[abrichr]

Closes #1990. Stacked on #1928 (agent/1899).

Preserve a loaded bundle’s original seal across inspection and require verified source authority for intentional derivatives. Unsealed legacy bundles remain refused by default; the migration option has been removed. Unchecked loads and reconstructed models cannot mint a trusted replacement.

Verified loop authoring preserves the original manifest. A template replacement API stages contained, manifest-listed bytes without changing the source bundle, checks that source again before saving, and seals the resulting derivative. Authorization summaries verify the original seal before display. The CLI imports optional MCP transport only when serving starts, so argument validation works without MCP installed; transport failures still propagate and close the bridge.

The committed synthetic showcase is recompiled from its existing recording with the current compiler, so default verified loading works with a genuine manifest. Its 18 actions, parameters, risks, postconditions and identity flags are preserved; no legacy-load exception or test change was introduced.

Tested on WSL:

• Loop regression: 9 passed, including unchanged tamper and unchecked-source refusals.
• Template replacement and standard-change controls: 56 passed. Touched lint, formatting and configured typing passed.
• CLI importers: 322 passed, 1 optional-privacy skip across the focused Flow and Agent modules. The original three malformed-mode cases failed before the lazy import and passed afterward; browser coverage used headless Chromium.
• Final ec1b306e6 package statics: Ruff, formatting, configured mypy, generality, release consistency, Python 3.10 syntax and CI compile checks all passed. Source-boundary was not run on the source mirror, which lacks Git metadata. The existing cloud workflow was then dispatched on exact pushed head ec1b306e6: source-boundary and platform-manifest jobs both passed (run 42163447454). This head-only check does not claim a full PR merge suite.

Final fixture commit 4ba8dd35b: both original visualization cases passed against the real fixture path; structural bundle PHI guard, generated-file lint and formatting passed. The current compiler ran once with existing local OCR and no external provider call. Its 18 actions, parameters, risks, postconditions and identity flags were preserved. The review-only Python file was formatted with an identical AST. The optional Presidio check was unavailable. The fresh exact-head cloud boundary and platform-manifest jobs passed in run 42166149470. The three whole related modules also passed: artifact reads 51, program sections 28 and visualize 26 (105 passed, no failures/errors/skips).

An earlier broader diagnostic recorded 12,440 passed, 38 failed, 323 skipped and one internal error. Its wrapper exit and collected-test denominator remain unresolved. The focused fixes above do not establish a green full suite. This remains a draft pending CI and independent review. The base PR’s SecretScan failure remains unresolved. No live application or release qualification is claimed.

Latest save-as collision fix, checked on the pushed head eda4f6477:

• A candidate-only regression confirms that saving into a sealed destination with a foreign pre-existing asset is refused. The distinct fixture asset is created before the bundle records its manifest hash.
• The exact regression passed (1 passed); full ruff check openadapt_flow, changed-file Ruff format, and Flow whole-package Mypy passed.
• The full Flow format check still reports the untracked reviewer diagnostic tests/test_probe_1993.py; that file was not changed. This is retained as a formatting limitation, not counted as a tracked source change.
• The complete PR suite and held-out application qualification remain unrun; no live-app or release qualification is claimed.

Generality: no per-app engine code; the fix covers the shared save-as destination-collision class; held-out app qualification has not been shown.

[abrichr]

Independent adversarial review: BLOCK

From: Claude
Reviewed-Head: 1bdf7b2

Scope: the delta over #1928's head e38299f.

What I ran (in a detached worktree, through the CPU-slot runner)

• pytest tests/test_sanitized_artifact.py tests/test_bundle_original_format.py tests/test_bundle_release_compatibility.py tests/test_qualification_proposal.py: 138 passed, 1 failed at head. The same failing test passes at e38299f.
• The new tests run against the base code: 7 fail, as they should (4 reseal, 1 authorization summary, 2 local-dev admission). So each test proves its fix.
• Throwaway probes for every save path: save(), shallow and deep model_copy, seal_manifest=False, save(key=...), saving to a different directory, rebuilding with model_validate(model_dump()), a stripped manifest followed by load and save, and edit-and-resave of a verified load.
• ruff check on the 7 changed files passes. ruff format --check (ruff 0.17.0) would reformat ir.py and tests/test_bundle_original_format.py. This may be a version difference from the repository's pinned ruff.

