feat(authoring): add closed public journey intake contract

npm/agentplugins/scripts/packed-installer-bridge.js

@@ -308,7 +308,24 @@ function publicEvidence(cfg, native, configPath, intake = "public-fixture/v1") {
       pair_marker_sha256: native.pair_marker_sha256, tools: native.tools, binaries: native.binaries,
       ...(v2 ? { installer_boundary: native.installer_boundary } : {}) } };
 }
+function authenticatedIntake(request) {
+  const reader = require("./public-authoring-acceptance");
+  reader.request(request);
+  // The production reader remains closed until genuine result validation exists.
+  // No caller callback, fixture conversion or completed/authenticated flag.
+  const inputs = reader.readJourney(request);
+  assert.equal(inputs.record.cell, "linux-amd64/pair-node22", "designated bridge cell");
+  assert.equal(inputs.identity.commit, request.expectedCommit);
+  assert.equal(inputs.projects.length, 10);
+  return { identity: inputs.identity, repo: inputs.repo, candidate_sha256: inputs.candidate_sha256,
+    packs: inputs.packs, projects: inputs.projects, snapshots: inputs.snapshots,
+    public_inputs: { schema: "authoring-public-local-inputs/v1", journey_sha256: request.journeySha256,
+      admission_sha256: request.admissionSha256, stage: inputs.record.stage, native_inputs: inputs.record.native_inputs,
+      producer: inputs.record.producer, cell: inputs.record.cell, tools: inputs.record.tools, protected_paths: inputs.protected_paths,
+      signed_promotion: false, public_eligible: false, qualification: null } };
+}
 function intake(request) {
+  if (request.intake === "public-authenticated/v1") return authenticatedIntake(request);
   if (!Object.hasOwn(request, "intake")) return privateIntake(request);
   c.keys(request, [...REQUEST_KEYS, "intake"], "public bridge request");
   assert.ok(["public-fixture/v1", "public-fixture/v2"].includes(request.intake)); assert.equal(request.disposableEvidence, true);
@@ -321,12 +338,24 @@ function intake(request) {
 }
 function seal(request) {
   const inputs = intake(request);
+  if (request.intake === "public-authenticated/v1") return {
+    schema: "packed-installer-bridge/public-authenticated/v1", request,
+    verifier_sha256: hash(__filename), helper_sha256: hash(require.resolve("./dual-authoring-candidate")),
+    reader_sha256: hash(require.resolve("./public-authoring-acceptance")), inputs,
+    release_eligible: false, platform_acceptance: false, attested: false };
   return { schema: "packed-installer-bridge/v1", request, verifier_sha256: hash(__filename), helper_sha256: hash(require.resolve("./dual-authoring-candidate")), inputs,
     release_eligible: false, platform_acceptance: false, attested: false };
 }
 function verify(configFile, configDigest, expectedCommit) {
   pin(configFile, configDigest);
   const cfg = json(configFile);
+  if (cfg.schema === "packed-installer-bridge/public-authenticated/v1") {
+    c.keys(cfg, ["schema", "request", "verifier_sha256", "helper_sha256", "reader_sha256", "inputs", "release_eligible", "platform_acceptance", "attested"], "authentic seal");
+    falseClaims(cfg); assert.equal(cfg.request.intake, "public-authenticated/v1");
+    assert.equal(cfg.request.expectedCommit, expectedCommit);
+    assert.deepEqual(cfg, seal(cfg.request), "authenticated local seal changed");
+    return cfg.inputs;
+  }
   c.keys(cfg, ["schema", "request", "verifier_sha256", "helper_sha256", "inputs", "release_eligible", "platform_acceptance", "attested"], "bridge config");
   assert.equal(cfg.schema, "packed-installer-bridge/v1"); falseClaims(cfg);
   assert.equal(cfg.request.expectedCommit, expectedCommit);
@@ -335,6 +364,11 @@ function verify(configFile, configDigest, expectedCommit) {
 }
 function publishSeal(request, output) {
   const result = seal(request); absolute(output);
+  if (request.intake === "public-authenticated/v1") {
+    for (const protectedPath of result.inputs.public_inputs.protected_paths) {
+      require("./public-authoring-acceptance").disjoint([output, protectedPath]);
+    }
+  }
   for (const root of [result.inputs.repo, request.fixtureRoot, ...result.inputs.snapshots.map(s => s.root)]) {
     const a = output.toLowerCase(), b = root.toLowerCase();
     assert.ok(a !== b && !a.startsWith(b + "/") && !b.startsWith(a + "/"), "output overlaps evidence/source");
@@ -346,7 +380,17 @@ function publishSeal(request, output) {
 if (require.main === module) {
   try {
     const [command, file, digest, commit] = process.argv.slice(2);
-    if (command === "seal" && process.argv.length === 5) {
+    if (command === "authenticated-options" && process.argv.length === 4) {
+      const options = require("./public-authoring-acceptance").fileJSON(file);
+      c.keys(options, ["request", "go", "node", "modCache"], "authenticated runner options");
+      process.stdout.write(c.encode(authenticatedIntake(options.request)));
+    } else if (command === "authenticated-intake" && process.argv.length === 4) {
+      process.stdout.write(c.encode(authenticatedIntake(require("./public-authoring-acceptance").fileJSON(file))));
+    } else if (command === "authenticated-seal" && process.argv.length === 5) {
+      const request = require("./public-authoring-acceptance").fileJSON(file);
+      assert.equal(request.intake, "public-authenticated/v1");
+      process.stdout.write(publishSeal(request, digest) + "\n");
+    } else if (command === "seal" && process.argv.length === 5) {
       process.stdout.write(publishSeal(json(file), digest) + "\n");
     } else if (command === "verify" && process.argv.length === 6) {
       process.stdout.write(c.encode(verify(file, digest, commit)));

