border-customs 0.8.0 → 0.8.2

package/README.md

@@ -10,7 +10,7 @@ cd /path/to/your/repo
 border check
 ```
 
-Requires Node >= 22 and the `gitleaks` binary on `PATH` (border vendors the rule config for
+Requires Node >= 22.22.2 (the transitive `ini@7` dependency sets that floor) and the `gitleaks` binary on `PATH` (border vendors the rule config for
 gitleaks 8.30.1; the binary itself is yours to install, same as `git`). secretlint runs
 in-process as a bundled dependency. Each registry leg additionally shells out to its platform's
 own publisher, which must be on `PATH` whenever that target is configured; a missing publisher
@@ -18,14 +18,29 @@ binary is exit 2, never a skipped leg:
 
 | Registry target | Publisher border runs | Version the same-bytes proofs were measured on |
 | --- | --- | --- |
-| `npm` | `npm` | (unchanged since 0.1.0) |
+| `npm` | `npm` | npm >= 11 for packages with pack-phase hooks (see below) |
 | `pypi` | `python3 -m build` / `python3 -m twine` | (unchanged since 0.1.0) |
 | `crates` | `cargo` | cargo 1.93.1 (rustup) |
 | `rubygems` | `gem` | RubyGems 3.6.7 on ruby 3.3.8 |
 
+**npm pack safety probe.** `npm pack --ignore-scripts` is not trustworthy on npm 10: measured
+on npm 10.9.7, the target package's `prepare` script still executes (npm 11.19.1 is clean).
+Before packing, border runs `npm --version`. On npm < 11 it refuses, with a named exit 2, any
+package that declares a `prepack`, `prepare`, or `postpack` script — border never executes the
+code it audits. A package with none of those hooks has nothing for npm to run and stays
+scannable on npm 10. Installing npm >= 11 removes the refusal.
+
 Other toolchain versions of `cargo` and `gem` are untested by those byte-determinism proofs.
 Optional engines are listed in [Configuration](#configuration).
 
+**Pinned consumption.** Install an exact version (`npm install -g border-customs@<version>`;
+`npx border-customs@<version> check` for a one-off) instead of running gate code out of a
+source checkout. Every check and push record carries `engineBuild` — the identity
+(`<version>+<commit>[.dirty]`) of the border build that produced the verdict, the same string
+`border --version` prints. A `.dirty` suffix means the verdict came from uncommitted code, and
+records from one repo carrying different `engineBuild` values mean the audit trail is mixed:
+both are findings an auditor should chase, which is exactly why the identity is on the record face.
+
 ## The problem it solves
 
 The usual secret workflow is leak-then-repent: `git push`, notice the AWS key in the diff
@@ -118,7 +133,18 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
    against the history of every ref *and* against the object set a remote does not already
    have (the transmit set). Oversized-file, checked-in-binary, and notebook-output rules
    round it out.
-7. **Registry pre-flight** (npm, PyPI, crates.io, and RubyGems targets). Three outcomes per
+7. **Landing-grade tip lens.** The exact machinery `border push` uses to verify a landing
+   (`scanTipTree`: the tip tree materialized from git objects into a throwaway directory,
+   scanned by the native exfil family plus both twins filtered to `exfil-*` ids) also runs
+   here, against local HEAD — the tree a push would transmit. This closes the
+   disk-versus-tip gap: content that exists only in HEAD (introduced by a merge commit's
+   resolution and since deleted from disk, say) is invisible to the history and working-tree
+   legs above but cannot hide from the gate. Tip findings merge before the allow-list, so a
+   config `allow` pin exempts them by rule+file+digest exactly like every other finding, and
+   the post-push landing check honors the *same* pins — a green packet means green landing, in
+   both directions. The tip leg's git plumbing is fail-closed: a git failure aborts the run
+   (exit 2), never a silent clean.
+8. **Registry pre-flight** (npm, PyPI, crates.io, and RubyGems targets). Three outcomes per
    target: version already published ⇒ CRITICAL `version-exists` ("bump version required");
    name owned by someone outside your `rules.authors` allow-list ⇒ CRITICAL
    `name-foreign-owner`; ambiguous ownership signals ⇒ also CRITICAL, because guessing wrong
@@ -129,7 +155,7 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
    one of that API's exact *absent* messages (its 404s are text, not JSON, and an
    unrecognized one is never guessed), a timeout, or unparseable JSON all fail closed as
    exit 2. An unreachable registry blocks the push instead of letting it run blind.
-8. **Artifact stage.** If registry targets are configured, packages are built **once** into
+9. **Artifact stage.** If registry targets are configured, packages are built **once** into
     `.border/dist/` (`npm pack --ignore-scripts`, `python -m build --no-isolation`,
     `cargo package --allow-dirty --no-verify`, `gem build <name>.gemspec -o .border/dist/`),
     that exact byte-stream is scanned (gitleaks + secretlint over the extracted contents),
@@ -145,14 +171,16 @@ it, and the two registry-facing legs (pre-flight and publish) both have to agree
     re-runs the check's exact `cargo package` into a throwaway directory and refuses to
     publish if the fresh digest differs from the certified `.crate`. `gem push` uploads the
     recorded `.gem` byte-for-byte, so it needs no such re-assertion.
