fix(cli): verdicts reach the exit code — am verify no longer exits 0 on FAIL (v0.3.0) - #3
Merged
Merged
Conversation
…on FAIL (v0.3.0) Every CLI path exited 0, so `am verify && …` proceeded on a tampered ledger; the printed 🔴 FAIL was the only signal. Found live: a commit-binding tool trusted the exit code and its tamper demo (byte-flipped ledger) came back green while the output plainly said "seal mismatch — content modified". verify / verify-peer / verify-sig → exit 1 on FAIL (0 on OK/WARN); attest → 0 only on ATTESTED (1 on CONTENT-MISMATCH and NOT-FOUND); record / history / witness / cross / keygen keep exiting 0. tests 50/50 (7 new subprocess-level exit-code checks, including the exact tampered-ledger case the defect shipped). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collaborator
Author
|
머지: 대장님 건별 승인(4건 일괄, 순서 머지). CI 그린·MERGEABLE 재확인. 트리아지=B였고 사람 결정으로 머지. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Every CLI path exited 0 regardless of verdict.
am verify && deployproceeded on a tampered ledger — the 🔴 FAIL existed only in stdout.Found live, not hypothetically: a commit↔ledger binding tool trusted the exit code, and its own tamper demo (a byte-flipped ledger) came back green while
am verify's output plainly said "seal mismatch — content modified". The verdict machinery was correct end to end; the last inch to the caller was missing.Changes
verify,verify-peer,verify-sigattestrecord,history,witness,cross,keygenreport()now returns the worst level it printed;_cli()returns an int (the[project.scripts]wrapper alreadysys.exits it, and__main__now raisesSystemExit).Compatibility
Scripts that parse the output are unaffected. Scripts that trusted the exit code were reading a constant — any change is strictly more information. Minor bump to 0.3.0 because observable CLI behaviour changes.
Verification
tests/50/50, including 7 new subprocess-level exit-code checks — one is the exact tampered-ledger case the defect shipped.Merge is triage-owned — this session stops at PR submission.
🤖 Generated with Claude Code