[intel352]

Summary

• Add typed, signed bootstrap manifests and deterministic protobuf install receipts bound to stored setup authority, immutable artifacts, epochs and worker identity.
• Add fixed-command managed lifecycle envelopes, encrypted artifact references, request-bound results and allowlisted dedicated-host preflight evidence.
• Export shared positive/rejection vectors. Keep challenge consumption, installation, authorization and control-plane policy outside core.

Design And Scope

Locked Gate 0A plan
and accepted design.

PR Count: 10. Tasks: 21. Status: Locked 2026-10-03T01:51:30Z.
PR grouping 4: Tasks 10/11, feat/recovery-bootstrap-contracts-20261002.
Manifest hash remains 83c974c6094daa0ec637407854a651f851d970f14b5955392d1a9d91a9930460.

This is the core contract slice, not completion of Gate 0A or live agent/provider acceptance. Release is pending merge/CI; downstream installer and app consumers are subsequent planned PRs.

Verification

• Independent full race: 4 packages, 418 cases, zero failures.
• Build, vet, module tidy diff, protobuf generation/lint and diff checks: exit 0.
• Released wfctl v0.86.0 plugin validate-contract --require-contract-kind message .: PASS.
• One independent adversarial code/security pass: SHIP-IT, zero Important/Critical findings, all bug classes documented. No repeated review round.
• Full local golangci-lint reports four findings in unchanged files: two errcheck and two staticcheck. It is not called clean. Configured CI runs build/race/vet and protobuf checks, not golangci-lint.

Runtime Launch Transcript

Built the real entrypoint with the release-equivalent main.version and internal.Version ldflags set to local candidate 0.9.0. Only temporary manifest version metadata was normalized; source remained 3bd398ab.

wfctl v0.86.0 plugin verify-capabilities --binary <built-core> <candidate-manifest-directory>
OK    workflow-plugin-compute-core 0.9.0 (plugin.json: 0.9.0)
exit 0

The first unversioned dev binary was rejected as a sentinel, as intended. Candidate launch is not a claim that v0.9.0 has been published.
The external Go test consumer executes production signing/verification functions against shared strict JSON/protobuf vectors. No contract logic is copied or replaced by mocks.
Failure-signature scrape on the final successful launch: clean.

Version skew: the existing CI/release wfctl v0.64.7 remains a contract/manifest inspection tool using unchanged PluginService message methods, not an application engine hosting these contracts. The compiled SDK and minimum application engine are v0.86.0. Current released-host validation passed; configured CI and release checks remain authoritative and will be monitored.

Doc-reconciliation: clean. No network-audit contract or private application policy changes.