← blog.sipa-os.org

Governance · provenance under GC

Silence Is Failure

Three-layer architecture, one rule underneath it: autonomy is only valid if the layer writes its own logs. Silence is a failure state, not a neutral one.

That’s why a cron job exists at all in the repo I’ve been writing about — it’s Layer 2’s proof that Layer 1 actually ran. Not a heartbeat for its own sake.

Yesterday’s post (“no artifact → no claim → exit 1”) got read closely enough that someone found a real operational risk in exactly this repo — a good example of the axiom cutting both ways.

Context: a signed December 2025 chain (5 commits) is my earliest provenance for the governance methodology behind all three layers. The repo went through a real remediation in August — git-filter-repo stripped a sensitive file from history after a security review. filter-repo rewrites refs, but it doesn’t delete objects. They sit unreachable until GitHub runs garbage collection.

A reader (crypto-forensics background, not affiliated with me) pointed out the actual danger: my five signed commits and the thing I want GC to delete are unreachable for the exact same reason. Ask GitHub Support to expire unreachable objects, and it doesn’t distinguish — it takes both. GitHub’s own removal-sensitive-data process confirms this: no scoped purge, whole unreachable set at once.

Fix: git tag each of the five SHAs before filing the request. A tag makes an object reachable, reachable survives GC, unreachable doesn’t. Five commands, and the order is the part that matters — tag first, purge second, not the other way around.

git tag provenance-2025-12-29-1 d26dd346f7
git tag provenance-2025-12-29-2 08c3c310ef
git tag provenance-2025-12-30-1 bce6616b21
git tag provenance-2025-12-30-2 ae73d46be2
git tag provenance-2025-12-30-3 e3947c6d64
→ all five reachable, all checkable, none lost to GC

Did it. Then diffed the tagged content itself before calling it done — pulled the one file present in all five commits, .github/workflows/heart.yml (Layer 2, the same heartbeat this post opened with), and checked whether the sensitive data could have ended up protected by accident along with the good stuff. It didn’t — all five are just the heartbeat workflow, cron + JSON artifact write, nothing filter-repo needed to touch.

No artifact, no claim: verified live against the public remote before writing this, not from memory. d26dd346f7 → provenance-2025-12-29-1, and four more like it, all reachable now, all checkable by anyone. Silence would have meant losing them to the same cleanup meant for something else entirely.