-9. **Report.** Findings carry `valueDigest` (sha256 of the matched value) and a masked
+10. **Report.** Findings carry `valueDigest` (sha256 of the matched value) and a masked
    snippet: fully blocked for short values, else `first4…last4`. Raw secret bytes never
    leave process memory. A per-run `TextSanitizer` holds the digest-to-value registry and
    replaces every flagged literal in *all* rendered text, including agent-written strings in
    the LLM layer, so a secret cannot reappear inside a message about itself. `report.json`
    (canonical, byte-stable for machines) and `report.md` land under `.border/runs/`.
-10. **Ledger record.** A PASS is appended to `.border/ledger.jsonl` together with the key
-    and artifact digests. Degraded and NO-OP runs can never write a PASS.
+11. **Ledger record.** A PASS is appended to `.border/ledger.jsonl` together with the key
+    and artifact digests. Degraded and NO-OP runs can never write a PASS. The key folds in a
+    *lens identity*, so a PASS recorded under an older, weaker set of legs never certifies a
+    push under the current lens — upgrading the gate forces one fresh full check.
 
 ```bash
 $ border check          # full scan, ~seconds on a mid-size repo
@@ -194,7 +222,7 @@ an installer *does*, per tier — the split behind opencode-ai's in-tree `postin
 The pairing classes behind these rows (multi-channel PASS **C5** subset/ordering discipline;
 **C9** interpolated-and-indirected root spellings; **C10** comment/quote-boundary shapes that
 once silent-passed) are frozen with their evidence in
-[src/artifacts/RESIDUE-CONTRACT.md](src/artifacts/RESIDUE-CONTRACT.md).
+[src/artifacts/RESIDUE-CONTRACT.md](https://github.com/TachikomaGundam/Border-Customs/blob/main/src/artifacts/RESIDUE-CONTRACT.md).
 
 **Fail-closed:** a residue scan whose rule table or classifier sources cannot be read is exit 2,
 never a silent pass — and the classifier source bytes are part of the ledger `rulesHash`, so
@@ -209,10 +237,30 @@ clean residue scan is an absence of matched signatures, never a certificate of b
 The signature table is deliberately closed, and the list of shapes it **cannot see** —
 content-writes, handle-variants, dead spellings, interpolation-then-slash, span-quirk
 over-blocks, IO-instance writers, user-shadowed bare verbs — lives in
-[RESIDUE-CONTRACT.md §8](src/artifacts/RESIDUE-CONTRACT.md); this README points, it does not
+[RESIDUE-CONTRACT.md §8](https://github.com/TachikomaGundam/Border-Customs/blob/main/src/artifacts/RESIDUE-CONTRACT.md); this README points, it does not
 restate. The empirical roundtrip (install → snapshot → uninstall → rc-delta-zero) is the 0.4.0
-valve. **border is NOT a malware sandbox**: it never executes, intercepts, or sandboxes the
-code it reads; it matches text and blocks the push.
+valve. **border does not execute the code it audits.** Every scan leg (gitleaks, secretlint,
+the native rules, the exfil lens) is pure byte inspection; the cross-channel marker fixture
+(`test/build.execMarkers.test.ts`) pins that a consentless `border check` spawns ZERO build
+toolchains. Registry artifact builds (npm pack, `python -m build`, `gem build`, `cargo
+ package`) DO execute repo-supplied build code, so they run only on operator consent:
+`--allow-builds`, or `allowBuilds: true` in the machine store / an explicit `--config` file
+outside the repo (the environment is deliberately NOT a consent source — a hostile `.envrc`
+owns it). Both sources live OUTSIDE the audited tree, and a repo's own border.yaml can declare
+targets but can never enable building them. Without
+consent the run is scan-only: no artifact digests are recorded (visible as MEDIUM
+`build-stage-withheld` findings), and a scan-only PASS can never back a registry publish.
+Consented builds can additionally run inside a **pinned container** (`targets.<ch>.sandboxImage`,
+see Configuration): the container is launched with the network disabled — the `--network none`
+argv the daemon applies is the enforcement anchor, and an in-container probe re-checks DNS and
+TCP from inside as a tripwire — the repo mounted read-only and built from a tmpfs copy, host
+credentials never entering the container, and every ledger record bound to the exact image
+digest that certified its bytes. `sandboxImage` itself is a security-tier key: honored only
+from the machine store or a `--config` file outside the repo whose ownership and modes pass
+the fd-chain qualification, and any competing declaration (repo config, lax-mode file, hijacked
+`XDG_CONFIG_HOME`) is a hard refusal, never a silent fallback. Border is
+containment-by-consent plus optional container containment — it is not a malware sandbox and
+not a VM: a kernel-level escape from the container remains in the threat model.
