From 05edc0ccca7d5b495e7bf6c58ed99392a2682d73 Mon Sep 17 00:00:00 2001 From: Joshua Date: Thu, 19 Feb 2026 14:29:10 -0800 Subject: [PATCH] Add tx-hash replay vectors and release-gate requirements --- docs/conformance/membership-gating-vectors.md | 10 +++++++ docs/release-gate.md | 26 ++++++++++--------- docs/roadmap-status.md | 1 + 3 files changed, 25 insertions(+), 12 deletions(-) diff --git a/docs/conformance/membership-gating-vectors.md b/docs/conformance/membership-gating-vectors.md index b5d5b3d..86c74b7 100644 --- a/docs/conformance/membership-gating-vectors.md +++ b/docs/conformance/membership-gating-vectors.md @@ -56,6 +56,11 @@ This document defines deterministic pass/fail vectors for membership-gated comme - When confirm executes - Then request fails closed +7. B7 `confirm_tx_hash_replay_blocked` +- Given tx hash H already used to confirm membership for designation A +- When designation B tries to confirm with the same tx hash H +- Then request is denied with replay error and designation B remains unactivated + ## Vector Group C: Checkout Membership Gate 1. C1 `checkout_block_no_membership` @@ -78,6 +83,11 @@ This document defines deterministic pass/fail vectors for membership-gated comme - When checkout is requested - Then checkout is denied +5. C5 `checkout_confirm_tx_hash_replay_blocked` +- Given tx hash H already used to confirm checkout quote Q1 +- When a different checkout quote Q2 is confirmed with tx hash H +- Then request is denied with replay error and no entitlement is minted for Q2 + ## Vector Group D: Entitlement Activation Gate 1. D1 `activation_allow_active_entitlement` diff --git a/docs/release-gate.md b/docs/release-gate.md index 9523d76..7de31ee 100644 --- a/docs/release-gate.md +++ b/docs/release-gate.md @@ -20,18 +20,19 @@ This gate controls deploy/no-deploy decisions for membership-gated commerce chan 6. Signature replay tests pass. 7. Quote expiry tests pass. 8. Tx mismatch tests pass. -9. Membership gate blocks non-members in all checkout paths. -10. Member channel blocks inactive memberships. -11. Governance activation blocks inactive/unknown entitlement states. -12. Boundary mismatch paths fail closed for paid execution. -13. `PARKED` availability state blocks paid execution while preserving read/export paths. -14. Admin/support channel endpoints are owner-gated (`org_root_owner` only). -15. Terms/privacy copy still match utility-access framing. -16. Structured logs and metrics are emitted for each state transition. -17. Bundled membership line-item disclosure is present on first checkout quotes. -18. Public web deployment blocks anonymous production catalog and quote endpoints. -19. `docs/public-content-standard.md` requirements are satisfied for all changed public pages. -20. `docs/ai-answer-conformance-checklist.md` passes across Claude, GPT, Grok, and Gemini for changed public URLs. +9. Membership and checkout tx-hash replay tests pass. +10. Membership gate blocks non-members in all checkout paths. +11. Member channel blocks inactive memberships. +12. Governance activation blocks inactive/unknown entitlement states. +13. Boundary mismatch paths fail closed for paid execution. +14. `PARKED` availability state blocks paid execution while preserving read/export paths. +15. Admin/support channel endpoints are owner-gated (`org_root_owner` only). +16. Terms/privacy copy still match utility-access framing. +17. Structured logs and metrics are emitted for each state transition. +18. Bundled membership line-item disclosure is present on first checkout quotes. +19. Public web deployment blocks anonymous production catalog and quote endpoints. +20. `docs/public-content-standard.md` requirements are satisfied for all changed public pages. +21. `docs/ai-answer-conformance-checklist.md` passes across Claude, GPT, Grok, and Gemini for changed public URLs. ## No-Deploy Triggers @@ -48,6 +49,7 @@ This gate controls deploy/no-deploy decisions for membership-gated commerce chan 11. Any `PARKED` state that still allows paid execution. 12. Any non-owner path that can open admin/support channel actions. 13. Any required public-content conformance fact fails on any required model. +14. Any path that allows reused tx_hash across different membership designations or checkout quotes. ## Evidence Bundle Required for Release diff --git a/docs/roadmap-status.md b/docs/roadmap-status.md index 48c6407..1547b87 100644 --- a/docs/roadmap-status.md +++ b/docs/roadmap-status.md @@ -61,6 +61,7 @@ Implemented now: 32. Wallet session issuance and validation are implemented (`session_token` from `/secret/wallet/verify`) with optional fail-closed enforcement via `SECRET_API_REQUIRE_WALLET_SESSION`. 33. Marketplace/member/governance OpenAPI contracts now declare wallet-session usage for launcher/app-channel calls. 34. Offer catalogs and marketplace responses now carry execution pacing profiles (`governed_human_pace` vs `local_hardware_speed`) for connector/runtime policy alignment. +35. Membership and checkout confirm handlers now reject tx-hash replay across different designations/quotes (`tx_hash_replay`) with deterministic tests and live validation. Remaining in this repo: