border-customs 0.7.1 → 0.8.1

package/README.md

@@ -118,7 +118,18 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
    against the history of every ref *and* against the object set a remote does not already
    have (the transmit set). Oversized-file, checked-in-binary, and notebook-output rules
    round it out.
-7. **Registry pre-flight** (npm, PyPI, crates.io, and RubyGems targets). Three outcomes per
+7. **Landing-grade tip lens.** The exact machinery `border push` uses to verify a landing
+   (`scanTipTree`: the tip tree materialized from git objects into a throwaway directory,
+   scanned by the native exfil family plus both twins filtered to `exfil-*` ids) also runs
+   here, against local HEAD — the tree a push would transmit. This closes the
+   disk-versus-tip gap: content that exists only in HEAD (introduced by a merge commit's
+   resolution and since deleted from disk, say) is invisible to the history and working-tree
+   legs above but cannot hide from the gate. Tip findings merge before the allow-list, so a
+   config `allow` pin exempts them by rule+file+digest exactly like every other finding, and
+   the post-push landing check honors the *same* pins — a green packet means green landing, in
+   both directions. The tip leg's git plumbing is fail-closed: a git failure aborts the run
+   (exit 2), never a silent clean.
+8. **Registry pre-flight** (npm, PyPI, crates.io, and RubyGems targets). Three outcomes per
    target: version already published ⇒ CRITICAL `version-exists` ("bump version required");
    name owned by someone outside your `rules.authors` allow-list ⇒ CRITICAL
    `name-foreign-owner`; ambiguous ownership signals ⇒ also CRITICAL, because guessing wrong
@@ -129,7 +140,7 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
    one of that API's exact *absent* messages (its 404s are text, not JSON, and an
    unrecognized one is never guessed), a timeout, or unparseable JSON all fail closed as
    exit 2. An unreachable registry blocks the push instead of letting it run blind.
-8. **Artifact stage.** If registry targets are configured, packages are built **once** into
+9. **Artifact stage.** If registry targets are configured, packages are built **once** into
     `.border/dist/` (`npm pack --ignore-scripts`, `python -m build --no-isolation`,
     `cargo package --allow-dirty --no-verify`, `gem build <name>.gemspec -o .border/dist/`),
     that exact byte-stream is scanned (gitleaks + secretlint over the extracted contents),
@@ -145,14 +156,16 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
     re-runs the check's exact `cargo package` into a throwaway directory and refuses to
     publish if the fresh digest differs from the certified `.crate`. `gem push` uploads the
     recorded `.gem` byte-for-byte, so it needs no such re-assertion.
-9. **Report.** Findings carry `valueDigest` (sha256 of the matched value) and a masked
+10. **Report.** Findings carry `valueDigest` (sha256 of the matched value) and a masked
    snippet: fully blocked for short values, else `first4…last4`. Raw secret bytes never
    leave process memory. A per-run `TextSanitizer` holds the digest-to-value registry and
    replaces every flagged literal in *all* rendered text, including agent-written strings in
    the LLM layer, so a secret cannot reappear inside a message about itself. `report.json`
    (canonical, byte-stable for machines) and `report.md` land under `.border/runs/`.
-10. **Ledger record.** A PASS is appended to `.border/ledger.jsonl` together with the key
-    and artifact digests. Degraded and NO-OP runs can never write a PASS.
+11. **Ledger record.** A PASS is appended to `.border/ledger.jsonl` together with the key
+    and artifact digests. Degraded and NO-OP runs can never write a PASS. The key folds in a
+    *lens identity*, so a PASS recorded under an older, weaker set of legs never certifies a
+    push under the current lens — upgrading the gate forces one fresh full check.
