security(core/R-15): Gate 2 — complete identity-bound adapters and AAD closure

[qnbs]

Program position

Child owner of #445 (R-15). This issue owns the remainder of Gate 2 after PR #917's typed identity-registry slice.

TARGET_RELEASE = v1.30.0
PARENT = #445
PREDECESSOR = PR #917 (Gate 2 slice 1)
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Current execution — M1 / Gate 2 — 2026-10-01

PREDECESSOR #917 = TERMINAL
BASE_MAIN = cf45da58ea8ba8edee38f1d8a0db8edb2160ce58
SLICE_A = PR #928 ACTIVE
SLICE_A_HEAD = e299c325bd05597baec5d2947990404ad59d5c7e
SLICE_A_SCOPE = identity-bound record codec + structural asset-pair relations
SLICE_B = legacy source-locator adapters
SLICE_C = Gate 2 closure + #361 reconciliation
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Slice A is intentionally headless and bounded. It does not own I/O, durable replacement, journal/admission, migration or app wiring. The first review epoch completed and correction wave 1 landed. The current exact-head review has two open Codex P2s (component-copy allocation discipline; §20 tamper/unsupported-schema wording) that must be resolved or dispositioned before merge.

After Slice A merges and its resulting-main proof/housekeeping is terminal, continue automatically to Slice B from proven main; do not append Slice B into #928.

Objective

Finish Gate 2 exactly as defined by the binding R-15 contract: strict parsing and canonical AAD remain authoritative; every protected record class that needs an implementation adapter has one explicit renderer-neutral adapter/result; stable logical identity and scope are preserved without narrowing legacy ID domains; cross-record substitution is rejected; current TS/Tauri production authority remains unchanged.

This is the implementation closure for the identity-binding problem historically tracked by #361; close #361 only when R-15 evidence actually proves its acceptance surface.

Required scope

1. Re-read current main after feat(core): add the Gate 2 typed record-identity registry (#445) #917 terminal.
2. Enumerate all v1 protected record classes from §3/§5 and classify implemented adapter, fixed literal identity, structured composite identity, explicit refusal, or no packaged persisted record yet.
3. Add the smallest coherent adapters required to move Gate 2 from registry-only to usable record identities.
4. Prove canonical AAD and substitution resistance across project/global/install scopes, asset pairs, snapshots, RAG, recovery, migration and control records.
5. Preserve arbitrary legal legacy component strings through an unambiguous canonical representation; never remap or silently narrow existing IDs.
6. Keep credentials/raw key material outside ordinary record envelopes per contract.

Acceptance

• all Gate 2 invariants have code + tests;
• no protected class silently falls back to path identity or unbound ciphertext;
• Bind desktop fs-backed ciphertext to its record identity (AAD) to prevent cross-file substitution #361 explicitly reconciled;
• Rust 1.77.2/MSRV proof remains green where applicable;
• exact-head CI/CD + CodeQL + reviewer convergence;
• resulting-main CI/CD + CodeQL + exact-SHA Production/HTTP;
• security(core/R-15): renderer-neutral encrypted desktop storage, durable migration & identity binding #445 + Linear updated with exact evidence.

Non-goals

• durable file replacement (Desktop atomic writes: fsync temp file + parent directory before/after rename for true crash durability #357 / Gate 3);
• migration journal/admission (Desktop fs-data key-rotation migration is not crash-resumable (mixed-key state possible) #359/Desktop fs reads/writes don't participate in the encryption-migration admission lock (race window during disable/rotate) #360 / Gate 4);
• all-class migration (Gate 5);
• production authority switch (Gate 7);
• browser/PWA authority changes;
• Project semantic-authority switch core(project): complete renderer-neutral Project authority switch and retire observation-only shadow authority #836.

Prefer small sequential PRs if the remainder exceeds normal reviewability. Do not create another XXL PR.

[qnbs]

Linear control-plane mirror

• Linear: QNB-166
• Project: v1.30.0 — Complete Desktop At-Rest Encryption
• Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5

GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.

