From dce89514e3bcd3752f589c40a498fdc5ef441ac2 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:24:51 -0400 Subject: [PATCH 01/13] chore: align Core runtime and verification metadata --- package.json | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index d84a8d5..d39936f 100644 --- a/package.json +++ b/package.json @@ -1,8 +1,15 @@ { "name": "riverbraid-core", "version": "1.0.0", + "packageManager": "npm@10.2.4", + "engines": { + "node": "20.11.0", + "npm": "10.2.4" + }, "scripts": { "test": "jest", + "verify": "node constellation-audit.mjs --ring 0 && node byte-audit.mjs --ring 0", + "verify:compatibility": "node constellation-audit.mjs --ring 2 && node byte-audit.mjs --ring 2", "test:riverbraid": "node verify-vector.cjs", "audit:ring2": "node byte-audit.mjs --ring 2", "audit:all": "node byte-audit.mjs" @@ -11,6 +18,8 @@ "jest": "^29.0.0" }, "riverbraid": { - "role": "spine" + "role": "spine", + "publicEvaluationEntry": "Riverbraid/Riverbraid-Evaluation-Kit", + "localVerificationCommand": "npm run verify" } } From 748e172fe3521b187d766d4b16444b7f66dc780b Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:24:59 -0400 Subject: [PATCH 02/13] chore: remove unconsumed empty pass fixture --- fixtures/pass.json | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 fixtures/pass.json diff --git a/fixtures/pass.json b/fixtures/pass.json deleted file mode 100644 index e69de29..0000000 From d31de1785b4dbd1a95bc320de0d3c828ac5c0632 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:25:10 -0400 Subject: [PATCH 03/13] chore: remove unconsumed empty fail fixture --- fixtures/fail.json | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 fixtures/fail.json diff --git a/fixtures/fail.json b/fixtures/fail.json deleted file mode 100644 index e69de29..0000000 From b562425d737cd71e939b7124f4f79607ac2ee52b Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:25:20 -0400 Subject: [PATCH 04/13] chore: remove unconsumed empty behavior contract --- riverbraid.behavior.json | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 riverbraid.behavior.json diff --git a/riverbraid.behavior.json b/riverbraid.behavior.json deleted file mode 100644 index e69de29..0000000 From 3a62bffe4b917bdcb767b5ac55dd327d92e545c5 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:25:30 -0400 Subject: [PATCH 05/13] chore: remove unconsumed empty contract placeholder --- riverbraid.contract.json | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 riverbraid.contract.json diff --git a/riverbraid.contract.json b/riverbraid.contract.json deleted file mode 100644 index e69de29..0000000 From 9671f868af2bb24d2d27f9d077570a47f3114c1f Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:25:46 -0400 Subject: [PATCH 06/13] docs: bind Core fixture presence policy --- fixtures/README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 fixtures/README.md diff --git a/fixtures/README.md b/fixtures/README.md new file mode 100644 index 0000000..f496526 --- /dev/null +++ b/fixtures/README.md @@ -0,0 +1,18 @@ +# Core Fixture Policy + +Riverbraid-Core does not currently treat file presence as contract verification. + +The former zero-byte placeholders (`pass.json`, `fail.json`, `riverbraid.behavior.json`, and `riverbraid.contract.json`) were removed because no active Core verifier contract was bound to their contents. Leaving empty files in the trusted surface would conflict with the Core rule that file presence is not verification. + +A future Core fixture may be added only when all of the following are declared: + +- the consuming verifier and version; +- the schema or structural contract; +- the expected result and exit behavior; +- the positive, negative, malformed, blocked, and unavailable cases that apply; +- the relationship to the Evaluation Kit reproduction path; +- the evidence record produced by execution. + +Until then, public reproduction fixtures belong to the versioned Riverbraid-Evaluation-Kit profile rather than to an unconsumed Core placeholder surface. + +This file is policy documentation only. It does not establish that a fixture suite has executed or passed. From 0e18636939887eec897c4b0f8ed15ebb10d30375 