# Security boundary

The attacker may edit project design artifacts, review reports, handoff JSON and metadata. The attacker cannot modify the caller's separately pinned external trust/current input or obtain the human's private Ed25519 key. Built-in Node verification protects approval provenance against forged project metadata. It does not prove the design is correct, reviewer execution occurred, the host is trustworthy, or release is authorized.

A simpler trusted-host assertion would suffice only if every writer of project metadata were trusted to assert human consent. The requested forged-approval boundary includes untrusted project contributions, so unsigned `approved` metadata is insufficient. A small detached signature verifier is chosen instead of a key service, catalog/database, automatic signer or second delivery engine. Human key/current assertion management is an explicit operational cost.

Trust/current configuration must resolve outside the reviewed root and be explicitly supplied by the caller. That location check alone does not establish trust: the caller must control the file independently of artifact writers. Keys embedded in artifacts are ignored/rejected as unexpected fields. Only Ed25519 keys are accepted; malformed PEM, signatures and unknown fields fail closed. No key creation/trust/signing flow runs autonomously.

The expected-current assertion binds specification ID/version/hash and repository revision. Replay is rejected relative to that caller assertion. A caller who deliberately or accidentally reuses old trust configuration can replay its corresponding old signed artifact. No global latest-version, hostile-host protection, or organization-wide revocation service is claimed. Superseding/revoking a design requires updating the external current assertion. A local superseded label alone can be changed by an artifact writer and is not the revocation authority.

Artifact paths must be relative without traversal and realpath within the root, including symlinks. Caller-supplied trust paths must be canonical absolute paths without `.`/`..` segments, repeated separators or symlink aliases. Raw traversal syntax is rejected before normalization; the final realpath and every ancestor must match the supplied canonical path and stay outside the artifact root. This rejects project symlinks, external aliases entering or passing through the project, and system aliases such as macOS `/tmp` or `/var`; callers must explicitly supply the independently trusted canonical location. The validator never silently selects a different trust file. Receipt and artifact-root paths retain their separate contracts. File input is size bounded; arrays and strings are bounded. Artifact content never becomes shell code. Root must expose matching actual Git origin and HEAD. This is revision binding, not a guarantee that working-tree source is clean; Codinary separately captures current diffs/untracked fingerprints. Callers validate stable snapshots. The validator does not lock the filesystem or protect against a hostile concurrent writer swapping files after validation. Revalidate at intake and preserve the validated snapshot for later roles.

The signed payload contains complete requirements, criteria, decisions, constraints, interfaces, data/failure/security/migration/operations details, risks, review coverage/findings/dispositions and design/report hashes. Any byte change to referenced design/report content invalidates approval, including editorial changes. Payload value changes also invalidate approval; JSON encoding whitespace/key order outside strings is excluded by the explicit canonical signing representation. No semantic-equivalence shortcut exists. Lifecycle and detached signature stay outside immutable payload to avoid circular signatures. Lifecycle labels never replace receipt verification.

Goldfish reviewers receive fresh conversations, explicit reading lists and minimal read tools where the host can enforce restrictions. Prompt instructions are advisory when host permissions cannot be constrained. Fresh context does not isolate shared filesystem, memory services or a compromised host. Untrusted references cannot authorize extra reads, writes or tool calls. Missing isolation blocks review; missing reviewer reports cannot be counted as success.

Design approval authorizes the architectural input only. Codinary's user scope, independent implementation QA, two delivery fix cycles, narrow device/native-host waivers and explicit release/commit/push authorization remain separate. Tests contain synthetic keys and fictional authorities only. Never infer a real human approval from fixtures or source provenance.