fix(runtime): harden state-native trust snapshots

[Lutar, Stephen P. (stephenlutar2-hash)]

Clean reviewed successor

• Exact protected-main base at publication: 58812fff46f8c5f18979d089fd1b7a059d6892d7
• Exact head: de26ac33994dffaf8b36d979c2312c3d2b13a6ec
• History: one new commit
• Commit controls: SSH signature, DCO trailer, and every message line at or below 100 characters
• The five committed files byte-match the locally reviewed and tested final tree

Trust-boundary hardening

• Snapshot the complete governed request once before any await and use only that snapshot.
• Snapshot every cognitive-epoch, validation-check, verifier, and kernel-definition field once.
• Reject every policy effect except allow, block, and approval_required.
• Require boolean validation results and bounded non-empty name/detail strings.
• Give execution and mandatory verification separate deep capsule and payload snapshots.
• Preserve single-read verifier evidence and bind prototype methods to their original receiver.
• Add direct accessor, receiver, request-mutation, capsule-mutation, and all-field epoch regressions.

Exact-head review feedback carried forward

• Add flipping-getter coverage for all seven admitted kernel-definition fields.
• Keep asynchronous budget expansion adversarial by emitting two outputs against a limit of one.
• Assert the original budget governs execution and the error receipt after caller mutation.

Local evidence

• pnpm --dir packages/a11oy-runtime test: 35 Vitest tests passed.
• The same command: 40 state-native Node tests passed.
• TypeScript compilation passed inside the package test command.
• Biome format/lint and Oxlint completed with no blocking error.
• Brand-string pre-push check passed.
• git diff --check passed.
• Optional OG image QA is not counted because local Python/Pillow was unavailable.

Truth boundary

This PR publishes source, tests, and a source-only proof packet. Hosted CI, fresh exact-head
independent review, merge, deployment, runtime, and production behavior remain UNVERIFIED until
their separate evidence is observed. No deployment or production claim is made.

PR #605 is superseded and must not merge. PRs #589 and #590 remain unmerged and were not amended,
rebased, force-pushed, merged, or closed by this successor work.

[Lutar, Stephen P. (stephenlutar2-hash)]

Codex (@codex) review

Please independently review exact head de26ac33994dffaf8b36d979c2312c3d2b13a6ec only. Re-audit every governed snapshot, all seven kernel-definition getter boundaries, every cognitive-epoch and validation field, policy-effect admission, verifier result, receiver binding, execution-versus-verifier capsule isolation, and the asynchronous request-budget expansion regression. Confirm the two findings from superseded #605 are fully closed. Report findings or an explicit no-findings result bound to this SHA. Do not infer deployment, runtime, or production status from source or CI.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: de26ac3399

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[Lutar, Stephen P. (stephenlutar2-hash)]

Codex (@codex) review exact head de26ac33994dffaf8b36d979c2312c3d2b13a6ec

Re-triggering because the earlier exact-head request has no bot acknowledgment. Please independently confirm the two #605 findings are closed and report findings or an explicit no-findings result for this SHA only.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: de26ac3399

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".