Add inactive evidence-integrity evaluator

[yihanzhu]

Roadmap item 2: Control foundation.

Exact candidate

• head: f2cb6b7
• base: f099016
• branch: codex/control-evidence-integrity-v1
• effect: inactive, repo-only, identity-only observation

Scope: eight paths

• README.md
• RESTORE.md
• ci/required-files.txt
• control/v1/evaluate-evidence-integrity.sh
• control/v1/evidence-integrity-decision.json
• control/v1/evidence-integrity-policy.json
• control/v1/evidence-integrity.jq
• scripts/test/control-evidence-integrity.test.sh

Proof on the exact head

• Evidence-integrity targeted matrix: 75/75.
• Bash syntax and ShellCheck 0.11.0: clean.
• Policy and decision JSON are canonical.
• Trusted launcher SHA-256: f0ecbe036601102db082d0a94c860ea868614ff79d06f2b37ec8dcd672c367a2.
• Exact executed payload SHA-256: 79e2a3c8817e19f1e3fc9d5571b68cb1eb15d55b69eb10f5090bb943220d1afc.
• Restore manifest, diff, and exact-path checks: clean.
• Late lifecycle markers keep liveness checks and a 20-second local bound inside the 360-second targeted-suite cap; product process and output limits are unchanged.

Behavior

• Mirrors pinned core-v2 evidence identities, shapes, ordering, uniqueness, qualification, and prior-reference rules.
• Qualification and evidence remain identity-only and unqualified. The evaluator grants no truth, qualification, authority, storage, activation, or permission.
• The decision separates an externally trusted launcher from the exact marked evaluation payload. The launcher does not claim to attest its already-loaded bytes. The evaluation payload is identity-checked, buffered, and delivered to a cleared Bash process through an anonymous pipe.
• Every scratch output, error, and receipt is prepared through descriptor-rooted exclusive no-follow operations. The producer retains the original descriptors through child completion and computes their final device, inode, size, timestamps, and SHA-256.
• Producer-final identities return only through a consumer-owned fd6 channel whose anchored FIFO name is identity-checked and removed before the producer starts. The real command cannot inherit fd6. No path-backed metadata record remains.
• Consumers use no-follow reads bound to producer-final identities and recheck after canonical schema, exact input tuple, verdict, reason, and evidence validation before output.
• Worker, policy validator, and core wrapper use explicit clear environments.
• Core validation uses the existing accounted mode under a worker-owned 0700 root with a fixed 16 MiB budget and an anchored fd3 receipt. The receipt and empty accounted root are verified.
• The supervisor keeps bounded process-group registration, signal handling, termination, wait, and reap behavior.
• Focused tests cover same-inode output mutation, inode replacement, metadata-channel removal, payload/launcher identity, accounted-core interruption after real nested scratch creation, environment isolation, link and ancestor replacement, portable execution, output limits, timeouts, cleanup failure, and driver/jq identity changes.

This change does not use a real target or credential, execute candidate code, access a networked adapter, install or activate a profile, publish, release, deploy, or perform an external write.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	f2cb6b7
Status:	✅  Deploy successful!
Preview URL:	https://d485a2f3.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-control-evidence-integ.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: f2cb6b7
Reviewed-base: f099016
reviewer: review_evidence_214_r9 @ high

CLEAN — zero unresolved Important findings.

Bugs

• Producer status, payload-writer status, metadata delivery, and consumer status are cross-checked and fail closed.
• Worker runtime remains bounded by the unchanged child deadline, output limits, process-group termination and reaping, and bounded metadata reads.
• Accounted core scratch remains inside the worker-owned tree and is removed on normal, error, stalled-child, and signal paths.

Security

• The producer retains the original output, error, and receipt descriptors until its child exits. It computes final device, inode, size, timestamps, and SHA-256 identities from those descriptors.
• Producer-final metadata returns only through consumer fd6. Its anchored FIFO name is identity-checked and unlinked before producer start, and the real command cannot inherit the channel.
• Consumers require exact producer-final identities before and after no-follow reads. They independently enforce canonical JSON and the complete stage, input, evidence, verdict, and reason relations.
• Inode replacement and same-inode post-producer mutation both fail closed.
• The launcher is explicitly trusted and non-self-attested. The exact executed payload hash is 79e2a3c8817e19f1e3fc9d5571b68cb1eb15d55b69eb10f5090bb943220d1afc, matching the decision.
• Nested Bash processes use clear allowlisted environments.

Compliance

• Exactly the eight authorized paths changed; no forbidden or constitution path changed.
• The package remains inactive, repo-only, identity-only, and authority-free.
• Docs, executable modes, hashes, and restore-manifest entries are coherent.
• Required CI run 33609979748, check 100182583061, completed successfully from app 15368. The focused suite passed 75/75.

[yihanzhu]

Construction publish receipt

• reviewed head/base: f2cb6b7 / f099016
• required CI: app 15368, check 100182583061, success
• independent review: comment 5507294095, zero unresolved Important
• squash merge/main: 81cdf84
• reviewed/merged tree: 9c161148541447a49b50ed824e9866277f5eb37e
• canonical receipt SHA-256: b5752a13d6653a7bee48ed0b90877e386f04edabd4ab65b36d5e03a96db4b927
• local main: clean and fast-forwarded