feat: qualify Gemini native project E2E

docs/GEMINI_PROJECT_NATIVE_ASSESSMENT_CACHE_CLOSURE_PLAN.md

@@ -0,0 +1,196 @@
+# Gemini: exact source-bound security assessment cache closure
+
+Accepted plan: root R1 and independent native-finish R2 reviewed exact draft
+SHA256 c310ebb04ea20da87d3cc0073a703b0f0043d18ee469c881e7fcf977bdcc4328
+before implementation. The published source being corrected is c0b25d933b35ed1d0172f09b8a81f957d69727ac,
+tree9b93ec3d0e49822e6f01b100e8ba41934502e6e7. This is a fixture authority
+correction, not a scanner, installer, qualification or release change.
+
+## Fresh genuine evidence
+
+Run40569317705/job122427178730 failed after13.507s at add-user. The actual
+public command exits0/error=false/context=false in369ms. All3 baseline
+catalogs and the4-frame empty baseline-a native session succeed. One provider
+exchange advertises no owned declaration; all4 probe segments contain zero
+actual probe events. The fatal remains Gemini public mutation escaped exact
+state closure; this is not the deliberate final review barrier.
+
+Native12765464677 is72812B, outerSHA256
+5a9692eff8f757210fecbc184b9ca91b79abbe219c77bc6a1a8ac1f0f0e6cc54,
+innereda79fa50d1e5c1b6ebbab1d36248600cdc2a276bfd789fd53e6a50298a264d0,
+24 closed ordinary members. Frontend12766166734 is53591B, outer
+ d6cb5f1d5b26409279e2c38019a601ff1f20ee859ce9e5903991893940726f75,
+inner0802df528dff9af52245c64a68cd74bcc9bf230bf2756b55bb7a0a92a5c67874,
+25 members. Exact source/tree/committed/empty patches and clean build frames,
+all24 frontend and30 nested raw byte/hash joins, command receipts, baseline
+session/provider facts and current failed-only admission pass independent
+review. Audit /tmp/uap-gemini-c0b-current-40569317705/independent-current-raw-audit.json
+has SHA25669251538fde00c340393c544c917844107f17d77d20f880dc906e595036e9871.
+The failed entry/path/tree was not exported. This plan does not claim a measured
+refused filename. Full provider-stage closure remains incomplete and must not
+be promoted. All five/runtime-complete/observed/account/model flags stay false.
+
+## Exact source proof
+
+cli/cmd/agentplugins/compose.go configures both the global cache root and user
+state root from AGENTPLUGINS_HOME. The fixture sets that to installer-state
+and freezes it before public operations. nativeProvisionScanner creates only
+the pinned scanner binary subtree under security/lintai. The ordinary CLI
+SecurityEvaluator uses FileCache{Root:globalRoot/security/assessments} for both
+user and project operations; project state .uap is separate from that global
+cache. SourceAcquirer also creates/removes snapshots in the global root.
+
+The captured add-user security object has evidence_source=local_scan, the held
+source/manifest subject, lintai0.1.3/default policy, no_blocking_findings,
+zero counts, scanned_files3 and report_digest90f5acb6ff3ac64f669be4f4ba6deea7ae5aa3a9954662441c0e5498b8d56598.
+Evaluator.Evaluate must successfully call Cache.Store before returning a local
+scan: cache errors propagate and would fail the command. FileCache.Store creates
+the0700 assessment parent, writes0600 JSON through a temporary file, syncs and
+closes it, and atomically replaces exactly CacheKey+'.json'. Cached Evidence is
+empty, with empty Findings omitted; successful cleanup leaves no temp residue.
+
+CacheKey hashes the NUL-joined held tree/manifest digests, scanner ID/version,
+policy ID/version/digest. For this actual held U-one subject the source-derived
+relative filename is security/assessments/b99b8ba443fb9059fc6b82486fc8e78537380cc18512785cf689dfc0673ca8a2.json.
+It is a source-derived output, not an exported path observation. The current
+state closure permits neither its new parent/leaf nor changed metadata on the
+existing security parent. This is another independently proved omission after
+the separate installer-tmp correction. Direct Loader/Stager/Kernel contracts
+bypass CLI SecurityEvaluator, explaining the missing file-cache seam.
