Retain closed initial policy closure failure diagnostics

docs/roadmaps/barc-01-useful-play.md

@@ -55,6 +55,30 @@ not amend the engine or installed failed packet. RP3 capacity, RP4 executable an
 engine/plugin custody, RP5 one changed Count1 attempt, and useful play **0/6** remain
 open under the linked qualification plan.
 
+## Initial closure diagnostic source candidate — 2026-10-03
+
+The single admitted owned-damage Count1 attempt refused after handoff and before
+browser startup. Its retained policy observation is `initial-closure:exception`;
+the exact failed closure check remains unknown. Actual engine/plugin mapping
+custody and settled owned cleanup establish their separate boundaries, while the
+selected smoke remains unaccepted and useful play remains **0/6**.
+
+The source candidate adds a bounded initial-closure diagnostic with closed
+subcheckpoint and code enums, including a distinct unexpected-exception code.
+It retains the original exception and every closure/custody/digest check. The
+capture parser and failure projection accept the new initial frame and retain
+legacy frames; noninitial diagnostics keep their existing bytes. No raw exception
+message, path, stack, credential or envelope is published. The local locked
+Release build and complete source gate pass, including genuine missing/hash/JSON/
+custody/argv failures, closed parser/projection controls, 38 Quint scenarios,
+500 invariant samples, complete-record correspondence and 13 rejected mutants.
+The initial local-clone build refused at the fixture provenance join; explicit
+exact-commit SourceLink supplied the required source proof for local verification.
+Hosted qualification at the canonical repository and protected delivery remain
+pending. Changed policy bytes require a reviewed
+protected build successor and a distinct future operation grant; the consumed
+attempt and sealed candidate remain immutable.
+
 ## Current frontier — 2026-10-01
 
 Selected product profile: unmodified Recoil2025.06.19 plus the ABI-matched HighBar plugin and bounded synced Lua queue observer. Delivered default source heads are HighBar `f08555372168cd911f438de0be5ec2898fd1cfb5` and FSBar `6b9139e83334da903ea6861adb57d97578af2239`; neither source merge establishes installation or gameplay acceptance. The existing custom FR1–FR6 experiment remains optional, inactive and open.

tests/Broker.NativeProof/RuntimeEvidence/CodecTests.fs

@@ -80,6 +80,19 @@ module CodecTests =
         let diagnostic=$"{{\"schema\":\"fsbar.barc-stock-failure-projection/v1\",\"expected\":{{\"configSha256\":\"{String('d',64)}\",\"sourceSetSha256\":\"{String('a',64)}\",\"policySha256\":\"{String('b',64)}\",\"closureSha256\":\"{String('c',64)}\"}},\"observation\":{observation},\"observationSha256\":\"{observationHash}\",\"operationResultBase64\":\"{operationBase64}\",\"operationResultSha256\":\"{operationHash}\"}}"
         let projected=evaluate diagnostic|>Codec.complete
         if not(projected.Contains("\"status\":\"observed-failure\"")) || not(projected.Contains("\"nativeAcceptance\":false")) || projected.Contains("PRIVATE_SENTINEL") then failwith "valid failure diagnostic projection refused"
+        let initialObservation detail =
+            observation.Replace("\"check\":\"policy-result-join\"","\"check\":\"policy-closure-precheck\"").Replace("\"outcome\":\"policy-nonaccepted\"","\"outcome\":\"refused\"").Replace(policyObservation,detail)
+        let initialDiagnostic detail =
+            let value=initialObservation detail
+            diagnostic.Replace(observation,value).Replace(observationHash,sha(bytes(value+"\n")))
+        for stage,code in ["manifest-read","refused";"manifest-hash","refused";"manifest-json","malformed";"directory-custody","refused";"manifest-hash","unexpected-exception"] do
+            let detail=FailureDiagnostic.initialClosureObservation stage code
+            let actual=evaluate(initialDiagnostic detail)|>Codec.complete
+            if not(actual.Contains("\"status\":\"observed-failure\"") && actual.Contains("\"subcheckpoint\":\""+stage+"\"") && actual.Contains("\"code\":\""+code+"\"")) then failwith "closed initial diagnostic lost in projection"
+        let initialDetail=FailureDiagnostic.initialClosureObservation "manifest-hash" "refused"
+        for invalid in [initialDetail.Replace("manifest-hash","PRIVATE_SENTINEL");initialDetail.Replace("\"code\":\"refused\"","\"code\":\"PRIVATE_SENTINEL\"");initialDetail.Replace("initial-closure","current-process");initialDetail.Replace("\"kind\":\"exception\"","\"kind\":\"refused\"");initialDetail.Replace("{","{\"path\":\"PRIVATE_SENTINEL\",",StringComparison.Ordinal)] do
+            let actual=evaluate(initialDiagnostic invalid)|>Codec.complete
+            if not(actual.Contains("\"status\":\"diagnostic-unavailable\"")) || actual.Contains("PRIVATE_SENTINEL") then failwith "initial detail escaped closed projection"
         let invalidDiagnostics =
             [ diagnostic.Replace("\"sourceSetSha256\":\""+String('a',64),"\"sourceSetSha256\":\""+String('f',64))
               diagnostic.Replace(observationHash,String('0',64))

