push from SNAPKITTYWEST/sovereign-agi-kernel

1cdfc83 verified about 2 months ago

4.27 kB

# Sovereign AGI Kernel — CI Pipeline
# Enforces: air-gap build, entropy validation, WORM commitment
# GATES: build fails if entropy > 0.20, if forbidden zones violated,
# or if unverified code touches the kernel directly.

stages:
  - forbidden_check
  - sovereign_build
  - entropy_validation
  - runtime_verification
  - worm_commit

# --- Gate 1: Forbidden Zone Enforcement ---
forbidden_check:
  stage: forbidden_check
  script:
    - echo "=== FORBIDDEN ZONE CHECK ==="
    # No /models/ directory (unverifiable weights)
    - "[ ! -d models/ ] || (echo 'FORBIDDEN: /models/ directory exists' && exit 1)"
    # No /data/ directory (breaks air-gap sovereignty)
    - "[ ! -d data/ ] || (echo 'FORBIDDEN: /data/ directory exists' && exit 1)"
    # No direct kernel imports from unverified code
    - |
      if grep -r "import ErdosStraus" --include="*.hs" --include="*.py" --include="*.js" .; then
        echo "FORBIDDEN: Untyped code imports kernel directly"
        echo "Use Reasoning_IDL.idr interface instead"
        exit 1
      fi
    # No sorry/believe_me in kernel (except ErdosStraus.idr which uses believe_me for omega proofs)
    - |
      if grep -n "sorry" idris/AgentModel.idr idris/WORM_Audit.idr idris/Reasoning_IDL.idr idris/SovereignKernel.idr idris/FlightTypes.idr idris/FlightKernel.idr idris/FlightWORM.idr idris/FlightGate.idr 2>/dev/null; then
        echo "FORBIDDEN: sorry found in sovereign kernel modules"
        exit 1
      fi
    # No direct FlightKernel imports from unverified code (must use FlightGate)
    - |
      if grep -r "import FlightKernel\|import FlightTypes\|import FlightWORM" --include="*.py" --include="*.js" --include="*.mjs" .; then
        echo "FORBIDDEN: Untyped code bypasses FlightGate"
        echo "Use FlightGate.idr interface for all flight requests"
        exit 1
      fi
    - echo "=== FORBIDDEN ZONE: CLEAR ==="

# --- Gate 2: Air-Gapped Sovereign Build ---
sovereign_build:
  stage: sovereign_build
  script:
    - echo "=== SOVEREIGN BUILD (AIR-GAPPED) ==="
    - docker build --target final -t erdos-straus-verified:$CI_COMMIT_SHA .
    - docker run --rm --network=none erdos-straus-verified:$CI_COMMIT_SHA cat manifest.txt
    - echo "=== BUILD: COMPLETE ==="
  artifacts:
    paths:
      - kernel/artifacts/verified_kernel.wasm
      - kernel/artifacts/artifact.hash
  needs: [forbidden_check]

# --- Gate 3: Entropy Validation ---
entropy_validation:
  stage: entropy_validation
  script:
    - echo "=== ENTROPY VALIDATION ==="
    # Idris 2 type-checks AgentModel.idr — FAILS if entropy > 20 possible
    - cd Idris && idris2 --check AgentModel.idr
    - cd Idris && idris2 --check WORM_Audit.idr
    - cd Idris && idris2 --check Reasoning_IDL.idr
    - cd Idris && idris2 --check SovereignKernel.idr
    # All files must be %default total
    - |
      for f in Idris/*.idr; do
        if ! head -5 "$f" | grep -q "%default total"; then
          echo "ENTROPY VIOLATION: $f is not declared total"
          exit 1
        fi
      done
    - echo "=== ENTROPY: ALL BOUNDED (compile-time proof) ==="
  needs: [sovereign_build]

# --- Gate 4: Runtime Verification ---
runtime_verification:
  stage: runtime_verification
  script:
    - echo "=== RUNTIME VERIFICATION ==="
    - cd runtime && node main.mjs > output.txt 2>&1
    - grep -q "All gap inequalities hold: VERIFIED" runtime/output.txt
    - cd scaffold && python3 agi_gate.py > gate_output.txt 2>&1
    - grep -q "PROVEN" scaffold/gate_output.txt
    - echo "=== RUNTIME: ALL CHECKS PASSED ==="
  needs: [entropy_validation]

# --- Gate 5: WORM Chain Commitment ---
worm_commit:
  stage: worm_commit
  script:
    - echo "=== WORM CHAIN COMMITMENT ==="
    # Hash all verified artifacts
    - sha256sum Idris/*.idr Erdos/*.lean runtime/*.mjs > BUILD_SEAL.txt
    # Commit hash to audit trail
    - |
      echo "{\"commit\":\"$CI_COMMIT_SHA\",\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"seal\":\"$(sha256sum BUILD_SEAL.txt | cut -d' ' -f1)\",\"status\":\"verified\"}" >> audit/commitments/latest.jsonl
    - echo "=== WORM: COMMITTED (append-only) ==="
  needs: [runtime_verification]
  only:
    - tags
    - main