Findings

• P1, ir.py:3532-3542 breaks sanitized_artifact.py:791-801. _reseal_sanitized_bundle is the one production caller of load(verify_integrity=False). Its purpose is to reseal a bundle that sanitization changed on purpose: it scrubs PHI from workflow.json and the crops, then saves. save() now runs verify_loaded_source_integrity on that loaded object, sees that the scrubbed payload no longer matches the original seal, and raises. As a result, tests/test_sanitized_artifact.py::test_phi_bearing_canonical_bundle_is_scrubbed_resealed_and_loadable fails with BundleIntegrityError: bundle original manifest integrity changed after loading. The PR's "70 tests passing" did not include this file. A fix needs an explicit, named opt-in for this case, such as a reseal_unverified=True flag or a separate constructor that drops _loaded_seal. The sanitizer would use it after its own verification of the source at line 858, and a test should cover it.
• P2, the reseal guard is tied to one Python object, so it is not structural.
  • Stripped manifest (Verify original bundle seals before schema upgrades #1928 P3 item 3): remove the embedded manifest and manifest.json, then call Workflow.load(b) with the default verification. The tampered bundle loads with _loaded_seal=None and a freshly built content_digest, and save() gives it a valid seal (probe: stripped reseal accepted: evil). Every CLI, runtime or MCP command that loads and then saves goes through Workflow.load, for example qualify from-demo without --admit-local (__main__.py:7180). Only authorization_summary.bundle_digest and admit_local_dev now refuse it. content_identity_digest (bundle_validation.py:692-694) still returns a digest for the stripped object.
  • Rebuilding: Workflow.model_validate(loaded.model_dump()).save(b) after load(verify_integrity=False) also reseals tampered content, because the private attribute is dropped.
  • Admission digest binding still fails closed, so this is not an authorization bypass. But the PR's goal of making a reseal impossible is not met. Options: have load record a "sourceless/unsealed" marker that save refuses without an explicit migration flag, or state in the PR that this is out of scope.
• P3, ir.py:3537-3541 checks assets in the target directory, not the source. verify_loaded_source_integrity(self, bundle, ...) hashes assets under the save target. As a result, Workflow.load(b).save(new_empty_dir) now raises manifest lists asset ... missing from the bundle; it passes at e38299f. I found no production caller that does this today (branch_teach.py:787 copies templates first and saves a promoted workflow). Still, "save as" from a verified load now fails, and nothing tests or documents that. Recording the source directory at load and verifying against it would fix this.
• P3, legacy unsealed bundles have no defined path. A bundle without any manifest still loads silently as unsealed everywhere except the two refusing call sites. Those sites raise a clear message, but nothing tells the user how to migrate (for example "re-save with openadapt flow ... --reseal after review"). The release-compatibility test covers only bundles that are sealed and verified.
• P3, authorization_summary.py:127 and :204 still use model_validate_json directly, without migration or verification (Verify original bundle seals before schema upgrades #1928 P3 item 4). The PR fixes bundle_digest only. These two display paths fail closed, so this is informational.
• Verify original bundle seals before schema upgrades #1928 P3 item 2 (qualification_proposal.py:447): closed in substance. The source seal is now verified before the in-memory digest of the edit is computed. Keeping compute_content_digest for the new content is correct, because that content is resealed by save_accepted_bundle.

The P1 blocks this PR. The P2 should either be fixed or narrowed explicitly in the PR description before approval.

[abrichr]

Independent adversarial review: BLOCK

From: Claude
Reviewed-Head: be0256a

Scope: the delta since my BLOCK at 1bdf7b2 (96fe2f7, 3d27f48, and the merge commit be0256a).

What I ran

• Detached worktree at the head above. I used an existing flow venv with PYTHONPATH set to this worktree's packages/flow, and confirmed that openadapt_flow imports from the worktree.
• tests/test_sanitized_artifact.py plus tests/test_bundle_release_compatibility.py: 92 passed. That includes test_phi_bearing_canonical_bundle_is_scrubbed_resealed_and_loadable (PASSED) and the six test_frozen_bundle_replays_one_exact_input_in_real_chromium[2.2.0|2.5.0|2.6.0 × linear|program] cases (PASSED, headless Chromium). Those six are the "browser cases deselected" in the PR body. They replay the frozen release bundles in a real browser and pass here, so deselecting them only reflects the WSL environment.
• test_artifact_reads.py, test_bundle_original_format.py, test_bundle_schema_v2.py, test_business_decision.py, test_compiler.py, test_qualification_proposal.py, test_authorization_sign.py: 19 failed, 13 errors, 241 passed. Every failure and error is in test_artifact_reads.py or test_authorization_sign.py.
• I ran those same two modules on the PR base (origin/agent/1899, 3d27f48): 63 passed. The failures are regressions introduced by this PR.
• ruff check and ruff format --check on the changed files: clean.
• A probe script on a copy of the frozen 2.6.0 linear fixture (steps below).

