Agentic exe: ashlar export native — portable self-proving app bundle (mesh slice 3)

[IanFrelinger]

Slice 3 of the mesh — the agentic exe. Turn a certified project into something you can hand someone: the project staged beside a self-contained runtime and a launcher that verifies before it runs. Download, unzip, run — offline, no install, and it proves its own certification on launch.

What lands

• ashlar export native --path <proj> --out <dir> [--rid <rid>] [--zip] — refuses to export a project that doesn't verify; stages app/ (contract, operator-owned policy, signed ledger, bricks), writes run.sh/run.cmd (verify-then-run), bundle.json, README.md. With the runtime it publishes a self-contained single-file ashlar beside the app; staging is deterministic + unit-tested, and the publish degrades gracefully (RUNTIME.md) when the CLI isn't publish-clean.
• The staged app self-verifies offline with no origin key — the provenance course confirms the signed ledger chain intrinsically. The download proves its own certification.

Fixes a real integrity hole a review surfaced (present since #390, HIGH)

The ledger's Subject (hash of the certified documents) was write-only — the provenance course checked chain integrity but never that the ledger covered the current documents. So an edited ashlar.yaml/ashlar.policy.yaml with an intact ledger passed as CERTIFIED, and a tampered downloaded bundle would have run. Now:

• provenance FAILS unless the ledger head attests the current documents;
• a keyedverify re-certifies (appends an entry covering the current docs), so the edit→verify loop still works;
• a keylessverify of altered documents fails closed (exit 65) — the launcher aborts, the tampered app never runs;
• export's "certified" and bundle.json require the head to cover the staged documents.

Verification

Kernel 394/394 (incl. edit-after-certification fails provenance); CLI 18/18; e2e 90/90 — certified bundle staged, launcher self-proves, a keyless downloader confirms the chain offline, a tampered contract is refused, unverified projects refused.

Flags as a follow-up task: the product CLI references three test projects, which blocks the self-contained single-file publish (NETSDK1191).

[coordinated-integration]

Kernel (src/ — the provenance/document-binding fix) and its CLI surface (application/ — export native, the re-certification flow) are one slice: the fix is meaningless without the verb that exercises it. No new src/-vs-application/ layering crossed. cert-gate gates the merge.