 
 ```bash
 $ border check          # full scan, ~seconds on a mid-size repo
@@ -251,6 +264,7 @@ lives inside. The exfil lens adds five rules over the surfaces about to become p
 | `exfil-home-path` | `/home/<user>` and `C:\Users\<user>` shapes |
 | `exfil-cred-location` | `~/.pypirc`, `SSHPASS`, `*.env` credential-location shapes |
 | `exfil-host-profile` | multi-signal host fingerprints (os+version / no-docker / no-passwordless-sudo co-occurrences in one paragraph) |
+| `exfil-machine-binding` | vendor inference-model ids pinned on portable surfaces next to model/default/provider context (L-MACHINE-LOCAL; born 2026-10-02) |
 
 The severity a reader **observes** is the (rule × facet × channel) matrix, and its single
 home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, the
@@ -264,11 +278,13 @@ home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, t
 | `exfil-home-path` | tree | native | MEDIUM |
 | `exfil-cred-location` | tree | native | MEDIUM |
 | `exfil-host-profile` | tree | native | MEDIUM |
+| `exfil-machine-binding` | tree | native | MEDIUM |
 | `exfil-rfc1918` | message | native | HIGH |
 | `exfil-ssh-target` | message | native | HIGH |
 | `exfil-home-path` | message | native | MEDIUM |
 | `exfil-cred-location` | message | native | MEDIUM |
 | `exfil-host-profile` | message | native | MEDIUM |
+| `exfil-machine-binding` | message | native | MEDIUM |
 
 Why an observed `CRITICAL` stands where the intent table says HIGH: the twin channels have
 no HIGH rung — every ingested gitleaks finding carries CRITICAL, and secretlint's `error`
@@ -411,7 +427,10 @@ never from cache:
   and exits 1; a rerun of `border push --yes` picks up only the still-PENDING targets.
 - After every git leg that moved, border **verifies the landing**: it re-observes the remote
   tip (`git ls-remote`, then a fetch of exactly that tip when it is not local) and scans the
-  landed tree with the same exfil machinery as `border exfil`. Three honest outcomes: clean
+  landed tree with the same exfil machinery as `border exfil` — the same lens `border check`
+  now runs pre-push, and the same config `allow` pins apply: blocking counts are computed
+  after the allow-list, and any exemption is echoed loudly (rule, entry index, count), never
+  silent. Three honest outcomes: clean
   appends a `t:"landing"` ledger record and preserves the push exit; a blocking hit exits 1
   with `ALREADY PUBLIC; border detects, never erases` — the bytes are out, and border's job
   there is detection, recording the fact, never rewriting history; an unobservable tip exits
@@ -491,7 +510,7 @@ border <command> [options]
 | `llm-ingest <findings.json>` | validate agent findings and record the combined verdict |
 | `scan <[ecosystem:]name@version>` | inspect a third-party published artifact for residue before installing it |
 | `exfil <rev\|url>` | read-only exfil lens over a local rev or a remote URL (tip tree by default) |
-| `opencode <install\|status\|uninstall>` | install/status/uninstall the official OpenCode plugin adapter |
+| `opencode <install\|status\|uninstall\|inspect>` | install/status/uninstall the official OpenCode plugin adapter; `inspect` audits this machine's V1 load surface |
 
 Every subcommand accepts the same global flags (verified against `border <cmd> --help`):
 
@@ -717,7 +736,7 @@ plugin entry ships as `exports["./server"]`):
 ```jsonc
 {
   // pin the exact version — an @latest channel hits the registry on every cold start
-  "plugin": ["border-customs@0.7.1"]
+  "plugin": ["border-customs@0.8.1"]
 }
 ```
 
@@ -752,7 +771,7 @@ The `/border` slash command stays V1-only until the V2 command-delivery API sett
 
 What loads is one agent tool `border` plus a `/border` slash command. The tool spawns the CLI
 argv-only (no shell; 300 s cap, 64 KiB per stream) restricted to the closed command list
-`check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`, `roundtrip`, `--help`, and
+`check`, `push`, `status`, `llm-request`, `llm-ingest`, `scan`, `roundtrip`, `exfil`, `--help`, and
 renders the exit-code contract unchanged: 0 pass, 1 gate-blocked or partial push, 2 the gate
 could not answer — which since 0.5.1 also covers "no border CLI found or verified": the tool
 answers exit 2 cannot-answer and spawns nothing else. The tool REFUSES `--yes` — a real push
@@ -769,6 +788,18 @@ HTTP assertions — the `border` tool id present, `/border` present exactly once
 fails); plugin load failures are silent, so judge by the HTTP responses, never by the exit
 code.
