Fix/0.7.1 security

.github/workflows/ci.yml

@@ -49,7 +49,16 @@ jobs:
       - name: product UI source proofs
         run: |
           node scripts/home-shell-regression-smoke.mjs
+          node scripts/home-agent-shell-smoke.mjs
+          node --test scripts/home-agent-cancellation.test.mjs
           node scripts/people-discovery-smoke.mjs
+      - name: release artifact source proofs
+        run: |
+          python3 scripts/components-release-integrity-check.py --self-test
+          python3 scripts/publish-platform-artifacts-test.py
+          python3 scripts/release-platform-input-test.py
+          python3 scripts/prepare-release-platform-test.py
+          python3 scripts/media-tools-build-test.py
       - name: Browser close handshake
         run: node --test scripts/browser-window-close-handshake.test.mjs
 
@@ -166,6 +175,108 @@ jobs:
               (cd "$capsule" && cargo test)
           done
 
+  # Rehearses the ELACITY-2298 dKMS ceremony (offline custody composition +
+  # Carrier dial-proof preflight) against a fresh instance of the
+  # deploy/custody-host 3-node compose harness -- scripts/custody-harness-ci-smoke.sh
+  # owns all the logic (throwaway client identity, throwaway compose
+  # project, receipt assertions, full teardown); this job is thin glue over
+  # it. Gated to workflow_dispatch and PRs that actually touch the harness
+  # image, the proof driver, or the protected-content/carrier crates it
+  # exercises -- NOT every push, since the image build + 3-node bring-up
+  # add real wall time.
+  custody-harness-smoke:
+    name: custody-harness-smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    needs: source-gate
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request'
+    # The top-level `permissions: contents: read` above zeroes every other
+    # scope for every job; dorny/paths-filter resolves a pull_request's
+    # changed files via the GitHub API (this job's checkout is fetch-depth 1,
+    # so there's no local base commit to diff against) and needs
+    # `pull-requests: read` to do that -- without this, the filter step
+    # (unconditional on pull_request) 403s and fails the job on every PR.
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
+      - name: detect custody/carrier-relevant changes
+        id: filter
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            custody:
+              - 'deploy/custody-host/**'
+              - 'scripts/protected-content-installed-e2e-proof.sh'
+              - 'scripts/protected-content-installed-static-audit.py'
+              - 'scripts/custody-harness-ci-smoke.sh'
+              - 'capsules/custody-provider/**'
+              - 'capsules/availability-provider/**'
+              - 'capsules/ipfs-provider/**'
+              - 'elastos/crates/elastos-protected-content-*/**'
+              # Targeted, not the whole elastos-server crate (which would
+              # fire this 60-minute job on most PRs): exactly the modules
+              # this smoke actually exercises -- Carrier transport/dial,
+              # standalone provider hosting, and the custody
+              # composition/chain-config CLI the ceremony drives.
+              - 'elastos/crates/elastos-server/src/carrier.rs'
+              - 'elastos/crates/elastos-server/src/carrier_service.rs'
+              - 'elastos/crates/elastos-server/src/provider_host.rs'
+              - 'elastos/crates/elastos-server/src/run_cmd.rs'
+              - 'elastos/crates/elastos-server/src/server_infra.rs'
+              - 'elastos/crates/elastos-server/src/node_cmd.rs'
+              - 'elastos/crates/elastos-server/src/protected_content_config.rs'
+      - id: should-run
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ "${{ steps.filter.outputs.custody }}" = "true" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "no custody/carrier-relevant paths changed on this PR; skipping the smoke run" >> "$GITHUB_STEP_SUMMARY"
+          fi
+      - if: steps.should-run.outputs.run == 'true'
+        uses: dtolnay/rust-toolchain@1.91.0
+      # Builds the host `elastos` binary the smoke script itself invokes
+      # (identity show, node peer add, node status) -- same cache shape as
