[P1] Package registry: add authorized signed trust and real resolver distribution

[wsdt]

[P1] Package registry: add authorized signed trust and real resolver distribution

Review baseline and scope

Reviewed source: c9d32008e98d0e1711f47cb739f61c42376b884e on main, 22 September 2026.
Classification: TRUST / DISTRIBUTION INTEGRATION.
Predecessors: #195.
This replaces their remaining work; closing a predecessor during backlog migration is not a claim that its original scope was completed.

Already delivered — do not rebuild

f6ef8e5 supplies canonical raw lock/fetch and a clean project-consumer bridge with swapped-subject rejection. 948230a adds Package Artifact Manifest v1 and registry snapshot/document v2, admitted only through verified Linked Build-v2 and exact subject/API/artifact bindings. These are local read-only contracts, not signing, publication, cache, network or a hosted registry.

Remaining implementation / execution

• Implement the remaining authenticated publisher/signature/trust-policy boundary and explicit revocation/yank handling, reusing the verified manifest and signed-release primitives.
• Provide the intended bounded distribution/cache/mirror and reproducible resolver workflow under explicit host/network authority; keep lock and fetched artifact bytes inseparable.
• Exercise clean offline/online-as-authorized consumption, swapped/tampered/stale metadata, wrong identity, rollback, revocation, unavailable mirrors and reproducible resolution.

Acceptance evidence

• A real authorized publisher/registry path verifies exact source/build/artifact/API provenance and refuses decoded-but-unadmitted evidence.
• The same trusted inputs resolve to identical locks and package bytes; no mutable alias, hidden network or arbitrary install script can bypass the contract.
• Trust decisions, supported distribution scope and hosted acceptance are explicitly recorded.

Integration dependencies

• R10 / #289

These identify related acceptance work; safe independent implementation can proceed in parallel where the owning contracts permit it.

Boundaries

Do not rebuild the raw consumer bridge or manifest-v2 decoder; do not publish or sign from the issue-refresh script. A task description is not an authorization for provider spend, signing, publication, remote deployment or a change to support policy. Preserve existing stable identities, explicit profile limits, source authority and non-vacuous acceptance gates.

Evidence and implementation entry points

• Issue #195 update
• Issue #195 update

Test results described above are retained repository evidence, not a fresh full test run performed by this backlog review. Re-run the owning gates for the implementation being accepted.

[wsdt]

Coordinator update (2026-09-23)

Status: blocked on R10 identity policy and registry/distribution decisions.

Local snapshot-v2, verified Manifest, raw lock/fetch, and fixed-input replay exist, but there is no authenticated publisher/revocation authority, bounded acquisition/cache/mirror policy, or supported distribution journey.

Next step: choose the registry signer/trust root and rotation/revocation/yank semantics, plus cache/mirror/network/install/support policy; then bind lock/fetch to the verified snapshot capability and run hostile distribution gates. The issue remains open.

[wsdt]

Implementation update on main at f972516 (safe squash of the isolated R19 work): added an explicit offline, lock-bound files-only cache fetch route. It holds source/cache authority through fd-relative nofollow operations, stages complete artifacts before no-replace publication, fails closed with retained stages or a published prefix for reconciliation, and refuses unsupported hosts before cache effects. The unsafe intermediate isolated commit was not published to main. Focused private-target verification: 8 CLI locked-fetch tests and 1 exact project integration test passed; independent security review found no P1/P2 blocker. No full gate, hosted registry, online provider, publisher signing, revocation/yank policy, or production trust decision was exercised. This issue remains open for those acceptance items.

[wsdt]

Implementation update (2026-09-24): main at c43e019 includes R19 local signed-registry trust verifier commits 2fe54ac, 2a2f098, 5b91e04 and c43e019. The TUF-style (not TUF-wire-compliant) pure verifier uses independently installed root keys, disjoint threshold roles, delegated publisher namespaces, exact signed timestamp/snapshot/publisher metadata and manifest/registry bytes, expiry/rollback/equivocation refusal, sequential dual-threshold root rotation, and authenticated yank refusal. Independent review found and prompted a checkpoint canonical-byte CAS fix before push. Exact focused trust selector passed 9/9 on Darwin arm64 after that fix; no full gate. Results are non-authoritative candidates only: no deployed trust anchors, durable checkpoint/cache commit, network/mirror capability, production signing, or hosted distribution acceptance. Existing offline fetch gains no registry-trust authority. Issue remains open.