tests/Broker.NativeProof/RuntimeEvidence/FailureDiagnostic.fs

@@ -38,6 +38,15 @@ module FailureDiagnostic =
     let outcomes = Set [ "refused"; "os-unavailable"; "deadline"; "malformed"; "unexpected"; "policy-nonaccepted" ]
     let policyCheckpoints = Set [ "initial-closure"; "current-process"; "invocation-ready"; "request-read"; "request-evaluation"; "final-closure"; "invocation-completion" ]
     let policyKinds = Set [ "exception"; "pending"; "refused"; "unknown" ]
+    [<Literal>]
+    let InitialClosureObservationSchema = "fsbar.barc-runtime-evidence-failure-observation/v2"
+    let initialClosureStages =
+        Set [ "argv"; "invocation"; "manifest-path"; "manifest-read"; "manifest-hash"
+              "manifest-json"; "manifest-schema"; "closure-roots"; "inventory"
+              "managed-census"; "provenance-census"; "runtime-census"; "search-layout"
+              "custody"; "runtime-roles"; "directory-custody"; "managed-custody"
+              "runtime-custody"; "provenance-join" ]
+    let initialClosureCodes = Set [ "refused"; "malformed"; "unavailable"; "unexpected-exception" ]
     let private shaPattern = Regex("\\A[0-9a-f]{64}\\z",RegexOptions.CultureInvariant)
 
     let private refuse () = raise(InvalidOperationException("diagnostic unavailable"))
@@ -64,6 +73,18 @@ module FailureDiagnostic =
         node["kind"]<-JsonValue.Create kind
         node.ToJsonString(JsonSerializerOptions(WriteIndented=false))
 
+    // These two strings come only from closed source stages and exception categories.
+    // Exception messages, stack traces and paths never enter the observation.
+    let initialClosureObservation (stage:string) (code:string) =
+        require(initialClosureStages.Contains stage && initialClosureCodes.Contains code)
+        let node=JsonObject()
+        node["schema"]<-JsonValue.Create InitialClosureObservationSchema
+        node["checkpoint"]<-JsonValue.Create "initial-closure"
+        node["kind"]<-JsonValue.Create "exception"
+        node["subcheckpoint"]<-JsonValue.Create stage
+        node["code"]<-JsonValue.Create code
+        node.ToJsonString(JsonSerializerOptions(WriteIndented=false))
+
     let private compatible (check:string) (checkpoint:string) =
         match check,checkpoint with
         | "policy-closure-precheck","initial-closure"
@@ -122,10 +143,15 @@ module FailureDiagnostic =
             let policyNode,policyKind =
                 if policyElement.ValueKind=JsonValueKind.Null then null,None
                 else
-                    exact policyElement ["schema";"checkpoint";"kind"]
-                    require(text "schema" policyElement=PolicyObservationSchema)
+                    let schema=text "schema" policyElement
                     let checkpoint=text "checkpoint" policyElement
                     let kind=text "kind" policyElement
+                    if schema=PolicyObservationSchema then
+                        exact policyElement ["schema";"checkpoint";"kind"]
+                    else
+                        exact policyElement ["schema";"checkpoint";"kind";"subcheckpoint";"code"]
+                        require(schema=InitialClosureObservationSchema && checkpoint="initial-closure" && kind="exception")
+                        require(initialClosureStages.Contains(text "subcheckpoint" policyElement) && initialClosureCodes.Contains(text "code" policyElement))
                     require(policyCheckpoints.Contains checkpoint && policyKinds.Contains kind && compatible check checkpoint)
                     JsonNode.Parse(policyElement.GetRawText()),Some kind
             let observationHash=digest "observationSha256" root

