fix(attestation): fail closed on subagent per-spawn attestation MISS (lr-2a8653)

[clagentic-builder]

What changed

Closes a live confused-deputy hole in gatekeeper attestation resolver chain, P1 lr-2a8653: a subagent spawn whose per-spawn sidecar file misses was falling through to the session-keyed sidecar adapter and silently minting a token under its PARENT session identity, e.g. NAOMI-as-holden.

• internal/attestation/domain_policy.go: adds a new DomainLocalSubagent domain that reuses the existing DomainResolver and PerSpawn-required MISS policy lr-2ca216 already built for DomainA2A. A per-spawn MISS fails closed, ErrPerSpawnRequired, instead of falling through to the session sidecar. DomainLocal, the lead or director session case with no per-spawn source by design per lr-86779f, is untouched.
• internal/mint/mint.go: Service gains DomainResolver alongside the legacy AttestationResolver field. New MintForDomain resolves identity under the caller-supplied domain MISS policy. Mint is now MintForDomain scoped to DomainLocal, so every existing caller keeps prior exact behavior with zero signature break.
• cmd/gatekeeper/main.go: runMint now builds a DomainResolver with PerSpawn scoped to the first entry of attestation.sidecars, the deployment per-spawn namespace per the documented spawn-first convention, and selects DomainLocalSubagent when that entry own session_id_env is set in the process environment, the same signal sidecarProvider.Resolve itself checks for its own MISS. No new config field, no new CLI flag.
• docs/SETUP.md: updates the Domain-aware fail-closed MISS section to reflect that the substrate is now wired into gatekeeper mint for the local-subagent case.

Why

MILLER diagnosis, confidence 0.9, verdict B live and uncovered, confirmed lr-2ca216 built the domain-aware fail-closed substrate but wired it to nothing. Every mint gatekeeper serves used the raw, domain-blind resolver. Deployed config has two sidecar adapters in order: a per-spawn one keyed on CLAGENTIC_SUBAGENT_ID, then a session one keyed on CLAUDE_CODE_SESSION_ID. Inside a subagent, CLAUDE_CODE_SESSION_ID is always the PARENT session id, so a per-spawn read MISS meant the resolver walked to the session adapter and attested the subagent as its parent lead. This is the same mechanism that converted lr-5a077d from refuse into mint-holden, retro 718.

Per lr-86779f, a blanket fail-closed-on-per-spawn-MISS would be wrong: a lead or director session legitimately has no per-spawn sidecar and must keep resolving via the session sidecar. This PR discriminator is whether a per-spawn source was expected for this invocation, reusing the existing DomainResolver and PerSpawn substrate rather than inventing a parallel mechanism.

Task

lr-2a8653, P1 bug. REF lr-2ca216 PR 23, lr-86779f, lr-3028e8, clagentic-loadout lr-1e16a4 PR 125.

Tests

Added regression tests at both layers, both directions:

• internal/mint/mint_test.go: TestMintForDomain_Subagent_PerSpawnMiss_RefusesNeverParentIdentity, T-plus, and TestMintForDomain_Lead_PerSpawnMiss_StillResolvesViaSession, T-minus.
• cmd/gatekeeper/main_test.go: TestRunMint_SubagentPerSpawnMiss_RefusesNeverParentIdentity, T-plus, and TestRunMint_LeadSession_PerSpawnMiss_StillResolvesViaSession, T-minus, exercising the CLI env-var-driven domain selection end to end against the deployed two-sidecar config shape.
• go build ./... : clean.
• go test ./... -count=1 : all 8 packages pass, including the pre-existing DomainA2A substrate tests unchanged.
• go vet ./... and go fmt ./... : clean.

tests_passed: true

Task: lr-2a8653

[clagentic-reviewer]

PEACHES — clean (0 findings)

Review of PR #26 (fix/lr-2a8653-gatekeeper-per-spawn-fail-closed) against AMoS code-craft baseline and project rules.

Summary:
Fix adds DomainLocalSubagent domain-aware resolution policy to prevent subagent per-spawn attestation MISS from silently falling through to session sidecar (confused-deputy hole lr-2a8653). Implementation correctly discriminates per-spawn-expected invocations (env var set) from lead/director sessions (env var unset), enforces fail-closed refusal on MISS, and preserves backward compatibility for existing callers. No regression of lr-86779f (session fallback for lead sessions). Regression tests cover all three layers (attestation, mint, integration) bidirectionally (T+ subagent-miss-refuses, T- lead-session-still-resolves).

