deps: bump measure-mirror pin → v0.28.0 (verify_chain prev_seal security fix)#20
Merged
Merged
Conversation
Ships the chain-integrity security fix (missing prev_seal no longer waives the link — SPEC §4 rule 3) to the integrated MCP install. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
머지: measure-mirror 핀 → v0.28.0 (verify_chain prev_seal 보안 픽스). CI 4/4 그린·CP5 클린·핀 SHA 실재 확인. 핀 표면(가드레일 #10) → 사람 승인 후 머지. |
bhyi4
pushed a commit
that referenced
this pull request
Jul 21, 2026
#20 landed the v0.28.0 pin as a 9-hex abbreviation (28290f2ba). Same commit, but it (a) violates the 'exact commits for reproducible installs' convention in this file's own comment and (b) blinds the cross-repo CP1 checker, whose regex requires full 40-hex — it silently degraded to 'pin SHA not found / format changed?', losing pin-lag monitoring for measure-mirror. Expand to the full digest 28290f2bad327525a0ec3b0b6287805c684c4647 (content-identical). Recurrence guard added on the triage side: CP1 now extracts 7–40 hex and flags any non-40-hex pin as a WARN so a future abbreviated-SHA pin bump PR is caught at triage instead of slipping through. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
bhyi4
added a commit
that referenced
this pull request
Jul 21, 2026
Propagates measure-mirror #33 to mm_power_check: power_check now honors
alpha/target_power instead of hardcoding z_alpha2=1.96/z_beta=0.842. The old
probe printed the requested power ('at 99% power') while always computing n at
80% — text and number lied to each other. Now target_power=0.99 → n≥1829 (was
781), alpha=0.0001 → n≥2229; default (α=0.05, power=0.80) unchanged. zero-dep
preserved (statistics.NormalDist, stdlib).
Pin recorded as full 40-hex SHA (abe0c19d…); the v0.28.0 bump #20 had landed a
9-hex abbreviation that blinded the cross-repo pin-lag checker, since normalized.
mcp 0.2.8 → 0.2.9; CHANGELOG updated.
Co-authored-by: Mother Seara <seara@bhyi4.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the
measure-mirrordependency pin from v0.27.0 (690c27e9) to v0.28.0 (28290f2ba).Why
v0.28.0 closes a chain-integrity hole:
verify_chainsilently skipped the chain link for entries missingprev_seal, so an attacker could stripprev_sealfrom every entry, reseal each standalone, and delete/reorder freely while still getting a green "Chain intact" verdict. Now SPEC §4 rule 3 compliant (missing prev_seal → empty string → link fails naturally). Reported by external review; attack reproduced + regression-tested (measure-mirror 325 tests green, conformance ALL MATCH).Supply-chain note
This is a pin bump (supply-chain-sensitive per pr-triage rule #10) — human review before merge, not auto-merge. Pin commit
28290f2bais on measure-mirrormain, CI green.🤖 Following the PR flow (this session's earlier security fixes were direct-pushed to main, bypassing pr-triage — correcting that here).
Co-Authored-By: Claude Fable 5 noreply@anthropic.com