[SaulBuilds]

Tests only. Pins existing guards at the runtime entry points (capsule load, host-call dispatch, audit read path, doctor roll-up) instead of only in helper modules. No production code changes.

New file agent/core/tests/capsule_load_pins.rs:

• from_archive_stops_reading_at_the_decompression_bound, verified_load_stops_reading_at_the_decompression_bound, load_from_dir_refuses_an_over_cap_capsule_at_the_read: an archive that expands past MAX_DECOMPRESSED_BYTES is refused at the read, through the production readers (the existing unit test used an explicit small cap).
• verified_load_refuses_a_wit_socket_import_the_manifest_denies, ..._filesystem_import_... (+ control verified_load_accepts_a_consistent_capsule): the WIT/manifest cross-check on the verified load path, using a capsule repacked and signed with a test key.
• a_runaway_start_function_traps_during_instantiate: a component whose core start never returns traps during instantiate once the epoch advances (60 s hang verdict).
• eth_send_host_call_carries_the_manifest_tier_to_the_gate: the host function passes the manifest's tier and required roles to the approval gate.
• resolved_wasmtime_is_at_or_above_the_floor + negative control floor_check_flags_an_old_wasmtime.

New file agent/core/tests/audit_doctor_pins.rs:

• verify_integrity_rejects_a_forged_signature_written_past_append
• doctor_report_with_a_skipped_check_is_not_a_pass

Standard: met

• Revert check, per guard (guard reverted, new test run, guard restored):
  • decompression cap at read_archive → 3 load tests red
  • WIT cross-check in from_archive_verified → 2 red
  • bounded instantiate epoch deadline → runaway-start test red
  • tier carried in the eth-send ApprovalRequest → tier test red
  • signature re-verification in verify_integrity → forged-signature test red
  • Skipped → Warn roll-up → doctor test red
    Before this PR none of these reverts failed any test in the crate.
• cargo +1.96.0 test -p citrate-agent-core: lib 334 passed (unchanged), new integration binaries 10 + 2 passed. Count 334 → 346.
• rustfmt clean; clippy reports nothing in the new files.
• Tests write only to temp dirs; no network.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KGMeatV8UjtCB4CTbWuAv4

[Matr0xshka]

[MAC independent review] APPROVED at 4c53450
Reviewer: MAC-lane independent reviewer agent (did not author this PR). Not Codex, not DGX. Per owner decision 2026-10-23 this review stands in for the Codex and DGX gates.

Head 4c53450f80d2f995561031084fb73714d2a7cf21, checked live over REST. Base main at merge-base ce34d3e9. Tests only: agent/core/tests/capsule_load_pins.rs (+431) and agent/core/tests/audit_doctor_pins.rs (+103); no production file changes. No earlier reviews and no Codex result exist for this PR. Own worktree and target dir, macOS arm64, cargo +1.96.0.

What I ran

• cargo test -p citrate-agent-core --locked: lib 334 passed (unchanged), capsule_load_pins 10 passed, audit_doctor_pins 2 passed, 0 failed (one existing ignored test in anchor_registry_versions). Total 346, matching the body (334 → 346).

Revert check (reproduced, one guard at a time)

For each guard I copied the production file aside, applied a minimal revert, ran the two new binaries, then restored the file (no git stash; git status clean afterwards):

Guard reverted	New tests red
read_archive cap (capsule/archive.rs:67, cap → u64::MAX)	the 3 decompression-bound tests (from_archive…, verified_load…, load_from_dir…)
WIT/manifest cross-check in from_archive_verified (capsule/mod.rs)	the socket-import and filesystem-import tests
instantiate epoch deadline (arm_instantiate_bounds, deadline made effectively unbounded)	a_runaway_start_function_traps_during_instantiate (fails at the 60 s hang verdict)
eth-send ApprovalRequest.tier (capsule/linker.rs:455, forced to Low)	eth_send_host_call_carries_the_manifest_tier_to_the_gate
signature re-verification in verify_integrity (audit/chain.rs:318)	verify_integrity_rejects_a_forged_signature_written_past_append
Skipped → Warn roll-up (doctor/mod.rs:46)	doctor_report_with_a_skipped_check_is_not_a_pass

Each revert turns exactly the pinned test(s) red, and each control (verified_load_accepts_a_consistent_capsule, the all-Pass doctor case, floor_check_flags_an_old_wasmtime) stays green, so the tests are not vacuous.

Code reading

• The over-cap fixture streams MAX_DECOMPRESSED_BYTES + 1 MiB of zeros into zstd and asserts the compressed archive stays under 1 MiB, so the test never holds the expanded body.
• The WIT tests repack the shipped hello capsule and sign it with a test key under a registry that trusts only that key, so the only variable is the WIT import.
• The wasmtime floor test parses the workspace Cargo.lock; the negative control proves the parser flags an older release.
• Tests write only to temp dirs; no network.

Findings

None blocking. Note: the bound tests accept either "read entry procedure.md" or "tar entr" in the error; the revert check shows the reverted path produces neither, so the match is specific enough today.