+      # the test-elastos/lint jobs above.
+      - if: steps.should-run.outputs.run == 'true'
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: elastos
+          prefix-key: ${{ runner.os }}-custody-smoke-bd
+          cache-directories: target-build
+      - if: steps.should-run.outputs.run == 'true'
+        uses: docker/setup-buildx-action@v3
+      # Pre-warms the custody-host image's BuildKit layer cache via the GHA
+      # cache backend, tagged/loaded exactly as deploy/custody-host/up.sh's
+      # own `docker compose up -d --build` expects it -- that later build
+      # then hits this same local layer cache instead of rebuilding cold.
+      - name: pre-build custody-host image (GHA layer cache)
+        if: steps.should-run.outputs.run == 'true'
+        run: |
+          docker buildx build \
+            -f deploy/custody-host/Dockerfile \
+            -t elastos-custody-host:latest \
+            --cache-from type=gha \
+            --cache-to type=gha,mode=max \
+            --load \
+            .
+      - name: custody harness smoke
+        if: steps.should-run.outputs.run == 'true'
+        run: scripts/custody-harness-ci-smoke.sh
+      - name: upload evidence receipt on failure
+        if: failure() && steps.should-run.outputs.run == 'true'
+        uses: actions/upload-artifact@v5
+        with:
+          name: custody-harness-smoke-evidence
+          path: /tmp/custody-harness-ci-smoke-evidence/
+          retention-days: 7
+          if-no-files-found: ignore
+
   # The source-home jobs run only once the test phase is green, in parallel
   # across the three architectures. They are the de-facto release builders:
   # setup-source-home compiles the runtime, shell, home-cli and every provider
@@ -203,7 +314,7 @@ jobs:
       - name: install host prerequisites
         run: |
           sudo apt-get update
-          sudo apt-get install -y coturn e2fsprogs ffmpeg
+          sudo apt-get install -y coturn e2fsprogs ffmpeg musl-tools nasm pkg-config
       - name: source-home into isolated HOME
         env:
           ELASTOS_COLLABORATION_STARTUP_MODE: isolated
@@ -218,6 +329,7 @@ jobs:
           export HOME="${SOURCE_HOME}"
           export XDG_DATA_HOME="${SOURCE_HOME}/.local/share"
           export PATH="${CARGO_HOME}/bin:${PATH}"
+          export SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR="$(dirname "$(command -v ffmpeg)")"
           scripts/setup-source-home.sh 2>&1 | tee "${RUNNER_TEMP}/source-home-logs/setup-source-home.log"
           ELASTOS_DATA_DIR="${XDG_DATA_HOME}/elastos" \
             scripts/installed-provider-verify.sh 2>&1 | tee "${RUNNER_TEMP}/source-home-logs/installed-provider-verify.log"
@@ -315,6 +427,7 @@ jobs:
           export RUSTUP_HOME="${RUSTUP_HOME:-${USER_HOME}/.rustup}"
           export HOME="${MAC_TEST_HOME}"
           export PATH="${CARGO_HOME}/bin:/opt/homebrew/bin:/opt/homebrew/opt/e2fsprogs/sbin:${PATH}"
+          export SETUP_SOURCE_HOME_MEDIA_TOOLS_DIR="$(dirname "$(command -v ffmpeg)")"
           scripts/setup-source-home.sh 2>&1 | tee "${RUNNER_TEMP}/source-home-logs/setup-source-home.log"
           ELASTOS_DATA_DIR="${HOME}/Library/Application Support/elastos" \
             scripts/installed-provider-verify.sh 2>&1 | tee "${RUNNER_TEMP}/source-home-logs/installed-provider-verify.log"

.gitignore

@@ -90,8 +90,9 @@ archive/
 control_graph/
 control_graph_viewer/
 
-# Website deployment artifacts
-website/
+# Website deployment artifacts; the public site's source is versioned.
+website/*
+!website/elastos/
 
 # AI models
 models/

PRINCIPLES.md

@@ -177,6 +177,12 @@ access policy.
   end-to-end cryptography remain above Carrier, and compatibility transports
   stay provider-internal
 
+The target [storage and access contract](docs/STORAGE_AND_ACCESS.md) applies
+these constraints to encrypted private objects, protected use, explicit export,
+revocation, and recovery. Its
+[implementation guide](docs/OBJECT_PROTECTION_IMPLEMENTATION.md) keeps storage,
+rights evidence, and key mechanisms replaceable behind Runtime authority.
+
 ## 16. UI surfaces must not be authority
 
 Opening a page and holding a capability are different things.

