feat(evidence): LO-EV-9 bind device evidence to the accepted job and kernel before settlement

[LamaSu]

Update 2026-09-24 @65485764: review rounds and the oracle's findings

Commits since the first cut (4132c1ed):

• R1, 2a8f574e: /resume-settlement settles only the pinned, re-verified anchor.

  • A device anchor needs the binding plus the registered-key signature.
  • A gateway anchor must match the envelope hash.
  • /complete pins the device row itself.

• Merges of feat(spec): LO-EV-1 canonical signing byte contract + cross-language goldens #338: da1268f0 brought in R20; 146df5da brought in R20 round 2.

• Evaluate only what you hashed, 98352619 (coord-watch's cross-cutting rule):

  • the binding reads jobId, kernelId and outputHash only as own properties of the canonical snapshot of what was hashed, and returns those snapshots;
  • the gateway anchors on the snapshots, never the caller's objects;
  • a non-enumerable, inherited or polluted jobId, and a getter answering A to the hash and B to the evaluator, cannot bind;
  • an event canonicalize refuses is malformed-event, and the binding never throws.

• Milestone binding, d3309de8 (oracle audit #3006: milestone 3's evidence settled milestone 4):

  • the optional subject fields settlementUnitId and challengeNonce (0x hex32) must be committed by the events;
  • kernel-sdk commits them from the job request.

• Per-event binding, 0a4836a6 (oracle #3101, which /settle already enforces):

  • every event must commit payload.jobId, and the unit fields when named;
  • kernel-sdk now names the job on every event.

• Incumbents conform, 65485764:

  • EvidenceEmitter stamps the PCC jobId (and the unit and nonce when registered) on every event, and refuses a conflicting value.
  • The kernel IPP adapter's printer-local number is now ippJobId, since payload.jobId is reserved for the PCC job.
  • The digital kernels name the job on every event.
  • A real mock IPP print bundle and a procurement bundle now bind. Kernel 868/868; 6 mutants killed.

Tests:

• subject-binding 36/36
• kernel-sdk 38/38
• spec 860/860
• gateway 3013 passed / 6 skipped; gateway and kernel-sdk tsc clean
• mutants killed across the rounds: 6 (R1), 4 (snapshots), 6 (unit), 4 (per-event)

Review: coord-watch's Gate B slot takes this head (the range is 897c7bae..65485764).

---

What this closes (technical pack §3, must-close 9)

A signature over a bundle digest proves who signed which digest. It does not say which job, node or output the digest is evidence for. The bundle-level jobId / kernelId are not inputs to hashBundle, and /complete never reopened the digest. So once the SEAM-2 gate opens, three replays settle money:

Replay	Why the signature check alone accepts it
Job A's genuine device bundle, relayed again under job B (same kernel, direct-signed)	Same key, same digest. The route's jobId is an unsigned label.
Job A's bundle under job B, delegated session whose scope lists both jobs	contractIds.includes(B) passes.
A log-chain entryHash + its per-entry signature, presented as a bundle	The node key signs entry hashes too, and they are tagged digests (LO-EV-1 only stops non-digest messages such as the registration challenge).

Each negative test first shows the signature leg accepting the replay, then shows settlement refusing it.

The contract: pcc.evidence.subject-binding.v1

verifyEvidenceSubjectBinding({ bundleHash, events, subject }) in @pcc/spec fails closed unless:

1. the subject names a job and a kernel;
2. bundleHash is a canonical tagged digest (LO-EV-1);
3. every event is well-formed and reproduces its own hash (hashEvent);
4. the events reproduce bundleHash (hashBundle);
5. at least one event commits payload.jobId, and every payload.jobId equals the subject job;
6. every source.kernelId, and every payload.kernelId, equals the kernel that accepted the job;
7. when the subject names an output, payload.outputHash is committed and matches.

These are fields kernel-sdk already hashes, so its bundles conform unchanged. The positive control uses the real createKernelHandler.

Gateway wiring (gate still closed by default)

• resolveSettlementEvidence:
  • Requires a subject and the stored events for any device slot.
  • Checks the binding before the signature.
  • Takes the delegation scope from subject.jobId.
  • Accepts deviceBundles (every candidate). The first one that passes both checks anchors settlement. If none passes, the result falls back and reports the first failure.
• /complete:
  • Loads each device-signed row's events with findEventsByBundle.
  • Sets subject = { jobId, kernelId: job.kernelId }. This is the job record's kernel, not an id supplied by the relay.
  • Tries every such row, so a replayed row stored first cannot hide the genuine bundle.
• The closed-gate path is byte-for-byte unchanged.