 
+`border opencode inspect [--json]` audits this machine's **V1 load surface** as one gate-owned
+command: six read-only aspects — cache self-consistency (package.json vs plugin marker line),
+spec freshness (exact pin offline; dist-tag against the registry), the 0.5.1 identity handshake
+replayed against the CLI resolver's candidate order, Route A byte parity, Route A∧B dual-registration
+collision, and the scope declaration — aggregated fail-closed: any FAIL exits 1, else any CANNOT
+exits 2, all PASS exits 0. The certificate boundary is printed, not implied: `--json` carries
+`scope:"v1"`, and V2 load surfaces (project-local `.opencode/plugins/`, npm-prefix layouts, lazy
+activation) are a DECLARED BLIND SPOT pending V2 stabilization — a PASS is never evidence that
+"the whole machine is clean". The tool never writes: `--purge` lives in the drift-watch cron shell,
+which is now a thin consumer of `inspect --json` with the rc contract unchanged
+(FRESH 0 / DRIFT 1 / NOT-CACHED 0 / CANNOT 2).
+
 ## What this is not
 
 - **Not a vault or secret manager.** It detects credentials on their way out; it does not
@@ -815,6 +846,27 @@ code.
 
 ## Changelog
 
+### 0.8.1 (2026-10-06)
+- Maintenance release: certificate-chain rebuild off the scrubbed lineage (INCIDENT-20261006
+  identity-exposure cleanup). No functional change vs 0.8.0; 0.8.0's tarball is byte-intact but
+  its OIDC provenance pin moved with the history rewrite, so a fresh tag + publish restores a
+  verifiable chain. Rotation: package.json + lock roots + plugin marker + scan UA + README pins +
+  this entry.
+
+### 0.8.0 (2026-09-30)
+- Add: **`border opencode inspect [--json]`** — the load-surface self-audit becomes a gate-owned
+  surface: six read-only aspects (cache self-consistency, spec freshness vs pin/registry, identity
+  handshake replay, Route A byte parity, Route A∧B dual-route collision, scope declaration),
+  fail-closed aggregation FAIL 1 > CANNOT 2 > PASS 0. `--json` pins `scope:"v1"` — V2 load surfaces
+  are a declared blind spot, not silently covered. Zero writes; `--purge` stays in the cron shell.
+- Change: **`exfil` joins the plugin's closed command list** (owner ruling R1 under the four-question
+  eligibility gate — no mutation, no credentials, no foreign-byte execution, no local egress;
+  packet: `.omo/evidence/F-EXFIL-ALLOWLIST-RULING-2026-09-30.md`). `border opencode …` verbs stay
+  terminal-only: they mutate `$XDG_CONFIG_HOME` and fail the gate's first question.
+- Change: `tools/plugin-drift-watch.mjs` retires to a thin shell over `border opencode inspect --json`
+  (single source of verdicts); the cron rc contract is byte-stable — FRESH 0, DRIFT 1, NOT-CACHED 0
+  (special-cased per ruling B2), CANNOT 2 — and the crontab line is unchanged.
+
 ### 0.7.1 (2026-09-30)
 - Fix: **release-gate test ruler race** (`test/push.integration.test.ts` I4) — the
   "dry-run made ZERO verdaccio requests" invariant counted lines in verdaccio's stdout
@@ -842,7 +894,7 @@ code.
 
 ### 0.6.0 (2026-09-25)
 - Add: **the exfil lens** — five rules (`exfil-rfc1918`, `exfil-ssh-target`,
-  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`) that flag
+  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`, `exfil-machine-binding`) that flag
   exfil-shaped literals on about-to-be-public surfaces, the gap classic secret
   scanners leave open because an internal IP is not a credential. The observed
   severity of every (rule × facet × channel) cell lives in one machine-readable
@@ -1000,6 +1052,8 @@ MIT, see [LICENSE](LICENSE).
