fix(security): harden context, dry-run, manifest, and glob handling

.github/workflows/ci.yml

@@ -34,6 +34,21 @@ jobs:
       - run: pnpm check:docs
         if: matrix.profile == 'full'
 
+      # Lexical filesystem-containment guard: flags raw readFile(join(cwd, ...))
+      # reads that bypass the owned/contained path seams. A structural backstop
+      # for the path-containment work; the SEMANTIC invariants (decision_refs
+      # namespace, forged-manifest ownership) are pinned by the security
+      # regression tests in test:unit, which this does NOT replace.
+      - run: pnpm check:fs-containment
+        if: matrix.profile == 'full'
+
+      # AST-based filesystem-authority gate: flags fs operations on paths
+      # not sourced from an authority resolver (resolveSymlinkFreeProjectPath,
+      # resolveOwnedReadPath, etc.). A structural backstop complementing the
+      # lexical containment guard above.
+      - run: pnpm check:fs-authority
+        if: matrix.profile == 'full'
+
       - run: pnpm typecheck
 
       - run: pnpm test:unit

CHANGELOG.md

@@ -13,15 +13,34 @@ identifiers. Starting with v1.0.0, stable releases use plain
 
 ## [Unreleased]
 
-No changes yet.
+### Security
+
+- **Context pack no longer follows a `design/constitution.md` symlink out of the project (CWE-59).** `loadConstitution` now reads through the same project-contained helper as rules/decisions (`resolveWithinProject`), so a repo that symlinks `design/constitution.md` to an outside file cannot leak that file into the agent-facing context pack. A missing/unreadable/unsafe constitution still degrades to "not included".
+- **`task complete --dry-run` no longer executes verification shell commands (CWE-78).** The caller's `dryRun` is now propagated into verify, so the project-controlled `verification.commands` (run with `shell: true`) are previewed, not executed, on a dry run. The read-only decision gate still runs. **Behavior change:** a `--dry-run` whose only failing check is a command no longer exits 1 — it returns a clean `dry_run` preview. A non-dry-run completion is unchanged (it executes commands and fails on a failing command).
+- **Adapter manifest I/O fails closed on a `.code-pact/adapters` symlink escape (CWE-59).** `readManifest` / `writeManifest` resolve the manifest path through `resolveWithinProject`, so a symlinked adapters directory can no longer make a read pull a foreign manifest or a write land outside the project. `adapter install` / `adapter upgrade` map the refusal to a structured `ADAPTER_MANIFEST_INVALID` envelope (exit 2) instead of leaking an internal error / exit 3.
+- **Atomic writes use unpredictable, exclusively-created temp files (CWE-59 / CWE-377).** Temp paths are now crypto-random and opened with `wx` (`O_CREAT|O_EXCL`), so a pre-planted symlink at the temp path is refused (EEXIST, never followed) instead of being written through to an outside target.
+- **`adapter install` no longer trusts a project-shipped manifest hash to preserve stale/forged generated content (CWE-345).** A `managed-clean` file whose content no longer matches the generator output is now re-rendered (`update`) instead of skipped, so a forged manifest hash matching shipped-malicious instructions is self-healed. A managed file that matches **neither** the manifest hash **nor** the generator output (`managed-modified × stale` — the shape a hostile repo ships: malicious content + a non-matching forged hash) is no longer **silently** skipped: it is **refused** (not overwritten — it could be a genuine local edit — but surfaced via `result.refused[]` / `files[].action: "refuse"`, and `adapter install` exits 1). Genuinely user-modified files are still never overwritten.
+- **`adapter upgrade --write` no longer deletes an orphan just because the manifest claims it (CWE-73).** An orphan is auto-pruned only when its path is in the adapter descriptor's `ownedPathRoles`; an orphan outside that set is surfaced (`action: "warn"`) and kept on disk. **Behavior change:** a renamed/removed generated file whose path is not in the owned set is now reported rather than auto-deleted, so a forged manifest entry cannot turn `upgrade --write` into an arbitrary in-project delete.
+- **`adapter install` / `adapter upgrade` establish read authority before touching generated-file targets (CWE-200).** Static existing files are read only after exact path+role authorization and symlink-free resolution. Existing dynamic skill collisions are **preserved opaquely** (warn, not refuse): their bytes are never read or hashed, but the rest of the install/upgrade continues (static writes, model pin, manifest refresh). Unowned manifest orphans are reported as `local: "unverifiable"` without a target existence/hash probe. This removes the manifest-SHA equality oracle for profile redirects such as `.env`.