tests/Broker.NativeProof/RuntimeEvidence/PolicyClosure.fs

@@ -63,7 +63,17 @@ module PolicyClosure =
         RuntimeRoots:Set<string>;RequiredSearchLayout:Set<string>;SourceIdentity:string
     }
 
-    let private fail message = invalidOp message
+    let private refusalKey = "fsbar.closure-guard-refusal"
+    let private fail message =
+        let error=InvalidOperationException(message)
+        error.Data[refusalKey] <- true
+        raise error
+    let private diagnosticKey = "fsbar.initial-closure-detail"
+    let initialFailureDetail (error:exn) =
+        match error.Data[diagnosticKey] with
+        | :? (string * string) as detail -> detail
+        | _ -> "invocation","unexpected-exception"
+
     let private hashBytes bytes = SHA256.HashData(bytes:byte[]) |> Convert.ToHexStringLower
     let private readBounded path maximum =
         use stream=File.Open(path,FileMode.Open,FileAccess.Read,FileShare.Read)
@@ -257,38 +267,50 @@ module PolicyClosure =
         for role in outputs.EnumerateObject() do if role.Value.GetString()<>managedRoles[role.Name].Sha256 then fail "build output receipt drift"
         policyCommit+":"+policyTree+":"+productCommit+":"+productTree+":"+helperHead+":"+helperTree+":"+roles["lockedBuildInputs"].Sha256+":"+roles["toolchainReceipt"].Sha256,productSourceSet
 
