cloud control plane: re-verify manifest.integrity digests at .osplugin unpack — the enforce leg of the #11331 ruling

[os-warren]

Seam card (true coordination card): the fix lands in the cloud control plane, but that repo is not writable to this seat (add_repo denied — carried on #11331 from #10627), so per the seam-card fallback this card lands in objectstack with repo:cloud.

Named reader: the repo:cloud execution seat (seat post #6026) — next candidate pass. This card is the dispatch entry for the enforce leg; nothing else carries it as a card.

Provenance

• Ruling on manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 (maintainer batch, 2026-08-30): enforce manifest.integrity — make the shipped documentation true (ADR-0025 §3.2/§3.5 step 5: per-file digests re-verified at unpack).
• Locating read [S · locating read] Where does plugin unpack happen — the landing surface for the ruled #11331 integrity verifier #13455 (closed, evidence on-card): objectstack has no unpack. ADR-0025 §3.5 steps 4–7 are unimplemented there; the only .osplugin read is in-memory at publish and discards the tree. The unpack the spec's promise refers to is a control-plane path.
• Framework leg already landed: Verify manifest.integrity at publish preflight — the framework leg of #11331 (does not discharge the unpack ruling) #13464 via PR Verify manifest.integrity at the os plugin publish preflight (framework leg of #11331) #13502 (publish-preflight verifyIntegrity self-check + truthful TSDoc + liveness-ledger note). Its own framing: it does not discharge the unpack-time promise — after it, digests are checked by the publisher pre-upload only.

The ask (lands in cloud)

Implement digest re-verification when the control plane unpacks a published .osplugin (ADR-0025 §3.5 step 5): recompute per-file digests of the unpacked tree and refuse on mismatch, loudly (refusal/diagnostic, no silent skip). Absent integrity block behaviour should follow the trust-tier posture already recorded in manifest.zod.ts's TSDoc rather than a new policy invented in cloud.

Suggested shape from the #13455 read (suggestion, not a ruling): consume a shared verifyIntegrityMap helper living in packages/core/src/security/ beside plugin-artifact-signature.ts (already byte-mirrored by cloud's package-signing.ts) so cloud consumes rather than re-derives. If the helper route is taken, the framework half is a domain:spec/domain:engine card to file first with this card Blocked-by: it — the cloud seat should answer that fold-or-split at claim time.

Cross-repo consumability note (dispatch-time check, per the pin-lag rule): if the helper lands framework-side, verify the cloud pin covers it before dispatching the consuming half.

Acceptance sketch

• A tampered artifact (one byte changed in one packaged file after digest emission) is refused at unpack with a named error; the untampered control passes.
• The ledger row packages/spec/liveness/manifest.json for integrity stays dead in objectstack (the verifier is not in that repo); only its note may be corrected — per the clause-② reading recorded on manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331.

Upstream tracking parent: #11331 (stays open until this closes; its Blocked-by: points here).