+- **Adapter authority model is now role-scoped (CWE-345).** `ownedPathGlobs` and `writePathGlobs` are replaced by `ownedPathRoles` (exact static read/hash/overwrite/delete authority) and `createPathGlobsByRole` (role-scoped create-only authority). A missing target whose path matches a create glob AND whose role matches the key may be CREATED; an existing file at that path is never read, hashed, or overwritten. This prevents a forged manifest from elevating a shared-namespace path (e.g. `.claude/skills/private.md`) to read authority via a wildcard match.
+- **Adapter placeholder preflight now rejects every symlink component before model pinning (CWE-59).** `context_dir` / `hook_dir` use the same strict owned-path resolver as the commit phase, including in-project final and parent symlinks. The resolved paths are carried into mkdir, generated-file write/prune, and manifest-write phases, so a failed `--model` install/upgrade cannot leave only the profile pin behind.
+- **Glob matching is now linear and backtrack-free (CWE-1333).** The file-walk / write-audit / doctor match paths use a two-pointer segment matcher instead of a regex compiled from `**`, eliminating the catastrophic backtracking a project-controlled `task.reads` glob could trigger. A pattern-length cap is also enforced in `validateGlobSyntax`.
+- **`context_dir` is now restricted to the `.context/**`namespace (CWE-22/CWE-73).** The`AgentProfile.context_dir`field is validated by a dedicated`ContextOutputDir`schema that rejects any path outside`.context/`. A new `resolveProfileContextOutputPath`enforces namespace containment and symlink-free resolution before any write.`writeContextPack`and`task prepare --dry-run`both route through this resolver, so a hostile profile can no longer redirect context pack output to an arbitrary project file (e.g.`CLAUDE.md`or`.env`).
+- **Manifest `agent_name` identity check (CWE-345).** `readManifest` and `writeManifest` now refuse a manifest whose `agent_name` doesn't match the target agent (`ADAPTER_MANIFEST_INVALID`), preventing a cross-agent manifest swap from being acted on.
+- **`classifyManifestFileForRead` now enforces role mismatch before filesystem access (CWE-200).** The API is simplified: the declared role is always checked against the static path's expected role. A role-swap (e.g. `CLAUDE.md` with `role: skill`) is `unowned` before any read/stat/heading inspection — no content oracle. The `roleCheck` / `expectedRoleFor` parameters are removed; the declared role is passed directly.
+- **`dedupeDesiredFiles` now rejects same-path different-role duplicates (CWE-345).** Two desired files at the same path with identical content but different roles now throw `ADAPTER_DESIRED_PATH_CONFLICT`, preventing a role confusion from silently corrupting the adapter's converged state.
+- **`resolveOwnedProjectPath` renamed to `resolveSymlinkFreeProjectPath`.** The old name implied ownership proof; the new name accurately describes the function's behavior: symlink-free project containment. A deprecated alias keeps existing imports working.
+- **Adapter staged transactions are journaled before project temp files are written.** `FileTransaction` now separates pre-commit rollback from post-commit cleanup and writes the prepared journal to user-private state before staging project-side temp files. Backup/temp/journal cleanup failures after the durable commit marker surface as `TRANSACTION_CLEANUP_PENDING` while preserving the new final files. The next adapter install/upgrade attempts journal recovery before starting a new mutation.
+- **`check:fs-authority` now rejects known false-negative bypasses.** The gate no longer treats `resolveWithinProject` or generic `resolveOwnedReadPath` as authority sources, merges branch authority by capability intersection, checks multi-path fs operations such as `rename`/`copyFile`/`symlink` per argument, tracks aliased projectFs/raw fs sinks, rejects namespace/dynamic/require raw fs calls, and removes the trusted-name nested-function exemption.
+- **Dynamic adapter skills are create-once handoff outputs.** A newly created dynamic skill records `ownership: handed_off` in the manifest. Later runs do not use the reserved `code-pact-*` prefix as provenance, do not read/hash/update/prune the file, and do not repeatedly warn once handoff is recorded.
 
