Scope retained G2 evidence to the attested contract surface - #17

Summary

Repair the retained G2 evidence relationship so the historic G2 attestation remains strict without freezing every unrelated repository file forever.

This PR:

• preserves the original reviewed G2 verifier byte-for-byte as scripts/check-g2-evidence-v1.py;
• layers a separate psyche.g2-attestation-scope/v1 policy around the original source, workflow, test-manifest, matrix, immutable Coven input, CI-run, and evidence checks;
• defaults every unknown or new path to protected;
• allows only ten exact repository-readiness/governance paths, with explicit add/modify operations and Git modes, to change outside the historic G2 implementation claim;
• compares exact Git tree entries—path, mode, object type, and blob/commit SHA—rather than relying on a potentially lossy file-name diff;
• uses GitHub commit/tree APIs in Actions and rejects truncated recursive trees;
• keeps local verification on the same classification policy through git ls-tree;
• rejects protected changes, deletions, mode changes, symlinks, submodules, renames, copies, unsafe paths, duplicate paths, and compare/tree truncation;
• introduces a separate candidate → passed scope attestation rather than rewriting the historic G2 evidence;
• adds focused scope regression tests to the reviewed CI workflow.

Root cause

The current passed-evidence verifier requires the historic tested source commit to be the pull-request head's merge-base and requires the complete tested-source-to-head diff to contain exactly one modified file: docs/G2-EVIDENCE.md.

That was correct for the original evidence-only attestation PR. Applied permanently, it rejects every later repository change—including root onboarding, roadmap, governance, or verification wrappers—and therefore blocks draft PR #15 even though all Rust, conformance, migration, crash, clippy, and evidence-checker unit work completed successfully before the relationship step.

Two-layer evidence model

1. docs/G2-EVIDENCE.md remains the immutable historic implementation attestation. Its tested source, CI run, matrix, Coven provenance, source hashes, and command allowlist do not change in this PR.
2. docs/G2-SCOPE-EVIDENCE.md attests the current fail-closed scope checker, scope manifest, reviewed workflow, and complete current G2 test run.

This first commit intentionally leaves the scope evidence at candidate.

After the exact candidate head passes the complete CI matrix, a second commit will modify only docs/G2-SCOPE-EVIDENCE.md to record:

• this candidate source SHA;
• the immutable successful pull-request Actions run.

The final run must then prove the candidate-source → evidence-head relationship under the new scope before merge.

Explicitly unattested paths

Only these exact paths may be added or modified using their declared regular/executable modes:

• README.md
• AGENTS.md
• CONTRIBUTING.md
• SECURITY.md
• LICENSE
• docs/ROADMAP.md
• docs/PROTOCOL-OWNERSHIP.md
• agent/manifest.yaml
• scripts/agent-bootstrap
• scripts/agent-check

Everything else remains protected by default. Changing this allowlist, its rules, its digest, the wrapper, the original checker copy, the focused tests, the workflow, or either evidence document requires a new scope candidate and attestation.

Security properties

• Unknown paths fail closed.
• A matching filename is insufficient: operation, mode, object type, and blob identity are checked.
• Deletion is never allowed by the initial readiness rules.
• Renames and copies are rejected rather than inferred.
• Symlinks and submodules cannot masquerade as allowed text/scripts.
• Recursive-tree truncation is rejected.
• The original exact evidence-only relationship remains tested and available for the historic mutation suite.
• Candidate scope does not claim retained validity; it only permits the trust-root itself to be tested.
• Passed scope requires immutable source/run provenance and a second exact-head CI run.

Scope and risk

Risk: R4 evidence trust root.

This PR does not change:

• Rust implementation or public protocol records;
• schemas, IDs, digests, transitions, migrations, persistence, dispatch, cancellation, or recovery;
• test/conformance fixtures or the G2 test manifest;
• Cargo dependencies, lockfile, Rust toolchain, or cargo-deny policy;
• the historic G2 evidence document;
• the current evidence source hashes, commands, expected matrix, Coven inputs, or historic successful run.

Tracking

• Fixes Scope retained G2 evidence validity to the attested contract surface #16 after the final passed-scope evidence run and review
• Blocks Land Psyche repository and agent-readiness foundation #10 and draft PR Establish Psyche roadmap and agent-readiness foundation #15
• Related to Establish Psyche security, release, support, and governance readiness #14

Candidate-head validation before push

• One commit, seven expected files, zero base divergence
• Original checker core uses the exact existing blob f5d8ce9ec62bb92e2041e8ebf4dd2423d9d5cfdd
• Scope manifest uses default: protected and ten exact paths
• Scope manifest SHA-256 is pinned in code and evidence
• Modified workflow SHA-256 is pinned in the wrapper
• Focused scope test suite covers allow, deny, deletion, mode, symlink, submodule, rename, copy, unsafe-path, duplicate-path, compare, and tree-truncation behavior

Required candidate evidence

• Rust format/clippy/workspace tests on Linux, macOS, and Windows
• Fixed-seed state machine on Linux, macOS, and Windows
• C-S1–C-S12 conformance on Linux, macOS, and Windows
• migrations, crash recovery, and fault-injection clippy on all three platforms
• original G2 mutation suite on all three platforms
• new scope regression suite on all three platforms
• relationship verifier on all three platforms
• dependency audit
• full-history secret scan
• npm wrapper and pack dry run on Node 20 and 22
• maintainer review of trust-root and fail-closed behavior

Final evidence step

After the candidate run succeeds:

1. record the exact candidate SHA and immutable run URL in docs/G2-SCOPE-EVIDENCE.md;
2. commit only that evidence-file modification;
3. rerun the complete workflow;
4. verify the candidate-source tree and final tree differ only by the permitted evidence transition;
5. link both exact heads and runs in Scope retained G2 evidence validity to the attested contract surface #16 before merge.

Rollback

Revert this PR to restore the original checker path and workflow. No data or protocol migration occurs. Draft PR #15 remains blocked until this trust-root change is accepted rather than bypassed.