P0: Authenticate release dependencies before Runtime semantic resolution

[wanghuan-520]

Incident and baseline

Corrects trust-boundary defects merged by PR #802. Supersedes failed/refined #807 and implements the mandatory corrections tracked by #806/#800/#745.

Start from current dev@b50a81b16cf4d93ffc80cb2abf1c7f96f202e958 or a fresh descendant after preflight.

Use real immutable provenance inputs only:

• repository source commit from committed package-release/testing-package-release.v1.source-commit, and require the Git object exists;
• fkst-packages commit from .fkst/conformance/fkst-packages.pin;
• fkst-substrate commit from .fkst/substrate-ref.

Do not use repeated-character pseudo commits as accepted source identities.

Objective

Fix two existing release-verifier defects without changing any committed signed release, authorization, bundle, manifest, source pin, schema-catalog, or schema-release bytes:

1. authenticate DSSE and its exact release subject before reading dependent artifacts;
2. treat publisher metadata as authenticated semantic claims only, then authorize execution through the existing Runtime-owned closed semantic mapping registry.

Authenticated read ordering

In scripts/verify_testing_package_release.mjs, enforce:

1. validate complete CLI policy grammar with no artifact reads;
2. read exact release bytes and enforce --expected-release-sha256;
3. parse/canonical-check the same release buffer and enforce time/sequence/revocation policy;
4. read and exact-pin authorization bytes;
5. read only the DSSE envelope, verify canonical/profile/key ID/signature, parse its statement, and bind the exact release subject digest;
6. only after successful step 5 read manifest, bundle, tool catalog, schema catalog, or schema release;
7. only after all dependent bindings verify may materialization/module load/execution occur.

Remove the pre-DSSE Promise.all over dependent paths.

Causal regression: use an invalid signature with nonexistent dependent paths and assert signature failure wins over ENOENT, no dependent stages occur, and no extraction/executor/effect sentinel appears.

Runtime-owned semantic authorization

Publisher-authenticated module, function, and tool port strings are not executable authority. They may be canonical authenticated metadata, but must not select imports, functions, or host ports.

After release/artifact verification, return only authenticated semantic facts:

• execution profile;
• package ID and version;
• entrypoint;
• contract major;
• ordered capabilities.

Pass those facts through the existing contract.testing_package_executor.semantic_mappings / testing_runtime.testing_package_executor resolution boundary. Require exactly one locally owned mapping. Zero, multiple, or unsupported mappings fail before module loading, executor invocation, or effects.

The Runtime-owned resolved invocation supplies the authorized executor ID and locally owned capability adapter. Only the Runtime-owned browser_read_title adapter may be exposed for the accepted browser.read-title.v1 capability. No publisher-controlled dynamic import, function lookup, or port exposure is permitted.

Causal tests:

• positive authenticated semantic facts resolve exactly one local mapping and execute the existing executor;
• zero/multiple mapping cases fail closed before load/effects;
• re-signed publisher metadata with changed module/function/port cannot redirect execution or call a sentinel default;
• complete passing ResultAuthority receipt validates through contract.testing_result_authority.validate_receipt.

Existing owners

Extend only existing owners where possible:

• scripts/verify_testing_package_release.mjs
• scripts/testing_package_release_test.py
• existing contract.testing_package_executor.semantic_mappings
• existing testing_runtime.testing_package_executor / package resolver
• documentation only if needed

Do not create another release format, verifier, resolver, executor, Runner, reducer, ResultAuthority, Runtime state machine, or capability port registry.

Artifact and signing boundary

All successor generation in tests uses fresh temporary roots, the real committed source pin and dependency pins, and an explicit public test-only Ed25519 seed. Snapshot all current package-release/ and schema-release bytes before tests and prove exact identity afterward. Never access or introduce a production signing seed.

