Follow-up from the v0.3 content-only-leaf PR (testifysec/judge#5559) Codex review + red-team.
compareArtifacts (attestation/policy/policy.go) is no-disagreement by design: a downstream material whose path matches an upstream product must agree on digest (catches substitution — proven by multistep_verify_e2e.sh NEGATIVE), but a material with no matching upstream path is allowed. So artifactsFrom does not prove EVERY consumed material came from the referenced step. This is pre-existing (byte-identical to main) and intentional (the code comment: "log rather than error to avoid breaking existing deployments… review for strict mode enforcement").
Flipping it to full-coverage unconditionally is wrong: a real build consumes the upstream product PLUS toolchain/source/caches that are not in any one upstream step's products, so it would break legitimate multi-input builds (and the minimal e2e wouldn't catch it — a latent prod break).
Proposal: add an OPT-IN strict mode that, when enabled on a step, requires every downstream material to either (a) match an upstream product by content digest (path is non-authoritative in v0.3), or (b) match a policy-declared allowlist (the old Step.AllowedUntracked mechanism, now dead — revive it digest/glob-aware) for toolchain/env reads. Default stays no-disagreement. Relates to #207/#189.
Follow-up from the v0.3 content-only-leaf PR (testifysec/judge#5559) Codex review + red-team.
compareArtifacts(attestation/policy/policy.go) is no-disagreement by design: a downstream material whose path matches an upstream product must agree on digest (catches substitution — proven by multistep_verify_e2e.sh NEGATIVE), but a material with no matching upstream path is allowed. SoartifactsFromdoes not prove EVERY consumed material came from the referenced step. This is pre-existing (byte-identical to main) and intentional (the code comment: "log rather than error to avoid breaking existing deployments… review for strict mode enforcement").Flipping it to full-coverage unconditionally is wrong: a real build consumes the upstream product PLUS toolchain/source/caches that are not in any one upstream step's products, so it would break legitimate multi-input builds (and the minimal e2e wouldn't catch it — a latent prod break).
Proposal: add an OPT-IN strict mode that, when enabled on a step, requires every downstream material to either (a) match an upstream product by content digest (path is non-authoritative in v0.3), or (b) match a policy-declared allowlist (the old
Step.AllowedUntrackedmechanism, now dead — revive it digest/glob-aware) for toolchain/env reads. Default stays no-disagreement. Relates to #207/#189.