border-customs 0.8.0 → 0.8.1

package/README.md

@@ -118,7 +118,18 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
    against the history of every ref *and* against the object set a remote does not already
    have (the transmit set). Oversized-file, checked-in-binary, and notebook-output rules
    round it out.
-7. **Registry pre-flight** (npm, PyPI, crates.io, and RubyGems targets). Three outcomes per
+7. **Landing-grade tip lens.** The exact machinery `border push` uses to verify a landing
+   (`scanTipTree`: the tip tree materialized from git objects into a throwaway directory,
+   scanned by the native exfil family plus both twins filtered to `exfil-*` ids) also runs
+   here, against local HEAD — the tree a push would transmit. This closes the
+   disk-versus-tip gap: content that exists only in HEAD (introduced by a merge commit's
+   resolution and since deleted from disk, say) is invisible to the history and working-tree
+   legs above but cannot hide from the gate. Tip findings merge before the allow-list, so a
+   config `allow` pin exempts them by rule+file+digest exactly like every other finding, and
+   the post-push landing check honors the *same* pins — a green packet means green landing, in
+   both directions. The tip leg's git plumbing is fail-closed: a git failure aborts the run
+   (exit 2), never a silent clean.
+8. **Registry pre-flight** (npm, PyPI, crates.io, and RubyGems targets). Three outcomes per
    target: version already published ⇒ CRITICAL `version-exists` ("bump version required");
    name owned by someone outside your `rules.authors` allow-list ⇒ CRITICAL
    `name-foreign-owner`; ambiguous ownership signals ⇒ also CRITICAL, because guessing wrong
@@ -129,7 +140,7 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
    one of that API's exact *absent* messages (its 404s are text, not JSON, and an
    unrecognized one is never guessed), a timeout, or unparseable JSON all fail closed as
    exit 2. An unreachable registry blocks the push instead of letting it run blind.
-8. **Artifact stage.** If registry targets are configured, packages are built **once** into
+9. **Artifact stage.** If registry targets are configured, packages are built **once** into
     `.border/dist/` (`npm pack --ignore-scripts`, `python -m build --no-isolation`,
     `cargo package --allow-dirty --no-verify`, `gem build <name>.gemspec -o .border/dist/`),
     that exact byte-stream is scanned (gitleaks + secretlint over the extracted contents),
@@ -145,14 +156,16 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
     re-runs the check's exact `cargo package` into a throwaway directory and refuses to
     publish if the fresh digest differs from the certified `.crate`. `gem push` uploads the
     recorded `.gem` byte-for-byte, so it needs no such re-assertion.
-9. **Report.** Findings carry `valueDigest` (sha256 of the matched value) and a masked
+10. **Report.** Findings carry `valueDigest` (sha256 of the matched value) and a masked
    snippet: fully blocked for short values, else `first4…last4`. Raw secret bytes never
    leave process memory. A per-run `TextSanitizer` holds the digest-to-value registry and
    replaces every flagged literal in *all* rendered text, including agent-written strings in
    the LLM layer, so a secret cannot reappear inside a message about itself. `report.json`
    (canonical, byte-stable for machines) and `report.md` land under `.border/runs/`.
-10. **Ledger record.** A PASS is appended to `.border/ledger.jsonl` together with the key
-    and artifact digests. Degraded and NO-OP runs can never write a PASS.
+11. **Ledger record.** A PASS is appended to `.border/ledger.jsonl` together with the key
+    and artifact digests. Degraded and NO-OP runs can never write a PASS. The key folds in a
+    *lens identity*, so a PASS recorded under an older, weaker set of legs never certifies a
+    push under the current lens — upgrading the gate forces one fresh full check.
 
 ```bash
 $ border check          # full scan, ~seconds on a mid-size repo
@@ -251,6 +264,7 @@ lives inside. The exfil lens adds five rules over the surfaces about to become p
 | `exfil-home-path` | `/home/<user>` and `C:\Users\<user>` shapes |
 | `exfil-cred-location` | `~/.pypirc`, `SSHPASS`, `*.env` credential-location shapes |
 | `exfil-host-profile` | multi-signal host fingerprints (os+version / no-docker / no-passwordless-sudo co-occurrences in one paragraph) |
+| `exfil-machine-binding` | vendor inference-model ids pinned on portable surfaces next to model/default/provider context (L-MACHINE-LOCAL; born 2026-10-02) |
 
 The severity a reader **observes** is the (rule × facet × channel) matrix, and its single
 home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, the
@@ -264,11 +278,13 @@ home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, t
 | `exfil-home-path` | tree | native | MEDIUM |
 | `exfil-cred-location` | tree | native | MEDIUM |
 | `exfil-host-profile` | tree | native | MEDIUM |
+| `exfil-machine-binding` | tree | native | MEDIUM |
 | `exfil-rfc1918` | message | native | HIGH |
 | `exfil-ssh-target` | message | native | HIGH |
 | `exfil-home-path` | message | native | MEDIUM |
 | `exfil-cred-location` | message | native | MEDIUM |
 | `exfil-host-profile` | message | native | MEDIUM |
+| `exfil-machine-binding` | message | native | MEDIUM |
 
 Why an observed `CRITICAL` stands where the intent table says HIGH: the twin channels have
 no HIGH rung — every ingested gitleaks finding carries CRITICAL, and secretlint's `error`
@@ -411,7 +427,10 @@ never from cache:
   and exits 1; a rerun of `border push --yes` picks up only the still-PENDING targets.