[wsdt]

Implementation update (2026-09-24): main at 69e0b65 includes reviewed R19 durable local host commits 8e7b4d3 and ac22d73. An explicit owner-private held/no-follow store and lock now commits independently pinned root, signed registry metadata, checkpoint and selected manifest-bound artifact bytes as one immutable generation with a durable ACTIVE pivot. Ambiguous stages fail closed and require exact input/fresh-time revalidation; no automatic rollback/deletion occurs. The exact nine-test focused host selector passed 9/9 locally on Darwin arm64, including genuine admitted artifact bytes, tamper/yank, root rotation and simulated crash/recovery controls; independent read-only review found no P1/P2. This does not grant fetch/read/network authority, change existing flat fetch --lock, prove physical power-loss durability or complete a full Lock-v3 resolver distribution path. A currently missing independently admissible leaf package profile prevents honest full-lock success evidence; R19 remains open. No full gate ran.

[wsdt]

Implementation update (2026-09-24): main at 0fd539e adds an independently verified Build-v1 dependency-free leaf manifest and sealed producer-backed Registry-v3 entries/snapshots alongside the existing linked Build-v2 root. A genuine app.root -> lib.leaf fixture now replays the Resolver-v2/Lock-v3 selection and checks exact admitted source, report, and dependency-graph equality; missing/yanked/cross-built leaves, erased root edges, artifact/evidence/API claims, and noncanonical snapshot wire refuse. The focused package_registry::registry_v3::tests selector passed 6/6 locally with a private Cargo target; no full gate ran. Byte-only inspection cannot be promoted to admitted authority. This is pure local evidence only: Trust-v3 signing, durable host integration for the complete lock, authorized acquisition/cache/mirror, and hosted acceptance remain open. No publisher keys or external authority were used.

[wsdt]

Implementation update (2026-09-24): main at 3cc6698 adds a separate offline signed Trust-v3 proof over the sealed producer-backed Registry-v3 snapshot and its real root/leaf manifests. Distinct publisher, registry-snapshot and timestamp roles sign exact versioned/expiring bytes; explicit installed root, trusted time and a sealed checkpoint-v2 enforce freshness, rollback/equivocation refusal and one-way protocol migration. Exact Lock-v3 and selected artifact checks remain read-only evidence, not fetch authority. Independent review found a publisher role/namespace rotation high-water bypass; the follow-up pins role-to-namespace continuity in checkpoint-v2, retains prior stamps, and rejects rename/reassignment while permitting same-role key rotation. The focused new Trust-v3 selector passed 9/9 and existing Trust-v1 selector passed 9/9 offline with a private target; review of the fix found no remaining P1/P2. No full gate, production keys, durable v3 host commit, network/mirror, hosted acceptance or public distribution claim. Issue remains open.

[wsdt]

Implementation update (2026-09-24): main at 9a22433 adds the reviewed local signed Registry-v3 host. The held owner-private store now commits an exact signed root/leaf Lock-v3 selection and its admitted manifest-bound core artifact bytes as one canonical immutable generation, including exact one-way v1 migration and interrupted-commit recovery checks. New host-v3 focused selector passed 9/9; existing v1-host selector passed 9/9 (offline, private Cargo target). Independent read-only review found no confirmed P1/P2. No full gate ran. This is local logical fail-stop evidence only: it grants no fetch/read/execution or network authority, does not prove physical power-loss durability, and does not complete authorized online/offline distribution, mirror policy, hosted registry, or production signing. #304 remains open for those acceptance items.

