fix(asset-compiler): bind source validation to opened objects

[blakinio]

Purpose

Remediate OTC2-AUD-003 by replacing pathname validation followed by ambient File::open with capability-relative, no-follow component traversal and validation on the exact opened source handle.

Implemented contract

• open the manifest parent once as a cap_std::fs::Dir capability;
• open the manifest relative to that capability without following its final link;
• traverse every validated normal source component relative to the capability;
• open every intermediate directory one component at a time with open_dir_nofollow;
• open the final source with FollowSymlinks::No;
• validate regular-file type and bounded size from the opened final handle;
• read all payload bytes from that same handle, with no accepted-path reopen;
• preserve the public compile_manifest(&Path, &Path) contract and pack format;
• use path metadata after open failure only for stable error classification.

Security evidence

• deterministic post-open substitution test proves replacing the pathname cannot redirect the current read;
• regular nested-directory integration test passes;
• intermediate directory symlink is rejected on Windows CI;
• existing final-symlink, traversal, special-file, oversize and deterministic-output coverage remains active;
• no unsafe project code or Win32/FFI.

Dependency review

cap-std = 4.0.2 and cap-fs-ext = 4.0.2 are pinned. Cargo 1.94.0 generated the lockfile. deny.toml records only exact reviewed capability-graph license and duplicate-version exceptions; advisories, wildcard and source policy remain fail-closed.

Decision record

oteryn-client/docs/architecture/decisions/2026-08-01-capability-safe-asset-source-open.md

Boundaries

No workflow, shared PR #23 documentation, external repository or unrelated runtime path remains in the diff.

Exact-head validation

Head 32557716b4455fa7d13094834f20b72ca8470e07 passed:

• Rust Client run 30699743934;
• Windows job 91368541996: locked metadata, rustfmt, strict Clippy, complete workspace tests and architecture validation;
• Supply Chain job 91368542008;
• CI run 30699744005, required job 91368653094;
• exact changed-file review: seven declared paths only;
• no comments, reviews or unresolved review threads;
• base main remains a16c7e7da32bdc96404845341fd72fbdf4db9bc3.

Task

OTC2-20260801-asset-open-integrity-remediation