npm --prefix packages/witnora-cli ci
npm --prefix packages/witnora-cli run build
node packages/witnora-cli/dist/cli.js design-partner init github-pr-merge --out .witnora/design-partner
Keep .witnora/design-partner/secrets/ out of source control. Compare the printed/pinned root fingerprint with the reviewer through a separate channel.
Create distinct read-only and write-capable credentials in the customer secret store. Never paste them into evidence, configuration committed to Git, or a support message.
Set WITNORA_GITHUB_READ_CREDENTIAL, WITNORA_GITHUB_WRITE_CREDENTIAL, and a base64-encoded 32-byte WITNORA_PROBE_STORAGE_KEY_BASE64 locally. The repository and branch must satisfy the generated sandbox policy.
Issue the short-lived approval and single-use execution Grant from the administrative boundary before mounting the Gateway runtime:
witnora design-partner authorization issue --dir .witnora/design-partner
The Approval and Grant signing private keys stay under secrets/; only the signed JSON documents and public certificates are mounted into the target and Gateway containers.
witnora design-partner doctor --dir .witnora/design-partner
witnora design-partner privacy inspect --dir .witnora/design-partner
witnora design-partner trust inspect --dir .witnora/design-partner
witnora design-partner dry-run --dir .witnora/design-partner
Dry-run must perform zero target writes.
docker compose --file .witnora/design-partner/docker-compose.yml up --detach --build target-sandbox probe
docker compose --file .witnora/design-partner/docker-compose.yml --profile acceptance run --rm gateway-acceptance
docker compose --file .witnora/design-partner/docker-compose.yml --profile acceptance run --rm offline-verifier
mkdir -p .witnora/design-partner/acceptance
docker compose --file .witnora/design-partner/docker-compose.yml --profile acceptance run --rm --no-deps \
--volume "$PWD/.witnora/design-partner/acceptance:/export" \
--entrypoint sh gateway-acceptance -c 'cp /output/* /export/'
The generated topology is sandbox-only. The Probe receives only the read credential and Probe signing secret. The Gateway receives only the write credential and request/Gateway signing secrets. The offline verifier is disconnected from every network and receives no private key. The root private key is not mounted into any runtime container.
# Host-mode verification is available when the packet was exported to a local directory.
witnora design-partner verify-offline \
--packet .witnora/design-partner/acceptance/witnora-evidence-packet-v0.2.json \
--root .witnora/design-partner/trust/pinned-root.json \
--revocation-journal .witnora/design-partner/trust/revocation-journal.json
witnora-verify evidence \
.witnora/design-partner/acceptance/witnora-evidence-packet-v0.2.json \
--root .witnora/design-partner/trust/pinned-root.json \
--revocation-journal .witnora/design-partner/trust/revocation-journal.json
The container command in step 4 verifies the named-volume packet without network access. Use either CLI above after exporting that packet, or for packets emitted by the host-process E2E. Review every declared limitation. INTERNAL review does not mean an independent certification.
This path inspects a dedicated sandbox pull request. It does not merge, mutate, dispatch, or produce acceptance evidence for a live repository. GitHub’s merge endpoint cannot atomically enforce the signed base SHA, required-check set, and Witnora Grant at the write boundary, so v0.2 intentionally exposes no live write command.
Set a protected Environment variable named WITNORA_LIVE_GITHUB_ALLOWLIST to the one exact owner/repository sandbox target. The dispatch input does not define or widen this allowlist.
The repository includes .github/workflows/design-partner-live-github.yml. It requires:
READ_ONLY_PREFLIGHT acknowledgement;owner/repository allowlist value;main nor master;WITNORA_GITHUB_READ_CREDENTIAL in the protected Environment.Equivalent local preparation commands are:
export WITNORA_LIVE_GITHUB_PREFLIGHT=1
export WITNORA_LIVE_GITHUB_ALLOWLIST=owner/dedicated-sandbox
witnora design-partner prepare-live-github \
--dir .witnora/design-partner \
--repository owner/dedicated-sandbox \
--pull-request 7
The output is an untrusted preflight snapshot for operator review. It is not a Grant, a release decision, or proof that a later merge used the inspected state. A future live write path requires a controlled target endpoint that atomically consumes an exact Witnora Grant and rejects changed base, head, checks, environment, or parameters.