Portable authenticated worker identity: semantic identity plus audit-only aliases for the primary-QRF worker binding (fixes #863)

PROGRESS.md

@@ -1,4 +1,93 @@
-# ACS predictor release join
+# F1 portable worker identity — Sol gate round 1
+
+## State
+
+In progress on 2026-09-04 on `f1-portable-worker-identity`, starting from
+`b26708a1`. All four Sol findings have fail-before reproductions. The schema-9
+envelope, Torch backend-autoload, loaded-runtime/stdlib, and real-resource
+fixes are implemented and focused green. Pin proof and full verification remain.
+
+## Done
+
+- Read `CLAUDE.md` and the F1 PR body/progress brief.
+- Confirmed the requested branch and clean starting tree at `b26708a1`.
+- Read the GitNexus debugging workflow. This workspace exposes no GitNexus
+  query/resource tools, so call-path analysis is being performed directly from
+  source and tests.
+- Recorded the hard boundaries: keep the complete `worker_execution` subtree
+  out of spec-engine digests; do not edit graph interface/acceptance lock files;
+  refuse before side effects; keep tests offline; commit each coherent step.
+- Recorded the required focused and final verification suites and the
+  requirement to report only commands actually run in `out.md`.
+- Synced the locked all-package US/UK environment after directing uv's cache to
+  a sandbox-writable path; the unmodified command's two environment-specific
+  refusals and the successful command are recorded in `out.md`.
+- Added fail-before coverage proving that schema 9 accepts missing/wrong
+  pipelines and routes other missing envelope sections around the common
+  validator; the focused result was 1 passed and 1 failed, exit 1.
+- Added fail-before identity coverage proving that loaded-runtime and stdlib
+  mutations are unbound, a synthetic unapproved `torch.backends` provider is
+  accepted, and the real SOI interest-components resource is absent. The four
+  focused nodes failed as intended, exit 1.
+- Added a fail-before launcher regression proving that an inherited/caller
+  `TORCH_DEVICE_BACKEND_AUTOLOAD=1` reaches the child unchanged. The focused
+  node failed as intended, exit 1.
+- Replaced the prior unrelated `out.md` with the current round's reproduction
+  report; fix/pin/final-verification sections remain explicitly pending.
+- Fixed the schema-9 bypass: schema 9 now has an explicit complete stacked
+  field set, traverses the same envelope classifier as schema 10, and does so
+  before any compatibility attestation is read or authenticated.
+- The valid schema-9 metadata-restoration case and the seven-case malformed
+  envelope regression pass together (2 passed, exit 0).
+- Forced `TORCH_DEVICE_BACKEND_AUTOLOAD=0` in both the authenticated semantic
+  environment and the worker module bootstrap, before its QRF/Torch import.
+- Enumerated and bound selected `torch.backends` entry-point metadata, refused
+  provider distributions outside the installed-code closure before clean
+  worker import, and refused duplicate canonical distribution identities so a
+  colliding provider cannot evade RECORD hashing.
+- Focused provider-refusal, duplicate-provider, launch-override, semantic
+  tamper, and legacy relocated-worker acceptance checks pass (exit 0 each).
+- Replaced the two-file resource list with a fresh worker-import audit trace
+  using the same inherited startup search path as the real worker. The semantic
+  transitive-import digest now includes every opened
+  Microcosm namespace file, with bytecode canonicalized to source, portable
+  locators only, and ambiguous duplicate locators refused.
+- The trace freezes and revalidates namespace roots, captures transient import
+  origins and successful pre-open file paths, refuses disappeared namespace
+  files, and rejects an empty or displaced worker trace. Its opened stdlib
+  paths supplement final `sys.modules` so transient stdlib imports stay bound.
+- Resolved the loaded Python image through platform mapping with static and
+  sysconfig fallbacks, and bound its kind and byte digest without serializing
+  its path. The interpreter identity also binds the clean import's file-backed
+  stdlib source and extension bytes while excluding site packages.
+- The mocked runtime-byte and stdlib-source mutation tests pass together; the
+  real SOI interest-components resource is observed and changes the resource
+  closure digest; and a real full identity constructs and validates with the
+  mapped `libpython3.14.dylib` (all exit 0).
+- Kept worker identity schema v1 because it is the still-unreleased exact
+  schema introduced by this branch. Bumping it would churn authored spec
+  templates despite the requirement that spec-engine pins remain fixed;
+  structural validation now requires the added v1 fields.
+- Restored `puf_qrf_chain.py` byte-for-byte after the first pin run proved that
+  editing its operational launcher also moves the QRF seed-kernel source
+  attestation. The worker bootstrap now owns the override, keeping the existing
+  seed protocol and compiled seed-map pins intact without re-pinning.
+- Added bound-environment-keyed, deep-copied caches only to the stacked-spine
+  and H5 canonical test fixtures so parameterized/tiny-pool cases do not rebuild
+  one identical production identity apiece; production identity generation
+  remains uncached. The interrupted pre-cache final run had 9 passes before
+  exit 130 and is not treated as final evidence.
+- Added the same narrowly scoped reuse to the inventory and coverage-tool test
+  modules: each module constructs one real binding and deep-copies it for
+  repeated report builds whose digests deliberately strip `worker_execution`.
+  This does not cache the production resolver or replace its first real check.
+
+## Next
+
+- Prove spec-engine pins remain fixed, run the complete requested verification
+  block, and finish `out.md` with exact commands, counts, and exit codes.
+
+# Historical: ACS predictor release join
 