[qnbs]

Admission 2026-10-01 (agent-executed, after #917 TERMINAL at main cf45da58)

The binding contract (§20 item 2) defines Gate 2 as "strict parsing, canonical AAD, record-class adapters, and substitution tests". Slice 1 (#917) left "record-class adapters that route real records through these identities" to later slices. The #361 closure row requires cross-record substitution, modified-AAD and relocation tests that fail closed while valid IDs and content stay intact. Gate 2 remainder is split into three sequential bounded slices, each with its own resulting-main proof:

Slice	Scope	Proof boundary
A — identity-bound record codec	seal_record/open_record take a RecordIdentity (strict WSR1 parse + canonical AAD from the identity, so routed records never hand-build a RecordContext); structural asset-pair ↔ member derivation by record_class substitution (§8.4, never string splitting)	relocation / cross-scope / cross-class / modified-AAD substitution fails closed; delimiter-bearing IDs round-trip
B — legacy source-locator adapters	pure mapping from today's physical locators (snapshot <id>.json, images, binder .bin/.meta.json, codex/vectors, settings, active-project marker) to RecordIdentity, with non-canonical or unowned locators refused rather than guessed (§3, §5.4)	locator → identity is canonical, preserve-first, no ownership guessing
C — Gate 2 closure	class-by-class disposition (adapter / fixed literal / composite / refusal / no persisted record), #361 reconciliation, contract/ledger status	every Gate 2 invariant has code + tests

Non-goals unchanged: no durable I/O (Gate 3), journal/admission (Gate 4), migration (Gate 5), app wiring or authority switch (Gate 7). PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO. Starting Slice A now.

[qnbs]

Slice A TERMINAL — PR #928 (identity-bound record codec)

squash-merged, exact-head bound to dffbd50ff0d437ba49588579e2634a0c3bd90406
RESULTING_MAIN = 56814c571651b9b1dc2cda2a8f2885aff8d3dc0c
  CI/CD 36815161235 = SUCCESS (Security Audit = SUCCESS) · CodeQL 36815161204 = SUCCESS
  Vercel Production dpl_83naMueE6yByBRh9F85u6pqEkyHp READY on 56814c57; canonical alias → it; HTTP 200
GOVERNANCE_OBSERVED (GET-only, user token): required checks 3, strict, conversation resolution,
  signed commits, 0 required approvals, no rulesets, MERGE_QUEUE = NOT_CONFIGURED

Delivered: seal_record/open_record bound to RecordIdentity (strict WSR1 parse, canonical AAD from the identity), the version-1 record-schema compatibility registry (ADMITTED_RECORD_SCHEMAS = [1], refused on seal and before any payload release on open, per §7), structural asset-pair derivation (§8.4, with the contract text corrected), and validate-then-build identity construction. 9 codec tests cover relocation across record, project, installation scope and class; exact per-byte outcomes; wrong key; malformed, future and legacy bytes; asset pairs with delimiter-bearing IDs; and a payload-free Debug.

Review convergence: three waves for exact-head findings. Wave 1 fixed the cubic P1 schema registry, the Codex/cubic P2 allocation issue, and two cubic P3s. Wave 2 fixed two Codex P2s (pair-only component cache; exact per-byte contract/test). Wave 3 fixed a cubic P3 (validate-then-build). On the final head, Codex, Sourcery, CodeScene and cubic are all clean. CodeRabbit was RATE_LIMITED for the last increment (3fee9cda..dffbd50f) and clean through 3fee9cda.

Housekeeping: local branch deleted (remote already gone). Four superseded #928 previews removed with --safe; the aliased latest is retained.

Next: Slice B — legacy source-locator adapters.

[qnbs]

Re-admission (agent-executed): Slice B and C collapse into the Gate 2 closure, PR #929. Re-reading §20 showed that per-class legacy migration adapters (discovery, locators, inventory) belong to Gate 5 (item 5: 'each needs a Core or WebView adapter migration/refusal result'; §15.3 MigrationSourceAdapter). A Gate 2 'source-locator adapter' slice would therefore pull Gate 5 forward, and it is withdrawn. What actually remained for Gate 2 was §10.4.1's record-class disposition. The codec could still seal credential and the B-1 IDB salt/sentinel, which must never become R-15 ciphertext. PR #929 adds the exhaustive disposition registry, the codec refusal, and the contract/ledger closure. #361 stays open: the Core evidence is complete, but the defect sits in the shipped filesystem helper and closes only with the Gate 7 switch (#925). Locator mapping is carried as Gate 5 (#923) input.