Prior findings

• P1 sanitizer scrub-and-reseal: fixed. The source is verified first, and authorize_sanitized_derivative grants the reseal and records sanitized_from_digest.
• P2 model_validate(model_dump()) getting around the guard: fixed. The capability lives in an identity-bound registry, so a manifest-bearing copy cannot be saved.
• P2 a tampered bundle loaded with verify_integrity=False can no longer be saved (_unverified_load).
• P3 authorization_summary skipping verification: outline and _covered_by_digest now use Workflow.load.

Findings

• P1: openadapt-flow seal --out is broken (openadapt_flow/ir.py:3584-3598). The new save-as block copies verified source assets straight into the target directory. When the target is a sealed-writer staging directory, the writer refuses: "file(s) were written outside the sealed writer: templates/open.png, templates/save.png". This causes the 13 setup errors and 8 failures in tests/test_artifact_reads.py (for example test_visualize_reads_a_sealed_bundle). All of them pass on the base.

• P1: bundles that tests and callers create without a manifest can no longer be authorized (openadapt_flow/ir.py:3805-3810, openadapt_flow/authorization_summary.py:62-67). The default refusal of unsealed loads makes 11 tests in tests/test_authorization_sign.py fail with "authorization summary requires a persisted bundle integrity seal". All of them pass on the base. Either the fixtures and callers have to produce real seals, or the behavior change needs a deliberate migration and test updates. The test runs reported in the PR body did not include either module.

• P2: legacy migration launders a tampered sealed bundle, and the admission refusal does not survive a save (openadapt_flow/ir.py:3827-3840, openadapt_flow/qualification_proposal.py:436). Probe on the 2.6.0 fixture:

  1. Edit workflow.json. A default load refuses it.
  2. Delete manifest.json, canonical.json and the embedded manifest.
  3. Workflow.load(d, allow_unsealed_legacy=True), then wf.save(d) succeeds, even without seal_manifest=True.
  4. A plain Workflow.load(d) then accepts the tampered name, with _legacy_migration == False, and the provenance has no marker that the bundle was migrated.

  _legacy_migration is process-local, so "remain refused for admission" holds only until the first save. The migration should write a durable provenance marker that admission checks, and it should require seal_manifest=True.

Verdict: BLOCK. The prior findings are addressed, but there are two new P1 regressions in modules outside the reported test set.

[abrichr]

From: Codex (independent worker, founder exception 2026-11-07)
Reviewed-Head: eda4f64

BLOCK

[P2] Preserve verified in-place plaintext template replacements when checking destination collisions (ir.py:3694-3717). The guard also runs when the destination is the verified source bundle. In that case source_assets is empty, and a plaintext load has no decrypted-template cache. The accepted byte set therefore contains only the staged replacement, while the existing destination still correctly contains the original verified bytes. Every changed replacement is rejected as a foreign collision:

loaded = Workflow.load(bundle)
loaded.stage_verified_template_replacement("templates/button.png", replacement_bytes)
loaded.save(bundle)
# BundleIntegrityError: save-as destination asset 'templates/button.png'
# conflicts with verified source

The exact operation passes at literal parent 4ba8dd35bb172e25b84d20eea0e32e00f0a6f8bd; its output reopens with verified replacement bytes. At this head it refuses without changing the bundle. Saving the same staged replacement into a new directory passes, and an in-place encrypted sealed-set replacement also passes at both commits. Distinguish the verified source's existing bytes from foreign destination bytes across this shared save model, while retaining the new collision refusals.

Ten independent synthetic bundle probes ran against both head and parent. They confirm that the new head fixes foreign plaintext and sealed destination collisions, and preserves the unchecked-load, manifest-bearing reconstruction and stripped-seal refusals. Ordinary in-place saves and verified deep-copy derivatives still work. The new plaintext in-place refusal is a regression introduced by the last commit.

The selected regression tests resolve to 225 unique head cases passing and one failure after correcting missing support files in my filtered review packet. The remaining failure is test_authorization_sign.py::test_control_characters_never_reach_the_terminal: its fixture edits a sealed workflow.json without resealing, so it raises during statement construction and never exercises terminal escaping. The same test fails on the literal parent. Keep that security check intact and make its deliberately authored fixture valid under the new seal policy. The initial packet's 26 setup/support failures and the remaining-only rerun are retained separately; they are not counted as product failures.

The earlier public sanitizer scrub/reseal and sealed seal --out/artifact-read regressions pass at this head. Frozen-release load/resave/tamper controls, authorization display/identity controls, verified loop authoring and lazy MCP transport tests also pass. The six native Chromium compatibility cases and full repository suite were not run in this review.

No per-app engine code: yes.
Class-wide fix: no; valid plaintext in-place replacement disagrees with its save-as and encrypted siblings.
Held-out application evidence: unavailable; the evidence here is synthetic bundle I/O, with no live-app or release qualification claim.

I did not author or contribute to this PR. This technical verdict records the founder-authorized independent Codex review exception.