feat(owner-decision): protect external gate authority

[ruby-dlee]

Summary

• bind protected runs to an Ed25519 public key plus immutable repository, branch, and submitted head identity
• require signed, expiring envelopes for respond, fix, approve, skip, abort, cancel, and restart checkpoint decisions
• persist an append-only hash-chained decision journal and exact deterministic findings projection before resuming execution
• refuse unsigned yolo, TUI, supersede, cancellation, rollback, replay, and same-step fix-loop bypasses
• keep the private key offline with strict owner-only file provenance
• embed the full 40-character source revision in normal and release builds so downstream runtimes can prove exact source identity

Why this is one change

The protocol, durable journal, daemon recovery, CLI transport, executor admission, and exact build identity are one security boundary. Splitting them would leave intermediate commits where the workload can still mint or replay an owner decision, or where a downstream runtime cannot prove the code it executes.

Verification

• focused owner-decision, database, pipeline, daemon, and CLI tests
• race-enabled tests for all affected packages
• make lint
• make e2e
• native, Linux, and Windows builds
• documentation build
• exact full-revision version assertion on the final tree
• independent adversarial review of the final head

One unrelated custody race fixture depends on the machine default Git branch being master. It passes together with the full custody package when run with an isolated init.defaultBranch=master.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

_{Reviews (4): Last reviewed commit: "test(owner-decision): pin Windows signer..." | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate: this is not auto-merge. Hold is on the author for required CI on the current head; captain-flag is no because the PR is not otherwise completely ready.

Head: 6144eb86efb707556384a1b961bb8060bd0a35ba (fork ruby-dlee/no-mistakes, branch codex/owner-decision-capability). Draft=no, mergeable=MERGEABLE, mergeStateStatus=BLOCKED.

Class: default-behavior + pipeline-shape. Opt-in owner-decision protection is real (--owner-decision-public-key / OwnerDecisionRunConfig), but resumeRecoveredRuns now fail-closes all unbound legacy parked runs after daemon restart (unbound legacy run cannot be resumed after daemon restart). That is a silent default flip of recovery, not an opt-in. Protected-run approval also becomes a second signed-envelope protocol beside unsigned AXI/TUI --yes. Never auto-merge this class.

R1 (one gate, one meaning): does not align as a silent merge. A pass on a recovered run no longer means the same thing (legacy parked runs die; protected runs require a verified signed history immediately before every step, including push/PR/CI). Core order is unchanged, but approval/restart semantics are not.

R2 (never lose work): fail-closed and claims custody retention of the verified head; not a data-loss merge by itself.

R3 (judgment stays human): this is a judgment-path change. It tries to bind controller decisions cryptographically (good for an explicit opt-in), but it also stacks unsigned vs signed admission and refuses unsigned yolo/TUI/supersede on protected runs. Captain owns whether that becomes product default.

R4 (independent validation): does not dilute reviewer/fixer separation.

R5 (evidence over confidence): append-only hash-chained journal is additional evidence, not a substitute for a pass.

R6 (humans and agents first-class): protected runs refuse --yes auto-resolve so the daemon never loads the private key; TUI is not given a signing path in this diff. Shared approval semantics for the opt-in mode are incomplete.

R7 (scope): this grows a controller/external-authority protocol. VISION: the gate publishes facts; it is not a team-governance platform. Captain call.

Files: 29 files, +5167/−243. Protocol + journal + daemon recovery + CLI transport + executor admission + full 40-char build identity. Workflow touch is .github/workflows/release.yml only (full git rev-parse HEAD instead of short SHA; on: push, not pull_request).

CI (current head, after firstmate fork-CI approval): all required checks were action_required at inspect; approved Guard generated files, CI, docs, Require no-mistakes. Still not SUCCESS. windows-git / windows-core / macos / ubuntu / e2e / check / Generated files: pending. Greptile in progress (not required). no-mistakes not yet green; body has no pipeline attestation.

