`manifest.integrity` declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them

[os-sam]

Measured while seeding the plugin-manifest liveness ledger for #10728 (verdict recorded as dead in packages/spec/liveness/manifest.json). Filed, not fixed.

Measured on origin/main (b9e9227e3).

What is declared

packages/spec/src/kernel/manifest.zod.ts:107-109, 576 — integrity: PluginIntegritySchema.optional(), a Record<string, string> of artifact-relative path → digest ("sha256-<base64>"), whose own describe/TSDoc says:

Per-file content digests of the packaged artifact (ADR-0025 §3.2), re-verified by the runtime when it unpacks the .osplugin (ADR §3.5 step 5).

What is measured

Zero reads, in either direction of the lifecycle:

• Nothing computes the digests — os plugin build (packages/cli/src/commands/plugin/build.ts) bundles with esbuild and never hashes per-file content into a manifest.
• Nothing verifies them — repo-wide probe for a manifest-shaped .integrity read ((manifest|pkg|package|entry|artifact)?.integrity, non-test, non-comment) returns no hits at all in objectstack, and objectui is likewise zero.

Controls

• The same probe finds real reads of sibling manifest keys — .packaging (cli/src/commands/plugin/build.ts:126), .data (runtime/src/app-plugin.ts:946), .contributes (objectql/src/engine.ts:4504) — so it is not blind to this object.
• objectui control: manifest.(id|name|namespace|version) → 46 hits there. The zero is about the path, not the probe.

Adjacent machinery that exists and is NOT this

packages/core/src/security/plugin-artifact-signature.ts verifies an artifact signature, and deliberately returns verified=false rather than throwing when one is absent (its header says so at :144, leaving the trust-tier decision to the caller). That is a different mechanism on a different field. Its presence is part of why this gap is easy to miss: the artifact-security story looks staffed.

Why it matters

A declared integrity check that never runs is the false-compliance shape in its most literal form: to any reader — human, AI, or an auditor reading a published manifest — the presence of an integrity block is indistinguishable from the digests having been checked. Unlike a dead display key, this one is about whether the bytes on disk are the bytes that were published.

⚠️ Scope limit — measure cloud before acting

cloud is unmeasured (carried from #10627: add_repo → "you don't have access to objectstack-ai/cloud"). The install-time unpack that ADR-0025 §3.5 describes is a control-plane path, and manifest.zod.ts:10-18 states the cloud control plane mirrors these shapes when validating a published .osplugin. Measure the cloud leg, with a control probe, before either fork. Same precondition #10724 carries.

The fork (not prejudged)

• A — Enforce. Emit digests at os plugin build and verify them at unpack. This is what the spec already tells readers happens, so A is the option that makes the shipped documentation true.
• B — Retire. Tombstone under ADR-0049 (ManifestSchema is not .strict(), so a plain deletion would silently strip the key — the loading precedent at manifest.zod.ts:510-514) and remove the "re-verified by the runtime" sentence with it.

A is the more defensible default here than on a typical dead key: the cost of B is deleting a supply-chain control the project has already published an intent to have. But intent is not delivery, and this is not a decision for an implementation seat.

Filed unassigned for triage.

Blocked-by: #10812

---

Generated by Claude Code

[claude]

Triage: parked pm:blocked on #10812 (line in body). domain:spec, Task. On unlock this goes to the DECISION BOX: integrity declares a security promise (digests "re-verified by the runtime at unpack") that nothing enforces — enforce (implement verification) vs remove (drop the promise) is a security-posture fork, manual floor. Cloud-leg reading completes the evidence.

---

Generated by Claude Code

[claude]

Measured correction to one half of this card's premise, found while authoring checklist coverage for the manifest capability (#11421 / PR #11524). Not acted on — the card stays open and pm:blocked; only its shape changes.

"nothing computes them at build time" is falsified. Measured on origin/main 2d1290ae:

• packages/cli/src/utils/osplugin.ts:61-69 — computeIntegrity(files) builds the archive-relative-path to SRI-digest map, excluding objectstack.plugin.json and SIGNATURE (the manifest cannot hash itself; the signature signs the manifest), with keys sorted for reproducible archives.
• packages/cli/src/commands/plugin/build.ts:209-213 — os plugin build calls it on every build and writes the result into the compiled manifest: const compiledManifest = { ...manifest, main: 'dist/index.mjs', integrity };
• build.ts:228 — the CLI even prints the entry count as Integrity entries.

Control for the probe: grep -rn computeIntegrity over packages/ returns exactly three non-test sites — the definition, the build.ts import, and that call — so the zero this card reported is about the verify side, not the pattern.

What survives: the dead verdict itself, if dead means "no reader". Nothing re-verifies the map at unpack — computeIntegrity has no consumer outside build.ts and its own unit test, and there is no unpack-side verifier anywhere.

What changes — the remedy shape, which is why this is worth a comment rather than a footnote:

1. The producer already exists and runs unconditionally. "Enforce" here is one verifier away, not a producer-plus-verifier pair built from scratch — a materially cheaper enforce leg than the card currently implies, and worth weighing before the remove leg is chosen.
2. The false-compliance is sharper, not milder, than the row reads. Every artifact os plugin build produces really does carry per-file digests. To anyone reading a published manifest, digests that were never checked are indistinguishable from digests that were — which is the exact shape ADR-0049 exists for, arriving with real data behind it rather than an empty field.

Where the sentence also lives: packages/spec/liveness/manifest.json's integrity row carries the same wording ("nothing computes them at build time and nothing re-verifies them at unpack"), so whoever executes this card corrects it there too. ⛔ Not corrected here — the ledger is out of scope for #11421 and edits to it belong with the disposition, not ahead of it.

The cloud-leg precondition this card already carries is untouched by the above: packages/rest/src/package-routes.ts publish and the control-plane unpack path were not measured here either.

---

Generated by Claude Code

---

Generated by Claude Code