ROADMAP.md

@@ -94,6 +94,12 @@ audited reassignment that verifies the root and its protectors before mutation.
 Hosted, loopback, native, and mobile hosts need explicit origin or host-auth
 policy; none may gain authority from a trusted header.
 
+Public first-owner enrollment must start from one-use local operator authority
+and bind one exact HTTPS origin and RP before the ceremony begins. Adding a
+credential to an existing owner requires explicit self-link consent and keeps
+the same principal and protected root. Both flows reuse Runtime auth state and
+produce typed denial, replay, expiry, concurrency, and audit results.
+
 Principal-root protection should use random per-principal data keys. Protectors
 may include a Recovery Kit, client-side WebAuthn PRF wrapping, DID-backed
 recovery, and future quantum-resistant envelopes. Runtime stores wrapped
@@ -133,19 +139,32 @@ in the UI. Recipients verify it before retaining, mounting, or forking it.
 The contract and its limits live in
 [Content availability](docs/CONTENT_AVAILABILITY.md).
 
+The first package-delivery milestone is a signed, CID-identified Qwen content
+capsule used through Runtime-owned preparation. Source has bounded local
+admission/offer binding and reply/reuse fixture proof; installed Use and cold
+peer delivery remain unaccepted. The intended experience uses Marketplace
+discovery/Open into Home Agent, retains the selected local model, and provides
+recoverability-aware removal in System. Generic Get is not current shipped
+support. The contract lives in
+[Content capsule distribution](docs/CONTENT_CAPSULE_DISTRIBUTION.md).
+Execution and proof dependencies live in
+[Builder-only execution](TASKS.md#builder-only-execution).
+
 ### 3. Build Runtime-mediated protected content
 
 The target protected-content design uses the same effect path as ordinary
 content:
 
-`viewer -> Runtime -> rights provider -> custody providers -> decrypt provider`
+`viewer -> Runtime -> custody nodes (node-local rights) -> decrypt provider`
 
-Runtime will resolve the content object, check availability, verify rights,
-request recipient-encrypted custody contributions, create a scoped decrypt or
-render session, and record the result. Each dependency will have a typed
-contract and fail closed. Viewers will receive scoped output or a scoped
-session, not content keys, custody shares, chain RPC, Wallet authority, storage
-APIs, provider routes, network locations, or credentials.
+Runtime will resolve the content object, check availability, load the exact
+Chain policy, and ask each selected custody node to evaluate rights locally
+before it returns a recipient-encrypted contribution. Runtime then creates a
+scoped decrypt or render session and records the result. Each dependency has a
+typed contract. Every invalid or unavailable dependency fails closed. Viewers
+will receive scoped output or a scoped session, not content keys, custody shares,
+chain RPC, Wallet authority, storage APIs, provider routes, network locations,
+or credentials.
 
 The dependency order is contracts and cryptographic review, private provider
 protocols, Wallet/Chain authority, durable Runtime coordination, then installed
@@ -489,7 +508,18 @@ It must not create a separate trust root or expose key material to apps.
 
 AI providers and agents need explicit identity, capabilities, budget policy,
 data access, and audit. Hosted credentials stay inside configured providers.
-Local and hosted models should expose the same typed Runtime contract.
+Local and hosted models use the same typed Runtime contract. Chat Completions
+and Responses adapters have fixture coverage; real configured provider
+compatibility and installed lifecycle proof remain open.
+Installed provider acceptance precedes service publication. Runtime publishes
+the operator-selected signed offer and owns principal-scoped grants. The
+destination Runtime authorizes each remote request, and Carrier transports only
+the route that Runtime selected. Local-engine sharing and hosted-API sharing
+have separate acceptance tracks in [Model provider](docs/MODEL_PROVIDER.md).
+Carrier ingress bounds and destination-owned remote authority precede peer
+acceptance. Hosted-sharing policy and full Jetson target proof remain requested
+work with credential, terms, access and hardware prerequisites, even when source
+review publication occurs earlier.
 
 Operator tools should derive decisions from source, signed artifacts, and
 machine-readable evidence. Durable docs should record contracts and current