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:26:16 -0400 Subject: [PATCH 07/13] feat: add machine-readable Core claim ceiling --- claim-ceiling.json | 60 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 claim-ceiling.json diff --git a/claim-ceiling.json b/claim-ceiling.json new file mode 100644 index 0000000..34724da --- /dev/null +++ b/claim-ceiling.json @@ -0,0 +1,60 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "schema_id": "rb.claim-ceiling", + "schema_version": "0.1.0", + "record_type": "CLAIM_CEILING", + "repository": "Riverbraid/Riverbraid-Core", + "artifact_role": "NORMATIVE_PROTOCOL_AUTHORITY_CLAIM_BOUNDARY", + "status": "DECLARED_NOT_EXECUTION_EVIDENCE", + "subject_binding": { + "method": "GIT_COMMIT_CONTAINING_THIS_EXACT_FILE_AS_OBSERVED_BY_AUDIT", + "commit_field_source": "audit-output.json repository git_commit", + "artifact_digest_source": "AUDIT-MANIFEST.sha256 generated by byte-audit.mjs", + "binding_status_before_execution": "UNBOUND_UNTIL_AUDIT_RUN" + }, + "public_evaluation_entry": "Riverbraid/Riverbraid-Evaluation-Kit", + "allowed_claims": [ + "Riverbraid-Core defines the normative Riverbraid protocol authority and audit substrate.", + "Riverbraid-Core implements deterministic repository-structure and tracked-byte audit tools under their declared conditions.", + "Riverbraid-Core can classify declared ring membership, inspect required-file presence, parse verifier outputs, detect dirty worktrees and UTF-8 BOMs, hash tracked bytes, emit an audit manifest, and append an audit-trail record.", + "A specific Core run may claim only the result recorded by its exact evaluator, source, configuration, environment, and evidence packet." + ], + "refused_claims": [ + "certification", + "legal approval or regulatory compliance", + "production readiness", + "absolute security", + "external audit or independent review", + "complete AI safety", + "adoption", + "registry freshness", + "full constellation verification", + "downstream repository verification by association", + "absence of defects", + "universal correctness or universal applicability" + ], + "claim_transfer_rules": { + "file_presence_is_verification": false, + "registry_membership_is_verification": false, + "component_result_composes_to_system_result": false, + "later_success_relabels_historical_results": false + }, + "local_verification_commands": { + "core_authority_surface": "npm run verify", + "dependent_ring_2_compatibility": "npm run verify:compatibility" + }, + "review_triggers": [ + "protocol authority change", + "audit-tool behavior change", + "claim-boundary change", + "public entry-point change", + "registry relationship change", + "evidence model change", + "superseding control record" + ], + "nonclaims": [ + "This declaration does not prove that any verification command executed.", + "This declaration does not make the containing commit verified.", + "This declaration does not replace an evaluator result, evidence envelope, authority disposition, or current-applicability record." + ] +} From 86a9332f6f7e4deabc74a90d3ae926d722492a84 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:26:37 -0400 Subject: [PATCH 08/13] docs: reconcile Core authority vocabulary --- AUTHORITY.md | 47 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/AUTHORITY.md b/AUTHORITY.md index 75b33fc..fee8185 100644 --- a/AUTHORITY.md +++ b/AUTHORITY.md @@ -1,19 +1,46 @@ # Riverbraid-Core Authority -Ring: 0 -Role: Proposed Phase 15 trust anchor -Status: CLASSIFIED + +Repository Ring: 0 — normative protocol authority +Dependent Compatibility Gate: Ring 2 for coupling-sensitive Core changes +Role: Core audit substrate and protocol trust anchor +Status: CORE_AUDIT_SURFACE + +## Ring and phase vocabulary + +`Ring 0` identifies this repository's authority role in the current cluster manifest. + +A required `Ring 2` pass means that a coupling-sensitive Core change must also be checked against the declared Ring 2 infrastructure set. It does not reclassify Riverbraid-Core as a Ring 2 repository. + +`Proposed Phase 15` is a historical implementation label and is not current authority vocabulary. Current public descriptions must use the repository role, ring