Verify `manifest.integrity` at publish preflight — the framework leg of #11331 (does not discharge the unpack ruling)

[claude]

Part-of #11331 · step 2 (framework leg), sized from the #13455 locating read (accepted; full evidence: #13455 (comment)).

⚠️ Scope framing — this card does NOT discharge the #11331 ruling

The ruled enforce leg (re-verification at unpack) has no landing surface in this repo — there is no unpack (ADR-0025 §3.5 steps 4–7 unimplemented). That leg routes to the cloud control plane and is tracked on #11331. This card lands the smaller real framework leg: today os plugin publish uploads artifacts whose bytes may no longer match their own declared manifest.integrity digests, because nothing anywhere reads that map. After this card, the publisher checks its own artifact pre-upload. The spec's promise of re-verification at unpack remains outstanding and must not be marked resolved by this PR.

Task

1. verifyIntegrity(files, integrity) (~40 lines + a structured rejection envelope) in packages/core/src/security/ beside plugin-artifact-signature.ts (which already declares itself byte-for-byte mirrored by cloud's package-signing.ts — keep that mirroring property in mind: pure, dependency-free, portable). Semantics: for each entry in the integrity map, hash the corresponding in-memory file and compare; refuse on mismatch, missing file for a declared entry, and (report, see decision below) extra files not in the map.
2. One call site: os plugin publish preflight at packages/cli/src/commands/plugin/publish.ts:84 — the full tree is already in memory (packages/cli/src/utils/osplugin.ts:156) and currently discarded. Verify before upload; refuse the publish on failure with an actionable message.
3. TSDoc prose corrections (prose only, no shape change): packages/spec/src/kernel/manifest.zod.ts:100-109 and :610-614 — stop claiming the runtime re-verifies at unpack; state what is true (computed at build, self-checked at publish; unpack-time verification is the cloud control plane's obligation, not yet implemented here).
4. Ledger note prose: packages/spec/liveness/manifest.json integrity row (~:265-269) — status stays dead (its verdict is a per-repo reader census; the publish self-check makes the CLI a reader, so if check:liveness semantics say a non-test reader flips it, follow the tool's verdict — never hand-edit a status the tool disagrees with). Correct the note prose either way.
5. Tests: match / single-file mismatch / missing declared entry / extra file / absent map ⇒ permissive pass (the field is .optional()).
6. Changeset (.changeset/*.md): os plugin publish gains a refusal — patch bump, plain sentence.

Decision mandate (pre-answered, carry in PR description)

Absent integrity map = permissive (publish proceeds, optionally with a one-line notice). Strict-by-default would reject every pre-computeIntegrity artifact and would be a contract change to an .optional() field — that needs its own ruling, not a rider here. Extra-files-not-in-map: refuse (a stale map is exactly the drift this check exists to catch) — if that proves controversial in review, downgrade to warn there, not here.

Error code

Per the precedent at packages/runtime/src/artifact-reference.ts:68-73, a pre-server-bind CLI refusal is NOT registered in ERROR_CODE_LEDGER — keep this card clear of packages/spec/src/api/error-code-ledger.zod.ts.

Gates owed

pnpm --filter @objectstack/cli test · pnpm --filter @objectstack/core test · pnpm --filter @objectstack/spec check:liveness · pnpm --filter @objectstack/spec check:authorable-surface (baseline measured unmoved by the prose edits — keys only, no describe text) · changeset present.

Clause ② (pre-recorded)

• Path limb fires: the diff touches packages/spec/src/kernel/manifest.zod.ts ⇒ the PR parks as DRAFT with needs:contract-review on both carriers (PR + card). Review chain owns enqueue.
• Content limb fires: publish gains an accept/reject change ⇒ fable-mandatory dispatch.

Blocked-by: (none)

---

Generated by Claude Code

[claude]

CLAIM — session_01KX8wnyjStaZcuMyAMNsy3N · branch claude/issue-13464-publish-integrity-preflight

Tier: fable (clause-② content limb). dispatch-gates.mjs --tier derived at origin/main c38b7eff: no path-derived mandate (floor sonnet · default opus · ceiling fable); SUSPECT line on packages/spec/src/kernel/manifest.zod.ts ⇢ packages/spec/src/**. Judged from card content: os plugin publish gains an accept/reject refusal ⇒ fable-mandatory. Path limb also fires ⇒ the PR parks DRAFT with needs:contract-review on both carriers; review chain owns enqueue.

Serial constraints — measured, one same-file adjacency. In-flight #11330 also edits packages/spec/src/kernel/manifest.zod.ts. Regions at c38b7eff: #11330 → the trust-tier tombstone :569 (+ possibly the :85/:603 describes); this card → the integrity TSDoc block :100-109 and the integrity: field :610-616. Disjoint including ±3 context lines (:603+3 < :615-3). Constraint on this card's dev: branch from current origin/main; if #11330's PR merges while this is in flight, merge the base and re-verify before finalizing. No other in-flight card touches publish.ts, osplugin.ts, or packages/core/src/security/.

---

Generated by Claude Code

[os-project-manager]

DEV CLAIM — dispatched dev for PM claim comment 5469046080 (session_01KX8wnyjStaZcuMyAMNsy3N dispatch loop) · branch claude/issue-13464-publish-integrity-preflight (from origin/main c38b7eff).

Starting now: verifyIntegrity in packages/core/src/security/, one call site in os plugin publish preflight, TSDoc prose corrections in manifest.zod.ts (regions :100-109 and :610-616 only — measured disjoint from in-flight #11330), liveness note prose, tests, changeset. PR will park as DRAFT with needs:contract-review per clause ②.

---

Generated by Claude Code