[auser]

Summary

• Read the project manifest once during policy resolution and reuse that parsed value for routes, approval and secret declarations. Retain absence for named project sources, including a directory created later.
• Resolve a policy file from the bytes used to classify it. Reject conflicting second reads of a profile/group during one resolution, including excluded groups and a late user profile shadowing a built-in.
• Record the proposed host-trusted freshness and atomic-apply boundary in ADR-111 without claiming the proposal is implemented.

Validation

• Focused route (6/6), secret (7/7), policy (22/22), and resolver (36/36) tests passed on 611e09a6e5.
• cargo fmt --all -- --check, cargo clippy --workspace -- -D warnings, cargo check --workspace, just check::gated, and the applicable documentation/claim checks passed.
• Full workspace suite is not green on this rebased commit. Two TMPDIR=/tmp cargo test --workspace attempts failed in different unchanged parallel tests: HVF restore fake-supervisor timeout and concurrent guest-runtime SDK-sidecar assembly. Each passed in isolation. A full suite passed on the pre-rebase base, which is not evidence for this commit. These failures are not hidden or waived.
• No live Firecracker, HVF or other-backend policy-cutover witness was run.

Scope and remaining work

Reviewable precursor for #5391, not an implementation of its committed-generation acceptance criteria. The source hashes here only detect inconsistency within one resolution; they are not a durable complete source closure. No policy apply, resident cutover owner, effect fencing, crash recovery, or atomic rollover is shipped. Keep #5391 and downstream #5392–#5394 open; do not merge this draft as completion of those issues.

[auser]

Launch-source consistency is a precursor, not a committed-generation policy guarantee. #5391 remains open for production caller, apply/launch serialization and refusal witnesses (handoff: #5391 (comment)). Closing draft without merging or branch deletion.