Close the loop: recursive review, agent enforcement, a recall index, and dogfooded distribution

.github/workflows/ci.yml

@@ -90,13 +90,27 @@ jobs:
 
           r = json.load(open("blueline-dogfood.json"))
           names = {i["name"] for i in r["items"]}
-          expected = {"@bluelinecli/cli", "blueline", "@bluelinecli/binary-linux-x64-gnu"}
-
+          expected = {
+              "@bluelinecli/cli", "blueline",
+              "@bluelinecli/binary-darwin-arm64", "@bluelinecli/binary-darwin-x64",
+              "@bluelinecli/binary-linux-arm64-gnu", "@bluelinecli/binary-linux-arm64-musl",
+              "@bluelinecli/binary-linux-x64-musl",
+              "@bluelinecli/binary-linux-x64-gnu", "@bluelinecli/binary-win32-arm64",
+              "@bluelinecli/binary-win32-x64",
+          }
+
+          # Scanner health: everything evaluated must be a shipped package
+          # and the lockfile delta must produce evaluations. Which shipped
+          # packages land in the delta is PR-dependent, so a hardcoded
+          # missing-set is wrong. An empty delta (docs-only PR) is healthy,
+          # not a scanner failure — and a version-bump PR legitimately has
+          # zero unchanged packages, so unchanged_count is reported but
+          # never gated.
+          unknown = names - expected
+          assert not unknown, f"scanner evaluated unknown packages: {unknown}"
           if r["total_evaluated"] == 0:
-              assert r["unchanged_count"] > 0, "no delta and nothing unchanged — scan saw nothing"
-          else:
-              missing = expected - names
-              assert not missing, f"scanner failed to evaluate: {missing}"
+              print("dogfood scanner healthy: empty lockfile delta, nothing to evaluate")
+              sys.exit(0)
 
           print(f"dogfood scanner healthy: evaluated {r['total_evaluated']}, "
                 f"unchanged {r['unchanged_count']}, max band {r['max_band']}")
@@ -177,7 +191,9 @@ jobs:
             --file src/registry/pypi.rs --file src/wheel_extract.rs --file src/baseline.rs \
             --file src/version.rs --file src/review.rs --file src/store.rs \
             --file src/executor.rs --file src/lockfile.rs --file src/ci.rs \
-            --file src/mcp.rs \
+            --file src/mcp.rs --file src/install_ref.rs --file src/recursive.rs \
+            --file src/agent.rs --file src/recall.rs --file src/shim.rs \
+            --file src/pkgbuild.rs --file src/render.rs --file src/policy.rs \
             --in-place --baseline=skip --timeout 30
       - uses: actions/upload-artifact@v4
         if: always()
@@ -225,7 +241,9 @@ jobs:
             --file src/registry/pypi.rs --file src/wheel_extract.rs --file src/baseline.rs \
             --file src/version.rs --file src/review.rs --file src/store.rs \
             --file src/executor.rs --file src/lockfile.rs --file src/ci.rs \
-            --file src/mcp.rs \
+            --file src/mcp.rs --file src/install_ref.rs --file src/recursive.rs \
+            --file src/agent.rs --file src/recall.rs --file src/shim.rs \
+            --file src/pkgbuild.rs --file src/render.rs --file src/policy.rs \
             --in-place --baseline=skip --timeout 30
       - uses: actions/upload-artifact@v4
         if: always()

.github/workflows/release.yml

@@ -46,6 +46,9 @@ jobs:
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-latest
             cross: true
+          - target: aarch64-unknown-linux-musl
+            os: ubuntu-latest
+            cross: true
           - target: aarch64-apple-darwin
             os: macos-latest
           - target: x86_64-apple-darwin
@@ -112,6 +115,7 @@ jobs:
             [x86_64-unknown-linux-gnu]=binary-linux-x64-gnu
             [x86_64-unknown-linux-musl]=binary-linux-x64-musl
             [aarch64-unknown-linux-gnu]=binary-linux-arm64-gnu
+            [aarch64-unknown-linux-musl]=binary-linux-arm64-musl
             [aarch64-apple-darwin]=binary-darwin-arm64
             [x86_64-apple-darwin]=binary-darwin-x64
             [x86_64-pc-windows-msvc]=binary-win32-x64
@@ -245,10 +249,18 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestation: write
     steps:
       - uses: actions/download-artifact@v4
         with:
           path: artifacts
+      - name: Attest build provenance for the release binaries
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            artifacts/binary-*/blueline
+            artifacts/binary-*/blueline.exe
       - name: Create release with all binaries
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

ARCHITECTURE.md

@@ -42,6 +42,9 @@ and any `postinstall`/`preinstall` script is surfaced for a *separate* human dec
 │                     approval overrides, policy                │
 │  extract         ── verify hash → bounded sandbox extract    │
 │  diff            ── file-level + line-level (similar crate)   │
+│  install_ref     ── scan payload for referenced installs      │
+│  recursive       ── re-review referenced installs: depth caps,│
+│                     cycle detection, roll-up                  │
 │  heuristic       ── rule engine → risk score → verdict        │
 │  revocation      ── OSV / GitHub Advisory cache + hosted idx  │
 │  provenance      ── sigstore/SLSA attestation *surfaced*,     │
@@ -138,6 +141,73 @@ Recommend the explicit tool to avoid breaking agent toolchains.
 