 > **Historical note (2026-08-28).** This journal describes the
 > `acs-predictor-release-join` lane as of 2026-08-27. The branch has since

changelog.d/f1-portable-worker-identity.fixed.md

@@ -0,0 +1 @@
+Authenticate primary-QRF workers with a versioned semantic identity covering launcher and loaded-Python-runtime bytes, imported stdlib source/extensions, canonical virtual-environment fields, the static and clean-import-observed Microcosm closure, the exact lock and installed RECORD environment, disabled and authenticated Torch backend autoloading, canonical arguments, and fit controls, while retaining absolute launcher paths only as audit aliases so byte-identical worktrees can relocate safely. Legacy schema-9 gate-failed artifacts may relocate only through the scoring-only loader after the complete stacked manifest envelope validates and with an explicit plan-authorized attestation binding the sealed artifacts, published `b8819b3f` campaign token, environment/code identity, and exact two-field alias mismatch; simulation-ready and release loaders remain closed, and the candidate-26 deny-list remains independently enforced. Manifests and downstream receipts now surface the worker schemas, semantic digest, audit aliases, and attestation digest and purpose when applicable.

docs/evidence/spec-engine/us-f0-coverage.json

@@ -1321,7 +1321,7 @@
         "expected": "complete execution-row and transition-authority object",
         "failures": [],
         "observed": {
-          "sha256": "503428f6e9d98f19ed3a6ada5bc9883ae44c1b5dc27f09e60b7ac98895a99bc0"
+          "sha256": "9a09b49855b3dc4c37ac86c3b91293b6944a50f4448354701b18db8f659ae121"
         },
         "status": "covered"
       },
@@ -1338,12 +1338,12 @@
         ],
         "expected": {
           "nodes": 38,
-          "sha256": "271a7bb8d0b3f97ff344e0b7e68184fa74738a6585c24fc8781793db669f388b"
+          "sha256": "40cd51ffdfe2e9d9d08d48c08e8ded9de1e4b134783bab05c4abc6ad5c72ca1e"
         },
         "failures": [],
         "observed": {
           "nodes": 38,
-          "sha256": "271a7bb8d0b3f97ff344e0b7e68184fa74738a6585c24fc8781793db669f388b"
+          "sha256": "40cd51ffdfe2e9d9d08d48c08e8ded9de1e4b134783bab05c4abc6ad5c72ca1e"
         },
         "status": "covered"
       },
@@ -1361,12 +1361,12 @@
         ],
         "expected": {
           "producer_count": 38,
-          "sha256": "afebb6725373abf5b8dd4fdb77bf2814cb6fcc569cb606c0c30963a8f65c0bab"
+          "sha256": "b2b7dbd64db211088e85c94ad6ca1b942cb5e45683eb8c34ba9b664b5de64624"
         },
         "failures": [],
         "observed": {
           "producer_count": 38,
-          "sha256": "afebb6725373abf5b8dd4fdb77bf2814cb6fcc569cb606c0c30963a8f65c0bab"
+          "sha256": "b2b7dbd64db211088e85c94ad6ca1b942cb5e45683eb8c34ba9b664b5de64624"
         },
         "status": "covered"
       },
@@ -1840,11 +1840,11 @@
           "legacy_adapter.stacked_checkpoint_static_components"
         ],
         "expected": {
-          "sha256": "e660a8ce42b69a39d29c5f0ec37264bc69d61b03f27adc386336ec8889531bb2"
+          "sha256": "9d4a9672a0f03039b1fe874b9fe21ed575be0d29f14afc396d03cdf5c809bdd2"
         },
         "failures": [],
         "observed": {
-          "sha256": "e660a8ce42b69a39d29c5f0ec37264bc69d61b03f27adc386336ec8889531bb2"
+          "sha256": "9d4a9672a0f03039b1fe874b9fe21ed575be0d29f14afc396d03cdf5c809bdd2"
         },
         "status": "covered"
       },
@@ -1887,7 +1887,7 @@
             "alpha",
             "zeta"
           ],
-          "sha256": "b88f2d9c0f6f92c6cd81eb14d6b126afe59577b8bb392b394b2c6fbbafd195c5"
+          "sha256": "7176664c34039def5f43281a7735f792fe43de4ef0a6e7ca18f53d812b412d15"
         },
         "failures": [],
         "observed": {
@@ -1911,7 +1911,7 @@
             "alpha",
             "zeta"
           ],
-          "sha256": "b88f2d9c0f6f92c6cd81eb14d6b126afe59577b8bb392b394b2c6fbbafd195c5"
+          "sha256": "7176664c34039def5f43281a7735f792fe43de4ef0a6e7ca18f53d812b412d15"
         },
         "status": "covered"
       },
@@ -1975,7 +1975,7 @@
             "take_up_contract",
             "us_qbi_reconciliation_contract"
           ],
-          "sha256": "04899daa491e8f089899c9df64cdb2ed44d61d11da2b4c733db6f20f38a1668a"
+          "sha256": "f22487c266bd24aba91ed526eed29d612875e4e78f7b4bdd93e10c9888801ecf"
         },
         "status": "covered"
       },
@@ -2599,7 +2599,7 @@
       "country": "us",
       "schema_id": "country_spec",
       "schema_version": 1,
-      "spec_sha256": "a6bc79878eb6f64637b9f3eceeea6cc2b050c0e5b8f9aca446179258940c44f2"
+      "spec_sha256": "9db29b4d33424fbb21a83c63927c7de55ba9a333d631f6323935f67a496eee46"
     }
   },
   "report_schema_version": 3,
@@ -2609,7 +2609,7 @@
     "country": "us",
     "schema_id": "country_spec",
     "schema_version": 1,
-    "spec_sha256": "a6bc79878eb6f64637b9f3eceeea6cc2b050c0e5b8f9aca446179258940c44f2"
+    "spec_sha256": "9db29b4d33424fbb21a83c63927c7de55ba9a333d631f6323935f67a496eee46"
   },
   "status": "pass"
 }