 
 #### Proof valve: `residue.requireProof` (0.4.0)
 
@@ -251,9 +299,10 @@ lives inside. The exfil lens adds five rules over the surfaces about to become p
 | `exfil-home-path` | `/home/<user>` and `C:\Users\<user>` shapes |
 | `exfil-cred-location` | `~/.pypirc`, `SSHPASS`, `*.env` credential-location shapes |
 | `exfil-host-profile` | multi-signal host fingerprints (os+version / no-docker / no-passwordless-sudo co-occurrences in one paragraph) |
+| `exfil-machine-binding` | vendor inference-model ids pinned on portable surfaces next to model/default/provider context (L-MACHINE-LOCAL; born 2026-10-02) |
 
 The severity a reader **observes** is the (rule × facet × channel) matrix, and its single
-home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, the
+home is [src/exfil/severity.ts](https://github.com/TachikomaGundam/Border-Customs/blob/main/src/exfil/severity.ts) — the check pipeline, the
 `border exfil` CLI and this table all render that table, never re-decide it; the
 `EXFIL-DOC` guard test fails the build if a cell is restated wrong:
 
@@ -264,11 +313,13 @@ home is [src/exfil/severity.ts](src/exfil/severity.ts) — the check pipeline, t
 | `exfil-home-path` | tree | native | MEDIUM |
 | `exfil-cred-location` | tree | native | MEDIUM |
 | `exfil-host-profile` | tree | native | MEDIUM |
+| `exfil-machine-binding` | tree | native | MEDIUM |
 | `exfil-rfc1918` | message | native | HIGH |
 | `exfil-ssh-target` | message | native | HIGH |
 | `exfil-home-path` | message | native | MEDIUM |
 | `exfil-cred-location` | message | native | MEDIUM |
 | `exfil-host-profile` | message | native | MEDIUM |
+| `exfil-machine-binding` | message | native | MEDIUM |
 
 Why an observed `CRITICAL` stands where the intent table says HIGH: the twin channels have
 no HIGH rung — every ingested gitleaks finding carries CRITICAL, and secretlint's `error`
@@ -411,7 +462,10 @@ never from cache:
   and exits 1; a rerun of `border push --yes` picks up only the still-PENDING targets.
 - After every git leg that moved, border **verifies the landing**: it re-observes the remote
   tip (`git ls-remote`, then a fetch of exactly that tip when it is not local) and scans the
-  landed tree with the same exfil machinery as `border exfil`. Three honest outcomes: clean
+  landed tree with the same exfil machinery as `border exfil` — the same lens `border check`
+  now runs pre-push, and the same config `allow` pins apply: blocking counts are computed
+  after the allow-list, and any exemption is echoed loudly (rule, entry index, count), never
+  silent. Three honest outcomes: clean
   appends a `t:"landing"` ledger record and preserves the push exit; a blocking hit exits 1
   with `ALREADY PUBLIC; border detects, never erases` — the bytes are out, and border's job
   there is detection, recording the fact, never rewriting history; an unobservable tip exits
@@ -589,11 +643,60 @@ degraded run.
 
 ## Configuration
 
-Everything border can be told lives in `border.yaml` at the repo root. Unknown keys are
+Border is a property of the **checking machine**, not of the checked repo. Config resolves
+in this order, and the machine-side rungs exist so gate config (including waivers) never has
+to be committed into a product repo:
+
+1. `--config <path>` (explicit);
+2. `$BORDER_CONFIG` — fail-closed: set-but-empty or unreadable is exit 2, never a fall-through;
+3. the **machine store**: `$BORDER_CONFIG_DIR` (else `$XDG_CONFIG_HOME/border/machines`, else
+   `~/.config/border/machines`) holding `<sha256-16>.yaml` files keyed by the repo's canonical
+   remote URL (`host/path`, credentials/`.git`/scp-vs-https spellings collapsed);
+4. `./border.yaml` (cwd, then git toplevel) — kept for repos that *choose* to carry their config;
+5. git-remote inference (targets only, no waivers) when nothing above exists.
+
+Unknown keys are
 rejected at load (a typo in a gate config is a gate you did not ask for). `${VAR}`
 expansion applies only to remote URLs and registry/repository/host values, and an unset variable
 is a hard error, never an empty string.
 
+#### Sandboxed builds (`targets.<ch>.sandboxImage`)
+
+Configure pins with the helper instead of hand-editing the machine store:
+`border sandbox init --lane npm --image node@sha256:<64hex>` (writes only the
+0600 machine-store file under the §3-qualified root, refuses tmp/unowned dirs and
+tag refs); `border sandbox status` shows what the loader will actually honor;
+`unpin` removes keys. The helper never writes into the audited repo.
