Objective
Independently test the KineGrant software permission boundary and publish either a reproducible PASS or a useful FAIL.
This is a request for criticism and clean-room reproduction, not endorsement. A PASS does not prove physical actuation, functional safety, production readiness, or adoption.
What to test
Run the default main branch, which includes the source-bound reproduction packet for Machine Permission Test v0.1. The test covers nine assertions:
- no capability means no action;
- a valid capability succeeds once;
- replay is rejected;
- changed agent, target, action, or purpose is rejected;
- an untrusted issuer is rejected;
- exact expiry is rejected;
- concurrent consumption has one winner;
- replay remains rejected after restart;
- tampered receipts and untrusted executors are rejected.
Zero-install option
Open main in GitHub Codespaces. The checked-in Dev Container installs dependencies, generates the packet, and invokes the independent verifier.
Publish the exact commit, environment, report, and checksum described below. A maintainer-owned Codespaces or Actions run is reference evidence, not an external reproduction.
Five-minute reproduction
Use Python 3.11 or newer in a fresh checkout:
git clone https://github.com/zoahdev/kinegrant-protocol.git
cd kinegrant-protocol
git checkout --detach main
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
python -m pip install -e '.[test]'
python challenge/reproduce.py --output-dir reproduction-output
python challenge/verify_reproduction.py reproduction-output/reproduction-report.json
The final command must print PASS and exit with status 0, or print a precise failure reason with a non-zero status. The packet also includes reproduction-report.sha256.
Publish the result
Use the repository's External reproduction result issue form and include:
- exact tested commit (
git rev-parse HEAD);
- operating system, architecture, and Python version;
- final verifier line;
reproduction-report.json and reproduction-report.sha256 as attachments or public links;- for FAIL, the smallest non-sensitive log excerpt and whether a clean rerun reproduced it.
Remove usernames, home-directory paths, credentials, device identifiers, and personal data. Report exploitable vulnerabilities privately through the repository Security tab instead of a public issue.
Useful adversarial review
Review of source/provenance binding, digest coverage, unsafe paths, evidence/schema mismatch, replay semantics, and overclaiming in the documented meaning of PASS is especially welcome.
Objective
Independently test the KineGrant software permission boundary and publish either a reproducible PASS or a useful FAIL.
This is a request for criticism and clean-room reproduction, not endorsement. A PASS does not prove physical actuation, functional safety, production readiness, or adoption.
What to test
Run the default
mainbranch, which includes the source-bound reproduction packet for Machine Permission Test v0.1. The test covers nine assertions:Zero-install option
Open
mainin GitHub Codespaces. The checked-in Dev Container installs dependencies, generates the packet, and invokes the independent verifier.Publish the exact commit, environment, report, and checksum described below. A maintainer-owned Codespaces or Actions run is reference evidence, not an external reproduction.
Five-minute reproduction
Use Python 3.11 or newer in a fresh checkout:
The final command must print
PASSand exit with status0, or print a precise failure reason with a non-zero status. The packet also includesreproduction-report.sha256.Publish the result
Use the repository's External reproduction result issue form and include:
git rev-parse HEAD);reproduction-report.jsonandreproduction-report.sha256as attachments or public links;Remove usernames, home-directory paths, credentials, device identifiers, and personal data. Report exploitable vulnerabilities privately through the repository Security tab instead of a public issue.
Useful adversarial review
Review of source/provenance binding, digest coverage, unsafe paths, evidence/schema mismatch, replay semantics, and overclaiming in the documented meaning of PASS is especially welcome.