npm/agentplugins/scripts/packed-installer-bridge.md

@@ -285,3 +285,80 @@ bridge intake. Genuine C3 execution needs a separately reviewed authenticated
 intake and actual installed launchers/postinstall and installer lifecycle.
 N2, C3 E, P/Q, B, anonymous public readbacks, pair channels, PyPI/Homebrew,
 full-platform E2E, release and phases 0–11 remain open.
+
+## C3a local authenticated input contract (execution remains closed)
+
+C3a adds a distinct `public-authenticated/v1` request, with exactly
+`intake,expectedCommit,journey,journeySha256,admission,admissionSha256,fixtureRoot`.
+It does not translate private, public-fixture/v1 or public-fixture/v2 receipts.
+Their existing false/null/not_evaluated claims and the offline v2 71-call
+boundary remain unchanged. No workflow, promotion, native qualification export,
+public launcher, dependency or package closure changes are part of C3a.
+
+`public-authoring-acceptance.js` fixes `public-wrapper-matrix/v1`'s eighteen
+host/runtime cells and thirty product/runtime executions. Its J codec binds the
+exact canonical I and S, both unchanged packs including SHA256/size/SRI/SHA1,
+all twelve native outer/inner subject pins, source F, producer run/attempt/ref,
+actual host and distinct controller/npm/shim Node/tool pins. It rejects unknown
+fields, alternate canonical spelling, duplicate keys, invalid UTF-8, excessive
+nesting and oversized records. Local paths must be canonical and quiescent;
+this does not introduce a hostile concurrent filesystem security guarantee.
+
+The fixed local receipt schema is `authoring-public-local-inputs/v1`. Its fields
+are `schema,selected,workflow_sha,input_file,stage,repo,work_parent,stage_root,
+input_root,journey_root,fixture_root,cell,tools,producer`. It contains comparison
+pins, never an authenticated/completed boolean. `readJourneyInputs` genuinely
+calls the existing completed `readStage` and `readInputs`, retaining their
+three- and nineteen-subject contracts. The existing stage reader supplies source,
+pack closure and pack inspection; C3a adds no extractor or verifier engine.
+Fresh authenticated subjects are compared with the original retained S/I/packs.
+Re-admission scratch is separate from original custody, source, projects and
+journey evidence, so later seal checks refer to the same original roots.
+
+J is `authoring-public-journey/v1`, with the plan's exact top-level fields.
+Evidence is an ordered table of fixed `commands.json`, `projects.json`,
+`npm-lifecycle.json`, `cache-process.json`, `installer.json` path/size/SHA256 rows.
+The limit is 1 MiB per record and non-command evidence file, 16 MiB for commands,
+and 1 MiB for each command stdout/stderr. The five-file closure therefore fits
+within the plan's 128 MiB aggregate cap. Original project snapshots include
+empty directories, bytes, sizes and modes. No regeneration or project copy is
+implemented. A fixed core inventory contains 55 kit-only or 127 pair command
+rows, including the eighteen genuine installer operations required per pair.
+Core argv/cwd/status/signal and bounded author result checks are recomputed;
+structural true assertions never imply their truth.
+
+**Live J admission deliberately fails.** Full npm shim/postinstall and peer
+lifecycle, cache/process/cancellation, complete conformance/parity and genuine
+installer result/observation validators belong to C3b. In particular there is
+no reviewed public-shim installer validator or whole-descendant observer
+interface available at this boundary. `verifyJourney` emits an explicit C3b
+missing-capability error even for structurally consistent transcripts. The
+three corresponding evidence payloads are bound bytes, not semantically
+validated results. No production producer returns synthetic success.
+`readJourneyInputs` is input-custody-only; `readJourney` cannot publish a seal.
+The local reader CLI exposes only `--read-local-inputs REQUEST` and explicitly
+labels that scope. Completed remote `readAcceptance` always fails in C3a.
+
+The bridge has separate `authenticated-options`, `authenticated-intake` and
+`authenticated-seal` commands. Its new seal pins the reader source in addition
+to the existing verifier/helper and repeats admission on `verify`. The runner's
+`--public-authenticated ROOT F OPTIONS` accepts exactly `request,go,node,modCache`.
+Python authentic runner, checker and direct reader entrypoints unconditionally
+reject with `missing independently provisioned trusted controller; C3b capability required`
+before interpreter subprocesses, planner effects, output creation or authenticated
+success. Receipt-selected `node` and self-supplied tool/reader hashes are not
+independent interpreter authority; no receipt or environment override opens this
+boundary. Prepared intake, Linux planner commands, five environment variables and
+terminal validations remain for C3b, covered only by explicitly synthetic gate
+mocks. C3b must independently provision the controller and make full public
+execution work; this closed subcheckpoint is not its completion.
+A local J/bridge, successful fixture TAP or injected planner cannot stand for E.
+
+Positive tests explicitly mock custody interfaces and, for bridge-only seal
+controls, the unavailable J result boundary. These are source controls only;
+they execute no npm, native, installer, scanner, verifier or provider. C3b must
+supply the genuine producer, full result validators, fixed workflow, completed
+E aggregate/authenticated reader and P adapter together. Its npm/process,
+workflow and P test names remain outstanding. Native/N2, genuine E, P/Q/B,
+anonymous acquisition/readbacks/channels, stable release and phases 0–11
+remain open; independent review and required remote CI are not waived.