+
+When a lane declares `sandboxImage`, that lane's consented build runs inside `docker run`
+instead of on the host: `--network none` (the daemon-applied argv is the enforcement anchor;
+a DNS+TCP probe re-checks from *inside* as a tripwire that fails the build closed), read-only repo mount, build on a tmpfs snapshot, `--cap-drop ALL`,
+`no-new-privileges`, and a scrubbed env (image defaults + `HOME=/tmp` only). The image MUST be
+digest-pinned:
+
+```yaml
+targets:
+  npm:
+    sandboxImage: node@sha256:<64 hex>   # tags are rejected at load — a mutable tag
+                                          # would let check and push certify different bytes
+```
+
+`sandboxImage` is a **security-tier key**: it is honored only from the machine store or an
+explicit `--config` file outside the repo, and only after fd-chain qualification (every path
+component verified by open file descriptor: root-owned or euid-owned above your trust anchor,
+euid-owned `0700`-below files `0600` below it — symlink or mode violations fail closed).
+Any other declaration of the same key — the repo's own border.yaml, a lax-mode (group/world
+readable or writable) store file, an `XDG_CONFIG_HOME` override pointing somewhere
+unqualifiable — is a named hard refusal (`sandbox-config-shadowed` /
+`sandbox-config-unqualified`), never a silent ignore and never a host fallback.
+
+Freshness and push carry the same binding: a PASS certified inside image X is re-proved only
+inside X (config drift forces a full re-check), and docker being *absent* while an image is
+configured is exit 2 with the remedy named — never a silent host fallback. No `sandboxImage`
+means today's host build, unchanged. The crates lane keeps its registry cache in
+`.border/cache/` (the one writable bind); the pypi image must ship the build backend's
+dependencies (there is no network inside).
+
 Minimal, a git-only repo:
 
 ```yaml
@@ -644,8 +747,15 @@ rules:
   ips: ["192.0.2.1"]
   pathPatterns: ["/Users/*", "*.pfx"]
   maxFileKB: 500                            # oversized-file threshold (default)
+  aliases:                                  # optional: rule-rename migration for allow pins
+    old-rule-name: current-rule-name        #   {renamed-from: current} — waivers survive renames
 allow:                                      # enumerated suppressions, never blanket
   - { rule: "junk-artifact", match: "*", file: "test/fixtures/**" }
+  - rule: "gitleaks:*"                      # fixture-set waiver: values pins the exact
+    file: "tests/fixtures/**"               #   value digests; ANY value outside stays red
+    values: ["<64hex>", "<64hex>"]
+    until: "2027-01-01"                     # optional UTC sunset; after it the entry is
+                                            #   inert and echoed as allow-entry-expired
 engines:
   require: [gitleaks, secretlint]           # trufflehog: true adds the third-party engine
 residue:
@@ -656,6 +766,15 @@ release:
 
 Notes that change behavior:
 
+- **Archive member addressing in `allow.file`:** findings inside archives are attributed
+  `archive!<inner>`. A plain `file` glob matches only the truncated OUTER path (`archive`),
+  so member-level pins need the escape form `archive\\!inner` (the `\!` switches the entry to
+  full-attribution matching). Members are addressable; forgetting the escape silently matches
+  the whole archive instead.
+- **Waiver floors:** a `values` entry suppresses only the listed value digests — a new value
+  under the same path/rule stays red; an `until` entry is inert after its UTC date and is
+  echoed as an INFO `allow-entry-expired` finding instead of quietly keeping work.
+
 - `targets.git.remotes: []` (explicit, empty) is a *deliberate* repo-local scope: all
   history/tree/identity/artifact legs still run, only the exposure set is empty. A
   completely missing config with real remotes falls back to config-from-`git remote` with
@@ -700,7 +819,10 @@ the hook must first pass. Drop `--force` to get sub-second skip-ledger replay in
 re-scan on every `git push`.
 
 **CI.** `border check --json` emits the stable report object; gate on the exit code, parse
-`verdict`/`counts` for dashboards. In CI you typically want `--force` on a cache-less
+`verdict`/`counts` for dashboards. Each finding is
+`{ rule, severity, target, path?, line?, commit?, engine, message, valueDigest, snippet }` —
+the file location is **`path`** (absent when the finding is commit-only, e.g. an identity
+finding); there is no `file` field. In CI you typically want `--force` on a cache-less
 runner, plus your `gitleaks` binary provisioned in the image (a degraded run exits 2, which
 most CI maps to red; that is the point).
 
@@ -717,7 +839,7 @@ plugin entry ships as `exports["./server"]`):
 ```jsonc
 {
   // pin the exact version — an @latest channel hits the registry on every cold start
-  "plugin": ["border-customs@0.8.0"]
+  "plugin": ["border-customs@0.8.2"]
 }
 ```
 
@@ -813,6 +935,10 @@ which is now a thin consumer of `inspect --json` with the rc contract unchanged
 - **Fail-closed doctrine.** "Silence never means absent" is applied mechanically: empty
   registry stdout, unparsed versions, non-translatable exit codes, unresolvable ownership,
   corrupt-but-present rules inputs, all become exit 2 or a CRITICAL, never a pass.
+- **Platform behaviour is probed, not assumed.** The npm stage reads `npm --version` before
+  packing. On npm < 11 a declared pack-phase hook is a named exit 2, because that npm line
+  executes `prepare` despite `--ignore-scripts` (reproduced on npm 10.9.7, 2026-10-19); a
+  missing or unparseable version is also exit 2.