Checked:

• amos.code-craft.1: minimal change (domain policy layer added, no unrelated edits)
• amos.code-craft.4: regression tests present and meaningful (contract_test.go, mint_test.go, main_test.go)
• amos.code-craft.13: fail-closed on security-critical per-spawn MISS (ErrPerSpawnRequired is hard refusal, never silent fallthrough)
• Discriminator: env var check (chainSidecars[0].SessionIDEnv) consistent with sidecar provider logic (no new config)
• Backward compat: mint.Service.Mint() unchanged, DomainResolver optional, AttestationResolver fallback wrapper preserves prior behavior
• No signature break, no scope creep

{"reviewer": "peaches", "review_status": "clean", "head_sha": "69adb6840eb92be33418db6a625b5e306aa39799", "pr_number": 26}

[clagentic-security]

Reviewed PR #26 (fix/lr-2a8653-gatekeeper-per-spawn-fail-closed) against RULEBOOK.md. Focus: confirm no residual fall-through from a subagent per-spawn attestation MISS to the session/parent identity.

Trace: internal/attestation/domain_policy.go DomainResolver.Resolve (lines 149-168) — for DomainA2A and DomainLocalSubagent (Domain.requiresPerSpawn()==true), resolution delegates ONLY to d.PerSpawn.Resolve; d.Chain is never consulted on this branch. PerSpawn is built in cmd/gatekeeper/main.go (lines 161-171) from chainSidecars[0] alone (the per-spawn namespace) via an independent Resolver, so it is structurally incapable of reading the session sidecar entry even when present. A per-spawn MISS (ErrNoIdentity) or nil PerSpawn returns ErrPerSpawnRequired — a hard refusal, never a fallthrough to Chain's remaining providers. Any hard error from PerSpawn also propagates unchanged (no soft-downgrade). internal/mint/mint.go MintForDomain (lines 472-502) always resolves via a DomainResolver (wrapping legacy AttestationResolver callers at DomainLocal semantics for back-compat) and never calls the broker/entitlement path before this resolution succeeds. Both directions are test-covered end to end through runMint itself (cmd/gatekeeper/main_test.go) and at the mint.Service boundary (internal/mint/mint_test.go): subagent per-spawn MISS refuses and never reaches MintFunc; lead/director session per-spawn-absent still resolves via session sidecar unchanged (no lr-86779f regression).

Discriminator (main.go lines 187-192): mintDomain is selected by reading the SAME session-id env var (chainSidecars[0].SessionIDEnv) that sidecarProvider.Resolve itself already reads to decide its own MISS. This is not a new trust boundary — an actor able to spoof/unset that env var to force DomainLocal already controls the same process environment the pre-existing sidecar-provider read trusts; no new bypass surface is introduced by reusing it as the domain discriminator.

No secret/token exposure: gitleaks (full-tree, no-git mode) found 0 leaks. No SAST hits: semgrep --config=auto over the three changed Go files (mint.go, domain_policy.go, main.go), 131 rules, 0 findings. No SQL/command/deserialization/template/path-traversal patterns in the diff. sidecarProvider's existing Lstat-not-Stat symlink guard and requireContained path-containment check are untouched by this PR.

Dependencies: go.mod is not touched by this diff. osv-scanner against go.mod reports pre-existing Go stdlib advisories tied to the toolchain floor (1.22.99) already present on main, unrelated to and not introduced by this PR -- out of scope per bobbie.dep.1/2 (no new dependency).

Config/docs surface: docs/SETUP.md and docs/SIDECAR-READ-CONTRACT.md updates are documentation-only and consistent with the code change; no new config keys, no new CLI flags.

No blocking or nit findings. Clean diff.

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "69adb6840eb92be33418db6a625b5e306aa39799", "pr_number": 26}

[clagentic-merger]

Merged via clagentic-loadout v0.1.0

Field	Value
Gated HEAD SHA	69adb6840eb92be33418db6a625b5e306aa39799
Merged SHA	69adb6840eb92be33418db6a625b5e306aa39799
Reviews	clagentic-reviewer[bot], clagentic-security[bot]
CI status	no-runner-by-design (0 commit-status entries at HEAD)
task_id	lr-2a8653