Security: fork CI reviewed; no secret-exfil, no PR-triggered release, private key stays offline. Approved.

Actions: did not merge, did not rebase, did not captain-flag. Wait on author for required CI SUCCESS on this head (Generated files; check; e2e; test ubuntu; macos; windows-git; windows-core). Even if that later goes green, do not auto-merge: re-triage for captain on the default-behavior / pipeline-shape / R1+R3 call.

[kunchenguid]

Speaking as Kun's firstmate: this is not auto-merge. Hold is on the author for required CI SUCCESS on the current head; captain-flag is no because the PR is not otherwise completely ready.

Newer activity after the 2026-08-22 5:40 PM PT hold-author: head moved to 3eb261add486516995df0791f7dcf815acfbaf5d (fix(build): embed full source revision + test(owner-decision): pin Windows signer refusal). Fork CI was re-reviewed and approved on this SHA. Required checks are still not SUCCESS.

Head: 3eb261add486516995df0791f7dcf815acfbaf5d (fork ruby-dlee/no-mistakes, branch codex/owner-decision-capability). Draft=no, mergeable=MERGEABLE, mergeStateStatus=BLOCKED.

Class: default-behavior + pipeline-shape. Opt-in owner-decision protection is still real (--owner-decision-public-key / OwnerDecisionRunConfig), but resumeRecoveredRuns still fail-closes all unbound legacy parked runs after daemon restart (unbound legacy run cannot be resumed after daemon restart). That remains a silent default flip of recovery, not an opt-in. Protected-run approval is still a second signed-envelope protocol beside unsigned AXI/TUI --yes. Never auto-merge this class. Even if CI later goes fully green, do not auto-merge.

R1 (one gate, one meaning): does not align as a silent merge. A pass on a recovered run no longer means the same thing (legacy parked runs die; protected runs require a verified signed history immediately before every step, including push/PR/CI). Core order is unchanged, but approval/restart semantics are not.

R2 (never lose work): fail-closed and claims custody retention of the verified head; not a data-loss merge by itself.

R3 (judgment stays human): this is a judgment-path change. It tries to bind controller decisions cryptographically (good for an explicit opt-in), but it also stacks unsigned vs signed admission and refuses unsigned yolo/TUI/supersede on protected runs. Captain owns whether that becomes product default.

R4 (independent validation): does not dilute reviewer/fixer separation.

R5 (evidence over confidence): append-only hash-chained journal is additional evidence, not a substitute for a pass.

R6 (humans and agents first-class): protected runs refuse --yes auto-resolve so the daemon never loads the private key; TUI is not given a signing path in this diff. Shared approval semantics for the opt-in mode are incomplete.

R7 (scope): this grows a controller/external-authority protocol. VISION: the gate publishes facts; it is not a team-governance platform. Captain call.

Files: 31 files, +5218/−243. Protocol + journal + daemon recovery + CLI transport + executor admission + full 40-char build identity. Workflow touch is .github/workflows/release.yml only (git rev-parse HEAD instead of short SHA; on: push to main, not pull_request).

CI (current head, after firstmate fork-CI approval): Guard generated files, CI, docs were action_required then approved. Required checks are not yet SUCCESS. windows-git / windows-core / macos / ubuntu / e2e / check / Generated files: pending after approval. Greptile SUCCESS (not required). no-mistakes missing on this rematch SHA and ancestors; body has verification notes, not a pipeline attestation. Missing is not a FAILURE.

Security: fork CI re-reviewed on the new head; no secret-exfil, no PR-triggered release, private key stays offline, release.yml trigger unchanged. Approved CI 32609277987, docs 32609277994, Guard generated files 32609278048.

Actions: did not merge, did not rebase, did not captain-flag. Wait on author for required CI SUCCESS on this head (Generated files; check; e2e; test ubuntu; macos; windows-git; windows-core). Captain-flag stays no until otherwise completely ready except R1/R3.