 - **No telemetry, no callbacks.** `border check` touches the network only for the
   registry pre-flight, against the URLs the channels define: `registry.npmjs.org`,
   `pypi.org`, and `rubygems.org` are overridable (private indexes; `targets.rubygems.host`),
@@ -824,9 +950,89 @@ which is now a thin consumer of `inspect --json` with the rc contract unchanged
   it, and which every scan leg refuses to treat as a finding source or an allow-list
   target. A repo that *tracks* `.border/**` is itself a CRITICAL finding. A single-writer
   lock makes concurrent runs exit 2 instead of racing.
+- **Reports go through a private channel.** See [SECURITY.md](SECURITY.md) for the
+  reporting route and scope. Do not put exploit details or live secrets in a public issue.
+
+## Development
+
+Contributor setup, the exact external-engine list, subset test commands, and the version
+rotation procedure live in [CONTRIBUTING.md](CONTRIBUTING.md). In short:
+
+```bash
+npm ci
+npm run typecheck
+npm test
+```
+
+CI runs the full suite on Node 22 (npm 10) and Node 24 (npm 11) for every push to `main`
+and every pull request, plus version single-source, typecheck, build, and audit gates.
 
 ## Changelog
 
+### 0.8.2 (2026-11-01)
+- Production dependency graph now measures ZERO advisories (`npm audit --omit=dev`): the
+  pattern rule is vendored (`src/engines/borderPatternRule.ts`, MIT attribution; drops the
+  unpatchable braces/micromatch + fast-uri chain) and `tool` — an identity function — is
+  vendored in `plugin/border.ts`, moving `@opencode-ai/plugin` (and its effect-beta → toml
+  chain) to devDependencies; live-host probe tests keep the activation proof. The CI audit
+  gate tightens from critical to HIGH so this cannot rot.
+- `border sandbox init|pin|status|unpin` — the opt-in pin helper from the Q1 ruling
+  (machine store only, 0600 atomic writes, §3 self-verification with rollback of its own
+  writes; deliberately absent from the plugin's agent-reachable command set).
+- Security tier for execution-deciding keys (`src/tier.ts`, sibyl §3⁗/§3⁖/§3‡):
+  `sandboxImage`/`allowBuilds` honor only from fd-chain-qualified machine-store or out-of-repo
+  `--config` sources; repo declarations, lax-mode files, and hijacked `XDG_CONFIG_HOME` are
+  named refusals (`sandbox-config-shadowed`/`sandbox-config-unqualified`); the
+  `BORDER_ALLOW_BUILDS` environment channel is REMOVED (never released, so no migration);
+  passwd-derived canonical store root — `$HOME` spoofing cannot move it.
+- Sandboxed artifact builds: optional `targets.<ch>.sandboxImage` (digest-pinned, tags fail
+  closed at load) runs consented npm/pypi/crates/rubygems builds — and freshness re-packs —
+  inside `docker run` with `--network none` proved by an in-container DNS+TCP probe, a
+  read-only repo mount, tmpfs build, `--cap-drop ALL`, scrubbed env, and the ledger record
+  bound to the exact image digest (a rotated image invalidates cached PASS). Missing docker
+  with an image configured is a named exit 2, never a host fallback. New `test/sandbox.test.ts`
+  pins the docker argv contract token by token.
+- Hardened the npm pack-phase guard (sibyl must_fix): ALL package.json manifests in the tree
+  are scanned, not just the root (a workspaces child's `prepare` is now refused on npm < 11),
+  and unreadable manifests or a walk-cap hit count as a hook — unknown is never assumed safe.
+- Machine-side config (HR decoupling handoff 2026-10-23): resolution chain is now
+  `--config > $BORDER_CONFIG (fail-closed) > machine store (XDG/border/machines, keyed by
+  canonical remote URL) > ./border.yaml > git-remote inference`, so gate config and waiver
+  lists live on the checking machine and never need to be committed into a product repo.
+  Allow entries gained `values` (fixture-set waivers that never cover a new value), `until`
+  (UTC sunset, expired entries echoed never silently honored), `\!` archive-member escaping,
+  and `rules.aliases` (rule renames no longer strand waivers). Border state was already
+  porcelain-invisible (`.border/.gitignore` self-ignore; verified 2026-10-23).
+- Provenance: every check and push record carries `engineBuild`
+  (`<version>+<commit>[.dirty]`, the string `border --version` prints), so a verdict names
+  the exact border build that produced it. Motivated by a machine where every gate ran off
+  an unpinned worktree bundle and no record said so; worktree use is now visible on the
+  record face (see "Pinned consumption"). Bundles are stamped by `tools/build.mjs`.
+- Security (breaking): artifact build stages now require operator consent. A hostile clone can
+  ship its own border.yaml declaring pypi/rubygems targets, and `border check` built them —
+  PEP 517 backends and gemspecs ARE code (`python3 -m build --no-isolation` and `gem build`
+  markers reproduced 2026-10-23). Default runs are now scan-only (zero build spawns, pinned by
+  `test/build.execMarkers.test.ts`); consent comes only from outside the audited tree:
+  `--allow-builds` or `BORDER_ALLOW_BUILDS=1`. A scan-only PASS records no artifact digests and
+  therefore can never back a registry publish; `border scan` of third-party artifacts requires
+  the same consent (named exit 2 without it).