npm/agentplugins/scripts/packed-installer-bridge.test.js

@@ -215,3 +215,48 @@ test('SYNTHETIC v2 help/preflight boundary cannot stand for production add', pos
  } finally { c.frozenCandidate = original; }
  assert.throws(()=>seal(), 'synthetic fixtures cannot publish native evidence');
 });
+
+// C3-only synthetic seam: bypass the unavailable journey result adapter ONLY
+// inside these tests. The real reader and CLI cannot accept this local J.
+test('C3 bridge authenticated intake preserves legacy dispatch', t => {
+ const a = require('./public-authoring-acceptance');
+ const {fixture, withReaders} = require('../test/public-authoring-acceptance.test');
+ const f = fixture(t);
+ withReaders(t, f, () => {
+  assert.throws(() => bridge.seal(f.request), /C3b required/);
+  t.mock.method(a, 'readJourney', request => a.readJourneyInputs(request));
+  const result = bridge.seal(f.request);
+  assert.equal(result.schema, 'packed-installer-bridge/public-authenticated/v1');
+  assert.equal(result.inputs.projects.length, 10);
+  assert.equal(result.inputs.public_inputs.qualification, null);
+  assert.equal(result.attested, false);
+  for (const intake of ['public-fixture/v1', 'public-fixture/v2', undefined]) {
+   const request = {...f.request}; if (intake) request.intake = intake; else delete request.intake;
+   assert.throws(() => bridge.seal(request));
+  }
+  for (const extra of [{authenticated:true}, {nativeTap:'fixture.tap'}, {disposableEvidence:true}]) assert.throws(() => bridge.seal({...f.request,...extra}));
+ });
+ assert.throws(() => a.readAcceptance(f.request), /completed remote E/);
+});
+test('C3 bridge seal binds original ten projects', t => {
+ const a = require('./public-authoring-acceptance');
+ const {fixture, withReaders} = require('../test/public-authoring-acceptance.test');
+ const f = fixture(t);
+ withReaders(t, f, () => {
+  t.mock.method(a, 'readJourney', request => a.readJourneyInputs(request));
+  const sealed = path.join(f.root, 'sealed.json'), pin = bridge.publishSeal(f.request, sealed);
+  const verify = () => bridge.verify(sealed, pin, f.request.expectedCommit);
+  assert.equal(verify().projects.length, 10);
+  for (const output of [path.join(f.admission.work_parent, 'overlap.json'), f.request.admission, f.j.tools.go.path]) {
+   assert.throws(() => bridge.publishSeal(f.request, output), /overlapping roots/);
+  }
+  const source = path.join(f.j.projects.agentplugins, 'skill'), manifest = path.join(source, 'plugin.json');
+  const original = fs.readFileSync(manifest), mode = fs.statSync(manifest).mode & 0o777;
+  fs.appendFileSync(manifest, 'changed'); assert.throws(verify); fs.writeFileSync(manifest, original);
+  fs.chmodSync(manifest, mode ^ 0o020); assert.throws(verify); fs.chmodSync(manifest, mode);
+  const extra = path.join(source, 'unexpected-empty'); fs.mkdirSync(extra); assert.throws(verify);
+  // Retain the changed fixture; no cleanup and no claim that it still verifies.
+  assert.throws(() => bridge.publishSeal(f.request, path.join(f.root, 'late-seal.json')));
+  assert.equal(fs.existsSync(path.join(f.root, 'late-seal.json')), false);
+ });
+});