-    let loadAndVerify manifestPath expectedSha invocationId =
+    let private loadAndVerifyCore stage manifestPath expectedSha invocationId =
+        stage "invocation"
         if String.IsNullOrWhiteSpace invocationId || invocationId.Length>128 then fail "invalid invocation id"
+        stage "manifest-path"
         let path=full manifestPath "manifest"
+        stage "manifest-read"
         let info=FileInfo path
         if not info.Exists || info.Length<=0L || info.Length>1024L*1024L then fail "manifest unavailable/bound"
         let raw=readBounded path (1024*1024)
+        stage "manifest-hash"
         let digest=hashBytes raw
         if digest<>hex 64 expectedSha "manifest digest" then fail "manifest digest drift"
+        stage "manifest-json"
         use document=JsonDocument.Parse(raw,JsonDocumentOptions(MaxDepth=32,CommentHandling=JsonCommentHandling.Disallow,AllowTrailingCommas=false))
         let root=document.RootElement
+        stage "manifest-schema"
         exact root ["schema";"custodyRoot";"managedRoot";"provenanceRoot";"runtimeRoots";"searchLayout";"managed";"provenance";"runtime";"runtimeRoles";"source";"custody"] "policy closure"
         if text root "schema"<>Schema then fail "policy closure schema"
+        stage "closure-roots"
         let custodyRoot=full(text root "custodyRoot") "custody root"
         let managedRoot=full(text root "managedRoot") "managed root"
         let provenanceRoot=full(text root "provenanceRoot") "provenance root"
         if managedRoot=provenanceRoot || not(managedRoot.StartsWith(custodyRoot+string Path.DirectorySeparatorChar)) || not(provenanceRoot.StartsWith(custodyRoot+string Path.DirectorySeparatorChar)) then fail "closure roots"
         let runtimeRoots=root.GetProperty("runtimeRoots").EnumerateArray() |> Seq.map(fun e->full(e.GetString()) "runtime root") |> Seq.toList
         if runtimeRoots.IsEmpty || runtimeRoots.Length>16 || (Set.ofList runtimeRoots).Count<>runtimeRoots.Length then fail "runtime roots"
+        stage "inventory"
         let managed=pins root "managed" true
         let provenance=pins root "provenance" true
         let runtime=pins root "runtime" false
         let all=managed@provenance@runtime
         if all.Length>MaxFiles || all|>List.sumBy _.Bytes>MaxTotalBytes || (all|>List.map _.Path|>Set.ofList).Count<>all.Length then fail "closure aggregate/duplicate bound"
         let managedRoles=roleMap managed
         if managed.Length<>5 || Set.ofSeq managedRoles.Keys<>Set.ofList["apphost";"managedDll";"depsJson";"runtimeConfigJson";"fsharpCore"] then fail "closed managed roles"
+        stage "managed-census"
         let managedCensus=enumerateBounded [managedRoot]
         if managedCensus<>(managed|>List.map _.Path|>Set.ofList) then fail "managed census drift"
+        stage "provenance-census"
         let provenanceCensus=enumerateBounded [provenanceRoot]
         if provenanceCensus<>(provenance|>List.map _.Path|>Set.ofList) then fail "provenance census drift"
+        stage "runtime-census"
         let runtimeCensus=enumerateBounded runtimeRoots
         let runtimeSet=runtime|>List.map _.Path|>Set.ofList
         if not(Set.isSubset runtimeCensus runtimeSet) then fail "runtime directory census drift"
+        stage "search-layout"
         let searchRows=root.GetProperty "searchLayout"
         if searchRows.ValueKind<>JsonValueKind.Array then fail "search layout"
         let searchBuffer=ResizeArray<DirectoryPin>()
@@ -298,6 +320,7 @@ module PolicyClosure =
         let search=List.ofSeq searchBuffer
         if search.IsEmpty || (search|>List.map _.Path|>Set.ofList).Count<>search.Length then fail "search layout"
         let searchMap=search|>List.map(fun d->d.Path,d)|>Map.ofList
+        stage "custody"
         let custody=root.GetProperty "custody"
         exact custody ["ownerUid";"executablePath";"fixedArgv"] "custody"
         let owner=custody.GetProperty("ownerUid").GetInt32()
@@ -306,6 +329,7 @@ module PolicyClosure =
         let executable=full(text custody "executablePath") "executable"
         let argv=custody.GetProperty("fixedArgv").EnumerateArray()|>Seq.map _.GetString()|>Seq.toList
         if argv<>[executable;"--closure-manifest";"--closure-sha256";"--invocation-id"] || managedRoles["apphost"].Path<>executable then fail "fixed apphost argv"
+        stage "runtime-roles"
         let roles=root.GetProperty "runtimeRoles"
         exact roles ["hostfxr";"hostpolicy";"coreLib";"coreClr";"jit"] "runtime roles"
         let rolePaths=roles.EnumerateObject()|>Seq.map(fun p->p.Name,full(p.Value.GetString()) p.Name)|>Map.ofSeq
@@ -326,14 +350,31 @@ module PolicyClosure =
                 yield! runtime|>Seq.map(fun pin->Directory.GetParent(pin.Path).FullName)
             } |> Set.ofSeq
         for required in requiredSearch do if not(searchMap.ContainsKey required) then fail("unsealed runtime search directory: "+required)
+        stage "directory-custody"
         let custodyStat=stat custodyRoot
         verifyDirectory custodyRoot false { Path=custodyRoot;OwnerUid=owner;Mode=int custodyStat.Mode&&&0o777;EntriesSha256=directoryEntries custodyRoot }
         for pin in search do verifyDirectory (if pin.Path.StartsWith(custodyRoot) then custodyRoot else "/") (pin.Path=managedRoot || pin.Path=provenanceRoot) pin
+        stage "managed-custody"
         for pin in managed@provenance do verifyFile custodyRoot true pin
+        stage "runtime-custody"
         for pin in runtime do verifyFile "/" false pin
+        stage "provenance-join"
         let sourceIdentity,productSourceSet=provenanceJoin (root.GetProperty "source") managed provenance
         { ManifestPath=path;ManifestSha256=digest;ExecutablePath=executable;ApphostSha256=managedRoles["apphost"].Sha256;ProductSourceSetSha256=productSourceSet;OwnerUid=owner;Files=all|>List.map(fun p->p.Path,p)|>Map.ofList;ManagedRoles=managedRoles|>Map.map(fun _ pin->pin.Path);RuntimeRoles=rolePaths;RuntimeRoots=Set.ofList runtimeRoots;RequiredSearchLayout=requiredSearch;SourceIdentity=sourceIdentity }
 