docs/f1-portable-worker-identity/PROGRESS.md

@@ -0,0 +1,111 @@
+# F1 portable worker identity progress
+
+## State
+
+The portable worker identity, authenticated H5/scoring boundary, typed
+specification mirrors, and downstream identity pins are implemented and
+focused green; documentation and full verification are in progress on
+`f1-portable-worker-identity` from base
+`09abf2ad78e9af3c5314a4b303d42a75e30d49c4`.
+
+## Done
+
+- Read `CLAUDE.md`, the reproduced refusal in `_inputs/STOP.md`, and the F1
+  specification in `_inputs/FIX-PLAN.md`.
+- Confirmed that runner-owned root journals and task inputs will remain
+  untouched.
+- Traced both authenticated late-DAG validations, every public scoring and
+  release loader, the deny-list layers, generated-spec mirrors, and downstream
+  release/scoring receipt propagation.
+- Specified fail-before coverage for portable semantic equality, semantic
+  tamper refusal, the sealed STOP alias mismatch, and the explicit legacy
+  scoring-only attestation boundary. The focused portable-identity nodes fail
+  against the base implementation with two missing semantic identities and one
+  missing legacy mismatch helper (3 failed).
+- Mapped the required version cascade: worker identity 1, primary config 5,
+  primary-QRF sidecar 2, resource semantics 2, registry 17, producer receipt
+  4, transition authority 2, stacked authority 12, checkpoint materializer 13,
+  and pool manifest 10.
+- Added a closed, versioned worker identity that binds interpreter bytes,
+  implementation/version/ABI/cache tag, canonical semantic `pyvenv.cfg`, the
+  exact approved lock, transitive source imports, verified installed RECORD
+  contents, canonical argv, and fit/predict controls. Absolute executable,
+  prefix, and raw argv aliases are retained separately for audit.
+- Switched current primary-QRF resource authentication and checkpoint-resume
+  comparison to semantic projections while preserving full audit aliases in
+  receipts. Bumped the primary config, checkpoint sidecar, late registry,
+  producer receipt, transition authority, and stacked authority sources.
+- Green evidence: Ruff passed for the three implementation files and the three
+  committed portable-identity regressions passed (`3 passed`).
+- Added the explicit schema-9, gate-failed, scoring-only compatibility path.
+  Its plan-bound attestation seals the manifest and H5 digests, the exact
+  plan-published campaign identifier and campaign lock, the installed
+  transitive environment/code identity, recorded worker, semantic worker, and
+  the exact two legacy alias mismatches. Neither readiness/release loader has
+  an attestation parameter.
+- Threaded the authenticated legacy context through both late-DAG validation
+  passes and reconstructed the frozen schema-4/config, registry-16,
+  receipt-3, transition-1, and authority-11 identities without weakening the
+  current validators.
+- Published current worker-authentication evidence in manifests, diagnostics,
+  authenticated H5 capabilities, release receipts, and head-to-head scorer
+  identity/loader receipts. Added the candidate-only scorer CLI attestation
+  argument and direct propagation coverage.
+- Kept deny-list refusal intact and made compatibility provenance impossible
+  to release-launder: schema 9, private legacy provenance, scoring-only receipt
+  fields, a changed returned manifest payload, and mismatched current receipts
+  each fail closed.
+- Hardened the semantic identity implementation so source discovery follows
