feat(crypto): add host-attested device pairing lifecycle (contract 1.25)

.github/scripts/run-native-master-cipher-coverage.sh

@@ -29,7 +29,8 @@ fi
 printf 'Native fixtures: repository working directory\n'
 "$verifier" "$module"
 "$device_verifier" "$module"
+"$verifier" "$module" 18
 external_cwd="$(mktemp -d)"
 trap 'rmdir "$external_cwd"' EXIT
 printf 'Native fixtures: external working directory\n'
-(cd -- "$external_cwd" && "$verifier" "$module" && "$device_verifier" "$module")
+(cd -- "$external_cwd" && "$verifier" "$module" && "$device_verifier" "$module" && "$verifier" "$module" 18)

.github/workflows/release.yml

@@ -355,6 +355,7 @@ jobs:
           package_name="${CRATE_NAME}-${VERSION}-${BUNDLE_ID}"
           package_root="dist/${package_name}"
           mkdir -p "$package_root"
+          chmod 755 "$package_root"
           install -m 755 "$module" "$package_root/"
           install -m 644 LICENSE MODULE.md "$package_root/"
 
@@ -364,6 +365,11 @@ jobs:
             > "$package_root/modules.toml"
 
           tar -C "$package_root" -czf "dist/${package_name}.tar.gz" .
+          archive_root_mode="$(tar -tvzf "dist/${package_name}.tar.gz" | awk 'NR == 1 { print substr($0, 1, 10) }')"
+          if [[ "$archive_root_mode" != "drwxr-xr-x" ]]; then
+            echo "unsafe module archive root mode: ${archive_root_mode}" >&2
+            exit 1
+          fi
           echo "archive=dist/${package_name}.tar.gz" >> "$GITHUB_OUTPUT"
 
       - name: Assemble Windows module package
@@ -513,6 +519,7 @@ jobs:
           package_name="${CRATE_NAME}-${VERSION}-${BUNDLE_ID}"
           package_root="dist/${package_name}"
           mkdir -p "$package_root"
+          chmod 755 "$package_root"
           install -m 755 "$module" "$package_root/"
           install -m 644 LICENSE MODULE.md "$package_root/"
 
@@ -522,6 +529,11 @@ jobs:
             > "$package_root/modules.toml"
 
           tar -C "$package_root" -czf "dist/${package_name}.tar.gz" .
+          archive_root_mode="$(tar -tvzf "dist/${package_name}.tar.gz" | awk 'NR == 1 { print substr($0, 1, 10) }')"
+          if [[ "$archive_root_mode" != "drwxr-xr-x" ]]; then
+            echo "unsafe module archive root mode: ${archive_root_mode}" >&2
+            exit 1
+          fi
           echo "archive=dist/${package_name}.tar.gz" >> "$GITHUB_OUTPUT"
 
       - name: Upload distribution package

.gitignore

@@ -23,3 +23,8 @@ worktrees/*
 .idea/
 .vscode/
 *.swp
+
+# Python tooling bytecode
+__pycache__/
+*.pyc
+*.pyo

MODULE.md

@@ -121,6 +121,9 @@ the [security architecture page](https://github.com/tinyhumansai/openhuman/blob/
 ## Confidential device handles
 Full details: [`Confidential device handles`](docs/module-crypto.md#confidential-device-handles).
 
+## Confidential paired-device lifecycle (contract 1.25)
+Full details: [paired-device lifecycle specification](docs/specs/device-pairing-contract-1.25.md).
+
 ## Confidential injected master resolution
 Full details: [`Confidential injected master resolution`](docs/module-crypto.md#confidential-injected-master-resolution).
 

