spec: `manifest.zod.ts` integrity TSDoc must stop asserting an unpack-time verification nobody performs (spec half of #13563)

[os-zhuang]

Spec half of #13563, split by director ruling (decision batch #58, 2026-09-06, option C — break the documentary cross-reference now; the runtime loader (option B) is the eventual home of ADR-0025 §3.5 step 5).

Why

packages/spec/src/kernel/manifest.zod.ts:129-131 says per-file manifest.integrity re-verification at unpack is the cloud control plane's obligation. The cloud repo's plugin-artifact.ts:9-11 and docs/design/plugin-distribution-cloud.md say it is done by the runtime at unpack. Neither side unpacks anything today (#13563 measured: the .osplugin blob is write-only on cloud, no tar/zlib dependency in either repo, verifyIntegrity's only production caller is the publisher self-check from #13464). Two published texts each point at the other, so an agent or a spec consumer reading either learns that a verification exists.

Scope

• Rewrite the integrity TSDoc in manifest.zod.ts to state what is true: the digest is computed and self-checked by the publisher (os plugin publish, Verify manifest.integrity at publish preflight — the framework leg of #11331 (does not discharge the unpack ruling) #13464); unpack-time re-verification is not implemented and is owned by the future runtime loader (ADR-0025 §3.5 steps 4–7), not by the control plane.
• If the ADR-0025 prose or a liveness ledger row states step 5 as done, correct it in the same PR (ADR edits are governed surface — the PR lands by human merge).
• Add a one-line pointer to manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 so the enforce leg is findable when the loader is built.

Out of scope

• Any verification code, in either repo. Cloud's documentary half is cloud control plane: re-verify manifest.integrity digests at .osplugin unpack — the enforce leg of the #11331 ruling #13563 itself (narrowed by the same ruling).

Acceptance

• manifest.zod.ts no longer asserts a cloud-side unpack verification
• ADR / ledger text agrees with the TSDoc
• changeset present

[huangyiirene]

Claim:

• session: session_01T6HeZvT9wdSJD1ZxJb5Eno (PM dispatch, domain:spec execution seat)
• branch: claude/issue-16333-manifest-integrity-tsdoc-unpack
• dispatched: 2026-09-07T07:10Z

The dev inherits this claim and the assignee. ⛔ It posts no second Claim:, and never writes the assignee field.

---

PM pre-dispatch readings, anchored to 3335bd35eaf47a5b2aed9120e217dafd242ff7e1

⚠️ origin/main moves under sibling fetches in this container — never anchor by name.

1. The card's line anchor has DRIFTED

The card cites manifest.zod.ts:129-131 for the integrity TSDoc. At this sha, :120-140 is PluginRuntimeSchema's describe and PluginPackagingSchema; the integrity docblock (Per-file content digests of the packaged artifact (ADR-0025 §3.2,) begins around :139.

⛔ Re-locate by symbol, not by line number, and report what you actually find.

2. ⚠️ The governed-surface half is LIVE and UNRESOLVED — this changes how the PR lands

The card says: "If the ADR-0025 prose or a liveness ledger row states step 5 as done, correct it in the same PR (ADR edits are governed surface — the PR lands by human merge)."

That condition is not vacuous. docs/adr/0025-plugin-package-distribution.md (521 lines) carries unpack prose at :118, :171, :236 — "5. Materialize. Unpack to a per-environment, per-plugin dir" — and :448.

⛔ I have not judged whether that prose asserts step 5 as done rather than as designed. That reading is the dev's, and it decides the PR's landing path:

• ADR untouched ⇒ ordinary packages/spec PR ⇒ this seat verifies, flips ready, arms, and the merge queue lands it.
• ADR touched ⇒ governed surface. ⛔ This seat may not approve it and may not merge it, and ⛔ will not arm it. It lands by human merge only (os-zhuang or hotlong). That is not a delay to route around — it is the rule.

⇒ Report which path you are on, explicitly and early. If it is the governed path, say so in the PR body's first paragraph so no reviewer mistakes it for an armable PR.

3. Serial constraint — clear

No in-flight claim in this lane names packages/spec/src/kernel/manifest.zod.ts or docs/adr/0025-*: #15867 holds ai/knowledge-source.zod.ts, #16293 holds contracts/ai-service.ts + ai/tool.zod.ts + the error ledger. ⚠️ #16327 landed manifest-surface prose two hours ago (merged, so no live conflict) — but it means manifest.zod.ts neighbours have moved recently; rebase awareness rather than a blocker.

---

Generated by Claude Code