It does not compare or disclose foreign source keys, preventing the invalidation report from becoming an inventory side channel.
- Recursive input inspection prohibits private provider/session/credential/path vocabulary at any nesting depth and rejects absolute Windows, POSIX, UNC, and
file: paths even under otherwise allowed field names.
- The store writes private staging bytes, revalidates the root and target, and publishes through a same-filesystem hard link with no replacement semantics. Concurrent writers converge to one canonical file; differing bytes at the same identity survive untouched and raise a conflict.
- Cryptographic verification occurs before payload normalization, derivation, or current-state comparison. A tampered signature cannot obtain a semantic invalidation report.
- Package construction and loading recursively freeze all reachable objects, preventing later caller mutation from making the in-memory value disagree with its content address.
Verdict
PASS for T54. Execution intent can now cross machines, providers, and agent backends as a deterministic authenticated closure while preserving exact pending work and refusing local/private runtime leakage. Any bound source or environment change is explicit, minimal, and Approval-invalidating; storage remains atomic, content-addressed, idempotent, and no-clobber under concurrency.