P0: Prepare successor Testing Packages release policy tooling

[wanghuan-520]

Lineage

Implements the non-secret production tooling portion of #789/#799 and parent #745.
Starts after merged release PRs #787 and #797 and merged rejection-matrix conflict resolution PR #798.
Readiness tracker: #665.

#799 correctly refused to modify signed production artifacts without the authorized private signing seed. This leaf must not access, infer, replace, or counterfeit that key. It prepares the production release profile and tests using ephemeral test-only artifacts while keeping current committed signed artifacts byte-identical.

Objective

Extend the existing release contract, schema, generator capability, verifier, and tests for complete package-side production policy without changing any current committed release descriptor, DSSE envelope, authorization record, bundle, manifest, source pin, or their digests.

The supported successor-release generation path must accept explicit authority/tool/policy inputs plus an external signing seed, but this PR must test it only against deterministic temporary output directories and ephemeral keys.

Required production profile capability

Extend existing code paths to support a successor release descriptor containing:

• authority issuer, key id, dsse-ed25519.v1 signature profile;
• canonical valid_from / valid_until UTC window;
• immutable revocation-authority HTTPS identity;
• positive safe-integer release sequence;
• deterministic exact-byte-bound tool catalog containing only browser.read-title.v1 -> browser_read_title under browser-deterministic.v1;
• explicit existing Runner identity (testing-runner, testing-runner.v1, testing-runner.run);
• existing executor identity (testing-package-executor.browser-title.v1, testing_package_executor.executor.execute);
• existing AssertionReducer identity and canonical digest;
• existing public testing-result-authority-receipt.v1 identity/validator.

Do not create a second release format, verifier, generator, Runner, reducer, result authority, executor, resolver, or Runtime state machine.

Independent consumer-policy verification

Extend the verifier CLI for temporary successor releases with explicit:

• --verification-time <canonical UTC RFC3339>;
• --minimum-release-sequence <positive safe decimal integer>;
• repeatable unique --revoked-keyid <bounded key id>;
• existing mandatory --expected-release-sha256 and --trusted-authorization-sha256.

Validate complete policy grammar before artifact use. Preserve the exact release-byte gate as the first artifact gate. After release digest match, validate authority window/revocation/sequence before DSSE or code loading where applicable. Runtime owns durable policy state and transport; this package verifier only consumes explicit policy values.

Zero-activity regression from #797

The review gap left by #797 must be fixed here. Add a causal poisoned-input proof for expected-release mismatch:

• deliberately invalid release JSON bytes;
• nonexistent authorization/envelope/bundle/manifest/tool-catalog/schema-catalog/schema-release paths;
• fake engine executable that writes a sentinel if invoked;
• controlled empty TMPDIR;
• exact digest-mismatch diagnostic;
• no parse/ENOENT diagnostic;
• absent engine sentinel;
• unchanged empty TMPDIR;
• empty stage log as supplemental evidence only.

This proves no parse, dependent artifact read, extraction, module load, executor, or effect.

Temporary successor generation tests

Add output-directory support or an equivalent isolated generation API so tests can create a complete successor release in a temporary directory with:

• explicit source commit and dependency commits;
• explicit authority metadata and release sequence;
• explicit fixed creation and verification times;
• deterministic tool catalog;
• ephemeral deterministic test seed clearly marked test-only.

Test byte reproducibility, schema/Lua validation, DSSE binding, external trust-pin verification, tool catalog binding, and verified existing-executor ResultAuthorityReceipt smoke. The generated temporary release must not overwrite committed production artifacts.

Negative matrix

Using temporary re-signed/rebound artifacts, cover:

• not-yet-valid, expired, malformed/reversed/equal window;
• revoked key and malformed/duplicate revoked inputs;
• release sequence below floor and malformed/overflow sequence;
• wrong issuer/key/profile/revocation identity, missing/unknown authority fields;
• tool catalog path/digest/size/schema/profile/capability/port/execution-profile mismatch, duplicate/extra/prohibited fields;
• Runner/entrypoint/executor/reducer/result-authority identity mismatch;
• same-version/different-content expected-release rejection;
• existing authorization/keyid substitution, source/dependency/catalog/schema/manifest/bundle mutation cases remain green.

All rejection tests assert no forbidden extraction/load/executor/effect after their owning boundary.

Committed artifact immutability

At test start and end, assert exact SHA-256 for all current committed package-release/ artifacts and current schema-release bindings. This PR may update schema/catalog publication only if doing so does not require changing the existing signed release's bound schema bytes; otherwise test the new schema contract as an unreferenced next-release capability and leave the current signed release/catalog bytes unchanged.

If extending the shared schema catalog necessarily changes bytes bound by the current signed release, do not mutate the committed catalog in this leaf. Keep the successor schema fixture/test-local until the authorized signing publication operation can atomically regenerate all bound artifacts.

Acceptance criteria

• Current committed signed release artifacts remain byte-identical.
• Production successor release authority/tool/identity profile is implemented in existing owners and testable in isolated output.
• Independent time/revocation/sequence consumer-policy inputs are strictly validated.
• Causal poisoned-input test closes github-devloop implementation for #790 #797's missing zero-activity proof.
• Tool catalog and existing Runner/executor/reducer/ResultAuthority identities are exact and cross-checked.
• Temporary successor release generation/verification/executor smoke passes with ephemeral test-only key.
• Full negative matrix fails closed with zero forbidden effects.
• No private production seed, production artifact mutation, new authority, Runtime state, or coverage allowlist entry is introduced.
• Focused tests, scripts/run.sh check, scripts/run.sh test testing-runner, full scripts/run.sh test, affected Generic Host tests, AI pipeline smoke, and git diff --check pass.
• PR targets dev and references this issue, P0: Publish signed Testing Packages bundle and manifest release #745, P0: Harden signed Testing Packages production release policy #789/Production slice: complete signed Testing Packages production release policy #799, and Tracking: Testing Packages readiness for deterministic Talos Browser MVP #665.

Follow-up publication boundary

After this tooling PR merges, #745 remains open for one authorized release-publication operation running in a named Hosted environment where FKST_TESTING_PACKAGE_RELEASE_SIGNING_SEED is provisioned out-of-band. That operation regenerates the successor committed artifacts atomically and passes the same verifier/CI. Do not claim #745 completed in this tooling leaf.

[chronoai-fkst]

👀 Picked up by fkst session mvp-integration.

A fkst pod is working this repo's mvp-integration-chronoai-fkst-cloud issues, including this one. The session posts its progress on this issue as it works, and the outcome will be a pull request (or, for issue-producing sessions, linked issues).

[chronoai-fkst]

This issue is managed by workflow software-feature-flow.

Reason:
Selected workflow software-feature-flow from the workflow catalog.

[chronoai-fkst]

Preparing to open a sub-issue for this task.

[chronoai-fkst]

Opened sub-issue #801 for this task.

[chronoai-fkst]

Materialized the walking-skeleton step as sub-issue #801.

[wanghuan-520]

Human: PR #802 merged despite maintainer CHANGES_REQUESTED at head 49a3f88. Two unresolved findings are now mandatory predecessor work in direct corrective leaf #803: DSSE must authenticate before any dependent artifact read, and verified mapping/tool-catalog data must exclusively drive module/function/port dispatch. Do not close #800 or materialize publication until #803 merges and validates those causal tests.

[chronoai-fkst]

Preparing to open a sub-issue for this task.

[chronoai-fkst]

Opened sub-issue #804 for this task.