+- Security: refuse npm < 11 packages that declare `prepack`/`prepare`/`postpack` before
+  spawning `npm pack`. npm 10 executes `prepare` even with `--ignore-scripts` (reproduced on
+  10.9.7; npm 11.19.1 is clean), so the old defense could execute code from the audited repo.
+  The probe also runs before freshness re-packs. New regression tests pin the refusal and the
+  never-fires hook marker.
+- Fix: the Windows drive-letter path pattern no longer fires on JS escapes in prose
+  (`raw-repoPath:\n`); the UNC pattern no longer spans newlines.
+- Docs: the `--json` findings schema is stated explicitly (`path`, no `file` alias);
+  npm-target prerequisites now name the npm 11 boundary.
+
+### 0.8.1 (2026-10-06)
+- Maintenance release: certificate-chain rebuild off the scrubbed lineage (INCIDENT-20261006
+  identity-exposure cleanup). No functional change vs 0.8.0; 0.8.0's tarball is byte-intact but
+  its OIDC provenance pin moved with the history rewrite, so a fresh tag + publish restores a
+  verifiable chain. Rotation: package.json + lock roots + plugin marker + scan UA + README pins +
+  this entry.
+
 ### 0.8.0 (2026-09-30)
 - Add: **`border opencode inspect [--json]`** — the load-surface self-audit becomes a gate-owned
   surface: six read-only aspects (cache self-consistency, spec freshness vs pin/registry, identity
@@ -868,7 +1074,7 @@ which is now a thin consumer of `inspect --json` with the rc contract unchanged
 
 ### 0.6.0 (2026-09-25)
 - Add: **the exfil lens** — five rules (`exfil-rfc1918`, `exfil-ssh-target`,
-  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`) that flag
+  `exfil-home-path`, `exfil-cred-location`, `exfil-host-profile`, `exfil-machine-binding`) that flag
   exfil-shaped literals on about-to-be-public surfaces, the gap classic secret
   scanners leave open because an internal IP is not a credential. The observed
   severity of every (rule × facet × channel) cell lives in one machine-readable
@@ -1065,4 +1271,4 @@ border 是一个 fail-closed(失败即拦截)的推送前门禁 CLI:`npm install
 
 OpenCode 插件适配层(0.5.0):零手工装载两条路线——主路是在 `opencode.jsonc` 声明 `"plugin": ["border-customs@0.5.0"]`(建议钉具体版本,@latest 每次冷启动都打注册表),opencode 自行下载构件,插件入口走 `exports["./server"]`;插件自带 CLI 解析,顺序为 `BORDER_BIN` 覆盖(独占,坏了就报错、绝不静默回退)> 包内同侧 `dist/index.js`(shebang 直接执行,不可执行则回退 PATH 上的 `node` 承载)> PATH 上的 `border`,免全局安装、免 PATH 配置;0.5.1 起任何候选都必须先过**身份握手**(以 `--help` 应答出 border 横幅与 `usage: border` 才算数),通过之前绝不投递用户 argv,握手不过即 cannot-answer exit 2、不运行任何其他二进制——0.5.0 曾用 `process.execPath` 承载包内 dist,而在插件宿主里 execPath 是 opencode 本体,边检门被静默冒充为宿主(2026-09-22 事故,见 0.5.1 变更日志)。备路是 `border opencode install|status|uninstall` 文件投递,落盘 `$XDG_CONFIG_HOME/opencode` 下的 `plugins/border.ts` 与 `commands/border.md`(无 XDG 回退 HOME/.config):受管文件凭 marker 行识别身份,同名外人文件 exit 2 拒绝、绝不覆盖,卸载只删自己带 marker 的文件,字节相同即 `up to date`。装载面只有一个 `border` 工具(argv-only 生成、无 shell、300 秒与每流 64 KiB 上限,命令闭集 check/push/status/llm-request/llm-ingest/scan/roundtrip/exfil/--help)与一条 `/border` 斜杠命令(config 钩子以 `??=` 自注册,用户同名文件命令保持权威)。边界如实说:allowlist 是 UX/防呆而非安全边界——插件进程与 opencode 进程同权,门禁的牙齿在 CLI 与账本,不在适配层;`push --yes` 按设计留在终端人审,工具端机械拒绝,会话内裸 push 本就是 CLI 合同的 DRY-RUN。装载验证走 opt-in 探针 `BORDER_OPENCODE_PROBE=1`(临时 HOME/XDG 起 `opencode serve` 对照组,断言 `border` 工具 id 与恰好一条 border 命令,重复即 FAIL;插件加载失败是静默的,只认 HTTP 响应不认退出码)。两条路线装载后都需重启 opencode:工具与命令在启动时扫描。
 
