test: complete executable encoding coverage

Preserve reviewed runtime admission and cover each execute bit.
Cover every standard Mach-O encoding and accurate evidence locator.
Retain valid signed bundles, caches and ordinary excluded diagnostics.
Actual signed native100 RED precedes code and coherent0.55.10 delivery.

Author: djm81

CHANGELOG.md

@@ -10,6 +10,35 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.55.10] - 2026-10-13
+
+### Security
+
+- Reject malformed alternate project manifests during authenticated admission without aborting CLI startup.
+
+- Require authenticated project authority for indirect category mounts and shared member loaders, including bundle aliases and cross-category claims.
+
+- Bind privileged project registration metadata and executable inventory to authenticated artifact bytes; reproduce source caches before the final file check and recheck authority before registration effects.
+
+- Reject category-less grouped workspace root commands, external claims to permanent core commands and
+  unauthenticated workspace claims to official category roots before registry, bridge or import-source activation.
+- Preserve resolved built-in authority, reject forged source labels and escaping symlinks, and prevent
+  rejected workspace sources from shadowing eligible package dependencies.
+- Reject unsigned executable caches and omitted Python/native artifacts; authenticate captured signed source
+  bytes before reproducing compatible interpreter caches without executing candidate code.
+
+### Fixed
+
+- Select the first fully eligible copy of each module, reconsider dependency fallbacks against selected versions
+  and each candidate's own version, and refuse contradictory priority cycles before registration effects.
+- Preserve categorized routing and supported unreserved legacy registration, including operator-configured
+  built-in discovery, while retaining the completed removal of flat bundle shims.
+- Preserve all six official project-scoped bundle roots only after full artifact checksum and signature
+  verification against the core-bundled key; reject unsigned, tampered and workspace-key replacements.
+- Preserve genuine installed bundles when a rejected project copy claims the same name, retain authenticated
+  project priority, and skip artifact payload verification for disabled module names.
+- Synchronize bugfix version declarations, frozen project metadata and the promotion fixture.
+
 ## [0.55.9] - 2026-10-13
 
 ### Security

docs/reference/module-categories.md

@@ -5,7 +5,7 @@ nav_order: 35
 permalink: /reference/module-categories/
 doc_owner: specfact-cli
 tracks: [src/specfact_cli/registry/**, ../specfact-cli-modules/packages/**]
-last_reviewed: 2026-07-10
+last_reviewed: 2026-10-11
 exempt: false
 exempt_reason: ""
 ---
@@ -91,6 +91,15 @@ Namespace mapping:
 Compatibility note:
 
 - Flat top-level command shims were removed. Use category groups (`project`, `backlog`, `code`, `spec`, `govern`, `requirements`).
+- Category-less workspace modules are skipped in default grouped mode. Add category/bundle metadata to
+  use the supported grouped surface. Explicitly disabling grouping preserves unreserved legacy workspace
+  commands; category-less user, marketplace and custom sources retain their compatibility path.
+- Permanent core commands (`init`, `module`, `upgrade`) are reserved for resolved built-in package paths.
+  Operator-selected built-in discovery remains supported. External packages cannot extend these roots
+  by declaring a core category, name or source label. Workspace packages also cannot supply official
+  category root command apps in either mode. Rejected packages contribute no active import roots,
+  schema extensions, service bridges or category mounts. Eligible categorized execution remains
+  intentional extension behavior; this guard is not a sandbox.
 - `specfact backlog auth ...` is provided by the backlog bundle, not by the permanent core command surface.
 - Prerelease `specfact-requirements` manifests that still declare category
   `project` with `bundle_group_command: requirements` are normalized to the

docs/reference/module-security.md

@@ -19,6 +19,34 @@ Module packages carry **publisher** and **integrity** metadata so installation,
 - **Publisher trust gate**: Non-official publishers require one-time explicit trust (interactive confirmation or `--trust-non-official` / `SPECFACT_TRUST_NON_OFFICIAL`).
 - **Denylist gate**: Modules listed in denylist are blocked before install/bootstrap regardless of source.
 
