feat(evidence): CoreWeave dogfood signer + node-forensics bundle (SHIP), reviewer-gated - #218
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request establishes a formal signing process for CoreWeave dogfood evidence bundles to ensure integrity and provenance. By leveraging a reviewer-gated workflow and production-grade transparency logs, the changes provide a secure mechanism for attesting to the evaluation results of internal skills, while maintaining strict quality control by withholding signatures from non-deterministic findings. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
2b90199 to
42c24b6
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a README.md to document the CoreWeave dogfood evidence bundles, detailing their provenance, signed skills, and held skills. Feedback was provided regarding a semantic inconsistency in the verification instructions: the README suggests using cosign verify-blob on a top-level .sigstore.json file, which contradicts the Evidence Bundle Specification's requirement for row-level DSSE signatures verified via cosign verify-attestation.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| The `.sigstore.json` alongside the bundle (added by the signing workflow) carries the Fulcio | ||
| cert + signature + Rekor inclusion proof; verify it yourself with `cosign verify-blob`. |
There was a problem hiding this comment.
The verification instructions specify using cosign verify-blob on a top-level .sigstore.json file. This contradicts the Evidence Bundle Specification (v0.1.0-draft), which explicitly prohibits top-level bundle signatures in R3 (No top-level signature) and mandates row-level DSSE signatures verified via cosign verify-attestation in R10 and R13. To maintain cross-artifact semantic consistency between the dogfood evidence implementation and the specification, the signing workflow and verification instructions should be updated to use row-level DSSE signatures and cosign verify-attestation.
| The `.sigstore.json` alongside the bundle (added by the signing workflow) carries the Fulcio | |
| cert + signature + Rekor inclusion proof; verify it yourself with `cosign verify-blob`. | |
| Each row in the bundle is wrapped in a DSSE envelope carrying its own signature and Rekor inclusion proof; verify them yourself with cosign verify-attestation. |
References
- Cross-artifact semantic consistency: Flag when the meaning, type, or implementation of entities/processes diverges across files (e.g., the specification requiring row-level attestation verification while the implementation uses top-level blob verification). (link)
…dle (SHIP) Add a reviewer-gated cosign keyless signing workflow (sign-dogfood-bundle.yml) and the first CoreWeave dogfood Evidence Bundle to sign: coreweave-gpu-node-forensics, decision pass (SHIP) — self-test 20/20 (deterministic blocker) + judgment 17/17, reproduced identically from intent-os 022-RA-DATA. The signer signs ONE committed gate-result/v1 bundle with cosign keyless -> production Rekor. It is workflow_dispatch-only and its sign job runs in the evidence-prod environment (required reviewer: jeremylongshore), so the irreversible prod Rekor upload HOLDS for human approval before any cosign step runs. Fail-closed: explicit --rekor-url, structural gate-result/v1 validation, cosign verify-blob self-check. actionlint clean; the exact sign/verify commands were rehearsed locally (key-based, tlog off) on the real bundle. Held, NOT signed: coreweave-gpu-cost-leak-hunter — its verdict is nondeterministic (SHIP 10/10 on 2026-07-05 -> BLOCK 5/10 on a 2026-07-06 re-run). A permanent public signature must not ride a single noisy sample; it waits for a seeded/multi-run majority. Eval'd locally via DeepSeek judge, no CoreWeave keys. Provenance in evidence/coreweave-dogfood/README.md. Refs intent-os 021-PP-PLAN #4, 023-AT-DECR.
42c24b6 to
7ec684d
Compare
1 participant
What
The first signed CoreWeave dogfood verdict — the pipeline
023-AT-DECRdescribes, nowexecuted with the gates you cleared (name allowed; DeepSeek key authorized).
.github/workflows/sign-dogfood-bundle.yml— reviewer-gated cosign keyless signer (→ prod Rekor)evidence/coreweave-dogfood/coreweave-gpu-node-forensics.bundle.json— thegate-result/v1bundle (decision pass / SHIP)evidence/coreweave-dogfood/README.md— provenance + the held-skill findingThe verdict signed
coreweave-gpu-node-forensics: pass (SHIP) — self-test 20/20 (deterministic blocker) +judgment 17/17, reproduced identically from
022-RA-DATA(2026-07-05).Held — not signed (a real finding)
coreweave-gpu-cost-leak-hunteris not signed: its verdict flipped SHIP 10/10 (2026-07-05)→ BLOCK 5/10 (2026-07-06 re-run), same skill/harness/judge. A permanent public signature must
not ride a coin-flip. Held for a seeded/multi-run majority.
Safety
workflow_dispatch-only; the sign job runs in theevidence-prodenvironment(required reviewer: @jeremylongshore) → the prod Rekor upload holds for your approval
before any cosign step runs.
--rekor-url, structuralgate-result/v1validation,verify-blobself-check. actionlint clean. The exact
sign-blob/verify-blobcommands were rehearsedlocally (key-based, tlog off) on the real bundle — "Verified OK".
After merge
gh workflow run sign-dogfood-bundle.yml -f bundle=evidence/coreweave-dogfood/coreweave-gpu-node-forensics.bundle.json→ you approve in the Actions UI → prod Rekor index → cited on the public labs scorecard.
Refs intent-os
021-PP-PLAN#4 ·023-AT-DECR.