feat(runtime-host): attest the bundled npm runtime

[zhiiw]

Stacked Draft: depends on #2620. #2485 has merged into main; until #2620 merges, the upstream comparison remains cumulative.

Summary

Attests the packaged npm runtime before it can issue the process-local capability consumed by managed provisioning. The attestation binds platform, architecture, Node/npm versions, declared runtime files, and the fixed execution policy; every managed invocation revalidates the declared runtime tree.

Trust boundary

The manifest proves runtime integrity inside an already authorized release resource root; it is not a standalone provenance trust root. Provenance comes from the outer signed application and release/update chain. If an attacker can replace both the packaged npm tree and its manifest, this layer alone cannot distinguish that tree from a Maka release.

Primary invariant

No path, version string, or caller-constructed object can self-authorize npm provisioning. Only a process-local capability issued after bundled-runtime attestation can cross the producer boundary.

• Owner: Runtime Host bundled npm attestation authority
• Failure state: invalid or changed runtime evidence fails closed before operational-root acquisition
• Rollback: remove bundled npm preparation/attestation; the constrained producer remains unreachable from production composition

Verification

• Runtime Host typecheck and build passed.
• Bundled npm attestation/preparation: 8 passed.
• Release verifier uses actual bundled npm with a hermetic loopback registry and a tarball fixture containing a real bin declaration.

Stack

1. durable dependency artifact authority (feat(storage): add managed dependency artifact authority #2485, merged)
2. constrained npm producer (feat(runtime-host): constrain managed npm dependency provisioning #2620)
3. This PR: bundled npm runtime attestation
4. cancellable managed admission authority
5. production managed inspection task + crash/replay proof

中文说明

**堆叠 Draft：**依赖 #2620；#2485 已合并到 main。在 #2620 合并前，上游比较仍会暂时显示累计 diff。

本切片在 managed provisioning 前验证随包发布的 npm runtime，并签发进程内不可伪造的 capability。验证绑定平台、架构、Node/npm 版本、完整文件清单与固定执行策略；每次调用都会重新验证 runtime tree。

这里明确区分两层信任：外层应用签名与发布/更新链提供来源信任，manifest 只证明已授权资源目录内的运行时完整性。manifest 本身不是独立的密码学信任根。

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: caf7367a-e6f3-4d12-9b9a-9344203433ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Astro-Han]

This branch is CONFLICTING against current main, so it cannot be reviewed as it stands. I attempted the rebase for you under maintainer authorization and deliberately stopped, because the first conflict is one only you can resolve correctly.

packages/runtime-host/src/server/index.ts, first commit (feat(runtime-host): constrain managed npm provisioning): the main side of the conflict is empty. main has since removed the whole export block — listener-set, websocket-listener, access-authority, connection-authority — and that file has gone from 65 lines down to 28. This branch's commit re-adds all of them alongside its own new managed-dependency-producer-process export.

That is not "both sides added something", it is "one side deleted it and the other is still using it." Taking this branch's version would silently revert an intentional refactor on main. Resolving it correctly requires knowing whether your change genuinely depends on those exports or whether it should follow main and drop them — and that is your call, not a merge-tool call.

I ran git rebase --abort. Nothing was pushed to your branch.

The same applies to the stack above it: #2622 (20 commits) and #2623 (30 commits) build on this one, and the first commit here already hits this. Rebasing #2621 first should shrink the other two considerably.

Happy to take another pass at whatever is purely mechanical once the export question is settled — just say so on this thread.

[zhiiw]

Rebased this Draft on the rebuilt producer-boundary branch and current main.

The release conflict was resolved in favor of the post-bundled-Git contract: this branch adds only the attested bundled npm runtime and does not restore Dugite, Git payloads, Git notices, or Git source-offer assets. Legacy installer verification keeps its explicit historical resource contract. The focused npm/runtime and packaged-resource suites pass (29 passed, 2 platform skips).

中文说明

该 Draft 已基于重建后的 producer boundary 与最新主线更新。发布冲突按移除 bundled Git 后的合同处理：只保留经过 attestation 的 bundled npm runtime，不恢复 Dugite、Git payload、Git notices 或 Git source-offer；旧安装包验证继续使用明确的历史资源合同。相关定向测试为 29 通过、2 个平台条件跳过。

[zhiiw]

Closing this Draft as superseded.

The npm runtime attestation work has been rebuilt from the newer baseline and continues in the replacement stack. The design discussion and review history here remain useful, but this branch will not be merged or developed further.

Replacement:

• feat(runtime-host): attest managed npm runtime zhiiw/maka-agent#21

中文说明

关闭此 Draft，标记为已被新实现替代。

npm runtime attestation 已从更新的基线重新构建，并在替代 PR 中继续推进。本 PR 的设计讨论和审查记录仍会保留，但该分支不会继续开发或合并。

替代实现：

• feat(runtime-host): attest managed npm runtime zhiiw/maka-agent#21