+## Workspace command authority
+
+Default grouped registration rejects category-less project modules before registration or import effects.
+Permanent `init`, `module` and `upgrade` commands require resolved built-in package paths in both modes.
+Unverified workspace packages cannot supply the official `project`, `backlog`, `code`, `spec`, `govern` or
+`requirements` roots. Supported official bundles installed with `--scope project` retain their canonical roots
+only after complete filesystem checksum and signature verification, including untracked module source files,
+against the public key bundled with the CLI and matching
+signed official bundle metadata. Payload symlink members, standalone bytecode, uncovered executable source and missing keys fail closed.
+Current-interpreter source caches remain compatible only when their compiled bytes match the signed source.
+Verification compares those bytes without executing or deserializing candidate caches. Unsigned/test flags, installation receipts and
+`SPECFACT_MODULE_PUBLIC_KEY_PEM` overrides cannot grant these project root commands.
+
+Categorized project packages can populate shared category-member loaders even when their commands do not name a
+root. They therefore require authenticated official bundle authority before candidate selection and registration.
+The same gate covers category mounts induced by explicit bundle metadata or namespaced bundle aliases.
+Explicit legacy registration retains unreserved category-less project commands without an official mount claim;
+non-project categorized routing retains its existing policy. These controls protect command admission and import activation, and do not sandbox intentionally
+invoked module code.
+
+## Preparing project-scoped release artifacts
+
+Publish regular payload files rather than symlinks. Replace links with their intended files before signing;
+remove standalone bytecode and executable files under directories excluded from signing. Regenerate ordinary
+source caches with the target interpreter, or remove stale or transformed caches before project installation.
+The strict project-root admission check independently verifies these conditions. Passing a companion repository
+signing or release-verification command alone does not establish eligibility for privileged project roots.
+
 ## Integrity flow
 
 1. Discovery reads `module-package.yaml` and parses `integrity.checksum`.
@@ -104,3 +132,9 @@ Module packages carry **publisher** and **integrity** metadata so installation,
 ## Versioned dependencies
 
 Manifest may declare versioned module and pip dependencies via `module_dependencies_versioned` and `pip_dependencies_versioned` (each entry: `name`, `version_specifier`). These are parsed and stored for installation-time resolution while keeping legacy `module_dependencies` / `pip_dependencies` lists backward compatible.
+
+Privileged project-root admission binds discovery fields to the same normalized manifest captured in the signed
+payload. It also completes reproduction of any permitted source caches before checking a fresh executable inventory.
+The final check compares membership, source/native digests and raw cache bodies without executing candidate code or
+invoking compilation. Admission and its recheck precede schema, bridge, protocol and import-root registration effects.
+These checks authenticate the admission snapshot; they do not make a mutable workspace immutable after admission.

openspec/changes/fix-categoryless-module-command-squatting/CHANGE_VALIDATION.md

@@ -1,3 +1,14 @@
+
+## Signed native100 RED verified — 15 October 2026 (Europe/Berlin)
+
+Signed specification6c63d63323e94a7c633c69ea964c85c3d1c9c71c precedes signed authored testsd20d6a56e9781a740a1c82907158c671ad3d4b7f on unchanged protected production/version.
+Actual native run38647654283, artifact11932289125, service ZIP SHA2568429e0ff751d0fcd044cda08b1d4225ca2ea494b94b5330c90bbf24c384151bc, has100 genuine AssertionErrors,
+zero errors/skips and exact source/tree/base/selectors plus all8 authored test hashes. Its RED gate passes
+with zero proof findings. JUnit digest:sha256:6a252b0198a77bdc86e5bb7511af4843a68fe7b836c1856b8c5f870c4ea54ea5. Reviewed production/version0.55.10 is restored only
+after this real service artifact and bindings are verified. Deliberate RED workflow failure is evidence,
+not final merge-ready CI. Final native producer/execution/FULL review, required CI, live exact-head authority
+and completed current-head review remain required; no target merge is authorized. Companion symlink blocker remains.
+
 ## Current accepted100 signed authoring — 15 October 2026 (Europe/Berlin)
 