 - After every git leg that moved, border **verifies the landing**: it re-observes the remote
   tip (`git ls-remote`, then a fetch of exactly that tip when it is not local) and scans the
-  landed tree with the same exfil machinery as `border exfil`. Three honest outcomes: clean
+  landed tree with the same exfil machinery as `border exfil` — the same lens `border check`
+  now runs pre-push, and the same config `allow` pins apply: blocking counts are computed
+  after the allow-list, and any exemption is echoed loudly (rule, entry index, count), never
+  silent. Three honest outcomes: clean
   appends a `t:"landing"` ledger record and preserves the push exit; a blocking hit exits 1
   with `ALREADY PUBLIC; border detects, never erases` — the bytes are out, and border's job
   there is detection, recording the fact, never rewriting history; an unobservable tip exits
@@ -717,7 +736,7 @@ plugin entry ships as `exports["./server"]`):
 ```jsonc
 {
   // pin the exact version — an @latest channel hits the registry on every cold start
-  "plugin": ["border-customs@0.8.0"]
+  "plugin": ["border-customs@0.8.1"]
 }
 ```
 
@@ -827,6 +846,13 @@ which is now a thin consumer of `inspect --json` with the rc contract unchanged
 
 ## Changelog
 
+### 0.8.1 (2026-10-06)
+- Maintenance release: certificate-chain rebuild off the scrubbed lineage (INCIDENT-20261006
+  identity-exposure cleanup). No functional change vs 0.8.0; 0.8.0's tarball is byte-intact but
+  its OIDC provenance pin moved with the history rewrite, so a fresh tag + publish restores a
+  verifiable chain. Rotation: package.json + lock roots + plugin marker + scan UA + README pins +
+  this entry.
+
 ### 0.8.0 (2026-09-30)
 - Add: **`border opencode inspect [--json]`** — the load-surface self-audit becomes a gate-owned
   surface: six read-only aspects (cache self-consistency, spec freshness vs pin/registry, identity
@@ -868,7 +894,7 @@ which is now a thin consumer of `inspect --json` with the rc contract unchanged
 
 ### 0.6.0 (2026-09-25)
 - Add: **the exfil lens** — five rules (`exfil-rfc1918`, `exfil-ssh-target`,
-  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`) that flag
+  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`, `exfil-machine-binding`) that flag
   exfil-shaped literals on about-to-be-public surfaces, the gap classic secret
   scanners leave open because an internal IP is not a credential. The observed
   severity of every (rule × facet × channel) cell lives in one machine-readable
@@ -1065,4 +1091,4 @@ border 是一个 fail-closed(失败即拦截)的推送前门禁 CLI:`npm install
 
 OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/exfil/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
 
-外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。
+外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。2026-10-04 补上透镜对等:check 流水线在原生规则之后、注册表预检之前多跑一条**树尖腿**,用与落地核验完全同一套 scanTipTree 机制预扫本地 HEAD(push 将传输的那棵树),历史与工作面腿看不见的"只在树尖存在"内容(如合并提交解析引入、随后从磁盘删除的文件)从此无处藏;树尖发现汇入 allow 前合并点,按 rule+file+digest 与所有发现同权豁免——落地核验同样消费 cfg allow 并把每一次豁免大声列出(规则、条目号、条数),绝不沉默;绿色交接单与绿色落地双向一致。ledger key 折入透镜身份,旧一代(无树尖腿)的缓存 PASS 不再为新透镜背书,升级后强制一次全新全扫。树尖腿 git 故障即 exit 2,没有静默清白。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。

package/dist/assets/exfil-src/rules.ts

@@ -176,4 +176,4 @@ export function matchSshTarget(text: string, o: RuleOptions): RuleHit[] {
 // matchHomePath / matchCredLocation / matchHostProfile live in rulesPath.ts
 // and are re-exported here so every consumer keeps importing the five
 // predicates from one module. Type-only imports keep that pair acyclic.
-export { matchCredLocation, matchHomePath, matchHostProfile } from "./rulesPath.ts";
+export { matchCredLocation, matchHomePath, matchHostProfile, matchMachineBinding } from "./rulesPath.ts";

package/dist/assets/exfil-src/rulesPath.ts

@@ -110,3 +110,31 @@ export function matchHostProfile(text: string, _o: RuleOptions): RuleHit[] {
   flush();
   return hits;
 }
+
+// ---------------------------------------------------------------- exfil-machine-binding
+
+/**
+ * L-MACHINE-LOCAL (owner ruling 2026-10-01; rule born 2026-10-02 after a
+ * vendor model id sat in another repo's portable README+code default for six
+ * releases unnoticed). Vendor inference-model identifiers pinned on portable
+ * surfaces couple a package to ONE operator's device authorization. Context
+ * gate: the line must ALSO speak of model/default/provider — prose mentions
+ * of a model name stay green (location, not vocabulary — mirrors the
+ * cred-location "position, not value" discipline).