-外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。
+外泄透镜(0.6.0):经典密钥扫描器看不见内网 IP、`user@内网主机`、家目录、凭据文件位置、主机画像这类"外泄形状"字面量——它们不是密钥,却如实描述公网仓库身后的私网。0.6.0 加五条规则 `exfil-rfc1918/exfil-ssh-target/exfil-home-path/exfil-cred-location/exfil-host-profile`,每个(规则×分面×通道)格子的**观察严重度**只有单一事实源 `src/exfil/severity.ts`:树面 HIGH 族走双生规则(gitleaks TOML + secretlint pattern,id 逐字节相等、三通道判决对等性有测试钉死),因两引擎都没有 HIGH 档而如实记为 CRITICAL(不硬掰,如实表);树面 MEDIUM 族走原生腿;提交消息面原生独占、id 带 `:message` 后缀,allow 条目按 id 精确匹配、跨面豁免在结构上不可能;tag note 分面归既有引擎腿 `tag-message-secret`,核心绝不重复发。规则源文件并入 rulesHash,改一个匹配器即令全部缓存 PASS 失效。独立只读入口 `border exfil <rev|url>`(默认树尖,`--deep` 补全史 blob 与全部可达提交消息;URL 模式落临时克隆、退出即销毁)。push 之后新增**落地核验**:ls-remote 复读远端尖、必要时精确 fetch 该对象,用同一套机制扫已公开树——干净则追加 `t:"landing"` 账本行并保留原退出码;有阻断发现则 exit 1 并明说 ALREADY PUBLIC;border 只检测、从不抹除;远端不可观测则 exit 2、一条记录都不造(没核验就没事实),已执行的 push 记录原样矗立——账本 append-only,任何情况下不改写历史。2026-10-04 补上透镜对等:check 流水线在原生规则之后、注册表预检之前多跑一条**树尖腿**,用与落地核验完全同一套 scanTipTree 机制预扫本地 HEAD(push 将传输的那棵树),历史与工作面腿看不见的"只在树尖存在"内容(如合并提交解析引入、随后从磁盘删除的文件)从此无处藏;树尖发现汇入 allow 前合并点,按 rule+file+digest 与所有发现同权豁免——落地核验同样消费 cfg allow 并把每一次豁免大声列出(规则、条目号、条数),绝不沉默;绿色交接单与绿色落地双向一致。ledger key 折入透镜身份,旧一代(无树尖腿)的缓存 PASS 不再为新透镜背书,升级后强制一次全新全扫。树尖腿 git 故障即 exit 2,没有静默清白。测试语料遵守夹具纪律:10.200.0.0/16 为预留夹具段(树面全通道静默、双生规则原生镜像该豁免,消息面例外照红),其余泄漏形状一律由 `assembleOctet`/`assembleHost` 运行时拼装,签出字节里没有完整泄漏 token——border 的透镜对自己的仓库绿,红故事照常武装。真值通道 `BORDER_EXFIL_TRUTH=1` 为 opt-in,红锚点带生命周期条款:上游作者清理后按设计转绿、留档不判败。

package/dist/assets/exfil-src/rules.ts

@@ -176,4 +176,4 @@ export function matchSshTarget(text: string, o: RuleOptions): RuleHit[] {
 // matchHomePath / matchCredLocation / matchHostProfile live in rulesPath.ts
 // and are re-exported here so every consumer keeps importing the five
 // predicates from one module. Type-only imports keep that pair acyclic.
-export { matchCredLocation, matchHomePath, matchHostProfile } from "./rulesPath.ts";
+export { matchCredLocation, matchHomePath, matchHostProfile, matchMachineBinding } from "./rulesPath.ts";

package/dist/assets/exfil-src/rulesPath.ts

@@ -110,3 +110,31 @@ export function matchHostProfile(text: string, _o: RuleOptions): RuleHit[] {
   flush();
   return hits;
 }
+
+// ---------------------------------------------------------------- exfil-machine-binding
+
+/**
+ * L-MACHINE-LOCAL (owner ruling 2026-10-01; rule born 2026-10-02 after a
+ * vendor model id sat in another repo's portable README+code default for six
+ * releases unnoticed). Vendor inference-model identifiers pinned on portable
+ * surfaces couple a package to ONE operator's device authorization. Context
+ * gate: the line must ALSO speak of model/default/provider — prose mentions
+ * of a model name stay green (location, not vocabulary — mirrors the
+ * cred-location "position, not value" discipline).
+ * Self-stealth: literals are built in fragments so THIS file never trips
+ * its own regex.