 The human accepted exact per-source100 mapping4c3ded1d98d1437c1de1fb73c243ad71d804506769135ea42581e9b3781ed274

openspec/changes/fix-categoryless-module-command-squatting/TDD_EVIDENCE.md

@@ -1,3 +1,14 @@
+
+## Signed native100 RED verified — 15 October 2026 (Europe/Berlin)
+
+Signed specification6c63d63323e94a7c633c69ea964c85c3d1c9c71c precedes signed authored testsd20d6a56e9781a740a1c82907158c671ad3d4b7f on unchanged protected production/version.
+Actual native run38647654283, artifact11932289125, service ZIP SHA2568429e0ff751d0fcd044cda08b1d4225ca2ea494b94b5330c90bbf24c384151bc, has100 genuine AssertionErrors,
+zero errors/skips and exact source/tree/base/selectors plus all8 authored test hashes. Its RED gate passes
+with zero proof findings. JUnit digest:sha256:6a252b0198a77bdc86e5bb7511af4843a68fe7b836c1856b8c5f870c4ea54ea5. Reviewed production/version0.55.10 is restored only
+after this real service artifact and bindings are verified. Deliberate RED workflow failure is evidence,
+not final merge-ready CI. Final native producer/execution/FULL review, required CI, live exact-head authority
+and completed current-head review remain required; no target merge is authorized. Companion symlink blocker remains.
+
 ## Current accepted100 signed authoring — 15 October 2026 (Europe/Berlin)
 
 The human accepted exact per-source100 mapping4c3ded1d98d1437c1de1fb73c243ad71d804506769135ea42581e9b3781ed274

openspec/changes/fix-categoryless-module-command-squatting/tasks.md

@@ -133,7 +133,7 @@ effects.
 
 - [ ] Reproduce bundle-induced mounts and existing-root replacement through public registration.
 - [ ] Bind indirect category capabilities to authenticated project authority before effects.
-- [ ] Extend native-format controls for `.so` and `.pyd` and retain clear required fixture diagnostics.
+- [x] Extend native-format controls for `.so` and `.pyd` and retain clear required fixture diagnostics.
 - [ ] Revalidate full delivery, canonical mapping acceptance and exact-current native RED/GREEN/review.
 
 ## Alternate-manifest review follow-up
@@ -192,4 +192,5 @@ No production behavior, pin, threshold, timeout, signature format or global depe
 - [x] Complete final full3420/FULL19score72/types0/1456 with unchanged inputs/graphs.
 - [x] Complete final standalone verify-fix before diverse review on194bf bytes, no actionable findings.
 - [ ] Obtain fresh exact100 mapping acceptance before signed/native publication.
-- [ ] Obtain signed native100 RED before runtime restoration and actual final native/CI/completed review.
+- [x] Obtain signed native100 RED38647654283 with100 genuine assertion failures and all18 encoding observations before runtime restoration.
+- [ ] Verify final native100 GREEN, all required CI and completed current-head review.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specfact-cli"
-version = "0.55.9"
+version = "0.55.10"
 description = "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery."
 readme = "README.md"
 requires-python = ">=3.11"

setup.py

@@ -7,7 +7,7 @@
 if __name__ == "__main__":
     _setup = setup(
         name="specfact-cli",
-        version="0.55.9",
+        version="0.55.10",
         description=(
             "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, "
             "and spec/contract evidence for AI-assisted and brownfield delivery."

src/__init__.py

@@ -3,4 +3,4 @@
 """
 
 # Package version: keep in sync with pyproject.toml, setup.py, src/specfact_cli/__init__.py
-__version__ = "0.55.9"
+__version__ = "0.55.10"

src/specfact_cli/__init__.py

@@ -76,6 +76,6 @@ def _install_progressive_disclosure() -> None:
 # keeps missing-command and missing-parameter UX consistent outside the root CLI too.
 _install_progressive_disclosure()
 
-__version__ = "0.55.9"
+__version__ = "0.55.10"
 
 __all__ = ["__version__"]