P5F-1: disk-backed per-project trust reader (pure extraction) [codex APPROVED]

[lantisprime]

Summary

Implements P5F-1 — pure extraction of the disk-backed per-project trust reader primitives. Per the accepted P5F plan (#143, 0ca3ee6). Zero production callers — the trust module is imported only by tests until P5F-3 wires /agents bg + preflight.

Commits

1. e51139d — P5F-1: disk-backed per-project trust reader (pure extraction) — initial slice (3 files)
2. 226c9ab — P5F-1 fix: fail-closed on malformed project trust key (codex P1 blocker) — R2 re-review fix

Files changed (2 net)

File	Change
agents/lib/bg-trust.ts	NEW: resolveProjectRoot, projectRootSha256, sha256Hex, readOrCreateProjectTrustKey, readProjectTrustStore (+ catch-block fail-closed fix in readProjectTrustStore)
agents/test/test-bg-trust.mjs	NEW: 13 tests (12 original + 1 added in fix for malformed-key regression guard)
agents/test/run-bg-trust-tests.sh	NEW: slice runner

Review status: ✅ codex APPROVED (cmux consensus, R2)

This slice went through the cmux-orchestrated coder↔reviewer consensus loop:

• R1 review (codex, gpt-5.5 high): 1 P1_BLOCKER found — readProjectTrustStore rethrew malformed-key failures instead of failing closed to the untrusted union (violated REQ-1/REQ-3). All other gates passed (12/12 tests, BREAK=1 non-zero, INV-2 grep empty, REQ-10 MAC-before-root).
• Consensus discussion: fix shape pinned (CONSENSUS: agreed) — message-prefix carve-out for the REQ-2 symlink security boundary; map all other non-ENOENT key-read failures (malformed content, EACCES/EPERM) → {ok:false, reason:"forged"}; one new red-then-green test with explicit try/catch fail-on-throw, no BREAK shim; scope limited to catch-block + one test.
• R2 re-review (codex): VERDICT: approve — fix matches consensus, all gates green, regression guard confirmed real.

Verification (independently re-run by codex in R2)

• bash agents/test/run-bg-trust-tests.sh → 13/13 passing
• BREAK=1 node agents/test/test-bg-trust.mjs → exit 1, 12/13 (foreign-root discriminating test, expected)
• INV-2 grep (resolveTrustedHome|readOrCreateSessionMacKey|getBgStateDir|getBgSessionMacPath) agents/lib/bg-trust.ts → empty
• REQ-11 imports → only node:* + ./bg-state.ts
• "refusing symlinked" → exactly 2 hits (L77 throw + L177 catch carve-out)
• Diff scope → only the 2 expected files

Invariants honored

• REQ-1/REQ-3 (fail-closed): trust-content failures return {ok:false, reason:...}, never throw — the ONLY intentional throw is the REQ-2 symlink carve-out.
• REQ-2 (symlink boundary): assertNoSymlinkLocal throw preserved at L77, re-thrown from the catch via message-prefix match.
• REQ-7 (key isolation): project trust key distinct from session MAC key.
• REQ-10 (timing-oracle mitigation): verifyBgPayloadMac (MAC) executes BEFORE projectRootSha256 compare, in source order.
• REQ-11 (no third-party deps): only node:* + ./bg-state.
• INV-2 (forbidden imports): no resolveTrustedHome/readOrCreateSessionMacKey/getBgStateDir/getBgSessionMacPath references.

Plan reference

agents/docs/P5F_DISK_BACKED_TRUST_READER_PLAN.md — Appendix B step 1.1 (verbatim bg-trust.ts source) + step 1.2 (test contract).