[rockyshi1993]

P0-A S07 — Trusted Host → Coordinator oversize boundary, strictly scoped

Following the audited S07 capacity fix merged as #8, this PR proves the remaining security/operation distinction:

(1) Unauthenticated raw receipt over 2 MiB: host.accept must reject FK_I_PROVENANCE_REJECTED without changing Checkpoint, Journal or receipt index. A model is never permitted to force a terminal transition just by sending oversized data.

(2) Genuine Host-observed oversized model response: a trusted Host transport, after independently verifying its provider/session event, creates an existing bounded agent-call-failed receipt with a constant-sized error message; the existing Ed25519 attestation → Host verification → Coordinator CAS executes normal bounded retries and terminal FK_R004 on exhaustion. Exact requestId/nodeId/attempt, immutable Program, State privacy, and existing receipt/Ack history remain pinned. No new signed message kind, no new storage or Context module.

(3) Signed bounded result that cannot fit the active Checkpoint: existing FK_I_CHECKPOINT_CAPACITY terminal behavior in #8 remains unchanged.

New evidence

• tests/interactive/host-oversize.test.mjs: raw overflow/forged failure negatively rejected with no writes, authenticated failure followed by second-attempt reference result (with duplicate Ack + Host recreation), and no-retry terminal FK_R004.
• docs/interactive-host-security.md: precise Host-owned streaming limit observation, bounded signed failure recipe, no authority from model text, failure vs capacity-exit distinction.
• docs/interactive-s07-capacity.md: fix earlier ambiguity that every oversized raw input automatically terminates a Run.

Important: The test's Host transport size observation is scripted; this is NOT genuine Codex/Claude/Grok provider evidence. M6 PR #7 remains Draft until S13 passes.

Required gates

Full Ubuntu/Windows × Node22/24 npm run verify with Standard regression, types, package/docs, website, and Linux Host OS isolation, precise-final-HEAD independent source review. Only squash merge when all pass. Do not publish or proceed to P0-B/P1/P2.

---

Note

Low Risk
Docs and test-only changes; behavior under test is security-sensitive but this PR does not modify production code paths.

Overview
Clarifies three distinct oversize failure modes for trusted Host integrations and adds end-to-end test evidence—no runtime/SDK changes in this diff.

Documentation: interactive-host-security.md gains a Host → Coordinator oversize contract section: unverified receipts over the 2 MiB v1 limit are rejected via normalizeHostAgentReceipt / FK_I_PROVENANCE_REJECTED with no Checkpoint, Journal, or receipt-index writes; Host-observed provider overflow must produce a bounded, signed agent-call-failed receipt (retries then FK_R004); checkpoint budget overflow remains FK_I_CHECKPOINT_CAPACITY. Includes illustrative Host transport logic using normalizeHostAgentReceipt. interactive-s07-capacity.md is updated so oversized raw input is not conflated with capacity-terminal behavior.

Tests: New host-oversize.test.mjs covers raw/forged oversize rejection with unchanged store state, authenticated transport failure → retry → small reference success (duplicate Ack, Host reopen), and no-retry durable FK_R004.

^{Reviewed by Cursor Bugbot for commit 70394d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rockyshi1993]

S07 Trusted Host 超限契约 — 独立复审（2026-11-11）

审查对象：精确 HEAD 70394d4e981ae0eaae50e1314c951818830d7a9c；基线 main@f49e2109a5de1986a8fdaf1952984d119832af82。

源码与边界复审

• 复核 src/interactive/host-attestation.mjs：normalizeHostAgentReceipt() 在 2 MiB 原始回执超限时抛出 FK_I_PROVENANCE_REJECTED，不会触发 Coordinator CAS。该行为是安全边界，不应改为未认证数据可直接终止 Run。
• 复核 src/interactive/trusted-host.mjs 和 coordinator.mjs：现有 Host 签名的、有界 agent-call-failed 已具备回执来源验证、幂等接纳、有限重试和 FK_R004 终态机制。无需引入新签名类型、补丁到执行器、文件存储或 Context 依赖。
• 本 PR 仅新增 tests/interactive/host-oversize.test.mjs 和更新 docs/interactive-host-security.md、docs/interactive-s07-capacity.md。未触及生产源代码、Standard API、Program ABI、数据库 schema、业务产物。
• 安全必须条件：在允许生成 signed failure 之前，必须由受信 Host/Provider Transport 独立观察输出超限，且绑定其实际会话与当前 requestId/nodeId/attempt。模型自行声明“我超限了”或一个任意规范化失败都不能变成可信审批。无可信证据时 Run 保持 waiting，由 Host 执行自己的重试/对账策略。

新增端到端行为验证（真实 Compiler + Program + Store + Trusted Host + Ed25519 + Coordinator，脚本传输事件）

1. 超过 2 MiB 的未验证模型原始回执，以及伪造的小型失败证明，0 Checkpoint/Journal mutation，保持 Pending；无法为超过签名协议上限的回执制造合法证明。
2. 模拟 Host 独立观察的 provider 输出超限事件，Host 生成既有 bounded agent-call-failed，签名/验签、原子 CAS 和历史索引均生效；执行按 retries:1 进入第二次 Pending，然后签名成功接受小型引用结果。重复的第一次失败回执返回原始 acceptedRevision，没有产生第三次尝试。通过新建相同策略 Trusted Host 实例从原 SQLite Store 恢复（不声称测试了新的 OS 进程）。
3. retries:0 时，受信 Host 容量失败回执正常持久化成 errored(FK_R004)，原 State 与 Journal/Receipt 索引不被破坏，重放稳定。
4. 区分 FK_I_PROVENANCE_REJECTED（未认证超限）、FK_R004（认证失败回执的有限重试耗尽）及现有 FK_I_CHECKPOINT_CAPACITY（有界已认证回执无法容纳于 Checkpoint）。

精确 HEAD CI

GitHub Actions 42946128092：7/7 completed/success。Ubuntu/Windows × Node22.13/24.22 四矩阵 npm run verify：349/349 PASS、0 FAIL、0 SKIP 各四组。网站、打包类型和文档消费、Linux 两项跨 UID 隔离均通过。

裁决：本次 Host 超限契约和集成测试 PASS，可按已授权门禁 squash 合并 PR #9。
**限制：**此处 Provider 输出超限事件是确定性脚本模拟，不是真实 Codex/Claude/Grok 原生模型会话证明；M6 S13 继续 BLOCKED，PR #7 不得因此转 Ready/合并。不自动发布、部署或扩展 P0-B/P1/P2。