Dependency

Relayed device rows carry events only once the operator relay stores them (#335, LO-GW-4b). Until then, a relayed row has no events and falls back to the gateway anchor. That fails closed. This PR does not touch the relay route (#335 owns it).

Producer requirements this sets

• kernel-sdk: conforms.
• pcc-node: has no signed-bundle producer on master yet. When one lands (feat(spec): MeasurementProfileV1 — capture parameters committed before execution (LO-SE-2) #336 lineage), each event needs source.kernelId, and at least one event needs payload.jobId. LogCapture events carry no source today.
• Kernel EvidenceEmitter bundles: these bind only if an adapter event commits payload.jobId.

Tests

• spec: 843/843 (22 new).
• gateway full suite: 2996 passed / 6 skipped / 0 failed across 188 files. That includes 8 new resolver cases and 3 new /complete route cases with the gate forced open. The route cases cover:
  • job A→B replay refused, while job A still anchors on its own bundle (positive control);
  • a kernel-nyc bundle refused for a job kernel-sf accepted;
  • a replayed row stored first does not hide the genuine one.
• gateway tsc --noEmit: clean.

Mutation checks: each leg was removed in turn, and every mutant turned at least one test red.

Mutant	spec	gateway
no job check	3 red	6 red
no per-event recompute	1 red	1 red
no source.kernelId check	1 red	0 red
no kernel checks at all	3 red	1 red
resolver skips binding	0 red	10 red
/complete tries first row only	0 red	1 red
no bundle recompute	3 red	0 red

Not in this PR

• Output binding at /complete: the gateway holds no digest of the delivered output there. The spec supports subject.outputHash for consumers that do hold one.
• stepId: not bound. kernel-sdk's payload.stepId names manifest workflow steps, a different namespace from job.stepId.

Stacked on #338 (LO-EV-1).

Update, 2026-10-03: round 4 (answering astra's E11 DO-NOT-SHIP on 51dbabd), head f249eb4

Every finding was reproduced at 51dbabd before any change (3 of 3 failing tests), and so were sensors' five realm recipes (bus #5381).

• F1 (HIGH, unit/challenge replay at /complete and /resume-settlement): fixed.
  • The settlement unit and challenge must match exactly, in both directions.
  • A subject that names none refuses evidence that commits either (unit-not-in-subject, challenge-not-in-subject).
  • The legacy routes, which name only job + kernel and drive milestone 0, therefore cannot settle unit-scoped evidence.
  • Seam and route tests cover it. /resume-settlement answers 409 for a unit-scoped row pinned before the fix.
• F2 (HIGH, an event.hash getter or Proxy): fixed.
  • Every field is read once, through its own descriptor, and source/payload are read through plainDataCopy.
  • A Proxy or accessor is refused before it runs, and all checks and hashes read only the copies.
• F3 (MEDIUM, never throws): fixed. The body is wrapped, and every input resolves to a refusal.
• Realm (sensors #5381): fixed.
  • The leg uses only intrinsics captured at load: feat(spec): MeasurementProfileV1 — capture parameters committed before execution (LO-SE-2) #336's primordials.ts and plainDataCopy, ported byte-identical from 8dc6ef2 (9214733), plus a captured synchronous node:crypto SHA-256.
  • There is no await, no sort, no iterator protocol, no RegExp and no JSON.parse.
  • The results are null-prototype and frozen.
  • The five recipes are tests, and they fail against 51dbabd's files.
• New reason codes: unit-not-in-subject, challenge-not-in-subject and unsupported-runtime. SUBJECT_UNIT_FIELD_PATTERN is no longer exported (it had no users).
• Verification:
  • spec 1206, kernel 869, kernel-sdk 39;
  • gateway 3733 of 3748: 2 load flakes (completion-real-tier, settlement-crank-wiring) that pass alone 3 of 3 and run with the gate closed;
  • tsc clean;
  • mutants: 6 of 7 killed, 1 equivalent.
• Pack: E11b-binding-341-r4-f249eb48.md (PASTE ORDER 510), a full delta round.

🤖 Generated with Claude Code

https://claude.ai/code/session_0117ows6894R3n6YQXBCRahS

[LamaSu]

Merge order (steward, bus #4856): this PR (#341) merges first, then #336 (MeasurementProfileV1, sensors), which carries this branch's commits and is now retargeted to master.

🤖 Generated with Claude Code