 
 ## 中文概要
 
+**0.8.0（2026-09-30）装载面自审计**：`border opencode inspect [--json]` 把散在插件、cron 脚本与安装器里的装载检查制度化为门禁自有表面——六个只读方面（缓存自洽：package.json 对插件 marker 行；spec 新鲜度：exact pin 离线比、dist-tag 问注册表；身份握手按 CLI 候选序重放；Route A 字节 parity；A∧B 双注册相撞；scope 声明），fail-closed 聚合：任一 FAIL 退 1，否则任一 CANNOT 退 2，全 PASS 退 0。`--json` 面值钉死 `scope:"v1"`：V2 装载面（项目本地 `.opencode/plugins/`、npm-prefix 布局、懒激活态）是**声明的盲区**而非被覆盖——PASS 永远不等于"全机干净"。工具零写入；`--purge` 留在 cron 薄壳，壳的 rc 合同原样保持（FRESH 0 / DRIFT 1 / NOT-CACHED 0（裁定 B2 特判）/ CANNOT 2），crontab 一行未动。exfil 依主人裁定（R1）进插件命令闭集——四问判据全过：不变异、不碰凭据、不执行外来字节、不外传本地数据；`border opencode` 动词组因写 `$XDG_CONFIG_HOME` 留在终端侧。裁决包：`.omo/evidence/F-EXFIL-ALLOWLIST-RULING-2026-09-30.md`。
+
 **0.7.1（2026-09-30）发布门禁尺伤修复**：I4 集成测试的"dry-run 对 registry 零请求"断言按 verdaccio stdout 日志行计数，而日志是最终一致视图——CI 满载 runner 上更早阶段的合法 probe 行晚于快照落盘，把差额错记到 dry-run 头上（v0.7.0 run 36671401844 红 `6 !== 2`，同字节本机绿）。修复=尺子不松语义：所有快照前后加 FIFO drain 屏障（哨兵请求行可见⇒先前请求行必已落盘；哨兵流量不计入计数）。dry-run 零网络契约本身未动，两侧实测请求为零。
 
 **0.7.0（2026-09-28）OpenCode 2（beta）兼容**：插件模块双形状——V1 宿主调 `server()`（对象入口需 ≥1.18.29），V2 宿主（`opencode2`）调 `setup(ctx)` 经 `ctx.tool.transform` 注册同一个工具；spawn 前门（allowlist/`--yes`）与 0.5.1 身份握手两形状共享，双边渲染逐字 parity 由测试钉死。V2 懒激活（断言前须 `POST /api/plugin/await-activation`）；`/border` 命令暂仅 V1（V2 投递 API 未定形）；已在 beta-19271 项目本地两形态活体验证。V1 活体探针反真空化：opt-in 缺前提即 FAIL 点名补救。
@@ -1035,6 +1089,6 @@ border 是一个 fail-closed(失败即拦截)的推送前门禁 CLI:`npm install
 
 发布一致性(0.4.1):起因是 aihr 事故——PyPI 上标为 0.2.2 的 wheel 里 `__init__.__version__` 却写着 0.2.1,构件名、元数据与实际模块行为三者不一致,所有 `==0.2.2` 的用户静默装上了旧行为;同类漂移在本仓库也出现过两次(npm tarball 的 User-Agent 停在 0.3.0 而 package.json 是 0.3.1;package-lock.json 根版本两个 release 一直躺在 0.1.0)。发布阶段扫描器因此在构件内部逐源交叉核对版本号:`release-coherence-version-drift` 为 CRITICAL(package.json 与被强制打包的 package-lock、wheel 文件名对 dist-info 目录对 METADATA `Version:` 对 `__init__` 字面量、sdist 的 pyproject 对 PKG-INFO/setup 系字面量、Cargo.toml 对已打包的 Cargo.lock、.gemspec 对 metadata.gz、dist 文件名对 sdist 内 PKG-INFO);版本源存在但无法静态解析(动态 `__version__`、`attr:`、`dynamic = ["version"]`、坏 lockfile)判 MEDIUM `release-coherence-unverifiable-source`——不可核查绝不静默算干净;第二版本源根本没被打包时不发现在内,缺源不是漂移,这条边界是承重的,误报的门禁会把用户训练成 `--force`。唯一可静态强制的跨包管理器声明是 opt-in `release.twin`(`{pypi, npm}` 严格 zod 对列表,未知键 exit 2):同一 run 的 dist 里孪生版本不等 ⇒ CRITICAL `release-coherence-twin-drift`,消息点名两个构件。规则源文件与 residue 指纹表一样并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。
 
-OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
+OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/exfil/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
 
-外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。
+外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。2026-10-04 补上透镜对等:check 流水线在原生规则之后、注册表预检之前多跑一条**树尖腿**,用与落地核验完全同一套 scanTipTree 机制预扫本地 HEAD(push 将传输的那棵树),历史与工作面腿看不见的"只在树尖存在"内容(如合并提交解析引入、随后从磁盘删除的文件)从此无处藏;树尖发现汇入 allow 前合并点,按 rule+file+digest 与所有发现同权豁免——落地核验同样消费 cfg allow 并把每一次豁免大声列出(规则、条目号、条数),绝不沉默;绿色交接单与绿色落地双向一致。ledger key 折入透镜身份,旧一代(无树尖腿)的缓存 PASS 不再为新透镜背书,升级后强制一次全新全扫。树尖腿 git 故障即 exit 2,没有静默清白。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。

package/dist/assets/exfil-src/rules.ts

@@ -176,4 +176,4 @@ export function matchSshTarget(text: string, o: RuleOptions): RuleHit[] {
 // matchHomePath / matchCredLocation / matchHostProfile live in rulesPath.ts
 // and are re-exported here so every consumer keeps importing the five
 // predicates from one module. Type-only imports keep that pair acyclic.
-export { matchCredLocation, matchHomePath, matchHostProfile } from "./rulesPath.ts";
+export { matchCredLocation, matchHomePath, matchHostProfile, matchMachineBinding } from "./rulesPath.ts";

package/dist/assets/exfil-src/rulesPath.ts

@@ -110,3 +110,31 @@ export function matchHostProfile(text: string, _o: RuleOptions): RuleHit[] {
   flush();
   return hits;
 }
+
+// ---------------------------------------------------------------- exfil-machine-binding
+
+/**
+ * L-MACHINE-LOCAL (owner ruling 2026-10-01; rule born 2026-10-02 after a
+ * vendor model id sat in another repo's portable README+code default for six
+ * releases unnoticed). Vendor inference-model identifiers pinned on portable
+ * surfaces couple a package to ONE operator's device authorization. Context
+ * gate: the line must ALSO speak of model/default/provider — prose mentions
+ * of a model name stay green (location, not vocabulary — mirrors the
+ * cred-location "position, not value" discipline).
+ * Self-stealth: literals are built in fragments so THIS file never trips
+ * its own regex.
