feat(verification): post provider snapshot hashes - #5
Draft
chalabi2 wants to merge 15 commits into
Draft
Conversation
Adds the narrow provider-side signing and broadcast interface needed by later AEP-86 inventory and snapshot components. The implementation is sourced from the provider CLI client context and keyring at service startup. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Routes REST and gRPC gateway Authorization headers through one parser. This keeps the gRPC interceptor from panicking on a single metadata value and makes both gateway paths enforce the same Bearer token shape. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Adds the provider-side snapshot builder boundary for L-3: collector and payload interfaces, nonce validation, deterministic gogo protobuf marshaling, payload hashing, and provider-key signing over canonical payload bytes. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Registers the AEP-86 inventory snapshot service when a provider-side snapshot builder is supplied. The default run path passes nil until the real payload source is wired. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Builds the inventory snapshot payload from the existing provider StatusV1 path and registers a real signed snapshotter on the provider gRPC server. This keeps the legacy status endpoints unchanged while making the AEP-86 snapshot RPC return nonce-bound deterministic protobuf bytes. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Embeds the provider status payload as a named evidence section so auditors can decode the existing provider status view from the signed snapshot. Built snapshots are validated before returning from the public inventory RPC. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Use the chain latest block time for provider verification snapshot payloads when it is available so local E2E posts do not race ahead of the chain clock. Keep the long-running poster loop alive after bounded non-context failures. RunOnce still reports the underlying error for direct callers and tests. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
chalabi2
force-pushed
the
aep86/l10-snapshot-poster
branch
from
July 27, 2026 18:34
9d9813a to
4fe63ba
Compare
chalabi2
force-pushed
the
aep86/l3-inventory-snapshot
branch
from
July 27, 2026 23:42
8e870ea to
0fa3c7d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the provider snapshot poster, persistent poster state, retry behavior,
query loop, runtime wiring, and software identity propagation.
Tracking
The poster and inventory packages are reviewable. Final upstream preparation
still needs the provider branch aligned with the node v3 dependency stack.