[wsdt]

Implementation update (2026-09-24): main at 01f2a6c adds a bounded offline artifact-read method to the held signed Registry-v3 store. A caller supplies an exact generation digest, canonical Lock-v3 bytes, sealed registry, coordinate/path and trusted time; under the held lock, the host rechecks ACTIVE/chain, replays the installed signed metadata and complete lock/manifest bindings, then rechecks ACTIVE before returning owned immutable bytes. The exact new read selector passed 6/6 offline in a private target; independent source review found no confirmed P1/P2. No full gate ran. This is an explicit local read boundary only—not a reusable capability token, network/mirror fetch, execution grant, future offline knowledge of not-yet-installed revocations, physical power-loss proof, production signing, or hosted acceptance. #304 remains open.

[wsdt]

Implementation update (2026-09-24): main at 8b8934d adds the reviewed signed-store → resolver-cache bridge. Under held source and destination authority, an exact signed root/leaf generation is replayed at trusted time, every selected module.wasm is checked through the live read boundary, and canonical Subject-v3 files are published through the existing nofollow/no-replace cache writer. A genuine root/leaf fixture then resolves to byte-identical Lock-v3; existing CLI receipt bytes remain pinned. Focused selectors passed: new bridge 6/6, relocated held-writer hostile controls 8/8, real CLI locked-fetch 1/1, all offline/private-target. Independent read-only review found no P1/P2. No full gate ran. Copied flat cache entries carry no persistent signature/freshness or artifact-execution authority; no network/mirror acquisition, hosted registry, production keys or public support claim is made. #304 remains open.

[wsdt]

Coordinator update (2026-09-24): Main ae0fb99 now includes bounded native HTTPS mirror byte acquisition and a separate acquired-metadata-to-Trust-v2 bridge. The transport requires explicit authority, exact origin-relative digest-bound paths, aggregate bounds, and no proxy discovery, credentials, redirect, or retry. The bridge verifies signed timestamp/snapshot/publisher metadata against independently installed root/checkpoint and retains both monotonic trusted-time high-water and a separate last-new-timestamp age anchor; repeated identical metadata cannot refresh the seven-day local offline window, and 100→200→150 clock rollback is refused. Focused transport 5/5 and Registry-v3 trust 10/10 passed locally; the latter also passed on the integrated main-bound checkout, with independent delta review finding no remaining P1/P2. No Wavect production publisher root/custody, real TLS peer, hosted registry, durable mirror checkpoint, or online resolver acceptance is claimed. Issue stays open.

[wsdt]

R19 progress (2026-09-24): Main a9bd6b0 adds a strictly one-shot local composition of caller-authorized mirror bytes, signed Registry-v3 proof, held generation commit, and one live Lock-v3 artifact read. It binds the initial bridge checkpoint to the live held bootstrap receipt before any network call; wrong-time, stale/reused or noninitial bridge state refuses before dispatch. A post-commit read failure now carries the commit receipt and next checkpoint rather than looking like a no-effect proof refusal. The focused local selector passed 2/2 and independent read-only review found no remaining P1/P2. This is bootstrap-only local evidence: no mirror refresh/resume, production roots/publisher custody, hosted TLS/registry, resolver-cache publication or public support. Issue remains open.

[wsdt]

R19 local implementation batch is on main at a825232 (a8252323): the mirror flow now derives root and checkpoint from the live held generation, persists authenticated timestamp-age provenance in generation-v3, supports replay/refresh/reopen without resetting the seven-day age, and preserves v2 history without automatic migration. The held commit binds the verifier candidate to the exact predecessor and distinguishes pre-effect refusal, uncertain publish (no receipt), confirmed post-pivot uncertainty (receipt), and final-read post-commit failure. Focused mirror-flow selector: 2 passed, 0 failed; fmt and diff checks passed. This remains local implementation evidence, not hosted registry or published-release support. Issue stays open for remaining R19 acceptance and hosted evidence.

[wsdt]

Main now includes 7e40fab (part of main head 6430cac): the local R19 online path composes mirror fetch, held-store commit, signed resolver-cache update, and Resolver-v2/Lock-v3 replay. It uses an explicit cache path, bounded nofollow reads, and distinct CachePartial vs Resolution outcomes. Focused registry online tests passed 5/5 locally. This is local implementation evidence only; no hosted registry/public-release claim yet. The docs batch also clarified PACKAGE-* contracts.