From 324fca836121cd394c9b807f49c36e5279e5591b Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Wed, 16 Sep 2026 14:00:04 +0200
Subject: [PATCH 01/13] test(pre1): bind installed SDK execution and named
 tooling provenance

---
 scripts/pre1_harness_binding.py         |   2 +
 scripts/pre1_package_execution.py       | 278 ++++++++++++++++++++++++
 scripts/run_pre1_qualification_case.py  |  24 +-
 scripts/test_pre1_package_execution.py  | 171 +++++++++++++++
 scripts/test_pre1_qualification_case.py |   2 +
 5 files changed, 472 insertions(+), 5 deletions(-)
 create mode 100644 scripts/pre1_package_execution.py
 create mode 100644 scripts/test_pre1_package_execution.py

diff --git a/scripts/pre1_harness_binding.py b/scripts/pre1_harness_binding.py
index 9a3a0db..8225a22 100644
--- a/scripts/pre1_harness_binding.py
+++ b/scripts/pre1_harness_binding.py
@@ -17,6 +17,8 @@
     "scripts/test_pre1_qualification_case.py",
     "scripts/pre1_harness_binding.py",
     "scripts/pre1_environment_contract.py",
+    "scripts/pre1_package_execution.py",
+    "scripts/test_pre1_package_execution.py",
 })
 
 
diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
new file mode 100644
index 0000000..4123fc3
--- /dev/null
+++ b/scripts/pre1_package_execution.py
@@ -0,0 +1,278 @@
+"""Bind staged assertions to byte-verified installed frozen SDK payloads.
+
+Preparation never installs dependencies or grants qualification credit. The
+caller owns network isolation, runtime selection and workspace lifetime.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+import tarfile
+import zipfile
+from pathlib import Path
+
+SCHEMA = "iicp.pre1-package-execution.v1"
+BINDINGS = (
+    "candidate_manifest_sha256", "artifact_materialization_sha256",
+    "runtime_map_sha256", "qualification_environment_sha256",
+)
+PYTHON_GUARD = '''import os, sys
+from pathlib import Path
+import pytest
+
+def check_origin():
+    import iicp_client
+    root = Path(os.environ["IICP_PRE1_INSTALLED_PACKAGE"]).resolve()
+    for name, module in tuple(sys.modules.items()):
+        if name == "iicp_client" or name.startswith("iicp_client."):
+            origin = getattr(module, "__file__", None)
+            if origin is None or not Path(origin).resolve().is_relative_to(root):
+                raise RuntimeError("packaged Python import origin differs")
+
+def pytest_sessionstart(session):
+    check_origin()
+
+reports = []
+
+def pytest_runtest_logreport(report):
+    reports.append(report)
+
+def pytest_sessionfinish(session, exitstatus):
+    calls = [report for report in reports if report.when == "call"]
+    if len(calls) != 1 or any(not r.passed or hasattr(r, "wasxfail") for r in reports):
+        session.exitstatus = 2
+    check_origin()
+
+@pytest.hookimpl(hookwrapper=True)
+def pytest_runtest_call(item):
+    check_origin()
+    yield
+    check_origin()
+'''
+
+
+def digest(value: object) -> str:
+    return "sha256:" + hashlib.sha256(json.dumps(
+        value, sort_keys=True, separators=(",", ":"), ensure_ascii=True,
+    ).encode()).hexdigest()
+
+
+def file_digest(path: Path) -> str:
+    h = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            h.update(chunk)
+    return "sha256:" + h.hexdigest()
+
+
+def safe_path(path: Path) -> Path:
+    if not path.is_absolute() or not path.exists():
+        raise ValueError("package execution path must exist and be absolute")
+    if any(p.is_symlink() for p in (path, *path.parents)):
+        raise ValueError("package execution path contains a symlink")
+    return path.resolve()
+
+
+def tree(path: Path) -> dict[str, str]:
+    safe_path(path)
+    result = {}
+    for item in sorted(path.rglob("*")):
+        if item.is_symlink():
+            raise ValueError("package execution tree contains a symlink")
+        if item.is_file():
+            if "__pycache__" in item.parts or item.suffix == ".pyc":
+                continue
+            result[item.relative_to(path).as_posix()] = file_digest(item)
+        elif not item.is_dir():
+            raise ValueError("package execution tree contains a special file")
+    return result
+
+
+def installed_payload(artifact: Path, installed: Path, component: str) -> dict[str, str]:
+    """Require exact package-file equality, not a self-reported install receipt."""
