Repository navigation
Conversation
postCompact required post_compact_chain_hash, the chain hash after the Guardian writes the postCompact ContextEntry. The Guardian chooses that entry's entry_id, so the sender cannot compute the value, and under ACS-Audit request_hash covers params, so the value would hash itself. It also required summary.provenance, which a provenance_producer: none client does not emit, so a conformant ACS-Core client could not send a valid postCompact. turnEnd and subagentStop had the same shape whenever summary was present. Drop post_compact_chain_hash from the payload: the Guardian publishes that value as the response chain_hash (section 8.6). Make pre_compact_chain_hash optional, as final_chain_hash already is on subagentStop, so a client that tracks no chain omits it rather than fabricating it. Make summary.provenance optional in the three base schemas and restore it under ACS-Provenance with post-compact, turn-end and subagent-stop acs-provenance variants. Update the Hooks page and section 7 and 8.6 prose to match. Closes GenAI-Security-Project#382 Signed-off-by: Raghuvar Karthik Durga <177662415+drk-ram@users.noreply.github.com>
drk-ram
requested review from
GangGreenTemperTatum,
afogel,
almogbhl,
bar-capsule,
fewdisc,
mamicidal,
rocklambros,
sclintonowasp and
stefanoamorelli
as code owners
November 6, 2026 16:37
|
Thanks for this. It is queued rather than ignored. A lead has not reviewed this pull request yet. A lead will read it when they have time, and we can't promise a date. Nothing here is rejected. If a check below fails, please fix it. A pull request that waits a long time may be closed, and you can reopen it later. |
|
This pull request's description says it closes #382, which is on the project roadmap. When it merges, GitHub closes that issue and the roadmap counts it as delivered. Please confirm the change delivers the whole issue before merging. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
postCompactno longer requires fields a sender cannot honestly fill.post_compact_chain_hashleaves the payload, because the Guardian writes that ContextEntry and publishes the value as the response'schain_hash(section 8.6).pre_compact_chain_hashbecomes optional, andsummary.provenancebecomes optional inpostCompact,turnEndandsubagentStop. New*.acs-provenance.jsonvariants for those three hooks putsummary.provenanceback for ACS-Provenance deployments.Which issue does this implement
Closes #382
meaning, so it needs no issue
Base branch
integration, because this touches the specification, schemas, a referenceimplementation, an adapter, tests, or CI
main, because every changed path is on the documentation lane allowlist inCONTRIBUTING.md
Type of change
Specification changes
Breaking for implementers? No for senders: every change relaxes a requirement, so a payload that validated before still validates, and a sender that was sending
post_compact_chain_hashstill validates because the schema is open. A Guardian that readpost_compact_chain_hashfrom the request should take the value from its own chain. A deployment claiming ACS-Provenance should validatepostCompact,turnEndandsubagentStopagainst the new strict variants to keep the old requirement onsummary.provenance.Choices made:
chain_hashon the response, which section 8.6 already requires. Removing the field also removes the self-hash under ACS-Audit.pre_compact_chain_hash. Optional, following thefinal_chain_hashprecedent onsubagentStop. The Guardian holds the same value in its chain, and a supplied value that disagrees is achain_mismatch. This goes slightly beyond the issue text, which names only the post hash, because a client that tracks no chain cannot fill the pre hash either.I tested this
I synced my branch with the base branch before opening this
uv run pytest -vpasses on my machineuv run mkdocs build --strictpasses on my machineuv run pytest tests/test_post_compact_fields.py tests/test_hook_taxonomy.py tests/test_publish_schemas.py -q: the new file and the taxonomy tests pass. The two symlink tests intest_publish_schemas.pyfail here because Windows denies symlink creation.uv run pytest -q: 1225 passed, 10 failed, 20 errors. The failures and errors are the symlink, subprocess and timing tests intest_fetch_roadmap,test_overrides,test_pr_intake_workflow,test_publish_schemasandtest_closing_choicethat fail on this Windows machine without this change.uv run mkdocs build --strict: passesChecklist
git commit -s(required by the DCO)Security