KineGrant Protocol v2.60.0 (milestone)

KineGrant Protocol v2.60.0 (milestone)

SROS2 policy mapping verification: an auditor can verify in the browser that
an SROS2 policy mapping is exactly the deterministic projection of the signed
KineGrant policy bundle.

What is new since v2.59.0

• Browser verifier re-verifies kinegrant:Sros2PolicyMappingPacket
  (verifySros2PolicyMapping): the signed policy bundle is verified against
  trusted authorities; every declaration must be exactly reproducible from
  the bundle's rules (sorted by policy_id and actions, one declaration per
  action with kg/<action>/goal topic patterns); declaration fields, domain,
  enforcement, and summary counts must be consistent; anything inconsistent
  fails closed.
• The HTML page and Node CLI (sros2-mapping command) expose it,
  cross-tested against Python-generated SROS2 mappings.
• Roadmap v2.60 (browser SROS2 policy mapping verification) complete.

Evidence

• Conformance: 23/23 PASS
• Machine Permission Test: 22/22 PASS
• Red team: 11/11 PASS
• Full test suite: 489 OK (7 skipped locally by design; Go interop in CI)
• JavaScript suite: 70/70
• Security review kit packet: checksummed and offline-verifiable

Verify offline with:

python scripts/verify_release.py <packet-directory>
python scripts/security_review_kit.py --verify-packet <kit-directory>
python challenge/verify_evidence.py machine-permission-test.evidence.json