+
+## Exact authority and lifecycle correction
+
+Add a bounded client-specific cache-frame helper/ledger, wired only into the
+existing Gemini public proof path. It owns no filesystem writes. Expected
+assessment bytes and keys come from the independently held selected recipe,
+not incoming paths, hashes, cache JSON or a new observed baseline.
+
+Use the fixture-pinned current security requirement: lintai0.1.3, policy
+agent-plugin-install/version2/digest9cf869e299d847d7078aeca01f5a182fcdb0144bbf513c83290459991c79e037.
+For the known harmless source shape require schema1, selected recipe tree and
+manifest digests, no_blocking_findings, zero counts, scanned_files3, the exact
+known report digest above, no findings and no stored evidence_source. Rebuild
+the exact domain JSON serialization and require whole-file size/hash/bytes
+closure; unknown fields, trailing data, wrong types, policy/source/scanner/
+report/count/evidence changes all refuse. This observes the cache output; it
+does not authorize installation from a fixture-supplied security verdict.
+The actual public scanner/evaluator/CLI policy path remains mandatory.
+
+Only finite source-acquisition operations may introduce the one current
+source-bound cache entry: add-user/add-a/add-b, repeat-add-a, unchanged-update-a,
+intact-repair-a, update-a and missing-repair-a. Select scope/recipe from the
+existing fixed label table. Cache hit preserves the exact earlier entry
+including inode/owner/mode/content; no same-byte replacement or rewrite is
+accepted. The ledger retains prior U/A/B/A-two entries, maximum4. A-two authority
+comes only from the existing separately verified intentional source revision.
+A source operation may add only its exact current key, never another scope's
+or arbitrary digest key. Removal and negative repeated removal allow no new
+entry or cache mutation. Native/listing stages keep the complete frozen maps.
+
+The exact security and security/assessments directories, when present, must
+be ordinary0700 and retain existing device/inode/UID/GID/mode identity. Validate
+these and all expected/unknown assessment children BEFORE any unchanged fast
+path. Unknown children, directories, aliases, special/multiple-link files,
+assessment temporary residue, deletion, replacement and body/mode drift refuse,
+even if an unexpected entry is unchanged in both maps. The scanner binary tree
+and every other global state/payload/data/caller entry remain frozen exactly.
+Legacy inert Stager-only paths whose cache is absent need no invented scanner
+or cache. Actual public source-operation wiring requires the expected entry;
+there is no runtime opt-out, environment switch or success fallback.
+
+For project operations, snapshot the complete global user-state root alongside
+the selected state/profile/cwd. Validate the exact cache delta and require all
+other global state/scanner/payload/data/caller records unchanged. The global
+root directory may retain identity/owner/mode while its bookkeeping metadata
+changes during a permitted source operation: the real SourceAcquirer creates
+and removes snapshots directly there. This exact directory identity check is
+not an unknown-child allowance; every residual child still belongs to the
+full inventory and must be proved or refused. Outside those finite operations,
+the existing full-record freeze remains. User operations retain the existing
+selected payload/data/state closure in that same global root.
+
+After cache-frame validation, project out ONLY the individually validated
+cache records/parents when applying the existing selected state closure; no
+security-prefix bypass or broad open/global root exception is allowed. For a
+project operation the remaining global map must match its prior frame (apart
+from the explicitly checked root-directory bookkeeping). Preserve all existing
+selected source, binding, payload, config, ownership, data, state and cwd checks.
+Recapture every complete involved tree and require stability, then atomically
+advance the frozen maps and cache ledger from those same verified captures.
+No cache or global baseline is adopted before all proof checks complete.
+
+No raw artifact schema/mode, Python success admission, provider, argv, source/
+executable/scanner pin, trust/permission, host/process, work/total deadline,
+production code or VS Code changes are included. Existing raw public security
+receipts remain captured; live cache-file equality is source-attested by the
+reviewed Go proof, just like the existing full on-disk preservation frames.