+    safe_path(artifact)
+    expected = {}
+    if component == "client-python":
+        with zipfile.ZipFile(artifact) as archive:
+            for row in archive.infolist():
+                if row.filename.startswith("iicp_client/") and not row.is_dir():
+                    name = row.filename.removeprefix("iicp_client/")
+                    expected[name] = "sha256:" + hashlib.sha256(archive.read(row)).hexdigest()
+    elif component == "client-typescript":
+        with tarfile.open(artifact, "r:gz") as archive:
+            for row in archive.getmembers():
+                if row.isfile() and row.name.startswith("package/"):
+                    name = row.name.removeprefix("package/")
+                    handle = archive.extractfile(row)
+                    if handle is None:
+                        raise ValueError("package archive file is unavailable")
+                    expected[name] = "sha256:" + hashlib.sha256(handle.read()).hexdigest()
+                elif row.issym() or row.islnk():
+                    raise ValueError("package archive contains a link")
+    else:
+        raise ValueError("no packaged adapter for this component")
+    if not expected or any(
+        Path(name).is_absolute() or ".." in Path(name).parts for name in expected
+    ) or tree(installed) != expected:
+        raise ValueError("installed SDK differs from the frozen package payload")
+    return expected
+
+
+def dependencies(workspace: Path, installed: Path, component: str) -> dict[str, str]:
+    base = installed.parent if component == "client-python" else workspace / "node_modules"
+    rows = {}
+    safe_path(base)
+    for item in sorted(base.rglob("*")):
+        name = item.relative_to(base).as_posix()
+        if "__pycache__" in item.parts or item.suffix == ".pyc":
+            continue
+        if item.is_symlink():
+            if component != "client-typescript" or not name.startswith(".bin/") or not item.resolve().is_relative_to(base):
+                raise ValueError("test dependency contains an unsafe link")
+            rows[name] = digest({"link": os.readlink(item), "target_sha256": file_digest(item.resolve())})
+        elif item.is_file():
+            rows[name] = file_digest(item)
+        elif not item.is_dir():
+            raise ValueError("test dependency contains a special file")
+    return rows
+
+
+def rewrite_typescript(text: str) -> str:
+    """Redirect literal runtime/worker paths only; leave assertions unchanged."""
+    def replace(match):
+        prefix, name = match.groups()
+        if ".." in Path(name).parts:
+            raise ValueError("unsafe TypeScript source reference")
+        name = re.sub(r"\.ts$", ".js", name)
+        if not Path(name).suffix:
+            name += ".js"
+        return f"{prefix}node_modules/@iicp/client/dist/{name}"
+    return re.sub(r"(\.{1,2}/)src/([A-Za-z0-9_./-]+)", replace, text)
+
+
+def fixture_tree(workspace: Path) -> dict[str, str]:
+    rows = {}
+    for name in ("tests", "parity", "scripts", ".github"):
+        if (workspace / name).exists():
+            rows.update({f"{name}/{p}": h for p, h in tree(workspace / name).items()})
+    for name in ("package.json", "package-lock.json", "pyproject.toml", "uv.lock", "pre1_origin_guard.py"):
+        if (workspace / name).exists():
+            safe_path(workspace / name)
+            rows[name] = file_digest(workspace / name)
+    if (workspace / "src").exists() or (workspace / "iicp_client").exists():
+        raise ValueError("staged workspace contains checkout runtime source")
+    return rows
+
+
+def assertion_files(root: Path, component: str) -> dict[str, bytes]:
+    metadata = {"pyproject.toml", "uv.lock", "package.json", "package-lock.json",
+                "scripts/run_sdk_quality.py", "scripts/run-sdk-quality.mjs",
+                ".github/workflows/release.yml"}
+    result = {}
+    files = subprocess.check_output(["git", "ls-files", "-z"], cwd=root).decode().split("\0")
+    for name in filter(None, files):
+        if not (name.startswith(("tests/", "parity/")) or name in metadata):
+            continue
+        source = safe_path(root / name)
+        if component == "client-typescript" and name.endswith(".ts"):
+            result[name] = rewrite_typescript(source.read_text()).encode()
+        else:
+            result[name] = source.read_bytes()
+    if component == "client-python":
+        result["pre1_origin_guard.py"] = PYTHON_GUARD.encode()
+    return result
+
+
+def stage(root: Path, workspace: Path, component: str) -> dict[str, str]:
+    """Copy only Git-bound fixtures/metadata; never copy SDK runtime sources."""