	# Sovereign AGI Kernel — CI Pipeline
	# Enforces: air-gap build, entropy validation, WORM commitment
	# GATES: build fails if entropy > 0.20, if forbidden zones violated,
	# or if unverified code touches the kernel directly.

	stages:
	- forbidden_check
	- sovereign_build
	- entropy_validation
	- runtime_verification
	- worm_commit

	# --- Gate 1: Forbidden Zone Enforcement ---
	forbidden_check:
	stage: forbidden_check
	script:
	- echo "=== FORBIDDEN ZONE CHECK ==="
	# No /models/ directory (unverifiable weights)
	- "[ ! -d models/ ] \|\| (echo 'FORBIDDEN: /models/ directory exists' && exit 1)"
	# No /data/ directory (breaks air-gap sovereignty)
	- "[ ! -d data/ ] \|\| (echo 'FORBIDDEN: /data/ directory exists' && exit 1)"
	# No direct kernel imports from unverified code
	- \|
	if grep -r "import ErdosStraus" --include=".hs" --include=".py" --include="*.js" .; then
	echo "FORBIDDEN: Untyped code imports kernel directly"
	echo "Use Reasoning_IDL.idr interface instead"
	exit 1
	fi
	# No sorry/believe_me in kernel (except ErdosStraus.idr which uses believe_me for omega proofs)
	- \|
	if grep -n "sorry" idris/AgentModel.idr idris/WORM_Audit.idr idris/Reasoning_IDL.idr idris/SovereignKernel.idr idris/FlightTypes.idr idris/FlightKernel.idr idris/FlightWORM.idr idris/FlightGate.idr 2>/dev/null; then
	echo "FORBIDDEN: sorry found in sovereign kernel modules"
	exit 1
	fi
	# No direct FlightKernel imports from unverified code (must use FlightGate)
	- \|
	if grep -r "import FlightKernel\\|import FlightTypes\\|import FlightWORM" --include=".py" --include=".js" --include="*.mjs" .; then
	echo "FORBIDDEN: Untyped code bypasses FlightGate"
	echo "Use FlightGate.idr interface for all flight requests"
	exit 1
	fi
	- echo "=== FORBIDDEN ZONE: CLEAR ==="

	# --- Gate 2: Air-Gapped Sovereign Build ---
	sovereign_build:
	stage: sovereign_build
	script:
	- echo "=== SOVEREIGN BUILD (AIR-GAPPED) ==="
	- docker build --target final -t erdos-straus-verified:$CI_COMMIT_SHA .
	- docker run --rm --network=none erdos-straus-verified:$CI_COMMIT_SHA cat manifest.txt
	- echo "=== BUILD: COMPLETE ==="
	artifacts:
	paths:
	- kernel/artifacts/verified_kernel.wasm
	- kernel/artifacts/artifact.hash
	needs: [forbidden_check]

	# --- Gate 3: Entropy Validation ---
	entropy_validation:
	stage: entropy_validation
	script:
	- echo "=== ENTROPY VALIDATION ==="
	# Idris 2 type-checks AgentModel.idr — FAILS if entropy > 20 possible
	- cd Idris && idris2 --check AgentModel.idr
	- cd Idris && idris2 --check WORM_Audit.idr
	- cd Idris && idris2 --check Reasoning_IDL.idr
	- cd Idris && idris2 --check SovereignKernel.idr
	# All files must be %default total
	- \|
	for f in Idris/*.idr; do
	if ! head -5 "$f" \| grep -q "%default total"; then
	echo "ENTROPY VIOLATION: $f is not declared total"
	exit 1
	fi
	done
	- echo "=== ENTROPY: ALL BOUNDED (compile-time proof) ==="
	needs: [sovereign_build]

	# --- Gate 4: Runtime Verification ---
	runtime_verification:
	stage: runtime_verification
	script:
	- echo "=== RUNTIME VERIFICATION ==="
	- cd runtime && node main.mjs > output.txt 2>&1
	- grep -q "All gap inequalities hold: VERIFIED" runtime/output.txt
	- cd scaffold && python3 agi_gate.py > gate_output.txt 2>&1
	- grep -q "PROVEN" scaffold/gate_output.txt
	- echo "=== RUNTIME: ALL CHECKS PASSED ==="
	needs: [entropy_validation]

	# --- Gate 5: WORM Chain Commitment ---
	worm_commit:
	stage: worm_commit
	script:
	- echo "=== WORM CHAIN COMMITMENT ==="
	# Hash all verified artifacts
	- sha256sum Idris/.idr Erdos/.lean runtime/*.mjs > BUILD_SEAL.txt
	# Commit hash to audit trail
	- \|
	echo "{\"commit\":\"$CI_COMMIT_SHA\",\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"seal\":\"$(sha256sum BUILD_SEAL.txt \| cut -d' ' -f1)\",\"status\":\"verified\"}" >> audit/commitments/latest.jsonl
	- echo "=== WORM: COMMITTED (append-only) ==="
	needs: [runtime_verification]
	only:
	- tags
	- main