@amaster.ai/employee-runtime-connector 0.1.0-beta.2 → 0.1.0-beta.21

package/README.md

@@ -21,6 +21,8 @@ Do not use `latest`, `^`, or `~` in a runtime image. The image tag and connector
 
 Immutable images should pin an exact package version as their baseline. The current connector does not download or replace runtime code while running; package upgrades and rollbacks belong to the image build and rollout.
 
+The publish workflow verifies that npm records the publishing commit as the package `gitHead`, then updates the repository deployment pin. Remote deployment accepts that package only when its `gitHead` is an ancestor of the target source commit and the connector package path is unchanged between them. This path-only comparison is valid because the published connector is self-contained; if runtime code starts importing workspace source outside this package, expand the provenance scope and tests before release. After restart, deployment also verifies the package CLI version inside the container. Do not update the deployment pin manually to bypass either provenance check.
+
 ## Package Contents
 
 - `dist/amaster-runtime.mjs`: configuration, pairing, workspace, diagnostics, and daemon lifecycle CLI.
@@ -30,6 +32,14 @@ The source of truth lives under this package's `src/` directory. The package bui
 
 Runtime code belongs in the container image. Persist only connector state, the result outbox, and workspaces under the configured state directory.
 
+## Mutation attestation
+
+The daemon reports its connector contract, exact package/build, platform/architecture, and discovered executor versions on every heartbeat. The server compares those facts with `AMASTER_RUNTIME_RECOMMENDED_VERSION` and `AMASTER_RUNTIME_RECOMMENDED_BUILD_COMMIT`, persists a short-lived content-bound attestation, and correlates Runtime V2 commands to that proof.
+
+`AMASTER_RUNTIME_ATTESTATION_MODE` defaults to `shadow`. Set it to `enforce` only after the expected version and build marker are configured and shadow diagnostics are clean; enforce mode refuses to create or lease Runtime V2 mutation commands without a current exact attestation. `AMASTER_RUNTIME_ATTESTATION_TTL_SECONDS` defaults to `300` and accepts `60`–`3600`. Invalid mode or TTL values fail server startup visibly.
+
+Threat model: these facts are self-reported by a connector authenticated with its existing connector credential. There is no hardware-backed signature, remote attestation, or independent trust root. The proof detects accidental version/schema/executor drift by an honest connector and correlates commands to the observed facts; it does not prove that a compromised or malicious connector is running the claimed code. Keep the default `shadow` mode observational. Do not treat this mechanism as a production security boundary or enable `enforce` until credential-epoch identity, transactional create/lease revalidation, batch-local rejection, and recovery from honest drift have passed review.
+
 The AMaster remote stack derives its runtime image from the Pi base image with
 `docker/Dockerfile.amaster-employee-pi-cli-runtime`. The build installs one exact
 connector package version under `/opt/pi-cli-runtime` and sets