+ */
+const BINDING_TOKEN = String.raw`\b(?:q` + "wen" + String.raw`|deep` + "seek" + String.raw`|kimi|g` + "lm" + String.raw`|ernie|dou` + "bao" + String.raw`|hunyuan|sp` + "ark" + String.raw`)[-\.\d][\w.-]*\b`;
+const BINDING_VENDOR_RE = new RegExp(BINDING_TOKEN, "gi");
+const BINDING_CONTEXT_RE = /(?:model|模型|default|默认|provider)/i;
+
+export function matchMachineBinding(text: string, _o: RuleOptions): RuleHit[] {
+  const hits: RuleHit[] = [];
+  text.split("\n").forEach((body, idx) => {
+    if (!BINDING_CONTEXT_RE.test(body)) return;
+    for (const m of body.matchAll(BINDING_VENDOR_RE)) {
+      hits.push({ rule: "exfil-machine-binding", matched: m[0] ?? "", line: idx + 1, message: "Machine binding: a vendor inference-model id pinned next to model/default/provider context — device authorization belongs in operator-local config, not portable surfaces (L-MACHINE-LOCAL)." });
+    }
+  });
+  return hits;
+}

package/dist/assets/exfil-src/scan.ts

@@ -40,6 +40,7 @@ import {
 import {
   matchCredLocation,
   matchHomePath,
+  matchMachineBinding,
   matchHostProfile,
   matchRfc1918,
   matchSshTarget,
@@ -99,6 +100,7 @@ const PREDICATES: Readonly<Record<ExfilRuleId, (text: string, o: RuleOptions) =>
   "exfil-home-path": matchHomePath,
   "exfil-cred-location": matchCredLocation,
   "exfil-host-profile": matchHostProfile,
+  "exfil-machine-binding": matchMachineBinding,
 };
 
 /**

package/dist/assets/exfil-src/severity.ts

@@ -44,13 +44,14 @@
 export const EXFIL_SEVERITIES = ["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"] as const;
 export type ExfilSeverity = (typeof EXFIL_SEVERITIES)[number];
 
-/** The five exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
+/** The exfil-lens rule ids, verbatim; twins must ship these ids byte-equal (T2 guard). */
 export const EXFIL_RULE_IDS = [
   "exfil-rfc1918",
   "exfil-ssh-target",
   "exfil-home-path",
   "exfil-cred-location",
   "exfil-host-profile",
+  "exfil-machine-binding",
 ] as const;
 export type ExfilRuleId = (typeof EXFIL_RULE_IDS)[number];
 
@@ -71,6 +72,7 @@ export const EXFIL_TABLE_SEVERITY: Readonly<Record<ExfilRuleId, ExfilSeverity>>
   "exfil-home-path": "MEDIUM",
   "exfil-cred-location": "MEDIUM",
   "exfil-host-profile": "MEDIUM",
+  "exfil-machine-binding": "MEDIUM",
 };
 
 /** HIGH family: the two identity-carrying location rules; tree face belongs to the twins. */
@@ -85,7 +87,7 @@ export const EXFIL_HIGH_FAMILY: readonly ExfilRuleId[] = ["exfil-rfc1918", "exfi
  */
 export const EXFIL_SECRET_VALUE_RULES: readonly ExfilRuleId[] = EXFIL_HIGH_FAMILY;
 /** MEDIUM family: privacy-shape rules; native carries them on both scanned facets. */
-export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile"];
+export const EXFIL_MEDIUM_FAMILY: readonly ExfilRuleId[] = ["exfil-home-path", "exfil-cred-location", "exfil-host-profile", "exfil-machine-binding"];
 
 /** null = FORBIDDEN cell: that channel must never emit that rule on that facet. */
 export type ObservedSeverity = ExfilSeverity | null;
@@ -96,6 +98,7 @@ const TWIN_HIGH: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-home-path": null,
   "exfil-cred-location": null,
   "exfil-host-profile": null,
+  "exfil-machine-binding": null,
 };
 const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-rfc1918": null,
@@ -103,13 +106,14 @@ const NULL_ROW: Readonly<Record<ExfilRuleId, ObservedSeverity>> = {
   "exfil-home-path": null,
   "exfil-cred-location": null,
   "exfil-host-profile": null,
+  "exfil-machine-binding": null,
 };
 
 /** The full (facet × channel × rule) truth table — the plan's 分面契约, machine-readable. */
 export const EXFIL_MATRIX: Readonly<Record<ExfilFacet, Readonly<Record<ExfilChannel, Readonly<Record<ExfilRuleId, ObservedSeverity>>>>>> = {
   tree: {
     // native tree leg = MEDIUM family补发 only (v2 double-emission revoked).
-    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM" },
+    native: { ...NULL_ROW, "exfil-home-path": "MEDIUM", "exfil-cred-location": "MEDIUM", "exfil-host-profile": "MEDIUM", "exfil-machine-binding": "MEDIUM" },
     // gitleaks.ts:81 hardcodes CRITICAL for every ingested finding.
     "gitleaks-twin": TWIN_HIGH,
     // secretlint.ts:299-309 has no HIGH rung — error maps to CRITICAL as-is.

package/dist/assets/gitleaks-defaults-v8.30.1.toml

@@ -1,3 +1,27 @@
+# Vendored from gitleaks v8.30.1 (assets/default_config.toml), MIT License.
+#
+# MIT License
+#
+# Copyright (c) 2019 Zachary Rice
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
 # This file has been auto-generated. Do not edit manually.
 # If you would like to contribute new rules, please use
 # cmd/generate/config/main.go and follow the contributing guidelines