 ---
 
+## 5. Second-order lanes (agent / recall / shim)
+
+Install-time references (npm lifecycle scripts, wheel `.data/scripts`,
+PKGBUILD npm/bun delivery) are first-class findings, reviewed recursively:
+
+- **R24** — every statically visible reference is disclosed; band reflects
+  pinnability (HIGH pinned, MEDIUM unpinned/dynamic, HIGH non-registry).
+- **R25** — depth/budget caps (`[recursion] max_depth`, `max_child_reviews`)
+  fail closed as HIGH findings, never silent skips.
+- **R26** — install-reference cycles (A → B → A) are cut with a HIGH finding.
+- **R27** — roll-up: a child finding at/above `child_block_band` escalates
+  the parent via a second-order finding carrying the delivery chain.
+- **R28** — recall-index staleness: MEDIUM past `[recall] max_age_hours`,
+  HIGH when unreadable, BLOCK with `block_on_stale`.
+
+### `ReviewContext` cycle (`src/recursive.rs`)
+
+One `ReviewContext` spans a top-level evaluation. `enter_scope` pushes the
+cycle key `(ecosystem, name, version)` and the human-readable delivery-chain
+label; `exit_scope` pops both after the evaluation *including its children*.
+Name identity in keys is ecosystem-scoped (`canonicalize_for_ecosystem`):
+PEP 503 applies to PyPI only — npm/cargo/AUR `foo_bar` vs `foo-bar` are
+distinct. The verdict schema (D7) carries the outcome in its `recursive`
+field: `Vec<ChildReview>` with chain, band, score, and findings per child.
+
+### Agent lane (`src/agent.rs`)
+
+`agent review` (JSON verdict, exit 0/2, never marks clean) and `agent gate`
+(hook binding policing one command line through the same scanner + engine).
+Both load policy via `Policy::load_for_agent`, which **ignores
+`BLUELINE_POLICY` unless `--policy` names the file** — ambient env is
+attacker-shaped at the hook boundary — and warns on stderr when it does.
+Redirect-capable env (`PIP_*`, `NPM_CONFIG_*`, `CARGO_*`) present at gate
+time is disclosed by name (never value) in the reason and audit trail.
+
+### Recall lane (`src/recall.rs`)
+
+Curated revocation snapshot synced wholesale (`recall sync`, monotonic
+`sequence`, backward moves refused without writing). Lookup normalizes
+PyPI names on both sides (PEP 503) and compares versions by grammar
+(`1.0` fires on `1.0.0`); other ecosystems match exactly. A hit BLOCKs via
+the advisory engine *before* the `check_advisories` switch — disabling OSV
+never silences recall — and never routes through the advisory cache.
+
+### Shim lane (`src/shim.rs`)
+
+Fail-closed bash shims for all eleven scanned managers (`npm`, `npx`,
+`pnpm`, `yarn`, `bun`, `bunx`, `pip`, `pip3`, `cargo`, `yay`, `paru`)
+routing through `agent gate --policy` before exec'ing the real binary.
+Known bypasses stay documented in the README.
+
+### Policy tables (`blueline.toml`)
+
+| Table | Keys |
+|---|---|
+| `thresholds` | `max_low_score` (19), `max_medium_score` (49), `block_score` (80) |
+| `policy` | `require_provenance`, `block_unreviewed_scripts`, `allow_git_dependencies`, `check_advisories`, `fail_closed_network` |
+| `advisories` | `block_on_malware`, `block_on_critical_cve`, cache TTLs |
+| `provenance` | `require_provenance`, `require_signatures`, builders/repos |
+| `allowlist.packages` | exact `name` (+optional `ecosystem`), `allowed_scripts`, `allow_unreviewed_baseline` |
+| `blocklist` | glob `packages` (+optional `ecosystem`), `maintainers` |
+| `ci` | `fail_on`, `max_evaluations`, `include_dev` |
+| `recursion` | `max_depth` (3, cap 16), `max_child_reviews` (8, cap 256), `child_block_band` (HIGH) |
+| `recall` | `max_age_hours` (48), `block_on_stale` |
+
+---
+
 ## 3. Tech Stack (Rust core)
 
 | Concern            | Crate / Tool                          |