Close the loop: recursive review, agent enforcement, a recall index, and dogfooded distribution

[kridaydave]

Close the loop: recursive review, agent enforcement, a recall index, and dogfooded distribution

Four campaigns took blueline from a single-release delta reviewer to a
closed-loop, agent-enforced, networked, self-distributed supply-chain
gate. The goal mandated one branch for the entire four-phase run, so
this is one PR instead of the stacked per-campaign set — the campaign
and slice boundaries are recorded as rulings in TODO.md (night-run
convention) and every slice passed the fmt/clippy/test gate with
adversarial review rounds before the next one started.

Summary:

• Recursive review (Campaign 1). Both documented attacks (TanStack
  worm, Atomic Arch) delivered through a second-order install nobody
  reviewed. Now every install reference inside a reviewed payload — npm
  lifecycle scripts, PKGBUILD npm install/bun delivery, wheel
  .data/scripts — is itself reviewed: depth-capped (policy
  [recursion] max_depth, default 3), cycle-safe (A → B → A is cut and
  disclosed), memoized so referenced packages are never re-downloaded,
  and rolled up into the parent verdict (R24–R27; a child HIGH can
  BLOCK the parent). R23_NPM_DELIVERY graduates INFO → MEDIUM now that
  the delivery line is resolved. The verdict JSON grows a recursive
  array (delivery chain, band, findings), so the card, CI reports, and
  the MCP tool all inherit it. New rules: R24–R28.
• Agent-native enforcement (Campaign 2). blueline agent review
  gives autonomous agents a policy-bound, never-interactive gate (JSON
  verdict on stdout, exit 0/2/1, no baseline blessing, audit trail with
  the agent's identity). blueline agent gate is the hook binding for
  Claude Code PreToolUse and Cursor beforeShellExecution — one
  scanner grammar, fail closed on every error path, dynamic and
  registry-override shapes denied. blueline shim install npm npx pip pip3 cargo yay paru routes real installs through the gate, with the
  bypass list documented rather than hidden. Recipes and the honest
  bypass list are in the README.
• Recall / revocation index (Campaign 3). The last unchecked README
  box: blueline recall serve (std-only loopback HTTP),
  recall sync (bounded fetch, fail-closed validation, monotonic
  sequence), recall export-candidates (audit log → human curation).
  Index hits fold into the advisory engine and BLOCK via the existing
  R09 path; staleness is disclosed (R28) and can BLOCK by policy.
  The SQLite store is untouched — the snapshot lives in a validated
  JSON file.
• Dogfood & distribution (Campaign 4). The npm launcher shims now
  carry the full published platform matrix (a darwin/macOS user used to
  get a launcher with no binary); the release workflow builds the
  missing linux-arm64-musl package and attests SLSA build provenance
  for the GitHub-release binaries. crates.io metadata, a Homebrew
  formula, and an AUR scaffold (reviewed by blueline's own PKGBUILD
  heuristics — see tests/self_review.rs) ship in-repo. Nothing is
  published: registry pushes stay a human-confirmed step.
• Self-CI: blueline ci runs on our own package-lock.json and
  Cargo.lock in CI; verified locally green (PASSED, exit 0 on both),
  agent review serde_json@1.0.151 → LOW, npx blueline cold start
  works through the launcher.

Use-it evidence (real binary, real runs):

• Adversarial A→B fixture chain: blueline review a@1.0.0 → BLOCK at
  score 100, card renders delivered via: a@1.0.0 → npm:b@1.0.0, the
  child's backdoored postinstall surfaces as BLOCK, R27 rolls it up —
  nothing executed (pinned in tests/recursive_review.rs).
• Live AUR review of webtorrent-desktop: real RPC + clone + diff; R23
  fired at MEDIUM on the npm delivery lines (bare npm install
  correctly produces no recursive child).
• Real npm install through an installed shim in a sandboxed project:
  unapproved package blocked (no node_modules created), allowlisted
  package installed for real; Claude Code and Cursor hook payloads
  denied/allowed with agent:claude-code / agent:cursor audit rows.
• Recall index e2e: served a curated snapshot, synced it, a
  clean-looking revoked release BLOCKed via blueline-recall; stale
  index disclosed at MEDIUM and escalated to BLOCK with
  block_on_stale; backward-sequence sync refused
  (tests/recall_cli.rs).

Review process: every slice ran the fmt/clippy/test gate and three
subagent reviewers (adversarial security, test auditor, fresh-eyes) in
parallel; P1/P2 findings were fixed and re-reviewed until clean. The
agent gate in particular went through three hardening rounds (error
paths now deny, per-ecosystem registry routing, flag/override/comment
scanner shapes) with empirical verification of every fixed shape.

PR made by zai-start-plan/glm-5.3-flash from zcode on behalf of Kriday.