+  the worker module actually resolved by the interpreter, every source and
+  installed RECORD byte is re-read at authentication time, direct external
+  imports must resolve into the hashed RECORD, package initializers are part of
+  the transitive closure, and worker-startup package resources are hashed.
+- Extended the regression surface with the 18-field semantic matrix, every
+  post-`argv[0]` position, exact legacy attestation/mismatch matrices,
+  release-laundering cases, scorer propagation/receipts, and the exact
+  non-mutating 12-household origin battery.
+- Latest green evidence: four source/resource/scorer unit cases passed; four
+  end-to-end current/legacy H5 authentication and release cases passed; the
+  12-case legacy attestation/laundering subset passed. Ruff check passed on the
+  edited Python boundary files.
+- Replaced both constants-era worker templates with the closed portable
+  resolver algebra, made the typed projector resolve the alias-free semantic
+  receipt, and retained semantic worker fields in inventory identity while
+  excluding only `audit_aliases`.
+- Updated the imputation and spine JSON schemas and checked-in US YAML mirrors
+  to primary config 5, registry/schedule 17, producer receipt 4, transition
+  authority 2, resource semantics 2, stacked authority 12, and checkpoint
+  materializer 13. JSON parsing, Ruff, bundle loading, and all four imputation
+  projector tests pass.
+- Refreshed the schedule, stacked-authority, resource-semantics, checkpoint,
+  graph, and country-spec identity pins, plus their exact version assertions.
+  Regenerated coverage evidence is green at `42154/42154` configuration fields
+  and `41/41` inventory checks; its deterministic `--check` is also green.
+- Green evidence for the refreshed spec identity contracts: `18 passed, 21
+  skipped`, exit 0. The constants-era bundle generator was also attempted with
+  both `--check` and `--check --skip-validation`; each exits 1 before byte
+  comparison because this environment lacks the optional `policyengine-us`
+  distribution metadata.
+- Documented the semantic/audit identity split, the explicit plan-authorized
+  schema-9 scoring exception, receipt fields, version cascade, independent
+  release deny-list, and the exact limits of the plan-defined authorization
+  tuple. Added the F1 changelog fragment.
+- Closed the exact-k release-receipt propagation gap found in adversarial
+  review: the authenticated pool's worker schema/digest/audit receipt is now
+  required in `exact_k_ladder.pool` and therefore survives into both build and
+  release manifests.
+- Corrected installed-wheel source discovery so only the `microcosm` namespace
+  roots are treated as internal code; neighboring site-packages remain in the
+  installed RECORD closure. The source and external-import closure now come
+  from one read rather than two potentially different filesystem snapshots.
+- Preserved the nested release-verdict regression beneath the new authenticated
+  manifest-payload guard by rebinding only its synthetic capability; both
+  parameterized cases pass while real mutated manifests still fail earlier.
+- Enforced absolute `sys_executable` and `sys_prefix` audit aliases while
+  retaining the unmodified raw `argv_template[0]` audit value.
+- Recorded the F1 threat-model boundary: inherited Python startup/path hooks
+  remain trusted and are not added to the two specified semantic fit controls.
+
+## Next
+
+- Run focused, CI-group, and required repository checks.