README.md

@@ -7,6 +7,10 @@ compile the transport-free `tinysecurity-bus` contract and load the isolated
 Contract 1.23 adds confidential per-frame `DeviceFrame2` calls over the live
 opaque tunnel capability issued by approved `ExecuteDevice2` work; see the
 [device contract](MODULE.md#confidential-device-handles).
+Contract 1.25 adds `DevicePairing2`, which owns the paired-device static
+identity, ciphertext-only persistence, host-attested enrollment/reconnect,
+session refresh and revocation while preserving the existing v2/v3/v4 wire;
+see the [pairing lifecycle specification](docs/specs/device-pairing-contract-1.25.md).
 Contract 1.1 also supplies immutable native [filesystem scopes](docs/specs/immutable-path-scopes.md)
 through `RegisterPathPolicy`, `ValidatePath`, `ValidateParent` and `CheckPath`.
 Contract 1.3 adds native `Redact`, `ScanPrompt` and `ScanToolDefinition`, with a
@@ -36,7 +40,7 @@ diagnostics work with disabled autonomy, which is the default.
 
 This is bootstrap infrastructure for [OpenHuman #7328](https://github.com/tinyhumansai/openhuman/issues/7328)
 and [TinySecurity #1](https://github.com/tinyhumansai/tinysecurity/issues/1).
-It does **not** complete the migration. Concrete sandbox spawning, connection pinning, Linux Secret Service and pairing challenge delivery (`Begin`/`Verify`) remain unavailable; contract 1.14 password, keyring and pairing-status members are implemented. The optional [native device handle surface](MODULE.md#confidential-device-handles) uses authenticated confidential calls and exact human/audit receipts. Reserved wire types do not advertise callable handlers.
+It does **not** complete the migration. Concrete sandbox spawning, connection pinning, Linux Secret Service and production host configuration/adapter migration remain unavailable. Contract 1.25 supplies the module-owned pairing and tunnel lifecycle; the host must provide the server-trusted controller/socket/reconnect callbacks and encrypted persistence plumbing described in its specification. The optional [native device handle surface](MODULE.md#confidential-device-handles) uses authenticated confidential calls; initial master unlock remains HumanOnly. Reserved wire types do not advertise callable handlers.
 There is no production host migration until an upstream release and checksum
 manifest exist.
 

crates/tinysecurity-bus/src/callbacks.rs

@@ -137,6 +137,14 @@ impl ApprovalCasRequest2 {
 }
 /// Fixed new callback identities; incompatible semantics never reuse legacy interfaces.
 pub mod callback_names2 {
+    /// Fixed trusted-host pairing context and encrypted-state callback.
+    pub const DEVICE_PAIRING_HOST: &str = "ai.tinyhumans.tinysecurity.DevicePairingHost2";
+    /// Resolve one server-owned pairing/socket event against authenticated host state.
+    pub const RESOLVE_PAIRING_EVENT: &str = "ResolvePairingEvent";
+    /// Load or compare-and-swap ciphertext for the fixed module-owned identity record.
+    pub const PERSIST_DEVICE_PAIRING: &str = "PersistDevicePairing";
+    /// Consume a one-shot import handle and load bounded legacy device ciphertext.
+    pub const LOAD_LEGACY_DEVICE_IDENTITIES: &str = "LoadLegacyDeviceIdentities";
     /// Fixed init-bound response-controlled confidential native output slots.
     pub const SECRET_CIPHER_CONSUMER: &str = "ai.tinyhumans.tinysecurity.SecretCipherConsumer2";
     /// Stage exact bound output privately until successful owner response.

crates/tinysecurity-bus/src/device_frame_tests.rs

@@ -70,5 +70,5 @@ fn frame_operations_redact_both_payloads_without_changing_open_wire_shape()
 #[test]
 fn frame_member_name_is_stable_and_contract_version_is_bumped() {
     assert_eq!(crate::names::methods::DEVICE_FRAME2, "DeviceFrame2");
-    assert_eq!(crate::CONTRACT_VERSION, (1, 24));
+    assert_eq!(crate::CONTRACT_VERSION, (1, 25));
 }