Acceptance criteria

• DSSE signature and statement/subject verification finish before any dependent artifact read.
• Invalid signature plus nonexistent dependent paths fails with signature error, never ENOENT.
• Verifier output contains semantic claims only; publisher module/function/port values never drive dispatch.
• Existing Runtime closed mapping registry exclusively selects executor identity and local capability adapter.
• Zero/multiple/unsupported mapping and publisher-coordinate substitution fail before module load/effects.
• Positive temporary successor release executes through the existing Runtime resolver/executor and validates the full passed ResultAuthority receipt.
• Real committed source/dependency pins are used; repeated-character pseudo commits are rejected as accepted provenance.
• Current committed signed artifacts remain byte-identical and no production secret is accessed.
• Focused tests, scripts/run.sh check, scripts/run.sh test testing-runner, full scripts/run.sh test, and git diff --check pass.
• PR targets dev and references github-devloop implementation for #801 #802/Walking skeleton: verify and execute one temporary successor release through authenticated bindings #807/P0: Complete successor release policy and verified dispatch #806/P0: Prepare successor Testing Packages release policy tooling #800/P0: Publish signed Testing Packages bundle and manifest release #745.

Non-goals

Do not publish successor production artifacts, persist Runtime policy, implement trust-root distribution/rotation, revocation transport/history, Browser lifecycle, Talos/NyxID/PQL integration, or model execution.

[chronoai-fkst]

👀 Picked up by fkst session mvp-integration.

A fkst pod is working this repo's mvp-integration-chronoai-fkst-cloud issues, including this one. The session posts its progress on this issue as it works, and the outcome will be a pull request (or, for issue-producing sessions, linked issues).

[chronoai-fkst]

github-devloop intake decision: enable
Service class: expedite

Reason:
Security-critical implementation follows authenticate-before-use, complete-mediation, and fail-closed practice; it is the class carrier explicitly generalizing defects from #803, #804, and #807, so Fowler’s Rule of Three supports enabling rather than re-escalating.

[chronoai-fkst]

github-devloop thinking: consensus started

[chronoai-fkst]

github-devloop decision: approve
Verdicts: teleology=approve parsimony=approve fidelity=approve natural-ownership=approve proportional-containment=approve

teleology:
Established practice is reference-monitor complete mediation: authenticate before dependent use, fail closed, and separate signed claims from locally controlled execution authority. ESSENCE: the system must ensure neither unauthenticated dependency access nor publisher-controlled coordinates can influence Runtime execution. The baseline violates that purpose by batch-reading the envelope and dependencies before signature verification (scripts/verify_testing_package_release.mjs:347) and by constructing a selected invocation and calling the executor directly (scripts/verify_testing_package_release.mjs:244, scripts/verify_testing_package_release.mjs:270) instead of passing through the existing local resolver. IDEAL: authenticate the exact release subject first, verify all bound artifacts, reduce the result to semantic facts, resolve exactly one Runtime-owned mapping, expose only locally selected capabilities, then execute and validate the authority receipt. That form is forced by the trust boundary, not novelty. SIX-SMELL: no magic-number smell—the single mapping and named capability are explicit bounded policy for this release slice; no proxy-over-truth—the proposal uses exact bytes, digests, signatures, real Git objects, and the local registry; no symptom branches—it repairs ordering and authority ownership at their roots; no narrative-over-verification—causal precedence, substitution, effect-sentinel, receipt, byte-identity, and full-suite checks are specified; no missing-inevitability—the existing closed registry already supplies the required mechanism (libraries/contract/testing_package_executor.lua:69, libraries/testing_runtime/package_resolver.lua:103); no skipped-purpose—the issue explicitly protects release authenticity and Runtime sovereignty. Although this is the third same-class attempt after #803 and #807, it now frames the class solution, forbids parallel owners, and provides bounded acceptance criteria.