relationship, verification surface, and claim boundary defined here and in `VOCABULARY_LOCK.md`. + ## Claim Boundary -This repository participates in the proposed Phase 15 Ring 0 trust anchor layer. -This file does not claim full constellation verification. -This repository may only claim VERIFIED after its local verifier produces verify-output.json with status VERIFIED. + +Riverbraid-Core is the normative protocol authority and deterministic integrity-audit substrate for the declared Riverbraid governance floor. + +This repository may claim `VERIFIED` only for an exact source-bound run whose declared verifier produces the required result and whose evidence remains attributable to the observed commit, configuration, environment, and claim boundary. + +A repository file, manifest entry, generated summary, or machine-readable claim declaration does not become verification evidence merely because it exists. + ## Refused Claims + This repository does not claim: + - production readiness -- legal compliance +- legal compliance or legal approval - universal safety -- absolute truth +- absolute truth or absolute security +- external audit or independent review +- complete AI safety - full constellation verification -- downstream ring verification +- downstream ring verification by association +- registry freshness +- adoption +- absence of defects + ## Mechanical Honesty Rule + File presence is not verification. -Verification requires a real verifier output. \ No newline at end of file + +Verification requires a real verifier result plus the source, configuration, environment, and evidence relationships needed to interpret that result. + +The public reproduction and evaluation entrance is `Riverbraid/Riverbraid-Evaluation-Kit`. Riverbraid-Core remains the normative protocol authority; it is not the public reproduction kit. From 07fb8a3470fdd2bf45f6c878a0c9def1674b8022 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:27:01 -0400 Subject: [PATCH 09/13] docs: extend normative ring and phase vocabulary --- VOCABULARY_LOCK.md | 50 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 40 insertions(+), 10 deletions(-) diff --git a/VOCABULARY_LOCK.md b/VOCABULARY_LOCK.md index 6b4e3fc..0093c10 100644 --- a/VOCABULARY_LOCK.md +++ b/VOCABULARY_LOCK.md @@ -1,23 +1,53 @@ # VOCABULARY_LOCK.md -# Version: 1.0.0 +# Version: 1.1.0 # Authority: Normative (Riverbraid-Core) ## 1. System States -- **Active**: Behavior is proven via deterministic vectors. + +- **Active**: Behavior is proven via deterministic vectors under a declared contract. - **Parked**: Non-behavior and boundary integrity are proven. - **Experimental**: Explicitly excluded from the trusted floor. - **Deprecated**: Authority is scheduled for removal. - **Archived**: Authority is removed; preserved for historical audit only. ## 2. Core Integrity Terms -- **Verified**: A state confirmed by a passing vector test. -- **Fail-Closed**: A safety state where any ambiguity results in a refusal or "Fail" status. -- **Stationary**: A state where the system is stable and reproducible. -- **Reconstructable**: The ability for a stranger to reproduce the system from the manifest. -- **Claim Boundary**: The declared limit of what a repository is authorized to verify. + +- **Verified**: A state confirmed by a passing, source-bound vector or evaluator result under declared conditions. +- **Fail-Closed**: A safety state where ambiguity, missing required evidence, or an invalid condition produces a bounded non-pass result. +- **Stationary**: A state where the declared system surface is stable and reproducible under its comparison contract. +- **Reconstructable**: The ability for a stranger to reproduce the declared system state from the manifest and required evidence. +- **Claim Boundary**: The declared limit of what an exact repository, profile, run, or authority disposition may assert. ## 3. Structural Roles -- **Normative**: Defines meaning and rules for the constellation. -- **Verifier**: Executes tests to prove claims. -- **Support**: Provides shared logic or structures. + +- **Normative**: Defines meaning and rules for the declared Riverbraid protocol surface. +- **Verifier**: Executes declared tests and emits a bounded mechanical result. +- **Support**: Provides shared logic, tooling, structures, or public infrastructure without redefining protocol semantics. - **Informative**: Provides human-legible context without machine authority. + +## 4. Ring Vocabulary + +- **Repository Ring**: The repository's declared structural position in the current cluster manifest. +- **Dependent Ring Gate**: A required compatibility or coupling check against another declared ring. It does not change the repository's own ring. +- **Ring 0**: Current normative protocol-authority and trust-anchor class in `cluster-manifest-v2.json`. +- **Ring 1**: Current declared Gold or domain-petal class. +- **Ring 2**: Current declared infrastructure compatibility class. +- **Ring 3**: Current declared peripheral or best-effort class. + +Riverbraid-Core is a Ring 0 repository. A required Ring 2 compatibility pass for coupling-sensitive Core changes is a dependent gate, not a second repository classification. + +## 5. Historical Phase Labels + +Phase-number labels describe historical implementation sequences. They do not define current authority, verification, lifecycle, or public claim status unless an active source-bound control record explicitly adopts them. + +`Proposed Phase 15` is retired from current Core authority language and must not be used as a substitute for the active repository role, ring, verification surface, or claim boundary. + +## 6. Vocabulary Separation Rules + +- Role is not lifecycle. +- Lifecycle is not registry membership. +- Registry membership is not verification depth. +- Verification depth is not execution evidence. +- Execution evidence is not authority disposition. +- A dependent compatibility gate is not repository reclassification. +- Historical phase sequence is not current applicability. From 0ad75b3f76ae3c9cc55e1066074c1e8650e3362e Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:27:35 -0400 Subject: [PATCH 10/13] docs: clarify Core entry, ring, fixture, and claim boundaries --- README.md | 119 ++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 79 insertions(+), 40 deletions(-) diff --git a/README.md b/README.md index 03a0009..6e34a88 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,10 @@ # Riverbraid-Core +> Public evaluation starts at [Riverbraid-Evaluation-Kit](https://github.com/Riverbraid/Riverbraid-Evaluation-Kit). This repository is the normative protocol authority and audit substrate; it is not the public reproduction kit. + > Status: CORE_AUDIT_SURFACE -> Ring Role: Core / normative protocol authority +> Repository Ring: 0 — normative protocol authority +> Dependent Compatibility Gate: Ring 2 for coupling-sensitive Core changes > Claim Boundary: deterministic integrity floor, byte audit, and ring governance only Riverbraid-Core is a deterministic integrity floor for the Riverbraid architecture. @@ -16,10 +19,14 @@ Riverbraid-Core is a canonical protocol authority surface within Riverbraid. This repository is part of the current Evaluation Kit canonical verification registry and defines core protocol authority and audit behavior for Riverbraid. +The Evaluation Kit is the public reproduction and evaluation entrance. Core exposes the normative rules and bounded local audit commands that the public profile references. + ## Evidence boundary This repository does not claim certification, legal approval, production readiness, absolute security, external audit, complete AI safety, adoption, registry freshness, or absence of defects. +The machine-readable declaration in `claim-ceiling.json` is a claim-boundary artifact, not execution evidence. Its exact applicability is bound only when the containing commit and artifact digest are observed by an audit packet. + ## Canonical One-Liner Riverbraid is an open-source deterministic integrity floor for AI governance: a fail-closed, byte-auditable architecture that makes structure, authority, and drift visible. Its broader research directions, including mathematical physics of cognition, memory-flow-truth braiding, and intent-aware compute, remain experimental surfaces built on top of this bounded floor. @@ -27,14 +34,15 @@ Riverbraid is an open-source deterministic integrity floor for AI governance: a ## Core Function Riverbraid-Core provides: -* Ring classification and constellation audit -* Required file surface verification -* Byte-level audit of tracked repository files -* BOM detection for text surfaces -* Dirty worktree detection -* Verification output validation -* Audit manifest generation -* Append-only audit trail recording + +- Ring classification and constellation audit +- Required file surface verification +- Byte-level audit of tracked repository files +- BOM detection for text surfaces +- Dirty worktree detection +- Verification output validation +- Audit manifest generation +- Append-only audit trail recording ## Authority Boundary @@ -44,18 +52,39 @@ It defines the audit substrate and verification rules. It does not implement dom Any repository outside Core must not redefine Riverbraid protocol semantics. It may only declare its role, expose its verification surface, and pass the applicable ring gates. +## Ring vocabulary + +Riverbraid-Core is classified as a Ring 0 repository in the current cluster manifest. + +A Ring 2 pass required after a coupling-sensitive Core change is a dependent compatibility gate against the declared infrastructure set. It does not make Core a Ring 2 repository. Historical phase-number labels do not define current authority or verification state. + +See `VOCABULARY_LOCK.md` and `AUTHORITY.md` for the controlling terminology. + +## Fixture policy + +Core does not retain empty contract fixtures as evidence-shaped placeholders. The current fixture policy is recorded in `fixtures/README.md`. + +A future fixture enters Core only when it has a declared consumer, schema or structural contract, expected result and exit behavior, negative cases, and execution-evidence relationship. Public reproduction fixtures otherwise belong to the versioned Evaluation Kit profile. + ## Coupling Test -Any change to these files requires a full Ring 2 verification pass before being treated as valid: -* constellation-audit.mjs -* byte-audit.mjs -* cluster-manifest-v2.json -* verify-output.json -* audit-output.json -* AUDIT-MANIFEST.sha256 -* AUDIT-TRAIL.ndjson +Any change to these files requires a full Ring 2 compatibility pass before being treated as valid: + +- `constellation-audit.mjs` +- `byte-audit.mjs` +- `cluster-manifest-v2.json` +- `verify-output.json` +- `audit-output.json` +- `AUDIT-MANIFEST.sha256` +- `AUDIT-TRAIL.ndjson` + +Required check: -Required checks: +```bash +npm run verify:compatibility +``` + +Equivalent underlying commands: ```bash node constellation-audit.mjs --ring 2 @@ -63,8 +92,9 @@ node byte-audit.mjs --ring 2 ``` Expected verified states: -* RING_GATE_PASS_VERIFIED -* BYTE_GATE_PASS_VERIFIED + +- `RING_GATE_PASS_VERIFIED` +- `BYTE_GATE_PASS_VERIFIED` ## Scale Separation Gate @@ -77,40 +107,49 @@ Core must remain small enough to audit directly. New experimental behavior belon ## Linear vs Nonlinear Boundary The Core audit path is linear: -1. Declare manifest -2. Check required files -3. Read verifier outputs -4. Hash tracked bytes -5. Reject BOM -6. Reject dirty worktrees -7. Emit audit manifest -8. Record audit trail + +1. Declare manifest. +2. Check required files. +3. Read verifier outputs. +4. Hash tracked bytes. +5. Reject BOM. +6. Reject dirty worktrees. +7. Emit audit manifest. +8. Record audit trail. The broader Riverbraid research surface may remain nonlinear, experimental, expressive, or exploratory. That layer does not override Core verification. ## Stationary State Invariant Riverbraid-Core is stationary when all of the following are true: -* Local worktree is clean -* Required files are present -* Verifier outputs parse successfully -* Ring 2 returns RING_GATE_PASS_VERIFIED -* Ring 2 returns BYTE_GATE_PASS_VERIFIED -* Audit manifest exists -* Audit trail records the verification event -* No UTF-8 BOM is present in tracked text files + +- Local worktree is clean. +- Required files are present. +- Verifier outputs parse successfully. +- The applicable ring gate returns its required verified state. +- The byte gate returns its required verified