File size: 4,272 Bytes
1cdfc83 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 | # Sovereign AGI Kernel — CI Pipeline
# Enforces: air-gap build, entropy validation, WORM commitment
# GATES: build fails if entropy > 0.20, if forbidden zones violated,
# or if unverified code touches the kernel directly.
stages:
- forbidden_check
- sovereign_build
- entropy_validation
- runtime_verification
- worm_commit
# --- Gate 1: Forbidden Zone Enforcement ---
forbidden_check:
stage: forbidden_check
script:
- echo "=== FORBIDDEN ZONE CHECK ==="
# No /models/ directory (unverifiable weights)
- "[ ! -d models/ ] || (echo 'FORBIDDEN: /models/ directory exists' && exit 1)"
# No /data/ directory (breaks air-gap sovereignty)
- "[ ! -d data/ ] || (echo 'FORBIDDEN: /data/ directory exists' && exit 1)"
# No direct kernel imports from unverified code
- |
if grep -r "import ErdosStraus" --include="*.hs" --include="*.py" --include="*.js" .; then
echo "FORBIDDEN: Untyped code imports kernel directly"
echo "Use Reasoning_IDL.idr interface instead"
exit 1
fi
# No sorry/believe_me in kernel (except ErdosStraus.idr which uses believe_me for omega proofs)
- |
if grep -n "sorry" idris/AgentModel.idr idris/WORM_Audit.idr idris/Reasoning_IDL.idr idris/SovereignKernel.idr idris/FlightTypes.idr idris/FlightKernel.idr idris/FlightWORM.idr idris/FlightGate.idr 2>/dev/null; then
echo "FORBIDDEN: sorry found in sovereign kernel modules"
exit 1
fi
# No direct FlightKernel imports from unverified code (must use FlightGate)
- |
if grep -r "import FlightKernel\|import FlightTypes\|import FlightWORM" --include="*.py" --include="*.js" --include="*.mjs" .; then
echo "FORBIDDEN: Untyped code bypasses FlightGate"
echo "Use FlightGate.idr interface for all flight requests"
exit 1
fi
- echo "=== FORBIDDEN ZONE: CLEAR ==="
# --- Gate 2: Air-Gapped Sovereign Build ---
sovereign_build:
stage: sovereign_build
script:
- echo "=== SOVEREIGN BUILD (AIR-GAPPED) ==="
- docker build --target final -t erdos-straus-verified:$CI_COMMIT_SHA .
- docker run --rm --network=none erdos-straus-verified:$CI_COMMIT_SHA cat manifest.txt
- echo "=== BUILD: COMPLETE ==="
artifacts:
paths:
- kernel/artifacts/verified_kernel.wasm
- kernel/artifacts/artifact.hash
needs: [forbidden_check]
# --- Gate 3: Entropy Validation ---
entropy_validation:
stage: entropy_validation
script:
- echo "=== ENTROPY VALIDATION ==="
# Idris 2 type-checks AgentModel.idr — FAILS if entropy > 20 possible
- cd Idris && idris2 --check AgentModel.idr
- cd Idris && idris2 --check WORM_Audit.idr
- cd Idris && idris2 --check Reasoning_IDL.idr
- cd Idris && idris2 --check SovereignKernel.idr
# All files must be %default total
- |
for f in Idris/*.idr; do
if ! head -5 "$f" | grep -q "%default total"; then
echo "ENTROPY VIOLATION: $f is not declared total"
exit 1
fi
done
- echo "=== ENTROPY: ALL BOUNDED (compile-time proof) ==="
needs: [sovereign_build]
# --- Gate 4: Runtime Verification ---
runtime_verification:
stage: runtime_verification
script:
- echo "=== RUNTIME VERIFICATION ==="
- cd runtime && node main.mjs > output.txt 2>&1
- grep -q "All gap inequalities hold: VERIFIED" runtime/output.txt
- cd scaffold && python3 agi_gate.py > gate_output.txt 2>&1
- grep -q "PROVEN" scaffold/gate_output.txt
- echo "=== RUNTIME: ALL CHECKS PASSED ==="
needs: [entropy_validation]
# --- Gate 5: WORM Chain Commitment ---
worm_commit:
stage: worm_commit
script:
- echo "=== WORM CHAIN COMMITMENT ==="
# Hash all verified artifacts
- sha256sum Idris/*.idr Erdos/*.lean runtime/*.mjs > BUILD_SEAL.txt
# Commit hash to audit trail
- |
echo "{\"commit\":\"$CI_COMMIT_SHA\",\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"seal\":\"$(sha256sum BUILD_SEAL.txt | cut -d' ' -f1)\",\"status\":\"verified\"}" >> audit/commitments/latest.jsonl
- echo "=== WORM: COMMITTED (append-only) ==="
needs: [runtime_verification]
only:
- tags
- main
|