WIP: Migrate pinned STEVE dependency sources to the Caution forge #16

Manually merged

anton merged 4 commits from feat/forge-migration into main

2026-10-21 19:12:56 +00:00

vincent commented

2026-10-15 11:57:28 +00:00

Owner

Move Bootproof and JS SDK tee-attestation-js sources to git.caution.co/public. Retain Bootproof 78f531a2c245404a9d8879fb71cc397096ae0077, tee-attestation-js ba0d0c57de673c8576c91a8730775a87575f5c10, compiler settings and container digests. Correct SDK monorepo metadata and Procfile sources, retaining EnclaveOS dda60363e43cfb00bd6b9d8bf56322bf122a5bac.

Branch head versus Platform pin

Signed branch head: d80a9a3573b6e94e57e3cbbf00745946e8f09e62. This two-parent retention merge joins 5d30ca777bca0edc9fef57b42b62c1fff7eb8103 and 6431612db09899314c7c30bc7ca0b1c54f7bc3c0; its complete tree equals 5d30ca7 exactly. The SDK conflict retains the current workspace dependency declaration. No source or lockfile bytes changed in the retention merge, and the branch was pushed without rewriting history.

Platform #479, revision 85e6300a99e5efb0badde6b74793746bb101e1a8, continues consuming 6431612db09899314c7c30bc7ca0b1c54f7bc3c0, the migration-only descendant of original pin c0b8d2d62e66108689745561242972048f6cfce5. Platform does not adopt the newer main-based branch tree. The old pin is now reachable through the migration branch in ordinary fresh clones.

Validation

Signatures, both parents, ancestor retention, tree equality, fresh canonical clone/checkout and exact source archives verified.
Clean-cache locked Cargo and SDK npm resolution passed for the consumed pin and branch head. Locks remained unchanged. Resolved Git sources contain no active legacy Caution hosts or duplicate source identities.
At consumed pin 6431612: JS SDK 69 passed; Rust libraries excluding the server 36 passed, 1 ignored; the pinned StageX WASM test target passed.
At branch head d80a9a3: JS SDK 103 passed; Rust libraries excluding the server 56 passed, 1 ignored.
Both server library suites report 41 passed and the same previously reproduced baseline failure: upstream_idle_read_timeouts_fail_both_forwarding_paths, expecting upstream response unavailable but receiving upstream unavailable. No unrelated runtime fix is included.
Platform’s actual Cargo retry passed with the primary unavailable, fetching Bootproof from GitHub with an unchanged lock. Its final StageX CLI and fresh EIF build passed with consumed STEVE pin 6431612. These are local build checks, not live Nitro evidence.

Landing gates

Keep this PR as a draft. Later merge it with a signed merge commit retaining both histories, establish GitHub synchronization from the canonical forge, then verify fresh GitHub checkout of the exact consumed STEVE and Bootproof pins before Platform lands. Mirror setup remains separate. No main-branch merge, tag, mirror configuration, deployment or trusted PCR policy change was performed.

Move Bootproof and JS SDK tee-attestation-js sources to git.caution.co/public. Retain Bootproof `78f531a2c245404a9d8879fb71cc397096ae0077`, tee-attestation-js `ba0d0c57de673c8576c91a8730775a87575f5c10`, compiler settings and container digests. Correct SDK monorepo metadata and Procfile sources, retaining EnclaveOS `dda60363e43cfb00bd6b9d8bf56322bf122a5bac`. ## Branch head versus Platform pin Signed branch head: `d80a9a3573b6e94e57e3cbbf00745946e8f09e62`. This two-parent retention merge joins `5d30ca777bca0edc9fef57b42b62c1fff7eb8103` and `6431612db09899314c7c30bc7ca0b1c54f7bc3c0`; its complete tree equals `5d30ca7` exactly. The SDK conflict retains the current workspace dependency declaration. No source or lockfile bytes changed in the retention merge, and the branch was pushed without rewriting history. [Platform #479](https://git.caution.co/public/platform/pulls/479), revision `85e6300a99e5efb0badde6b74793746bb101e1a8`, continues consuming `6431612db09899314c7c30bc7ca0b1c54f7bc3c0`, the migration-only descendant of original pin `c0b8d2d62e66108689745561242972048f6cfce5`. Platform does not adopt the newer main-based branch tree. The old pin is now reachable through the migration branch in ordinary fresh clones. ## Validation - Signatures, both parents, ancestor retention, tree equality, fresh canonical clone/checkout and exact source archives verified. - Clean-cache locked Cargo and SDK npm resolution passed for the consumed pin and branch head. Locks remained unchanged. Resolved Git sources contain no active legacy Caution hosts or duplicate source identities. - At consumed pin `6431612`: JS SDK 69 passed; Rust libraries excluding the server 36 passed, 1 ignored; the pinned StageX WASM test target passed. - At branch head `d80a9a3`: JS SDK 103 passed; Rust libraries excluding the server 56 passed, 1 ignored. - Both server library suites report 41 passed and the same previously reproduced baseline failure: `upstream_idle_read_timeouts_fail_both_forwarding_paths`, expecting `upstream response unavailable` but receiving `upstream unavailable`. No unrelated runtime fix is included. - Platform’s actual Cargo retry passed with the primary unavailable, fetching Bootproof from GitHub with an unchanged lock. Its final StageX CLI and fresh EIF build passed with consumed STEVE pin `6431612`. These are local build checks, not live Nitro evidence. ## Landing gates Keep this PR as a draft. Later merge it with a signed merge commit retaining both histories, establish GitHub synchronization from the canonical forge, then verify fresh GitHub checkout of the exact consumed STEVE and Bootproof pins before Platform lands. Mirror setup remains separate. No main-branch merge, tag, mirror configuration, deployment or trusted PCR policy change was performed.

vincent added 1 commit

2026-10-15 11:57:28 +00:00

Migrate dependency sources to the Caution forge 42ae79a260

vincent referenced this pull request from public/platform

2026-10-15 12:02:53 +00:00

WIP: Migrate Platform public sources to git.caution.co #479

vincent added 1 commit

2026-10-15 12:53:57 +00:00

fix: finish STEVE forge source migration 6431612db0

vincent force-pushed feat/forge-migration from 6431612db0 to 5d30ca777b

2026-10-15 14:07:14 +00:00

Compare

vincent added 3 commits

2026-10-15 15:10:34 +00:00

Migrate dependency sources to the Caution forge 42ae79a260

fix: finish STEVE forge source migration 6431612db0

Retain the migration-only Platform STEVE pin d80a9a3573

Merge 6431612 without changing the tree at 5d30ca7. Platform continues to consume the migration-only revision; retaining its ancestry makes ordinary clones include that exact source commit.