fix(runtime): harden state-native trust snapshots

audit/frontier/ALLOY_STATE_NATIVE_RUNTIME_POSTMERGE_HARDENING_PROOF_2026-08-13.md

@@ -0,0 +1,40 @@
+# Proof Packet - State-Native Runtime Post-Merge Hardening
+
+**Workcell:** A11OY-STATE-001-C
+**Date:** 2026-08-13
+**Repository:** szl-holdings/platform
+**Protected base:** `58812fff46f8c5f18979d089fd1b7a059d6892d7`
+**Claim level:** source implementation pending exact-head protected qualification
+
+## Context
+
+An independent read-only audit of the state-native runtime on protected main found four remaining
+mutable-boundary defects after PR #595 merged. Hosted checks on #595 were green, but no independent
+Codex review completed because the review service reported a usage-limit block.
+
+## Patch
+
+- Read each registered kernel field once, validate those local values, and bind admitted prototype
+  methods to the original receiver before freezing the definition.
+- Read verifier `passed`, `reason`, and `evidenceDigests` once, copy each evidence element once, and
+  use only that validated snapshot for the mandatory decision and receipt.
+- Read each epoch-validation check field once before shape validation, state selection, and storage.
+- Give kernel execution and mandatory verification independent deep copies of capsule metadata and
+  payload bytes.
+- Preserve the complete governed-request snapshot, complete cognitive-epoch specification snapshot,
+  and closed policy-effect set already present on protected main.
+
+## Adversarial regressions
+
+The focused tests exercise verifier accessor flips, validation-check accessor flips, class private
+receiver state, distinct nested capsule identities, caller mutation across admission and receipt
+fields, and one-read coverage for every declared cognitive-epoch field.
+
+## Truth boundary
+
+This packet records source changes only. Local validation, hosted CI, independent exact-head review,
+merge qualification, deployment, runtime operation, and external witness state remain unverified
+until separately observed at the exact successor head.
+
+No UI route, deployment, database, DNS, secret, branch-protection setting, or external account is
+changed by this workcell. No production or customer-runtime claim is made.

packages/a11oy-runtime/src/state-native/epoch-manager.ts

@@ -28,7 +28,9 @@ function specDigest(spec: CognitiveEpochSpec): string {
 function freezeRecord(record: CognitiveEpochRecord): CognitiveEpochRecord {
   return Object.freeze({
     ...record,
-    validationChecks: Object.freeze(record.validationChecks.map((check) => Object.freeze({ ...check }))),
+    validationChecks: Object.freeze(
+      record.validationChecks.map((check) => Object.freeze({ ...check })),
+    ),
   });
 }
 
@@ -90,7 +92,11 @@ export class CognitiveEpochManager {
   }
 
   public validate(epochId: string, checks: readonly EpochValidationCheck[]): CognitiveEpochRecord {
-    assertStateNative(checks.length > 0, 'INVALID_INPUT', 'At least one epoch validation check is required.');
+    assertStateNative(
+      checks.length > 0,
+      'INVALID_INPUT',
+      'At least one epoch validation check is required.',
+    );
     const current = this.require(epochId);
     if (current.state !== 'PREPARED') {
       throw new StateNativeError(
@@ -106,22 +112,25 @@ export class CognitiveEpochManager {
           'INVALID_INPUT',
           'Cognitive epoch validation checks must be objects.',
         );
+        const name = check.name;
+        const passed = check.passed;
+        const detail = check.detail;
         assertStateNative(
-          typeof check.name === 'string' && check.name.trim().length > 0,
+          typeof name === 'string' && name.trim().length > 0,
           'INVALID_INPUT',
           'Cognitive epoch validation check name must be a non-empty string.',
         );
         assertStateNative(
-          typeof check.passed === 'boolean',
+          typeof passed === 'boolean',
           'INVALID_INPUT',
           'Cognitive epoch validation check passed must be a boolean.',
         );
         assertStateNative(
-          typeof check.detail === 'string' && check.detail.trim().length > 0,
+          typeof detail === 'string' && detail.trim().length > 0,
           'INVALID_INPUT',
           'Cognitive epoch validation check detail must be a non-empty string.',
         );
-        return Object.freeze({ name: check.name, passed: check.passed, detail: check.detail });
+        return Object.freeze({ name, passed, detail });
       }),
     );
     const state = normalizedChecks.every((check) => check.passed) ? 'VALIDATED' : 'REJECTED';
@@ -181,12 +190,23 @@ export class CognitiveEpochManager {
     return next;
   }
 
-  public rollback(activeEpochId: string, targetEpochId: string, reason: string): CognitiveEpochRecord {
-    assertStateNative(reason.trim().length > 0, 'INVALID_INPUT', 'Rollback reason must not be empty.');
+  public rollback(
+    activeEpochId: string,
+    targetEpochId: string,
+    reason: string,
+  ): CognitiveEpochRecord {
+    assertStateNative(
+      reason.trim().length > 0,
+      'INVALID_INPUT',
+      'Rollback reason must not be empty.',
+    );
     const active = this.require(activeEpochId);
     const target = this.require(targetEpochId);
     if (active.state !== 'ACTIVE') {
-      throw new StateNativeError('INVALID_TRANSITION', 'Only an active cognitive epoch can be rolled back.');
+      throw new StateNativeError(
+        'INVALID_TRANSITION',
+        'Only an active cognitive epoch can be rolled back.',
+      );
     }
     if (active.tenantId !== target.tenantId || active.route !== target.route) {
       throw new StateNativeError(
@@ -232,23 +252,33 @@ export class CognitiveEpochManager {
     const routeKey = this.#routeKey(tenantId, route);
     const epochId = this.#activeByTenantRoute.get(routeKey);
     if (!epochId) {
-      throw new StateNativeError('EPOCH_NOT_ACTIVE', 'No active cognitive epoch exists for this route.', {
-        tenantId,
-        route,
-      });
+      throw new StateNativeError(
+        'EPOCH_NOT_ACTIVE',
+        'No active cognitive epoch exists for this route.',
+        {
+          tenantId,
+          route,
+        },
+      );
     }
     if (expectedEpochId && expectedEpochId !== epochId) {
-      throw new StateNativeError('EPOCH_NOT_ACTIVE', 'The requested cognitive epoch is not active.', {
-        tenantId,
-        route,
-        expectedEpochId,
-        activeEpochId: epochId,
-      });
+      throw new StateNativeError(
+        'EPOCH_NOT_ACTIVE',
+        'The requested cognitive epoch is not active.',
+        {
+          tenantId,
+          route,
+          expectedEpochId,
+          activeEpochId: epochId,
+        },
+      );
     }
 
     const current = this.require(epochId);
     if (current.state !== 'ACTIVE') {
-      throw new StateNativeError('EPOCH_NOT_ACTIVE', 'Cognitive epoch is no longer active.', { epochId });
+      throw new StateNativeError('EPOCH_NOT_ACTIVE', 'Cognitive epoch is no longer active.', {
+        epochId,
+      });
     }
     const pinned = freezeRecord({ ...current, leaseCount: current.leaseCount + 1 });
     this.#records.set(epochId, pinned);