state. +- Audit manifest exists. +- Audit trail records the verification event. +- No UTF-8 BOM is present in tracked text files. ## Verification -Run: +For the bounded local Core authority surface, run: ```bash -node constellation-audit.mjs --ring 2 -node byte-audit.mjs --ring 2 +npm run verify +``` + +For the dependent Ring 2 compatibility path after a coupling-sensitive Core change, run: + +```bash +npm run verify:compatibility ``` +For the public pinned reproduction path, use Riverbraid-Evaluation-Kit. + ## Claim Hygiene -Riverbraid-Core supports the bounded claim that Riverbraid has a working open-source deterministic integrity floor and governance artifact. +Riverbraid-Core supports the bounded claim that Riverbraid has a working open-source deterministic integrity floor and governance artifact under its implemented conditions. The broader claims around True AI, mathematical physics of cognition, memory-flow-truth braiding, resonance, and intent-aware compute remain active experimental directions unless implemented, tested, and verified in dedicated repositories. From 893485e821c9ae86257029295212693e672cd5c8 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:27:53 -0400 Subject: [PATCH 11/13] ci: classify Core workflow as live compatibility --- .github/workflows/verify.yml | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 8399a04..2368932 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -1,4 +1,5 @@ -name: Riverbraid Verification Suite +name: Riverbraid Core Live Compatibility Check + on: push: branches: @@ -7,19 +8,23 @@ on: branches: - main workflow_dispatch: + permissions: contents: read + jobs: - verify-core: + verify-core-live-compatibility: runs-on: ubuntu-24.04 steps: - name: Checkout Riverbraid-Core uses: actions/checkout@v4 + - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20.11.0' - - name: Clone Ring 0 sibling repositories + + - name: Clone current Ring 0 sibling default branches shell: bash run: | set -euo pipefail @@ -30,15 +35,19 @@ jobs: Riverbraid-Integrity-Floors \ Riverbraid-Types do - echo "Cloning $repo" + echo "Cloning current default branch for live compatibility: $repo" git clone --depth 1 "https://github.com/Riverbraid/${repo}.git" "$repo" done - echo "RING0_SIBLINGS_CLONED" - - name: Run compatibility audit + echo "RING0_LIVE_COMPATIBILITY_SIBLINGS_CLONED" + + - name: Run live compatibility audit shell: bash run: | set -euo pipefail node audit_final.js node constellation-audit.mjs --ring 0 - - name: Final status - run: echo "RIVERBRAID_CORE_RING0_CI_OK" \ No newline at end of file + + - name: Final bounded status + run: | + echo "RIVERBRAID_CORE_LIVE_COMPATIBILITY_OK" + echo "This workflow is a mutable-default-branch compatibility check, not the pinned Evaluation Kit reproduction surface." From 861098ef48bf4d0e692c30a1eee9548dd2fe9cc3 Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 11:34:39 -0400 Subject: [PATCH 12/13] fix: align Core verify command with workflow precheck --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index d39936f..896c646 100644 --- a/package.json +++ b/package.json @@ -8,8 +8,8 @@ }, "scripts": { "test": "jest", - "verify": "node constellation-audit.mjs --ring 0 && node byte-audit.mjs --ring 0", - "verify:compatibility": "node constellation-audit.mjs --ring 2 && node byte-audit.mjs --ring 2", + "verify": "node audit_final.js && node constellation-audit.mjs --ring 0 && node byte-audit.mjs --ring 0", + "verify:compatibility": "node audit_final.js && node constellation-audit.mjs --ring 2 && node byte-audit.mjs --ring 2", "test:riverbraid": "node verify-vector.cjs", "audit:ring2": "node byte-audit.mjs --ring 2", "audit:all": "node byte-audit.mjs" From 699567de01e83494a8f4a00b503b322ff61b410c Mon Sep 17 00:00:00 2001 From: Riverbraid Date: Mon, 27 Jul 2026 12:40:03 -0400 Subject: [PATCH 13/13] ci: pin Core workflow action identities --- .github/workflows/verify.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 2368932..9cf0ce0 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -17,10 +17,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout Riverbraid-Core - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: '20.11.0'