+ * Self-stealth: literals are built in fragments so THIS file never trips
+ * its own regex.
+ */
+const BINDING_TOKEN = String.raw`\b(?:q` + "wen" + String.raw`|deep` + "seek" + String.raw`|kimi|g` + "lm" + String.raw`|ernie|dou` + "bao" + String.raw`|hunyuan|sp` + "ark" + String.raw`)[-\.\d][\w.-]*\b`;
+const BINDING_VENDOR_RE = new RegExp(BINDING_TOKEN, "gi");
+const BINDING_CONTEXT_RE = /(?:model|模型|default|默认|provider)/i;
+
+export function matchMachineBinding(text: string, _o: RuleOptions): RuleHit[] {
+  const hits: RuleHit[] = [];
+  text.split("\n").forEach((body, idx) => {
+    if (!BINDING_CONTEXT_RE.test(body)) return;
+    for (const m of body.matchAll(BINDING_VENDOR_RE)) {
+      hits.push({ rule: "exfil-machine-binding", matched: m[0] ?? "", line: idx + 1, message: "Machine binding: a vendor inference-model id pinned next to model/default/provider context — device authorization belongs in operator-local config, not portable surfaces (L-MACHINE-LOCAL)." });
+    }
+  });
+  return hits;
+}

package/dist/assets/exfil-src/scan.ts

@@ -40,6 +40,7 @@ import {
 import {
   matchCredLocation,
   matchHomePath,
+  matchMachineBinding,
   matchHostProfile,
   matchRfc1918,
   matchSshTarget,
@@ -99,6 +100,7 @@ const PREDICATES: Readonly<Record<ExfilRuleId, (text: string, o: RuleOptions) =>
   "exfil-home-path": matchHomePath,
   "exfil-cred-location": matchCredLocation,
   "exfil-host-profile": matchHostProfile,
+  "exfil-machine-binding": matchMachineBinding,
 };
 
 /**

package/dist/assets/exfil-src/severity.ts

@@ -44,13 +44,14 @@
 export const EXFIL_SEVERITIES = ["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"] as const;
 export type ExfilSeverity = (typeof EXFIL_SEVERITIES)[number];
 
-/** The five exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
+/** The exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
 export const EXFIL_RULE_IDS = [
   "exfil-rfc1918",
   "exfil-ssh-target",
   "exfil-home-path",
   "exfil-cred-location",
   "exfil-host-profile",
+  "exfil-machine-binding",
 ] as const;
 export type ExfilRuleId = (typeof EXFIL_RULE_IDS)[number];
 
@@ -71,6 +72,7 @@ export const EXFIL_TABLE_SEVERITY: Readonly<Record<ExfilRuleId, ExfilSeverity>>
   "exfil-home-path": "MEDIUM",
   "exfil-cred-location": "MEDIUM",
   "exfil-host-profile": "MEDIUM",
+  "exfil-machine-binding": "MEDIUM",
 };
 
 /** HIGH family: the two identity-carrying location rules; tree face belongs to the twins. */
@@ -85,7 +87,7 @@ export const EXFIL_HIGH_FAMILY: readonly ExfilRuleId[] = ["exfil-rfc1918", "exfi
  */
 export const EXFIL_SECRET_VALUE_RULES: readonly ExfilRuleId[] = EXFIL_HIGH_FAMILY;
 /** MEDIUM family: privacy-shape rules; native carries them on both scanned facets. */
-export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile"];
+export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile", "exfil-machine-binding"];
 
 /** null = FORBIDDEN cell: that channel must never emit that rule on that facet. */
 export type ObservedSeverity = ExfilSeverity | null;
@@ -96,6 +98,7 @@ const TWIN_HIGH: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-home-path": null,
   "exfil-cred-location": null,
   "exfil-host-profile": null,
+  "exfil-machine-binding": null,
 };
 const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-rfc1918": null,
@@ -103,13 +106,14 @@ const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-home-path": null,
   "exfil-cred-location": null,
   "exfil-host-profile": null,
+  "exfil-machine-binding": null,
 };
 
 /** The full (facet × channel × rule) truth table — the plan's 分面契约, machine-readable. */
 export const EXFIL_MATRIX: Readonly<Record<ExfilFacet, Readonly<Record<ExfilChannel, Readonly<Record<ExfilRuleId, ObservedSeverity>>>>>> = {
   tree: {
     // native tree leg = MEDIUM family补发 only (v2 double-emission revoked).
-    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM" },
+    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM", "exfil-machine-binding": "MEDIUM" },
     // gitleaks.ts:81 hardcodes CRITICAL for every ingested finding.
     "gitleaks-twin": TWIN_HIGH,
     // secretlint.ts:299-309 has no HIGH rung — error maps to CRITICAL as-is.

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "border-customs",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "border-customs",
-      "version": "0.8.0",
+      "version": "0.8.1",
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "^1.17.4",