+    let loadAndVerify manifestPath expectedSha invocationId =
+        let mutable stage="invocation"
+        try loadAndVerifyCore (fun value->stage<-value) manifestPath expectedSha invocationId
+        with error ->
+            let code =
+                match error with
+                | _ when error.Data[refusalKey] :? bool && unbox<bool> error.Data[refusalKey] -> "refused"
+                | :? JsonException -> "malformed"
+                | :? IOException | :? UnauthorizedAccessException -> "unavailable"
+                | _ -> "unexpected-exception"
+            error.Data[diagnosticKey] <- (stage,code)
+            reraise()
+
     let verifyCurrentProcess (verified:Verified) =
         let exe=File.ResolveLinkTarget("/proc/self/exe",true).FullName|>Path.GetFullPath
         if exe<>verified.ExecutablePath then fail "running executable drift"

tests/Broker.NativeProof/RuntimeEvidence/PolicyClosureTests.fs

@@ -1,11 +1,48 @@
 namespace FSBar.NativeProof.RuntimeEvidence.Tests
 
 open FSBar.NativeProof.RuntimeEvidence
+open System
+open System.IO
+open System.Security.Cryptography
+open System.Text
 
 module PolicyClosureTests =
     let private accepted = PolicyInvocation.requireAccepted
     let private refused = function InvocationRefused state when state.StickyInvalid -> state | other -> failwithf "expected sticky refusal: %A" other
+    let private initialClosureFailures() =
+        let privateMarker="PRIVATE_SENTINEL_credential_envelope"
+        let root=Path.Combine(Path.GetTempPath(),"bar-initial-closure-"+Guid.NewGuid().ToString("N"))
+        Directory.CreateDirectory root |> ignore
+        let hash bytes=SHA256.HashData(bytes:byte[]) |> Convert.ToHexStringLower
+        let check label path digest expectedStage expectedCode =
+            try
+                PolicyClosure.loadAndVerify path digest "invocation" |> ignore
+                failwith(label+" accepted")
+            with error ->
+                let stage,code=PolicyClosure.initialFailureDetail error
+                if (stage,code)<>(expectedStage,expectedCode) then failwith(label+" wrong closed detail")
+                let observation=FailureDiagnostic.initialClosureObservation stage code
+                if observation.Length>512 || observation.Contains root || observation.Contains privateMarker || observation.Contains error.Message then failwith(label+" leaked detail")
+        try
+            check "missing manifest" (Path.Combine(root,privateMarker)) (String.replicate 64 "a") "manifest-read" "refused"
+            let path=Path.Combine(root,"manifest.json")
+            File.WriteAllText(path,"{"+privateMarker)
+            check "hash drift" path (String.replicate 64 "a") "manifest-hash" "refused"
+            check "malformed JSON" path (hash(File.ReadAllBytes path)) "manifest-json" "malformed"
+            File.WriteAllText(path,"{}")
+            check "malformed schema" path (hash(File.ReadAllBytes path)) "manifest-schema" "refused"
+            check "unexpected null digest" path null "manifest-hash" "unexpected-exception"
+            for stage in FailureDiagnostic.initialClosureStages do
+                for code in FailureDiagnostic.initialClosureCodes do
+                    if (FailureDiagnostic.initialClosureObservation stage code).Length>512 then failwith "diagnostic byte bound"
+            try
+                FailureDiagnostic.initialClosureObservation privateMarker "refused" |> ignore
+                failwith "unclosed diagnostic stage accepted"
+            with :? InvalidOperationException -> ()
+        finally
+            Directory.Delete(root,true)
     let run() =
+        initialClosureFailures()
         let identity={InvocationId="invocation";ClosureSha256=String.replicate 64 "a";Pid=100;StartTicks="1";Uid=1000}
         let started=PolicyInvocation.beginInvocation identity PolicyInvocation.empty|>accepted
         let ready=PolicyInvocation.ready identity started|>accepted