parsimony:
ESSENCE: A release verifier must authenticate the exact artifact before observing its dependencies, and authenticated publisher metadata must remain data—not executable authority. Established practice is DSSE verify-before-parse/use, subject-digest binding, complete mediation, least authority, fail-closed defaults, and economy of mechanism. (github.com) IDEAL: Read the independently pinned release and trust root, verify the envelope and exact subject, verify dependency bindings, reduce the result to semantic facts, resolve exactly one Runtime-owned mapping, expose only its local capability adapter, then load and execute. SIX-SMELL: approve. Magic numbers: named versioned contract identities are justified; implementation should reject fake commits through exact pin equality and Git-object validation, not a repeated-character special case. Proxy-over-truth: the issue explicitly requires real pins, existing Git objects, exact digests, and byte preservation. Symptom branches: it removes root causes—the pre-authentication Promise.all at scripts/verify_testing_package_release.mjs:347 and fabricated direct dispatch through executor.execute at scripts/verify_testing_package_release.mjs:270—rather than remapping errors. Narrative-over-verification: causal precedence, stage/effect sentinels, substitution tests, receipt validation, and byte snapshots are code-verifiable. Missing-inevitability: the existing singleton Runtime registry already owns semantic selection at libraries/contract/testing_package_executor.lua:69, while Runtime restricts forwarded ports at libraries/testing_runtime/testing_package_executor.lua:13. Skipped-purpose: every requested change directly restores authenticated, least-authority execution. This is the third same-class pass, but it explicitly supersedes #807, repairs both recurring classes, and forbids parallel formats, registries, or executors; that is an adequa

fidelity:
The proposal identifies two real trust-boundary defects on the pinned b50a81b baseline, follows established verify-before-use and least-authority practice, reuses the existing exact-one Runtime semantic mapping instead of inventing another resolver, and gives bounded, code-verifiable causal acceptance criteria. The implementation should preserve one important distinction during PR review: the present baseline visibly bypasses Runtime resolution by manually constructing the resolved invocation, but it does not visibly use publisher module, function, or port strings for dynamic dispatch. Tests against re-signed coordinate substitution are therefore valuable invariant proofs, while claims of an existing publisher-controlled dynamic import should not be made without additional source evidence.

natural-ownership:
This proposal is sound, bounded, actionable, and naturally owned. At the pinned baseline, dependent artifacts are read in the same Promise.all as the DSSE envelope before signature verification (scripts/verify_testing_package_release.mjs:347), despite verification occurring only afterward (scripts/verify_testing_package_release.mjs:356). The repository already defines contract.testing_package_executor.semantic_mappings as the Runtime-owned closed registry (libraries/contract/testing_package_executor.lua:69) and already rejects zero or ambiguous matches (libraries/testing_runtime/package_resolver.lua:122). The issue places provenance ordering in the verifier and executable authorization in that existing Runtime boundary, with causal tests for failure precedence, publisher-coordinate substitution, mapping uniqueness, pre-effect rejection, receipt validation, and artifact immutability. Advisory for PR review: ensure the implementation passes only authenticated semantic facts into the resolver and does not preserve a verifier-local shadow mapping or generic publisher-selected capability lookup.

proportional-containment:
The proposal is sound, actionable, proportionate, and code-verifiable. Although this is at least the third same-class attempt, it explicitly supersedes the failed refinement and reframes the work around two reusable class invariants: authenticate release dependencies before reading them, and authorize semantic execution only through the existing Runtime-owned closed registry. That is sufficient recurrence handling rather than another narrow symptom patch. The repository confirms the proposed owner layer already selects exactly one local mapping and validates entrypoint and capabilities (libraries/testing_runtime/package_resolver.lua:111), so no higher or new authority layer is justified. Advisory for PR review: ensure scripts/verify_testing_package_release.mjs does not acquire a duplicate JavaScript mapping/port registry; its boundary should end at authenticated semantic facts, with executor identity and browser_read_title exposure derived exclusively inside the existing Runtime resolver and executor.

⟦AI:FKST⟧

[chronoai-fkst]

github-devloop implementation worktree ready

Worktree: /var/lib/fkst/runtime/worktrees/devloop-ChronoAIProject-fkst-packages-testing-808-3846187083
Branch: devloop/issue/ChronoAIProject/fkst-packages-testing/808/ready-github-devloop-issue-ChronoAIProject-fkst-packages-testing-808-intake-4289871358-3846187083
Base branch: dev
Base head: b50a81b