GitHub - cjchanh/aaap-challenge · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
cjchanh
aaap-challenge
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Latest commit
History<br>11 Commits<br>11 Commits
Folders and files<br>NameNameLast commit message<br>Last commit date<br>EVIDENCE
EVIDENCE
docs
docs
packet
packet
security
security
tests
tests
AGENTS.md
AGENTS.md
CHALLENGE.md
CHALLENGE.md
DAYBREAK_CREDIT.md
DAYBREAK_CREDIT.md
DAYBREAK_II_CREDIT.md
DAYBREAK_II_CREDIT.md
LICENSE
LICENSE
README.md
README.md
SECURITY.md
SECURITY.md
WALKTHROUGH.md
WALKTHROUGH.md
anchors.json
anchors.json
View all files
Repository files navigation
AAAP v0.5 — Hardened Post-Release Challenge
AAAP v0.3 at commit<br>e0fca96651b30c76d0a29bf867cdd14cdc38db00 is preserved as an immutable,<br>reproducibly vulnerable historical release. This repository is its<br>hardened successor.
The v0.4 packet preserves the v0.3 chain.jsonl, artifacts/, and<br>attestation.json byte-for-byte. It regenerates the human/verification layer<br>and signs manifest schema v2 with the same anchored production identity. The<br>chain head and public key therefore remain:
head: 14d14281170d89f6f8b918daf6541f81e7e13549dd4c66f5b085304ff6a61724
pubkey: e7fb4aad8b0e0246eb6569f49d301ad88a0b54333e3de8bb57e02e118fd3716c
Start with CHALLENGE.md. The complete v0.3 reproducer and<br>machine results are under security/; the post-release finding ledger is<br>docs/AAAP_POST_RELEASE_SECURITY.md.
Verify
Requirements: Python 3.10+ and either the Python cryptography package or an<br>OpenSSL build with Ed25519 pkeyutl -rawin support.
cd packet<br>python3 verify_packet.py . \<br>--expected-head 14d14281170d89f6f8b918daf6541f81e7e13549dd4c66f5b085304ff6a61724 \<br>--expected-pubkey e7fb4aad8b0e0246eb6569f49d301ad88a0b54333e3de8bb57e02e118fd3716c
For registry-policy verification, independently acquire both exact registry<br>snapshots and use --packet-name demo/packet. Both repositories are controlled<br>by github.com/cjchanh: they are two Git histories, not two administrative or<br>custodial trust origins.
Narrow claim
A PASS authenticates the checked bytes, canonical envelope semantics, ordering,<br>manifest policy, and signatures under the supplied anchor. It does not prove<br>world truth, signing time, Keychain custody, operator ownership, verifier/host<br>benevolence, registry freshness, or independent origin.
Hardening source: local working commit in the operator's private<br>workspace; the published lineage is e0fca96 -> 8f5ba31f -> c06b163 -><br>939b1e7 -> 9655a65 -> 06a3982 (current).
About<br>No description or website provided.<br>Topics<br>agent-safetyai-agentsaudited25519provenancetamper-evidence<br>Resources<br>Readme<br>Apache-2.0 license<br>Security policy<br>Security policy<br>Activity<br>Stars<br>0 stars<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository
Releases
Packages
Contributors
Languages
You can’t perform that action at this time.