 ## [2.0.0] — 2026-06-18
 
 **v2.0.0 — bounded archive maintenance.** `state archive-maintain` is the one command that keeps `.code-pact/state/archive` bounded — it recovers any pending delete-intent journal, compacts the loose tail into bundles, retains/removes unreferenced old truth, re-plans, and runs `validate` + `plan lint`, reporting an honest `bounded_status`. **Scope (no over-claim):** v2.0.0 bounds the archive's **file-count** sprawl and removes **unreferenced old truth** while **preserving referenced truth**. It does **not** yet bound a single bundle's **byte size** — sharding is the next storage milestone. This is a **major** bump because of one breaking error-code-contract change (see Changed → `MISSING_PHASE_FILE`).
 
 ### Changed
 
-- **Behavior fix (error-code contract): `doctor` / `validate` now report a roadmap-referenced missing phase file as `MISSING_PHASE_FILE`, matching `plan lint`.** Previously `doctor` (and `validate`, which delegates to it) emitted `ORPHAN_PHASE_FILE` (severity `error`) for a `roadmap.yaml` reference whose phase file is absent or present-but-inaccessible — the opposite of that code's documented meaning ("a phase file present but not referenced"), so a user looking the code up read a contradictory definition. The condition now uses the code whose name matches it (`MISSING_PHASE_FILE`, *referenced but not present*), with **severity unchanged (`error`)**. `ORPHAN_PHASE_FILE` (warning) is unchanged and now means **only** *present but unreferenced*. **Migration:** a consumer that string-matched `doctor` / `validate` JSON for `ORPHAN_PHASE_FILE` to detect a missing referenced phase must switch to `MISSING_PHASE_FILE`; one that keys on `severity` (error vs warning) needs no change. `plan lint` already used `MISSING_PHASE_FILE` and is unaffected.
+- **Behavior fix (error-code contract): `doctor` / `validate` now report a roadmap-referenced missing phase file as `MISSING_PHASE_FILE`, matching `plan lint`.** Previously `doctor` (and `validate`, which delegates to it) emitted `ORPHAN_PHASE_FILE` (severity `error`) for a `roadmap.yaml` reference whose phase file is absent or present-but-inaccessible — the opposite of that code's documented meaning ("a phase file present but not referenced"), so a user looking the code up read a contradictory definition. The condition now uses the code whose name matches it (`MISSING_PHASE_FILE`, _referenced but not present_), with **severity unchanged (`error`)**. `ORPHAN_PHASE_FILE` (warning) is unchanged and now means **only** _present but unreferenced_. **Migration:** a consumer that string-matched `doctor` / `validate` JSON for `ORPHAN_PHASE_FILE` to detect a missing referenced phase must switch to `MISSING_PHASE_FILE`; one that keys on `severity` (error vs warning) needs no change. `plan lint` already used `MISSING_PHASE_FILE` and is unaffected.
 - **Docs: trimmed duplicated error-code tables from concept docs.** `concepts/finalization-reconciliation.md` and `concepts/governance.md` now link to `cli-contract.md` § Error codes for exit codes / triggers / envelopes instead of restating them in their own tables (matching the existing `concepts/runbook.md` pattern). Reference detail stays in its single owner; the concept docs keep only the mental model. No code change.
 
 ### Added
@@ -31,7 +50,7 @@ No changes yet.
   existing archive primitives in the safe order (recover any pending
   delete-intent journal → `compact-archive` all kinds → `archive-retention` →
   compact again if a follow-up materialised → re-plan → `validate` → `plan
-  lint`) so an operator no longer has to remember and order the low-level verbs.
+lint`) so an operator no longer has to remember and order the low-level verbs.
   It adds **no new destructive semantics and no new persistent state** — a thin,
   honest orchestration over `compactArchive` / `applyArchiveRetention` and their
   journal recovery, writing nothing outside `.code-pact/state/archive` (no