fix: complete pattern mapping + correct signing key docs - #25
Merged
Conversation
Finding 2: Pattern component table now maps all 8 EAC v1.3 components with correct numbering per docs/concepts.md. Component 6 (Mutual Authentication / mutauth) documented as present but not wired into the broker. Components 7 (Delegation) and 8 (Observability) added with their Go packages, types, and functions. Finding 3: Removed false claim in Security Assumptions that "all previously issued tokens become unverifiable after restart (new signing keys)." The Ed25519 signing key is persistent via internal/keystore — tokens survive broker restarts. Corrected the single-broker-instance note to describe the actual split-brain risk (in-memory transient state, not the signing key).
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
Missed spots from PR #24's LicenseRef rename: - Dockerfile OCI label (org.opencontainers.image.licenses) - docs/api/openapi.yaml license name field - docs/getting-started-operator.md OCI label reference - CHANGELOG.md historical entries updated to match corrected value Verified: zero bare PolyForm-Internal-Use-1.0.0 identifiers remain outside of human-readable prose ("PolyForm Internal Use License 1.0.0").
devonartis
added a commit
that referenced
this pull request
Apr 13, 2026
The component table in PR #25 added mutauth but the top-line count and directory layout weren't updated to match.
2 tasks
devonartis
added a commit
that referenced
this pull request
Apr 13, 2026
The component table in PR #25 added mutauth but the top-line count and directory layout weren't updated to match.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two unresolved findings from code review:
Finding 2 — Component mapping incomplete: Pattern table now maps all 8 EAC v1.3 components with correct numbering per
docs/concepts.md. Component 6 (Mutual Authentication /mutauth) documented as present but not wired. Components 7 (Delegation Chain) and 8 (Operational Observability) added with packages, types, and functions.Finding 3 — Restart behavior contradicts persistent signing key: Removed false claim that "all previously issued tokens become unverifiable after restart (new signing keys)." The Ed25519 key persists via
internal/keystore— tokens survive restarts. Corrected the single-broker note to describe the actual risk: split-brain in-memory state, not signing keys.Verification
docs/concepts.md(authoritative source)internal/keystore/keystore.go:LoadOrGenerate()persists key to diskmutauthpackage exists but is not imported incmd/broker/main.goTest plan
go build ./...passesgo test ./... -shortall packages pass