security(evidence): denial/quarantine paths claim audit evidence without sealing Covenant evidence

[reprewindai-dev]

Finding

Current main in src/lib/covenant/runtime.ts has an evidence-truth regression after the Phase 2 evidence integration.

Pre-execution failure paths call ManagedIntermediary.processRequest(...) and return res.receipt.receipt_hash.value as the public evidence_hash, while also returning metadata.audit_logged: true. They do not call generateEvidence(), do not insert a record into evidenceLedger / auditLog, and do not invoke forwardToPgl().

Affected paths observed on current main:

• generic Phase 1 reject(...) paths: unknown/suspended/invalid-signature/replay/missing capability
• Phase 2 policy denial
• Phase 3 quarantine
• Phase 4 budget denial
• Phase 5 approval-required quarantine

This creates two incompatible meanings for the same response field:

• authorized/execution-error paths: evidence_hash = Covenant envelope_hash, retrievable from Covenant audit evidence and eligible for PGL forwarding
• pre-execution denial/quarantine paths: evidence_hash = intermediary receipt hash only, while audit_logged still claims true

That violates the source-of-truth boundary and can cause callers to treat an intermediary receipt as Covenant/PGL evidence.

Required correction

Make every terminal decision truthful and unambiguous:

1. Seal a Covenant evidence envelope for denied/quarantined/error pre-execution outcomes, linked to the intermediary receipt ID/hash, or explicitly return a separately named receipt field and set Covenant evidence/audit state to NOT_RECORDED / NOT_VERIFIED until a real evidence record exists.
2. Do not report audit_logged: true unless the record is actually present in the canonical Covenant audit store for that response.
3. Do not overload evidence_hash with two hash domains. Keep envelope_hash, intermediary receipt_hash, and eventual Gnomledger/PGL hash semantically distinct.
4. For non-executed decisions, do not label execution status as success. Evidence should distinguish not_executed, denied, quarantined, and actual execution success|error without inventing an execution result.
5. Add focused negative-path regressions covering unknown agent, invalid signature, policy denial, safety quarantine, budget denial, and missing approval. Each test must prove the returned hash resolves to exactly the evidence domain it claims and that audit/PGL state is truthful.
6. Preserve cAPI as canonical Interlink and Gnomledger as durable external evidence/provenance; local signing must not be presented as durable ledger persistence.

Verification required before merge

• exact-head unit/integration tests for all terminal decision classes
• lint/typecheck/build
• secret scan / dependency review / CodeQL where configured
• no concrete credentials/private Ollama IPs in fixtures
• runtime remains UNVERIFIED until listener 3003, HTTP/protocol identity, container listener, and Traefik routing independently agree

observed_current_responsibilities: cAPI performs Interlink routing/governance and creates local Covenant evidence plus intermediary receipts; Gnomledger forwarding is best-effort external persistence.

target_responsibilities: one truthful response contract with separate cryptographic domains and no unsupported audit/ledger claims.

reported_runtime_state: cAPI 3003.

verified_runtime_state: none from this source audit.

unverified_claims: deployed SHA, listener 3003, HTTP/protocol identity, Traefik routing, Gnomledger registration/persistence, and any denial-path durable evidence.