Spaces:
Running
Running
File size: 2,883 Bytes
a6a5d8e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 | # Warhacker UDS proof point
This is the Defense-Unicorns-facing shape for the A11oy demo. It connects the
existing governed-execution substrate to UDS/Zarf without implying endorsement,
catalog acceptance, or partnership.
## Objective
Show a running, inspectable proof point for trusted AI/agent orchestration in a
UDS-style operator workflow:
- payload artifacts are content-addressed;
- operator actions emit verifiable receipts;
- package metadata can be inspected before deploy;
- public claims route back to GitHub evidence.
## Option A — three-week proof point
| Week | Deliverable | Evidence |
| --- | --- | --- |
| 1 | Build/verify A11oy UDS payload from source | `artifacts/a11oy-uds/scripts/build.sh`, `deploy/MANIFEST.json` |
| 2 | Receipt-chain demo with tamper failure | `packages/receipt-substrate`, `npm test --prefix packages/receipt-substrate` |
| 3 | Operator walkthrough packet | Hugging Face mirror + GitHub release/check links + short demo video |
## Demo script
```bash
# 1. Validate runtime receipt primitives.
npm test --prefix packages/receipt-substrate
npm run smoke --prefix packages/receipt-substrate
# 2. Validate doctrine package lane.
pnpm test:doctrine
pnpm typecheck:doctrine
pnpm build:doctrine
# 3. Validate deploy payload integrity.
pnpm payload:verify
# 4. Generate the public diligence mirror.
pnpm payload:huggingface
# 5. Build and verify the operational review tarball.
pnpm payload:bundle
pnpm payload:bundle:verify
```
## UDS/Zarf inspection lane
Where Zarf is available, the proof point should add:
```bash
zarf package inspect a11oy-uds-<version>.tar.zst
zarf package deploy a11oy-uds-<version>.tar.zst --confirm
```
Where Zarf is not available, use the documented source fallback only as a CI/dev
verification mode. The fallback tarball is not a deployable Zarf package and
must not be presented as one.
## Tamper test
1. Unpack a generated payload.
2. Modify any file listed in `MANIFEST.json`.
3. Re-run manifest verification.
4. Show the verifier failing on the changed SHA-256.
That failure is the point: the operator can trust the package because mutation
breaks the manifest trail.
## What to say
Use:
- “UDS/Zarf-compatible proof point.”
- “Operator handoff with manifest and attestation verification.”
- “A11oy is the governed-execution fabric; UDS is the delivery/control-plane
context we are integrating with.”
Avoid:
- “Defense Unicorns endorsed.”
- “Accepted into the UDS catalog.”
- “Deploys to every UDS environment.”
- “All formal proof work is green.”
## Evidence bundle checklist
- GitHub branch/PR URL.
- A11oy release URL.
- UDS release URL (`uds-v0.2.0` or newer).
- Workflow run URLs for Doctrine Build, Operational Validation, SBOM, CodeQL.
- `MANIFEST.json` and attestation excerpts.
- Receipt JSONL sample and verifier output.
- Hugging Face mirror URL.
|