+ */
+const BINDING_TOKEN = String.raw`\b(?:q` + "wen" + String.raw`|deep` + "seek" + String.raw`|kimi|g` + "lm" + String.raw`|ernie|dou` + "bao" + String.raw`|hunyuan|sp` + "ark" + String.raw`)[-\.\d][\w.-]*\b`;
+const BINDING_VENDOR_RE = new RegExp(BINDING_TOKEN, "gi");
+const BINDING_CONTEXT_RE = /(?:model|模型|default|默认|provider)/i;
+
+export function matchMachineBinding(text: string, _o: RuleOptions): RuleHit[] {
+  const hits: RuleHit[] = [];
+  text.split("\n").forEach((body, idx) => {
+    if (!BINDING_CONTEXT_RE.test(body)) return;
+    for (const m of body.matchAll(BINDING_VENDOR_RE)) {
+      hits.push({ rule: "exfil-machine-binding", matched: m[0] ?? "", line: idx + 1, message: "Machine binding: a vendor inference-model id pinned next to model/default/provider context — device authorization belongs in operator-local config, not portable surfaces (L-MACHINE-LOCAL)." });
+    }
+  });
+  return hits;
+}

package/dist/assets/exfil-src/scan.ts

@@ -40,6 +40,7 @@ import {
 import {
   matchCredLocation,
   matchHomePath,
+  matchMachineBinding,
   matchHostProfile,
   matchRfc1918,
   matchSshTarget,
@@ -99,6 +100,7 @@ const PREDICATES: Readonly<Record<ExfilRuleId, (text: string, o: RuleOptions) =>
   "exfil-home-path": matchHomePath,
   "exfil-cred-location": matchCredLocation,
   "exfil-host-profile": matchHostProfile,
+  "exfil-machine-binding": matchMachineBinding,
 };
 
 /**

package/dist/assets/exfil-src/severity.ts

@@ -44,13 +44,14 @@
 export const EXFIL_SEVERITIES = ["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"] as const;
 export type ExfilSeverity = (typeof EXFIL_SEVERITIES)[number];
 
-/** The five exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
+/** The exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
 export const EXFIL_RULE_IDS = [
   "exfil-rfc1918",
   "exfil-ssh-target",
   "exfil-home-path",
   "exfil-cred-location",
   "exfil-host-profile",
+  "exfil-machine-binding",
 ] as const;
 export type ExfilRuleId = (typeof EXFIL_RULE_IDS)[number];
 
@@ -71,6 +72,7 @@ export const EXFIL_TABLE_SEVERITY: Readonly<Record<ExfilRuleId, ExfilSeverity>>
   "exfil-home-path": "MEDIUM",
   "exfil-cred-location": "MEDIUM",
   "exfil-host-profile": "MEDIUM",
+  "exfil-machine-binding": "MEDIUM",
 };
 
 /** HIGH family: the two identity-carrying location rules; tree face belongs to the twins. */
@@ -85,7 +87,7 @@ export const EXFIL_HIGH_FAMILY: readonly ExfilRuleId[] = ["exfil-rfc1918", "exfi
  */
 export const EXFIL_SECRET_VALUE_RULES: readonly ExfilRuleId[] = EXFIL_HIGH_FAMILY;
 /** MEDIUM family: privacy-shape rules; native carries them on both scanned facets. */
-export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile"];
+export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile", "exfil-machine-binding"];
 
 /** null = FORBIDDEN cell: that channel must never emit that rule on that facet. */
 export type ObservedSeverity = ExfilSeverity | null;
@@ -96,6 +98,7 @@ const TWIN_HIGH: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-home-path": null,
   "exfil-cred-location": null,
   "exfil-host-profile": null,
+  "exfil-machine-binding": null,
 };
 const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-rfc1918": null,
@@ -103,13 +106,14 @@ const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-home-path": null,
   "exfil-cred-location": null,
   "exfil-host-profile": null,
+  "exfil-machine-binding": null,
 };
 
 /** The full (facet × channel × rule) truth table — the plan's 分面契约, machine-readable. */
 export const EXFIL_MATRIX: Readonly<Record<ExfilFacet, Readonly<Record<ExfilChannel, Readonly<Record<ExfilRuleId, ObservedSeverity>>>>>> = {
   tree: {
     // native tree leg = MEDIUM family补发 only (v2 double-emission revoked).
-    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM" },
+    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM", "exfil-machine-binding": "MEDIUM" },
     // gitleaks.ts:81 hardcodes CRITICAL for every ingested finding.
     "gitleaks-twin": TWIN_HIGH,
     // secretlint.ts:299-309 has no HIGH rung — error maps to CRITICAL as-is.

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "border-customs",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "border-customs",
-      "version": "0.7.1",
+      "version": "0.8.1",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "^1.17.4",