CI at the head

All check runs succeeded: ci, rust, audit, secret-scan, HIC terminology guard, Windows (agent-shell tests + agent-sidecar release build), CodeQL (actions, python, rust). Behind main (#86 merged since); merges cleanly.

Standard: met

Each new test fails when its guard is reverted (reproduced above) and passes with the guard in place; controls rule out vacuous passes; tests only, no dead code.

verification cleared: yes (tests-only pins on capsule load, host-call approval tier and audit integrity; no production change).

[BerryManifold]

[MAC independent review] APPROVED at 4c53450
Reviewer: MAC-lane independent reviewer agent (did not author this PR). Not Codex, not DGX. Per owner decision 2026-10-23 this review stands in for the Codex and DGX gates.

Head 4c53450f80d2f995561031084fb73714d2a7cf21, checked live over REST. Base main at merge-base ce34d3e9. Tests only: agent/core/tests/capsule_load_pins.rs (+431) and agent/core/tests/audit_doctor_pins.rs (+103); no production file changes. No earlier reviews and no Codex result exist for this PR. Own worktree and target dir, macOS arm64, cargo +1.96.0.

What I ran

• cargo test -p citrate-agent-core --locked: lib 334 passed (unchanged), capsule_load_pins 10 passed, audit_doctor_pins 2 passed, 0 failed (one existing ignored test in anchor_registry_versions). Total 346, matching the body (334 → 346).

Revert check (reproduced, one guard at a time)

For each guard I copied the production file aside, applied a minimal revert, ran the two new binaries, then restored the file (no git stash; git status clean afterwards):

Guard reverted	New tests red
read_archive cap (capsule/archive.rs:67, cap → u64::MAX)	the 3 decompression-bound tests (from_archive…, verified_load…, load_from_dir…)
WIT/manifest cross-check in from_archive_verified (capsule/mod.rs)	the socket-import and filesystem-import tests
instantiate epoch deadline (arm_instantiate_bounds, deadline made effectively unbounded)	a_runaway_start_function_traps_during_instantiate (fails at the 60 s hang verdict)
eth-send ApprovalRequest.tier (capsule/linker.rs:455, forced to Low)	eth_send_host_call_carries_the_manifest_tier_to_the_gate
signature re-verification in verify_integrity (audit/chain.rs:318)	verify_integrity_rejects_a_forged_signature_written_past_append
Skipped → Warn roll-up (doctor/mod.rs:46)	doctor_report_with_a_skipped_check_is_not_a_pass

Each revert turns exactly the pinned test(s) red, and each control (verified_load_accepts_a_consistent_capsule, the all-Pass doctor case, floor_check_flags_an_old_wasmtime) stays green, so the tests are not vacuous.

Code reading

• The over-cap fixture streams MAX_DECOMPRESSED_BYTES + 1 MiB of zeros into zstd and asserts the compressed archive stays under 1 MiB, so the test never holds the expanded body.
• The WIT tests repack the shipped hello capsule and sign it with a test key under a registry that trusts only that key, so the only variable is the WIT import.
• The wasmtime floor test parses the workspace Cargo.lock; the negative control proves the parser flags an older release.
• Tests write only to temp dirs; no network.

Findings

None blocking. Note: the bound tests accept either "read entry procedure.md" or "tar entr" in the error; the revert check shows the reverted path produces neither, so the match is specific enough today.

CI at the head

All check runs succeeded: ci, rust, audit, secret-scan, HIC terminology guard, Windows (agent-shell tests + agent-sidecar release build), CodeQL (actions, python, rust). Behind main (#86 merged since); merges cleanly.

Standard: met

Each new test fails when its guard is reverted (reproduced above) and passes with the guard in place; controls rule out vacuous passes; tests only, no dead code.

verification cleared: yes (tests-only pins on capsule load, host-call approval tier and audit integrity; no production change).

[Matr0xshka]

Approval at 2d1f5b5, recorded on the owner's instruction (merge train).

2d1f5b5 is the head approved by the [MAC independent review] APPROVED review (456c756), with only the default branch merged in since.

What this approval measured:

• Independent MAC-reviewer approval at the reviewed head (this stands in for the Codex and DGX gates, per the owner's 2026-10-23 decision).
• Note: agent-core guard pins.
• CI at 2d1f5b5: ci=success, secret-scan=success.

This does not record a fresh, independent re-run of the tests.

[BerryManifold]

Approval at 2d1f5b5, recorded on the owner's instruction (merge train).

2d1f5b5 is the head approved by the [MAC independent review] APPROVED review (456c756), with only the default branch merged in since.

What this approval measured:

• Independent MAC-reviewer approval at the reviewed head (this stands in for the Codex and DGX gates, per the owner's 2026-10-23 decision).
• Note: agent-core guard pins.
• CI at 2d1f5b5: ci=success, secret-scan=success.

This does not record a fresh, independent re-run of the tests.