+
+## Meaningful inert verification
+
+Exercise the actual production FileCache.Store with an independently authored
+finite domain assessment and verify exact key/JSON/mode/temp cleanup using real
+held ordinary captures. This is a file-format/authority contract, not a fake
+scanner execution or an authorization to skip native security. Pin independent
+known key/byte/hash values as the primary contract, with actual Store parity
+as supplementary evidence. Do not launch any installer/vendor/scanner locally.
+
+Test new and retained valid entries, all4 ledger identities, current-source
+selection, cache-hit identity preservation and project-global cache addition
+while user receipt/data/scanner/caller bytes remain fixed. Refuse changed or
+unchanged unknown entries, wrong source/manifest/scanner/policy/report/count/
+evidence/type/unknown/trailing fields, mode, hardlink/symlink/specials, temp
+residue, deleted/replaced entries/parents, caller/scanner drift, wrong scope/
+label and original-context exhaustion. Demonstrate that a rejected frame never
+updates the accepted ledger or frozen maps. Use actual ordinary files/tree
+captures, not fabricated stat maps or positive hosted guards. Existing user/A/B
+actual Stager/Store/native-file contracts remain required and cache-absent
+inert paths remain valid without inventing a scanner result.
+
+Before source edits obtain root R1 and an independent R2 on this exact plan.
+Then implement in an isolated current-head branch and obtain exact-code review.
+Coordinate the exclusive Go/lint slot for meaningful Gemini/shared contracts,
+current Python admission/raw replay, actual all-enabled affected root lint and
+unchanged whole-root architecture/size lint; check full branch whitespace.
+Root alone publishes after fresh-head reconciliation. A new genuine cycle is
+required to establish later stages. Both historical failed captures remain
+failed/allfalse; another observed discrepancy is reviewed separately.
+
+## Implementation and local validation, 2026-10-27
+
+The correction is isolated on exact c0b25d9, which already includes program base
+a412ba5e. Only the Gemini lifecycle fixture and its inert contracts change.
+The public apply seam derives an expected descriptor only for the eight finite
+source operations. The shared proof captures the global user state root, validates
+the finite cache ledger, applies the existing selected state proof to its exact
+projection, recaptures all complete trees, then advances accepted frames.
+Cache-absent direct Stager contracts retain their original path.
+
+The independent fixed key/578-byte JSON/SHA golden and actual production
+FileCache.Store/Load parity pass. Real-file contracts cover all four source
+identities, cache-hit identity preservation, project proof retaining actual
+user state, finite labels and recipes, descriptor bounds and cloning, unknown
+entries including unchanged entries, wrong modes, replacement/deletion, alias/
+hardlink/FIFO, temp residue, malformed whole JSON, source/security drift,
+unrelated caller/scanner drift and original-context cancellation. Rejection
+preserves the incoming ledger and captured maps. These are file-format and
+proof contracts; no vendor, scanner or public installer executes locally.
+
+Observed gates on the source submitted for independent code review:
+
+- Focused `go test ./repotests -run '^Test(Gemini|ProjectNativeRuntime)' -count=1`: PASS, 1.724s after the ordering correction.
+- Existing Gemini and runtime Python admission contracts: 62 PASS, 8.387s.
+- The retained current c0b native ZIP replays through the unchanged reader as
+  its genuine 24-member failed/all-false capture; no historical qualification changes.
+- Actual all-enabled full-root affected lint against a412ba5e: zero issues.
+- Unfiltered whole-root revive/funlen/gocyclo/gocognit/dupl/depguard gate: zero issues.
+
+The first lint invocation lacked the pinned Go directory in PATH and did not
+analyze source. After PATH correction, the first analyzed run identified three
+tagged-switch style findings in new inert refusal controls; they were corrected
+and both final gates pass without exclusions. Self-review also identified that the pre-existing native settings-lock validation
+followed the old frozen-map advancement point. Root required that unchanged
+mode/size/hash validation to run before final full recapture and any frozen-map
+or cache-ledger advancement. The corrected proof validates it there and later
+assigns protected/file frames from that already held record. Source publication
+remains root owned and requires final exact-code review. A fresh genuine native capture remains
+necessary; the unexported refused path and later lifecycle remain unproved.