+    root, workspace = safe_path(root), safe_path(workspace)
+    if workspace == root or workspace.is_relative_to(root):
+        raise ValueError("package workspace must be outside the checkout")
+    if fixture_tree(workspace):
+        raise ValueError("package assertion staging is not empty")
+    for name, data in assertion_files(root, component).items():
+        dest = workspace / name
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_bytes(data)
+    return fixture_tree(workspace)
+
+
+def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
+                   component: str, runtime: str, target: str, bindings: dict) -> dict:
+    if set(bindings) != set(BINDINGS) or any(
+        re.fullmatch(r"sha256:[0-9a-f]{64}", str(v)) is None for v in bindings.values()
+    ):
+        raise ValueError("package execution immutable bindings differ")
+    if not safe_path(installed).is_relative_to(safe_path(workspace)):
+        raise ValueError("installed package must be in the run workspace")
+    payload = installed_payload(artifact, installed, component)
+    fixtures = fixture_tree(workspace) or stage(root, workspace, component)
+    expected_fixtures = {name: "sha256:" + hashlib.sha256(data).hexdigest()
+                         for name, data in assertion_files(root, component).items()}
+    if fixtures != expected_fixtures:
+        raise ValueError("staged assertions differ from the reviewed source mapping")
+    value = {
+        "schema": SCHEMA, "component": component, "runtime": runtime, "target": target,
+        "bindings": bindings, "workspace": str(workspace), "installed_package": str(installed),
+        "artifact_sha256": file_digest(artifact), "installed_payload_sha256": digest(payload),
+        "fixtures_sha256": digest(fixtures), "binding_sha256": None,
+        "test_dependencies_sha256": digest(dependencies(workspace, installed, component)),
+        "non_authorizing": True, "qualification_credit": False,
+    }
+    value["binding_sha256"] = digest(value)
+    return value
+
+
+def validate_binding(value: dict, context: dict, artifact: Path, root: Path) -> Path:
+    copy = dict(value)
+    copy["binding_sha256"] = None
+    if value.get("schema") != SCHEMA or value.get("binding_sha256") != digest(copy):
+        raise ValueError("package execution binding digest differs")
+    if value.get("non_authorizing") is not True or value.get("qualification_credit") is not False:
+        raise ValueError("package execution binding cannot authorize or grant credit")
+    if any(value.get(k) != context[k] for k in ("component", "runtime", "target")) or value.get("bindings") != {k: context[k] for k in BINDINGS}:
+        raise ValueError("package execution candidate/environment/runtime binding differs")
+    workspace = safe_path(Path(value["workspace"]))
+    home = safe_path(Path(os.environ["HOME"]))
+    installed = safe_path(Path(value["installed_package"]))
+    if not workspace.is_relative_to(home) or workspace == home or workspace.is_relative_to(root.resolve()) or not installed.is_relative_to(workspace):
+        raise ValueError("package execution workspace is not run-isolated")
+    if value["artifact_sha256"] != file_digest(artifact) or value["installed_payload_sha256"] != digest(installed_payload(artifact, installed, context["component"])):
+        raise ValueError("package execution installed artifact binding differs")
+    if value["fixtures_sha256"] != digest(fixture_tree(workspace)):
+        raise ValueError("package assertion fixtures changed")
+    if value["test_dependencies_sha256"] != digest(dependencies(workspace, installed, context["component"])):
+        raise ValueError("package test dependencies changed")
+    return workspace
+
+
+def package_command(root: Path, context: dict, component_manifest: dict,
+                    artifact_root: Path, argv: list[str], env: dict) -> tuple[list[str], dict, Path, dict]:
+    if any(Path(arg.split("::")[0]).name in {
+        "test_dispatch_ticket_trust_crypto.py", "dispatch_ticket_trust_crypto.test.ts",
+    } for arg in argv):
+        raise ValueError("mapped assertion uses a fixture-only decision model, not installed SDK enforcement")
+    path = safe_path(Path(os.environ["IICP_PRE1_PACKAGE_EXECUTION_BINDING"]))
+    value = json.loads(path.read_text())
+    if value.get("binding_sha256") != os.environ.get("IICP_PRE1_PACKAGE_EXECUTION_SHA256"):
+        raise ValueError("package execution binding pin differs")
+    kind = "wheel" if context["component"] == "client-python" else "npm-tarball"
+    artifacts = [r for r in component_manifest["artifacts"] if r["kind"] == kind]
+    if len(artifacts) != 1:
+        raise ValueError("candidate SDK install artifact is ambiguous")
+    artifact = artifact_root / context["component"] / artifacts[0]["name"]
+    workspace = validate_binding(value, context, artifact, root)
+    if context["component"] == "client-python":
+        argv = [*argv[:3], "-p", "pre1_origin_guard", *argv[3:]]
+        env["PYTHONPATH"] = os.pathsep.join((str(Path(value["installed_package"]).parent), str(workspace)))
+        env["IICP_PRE1_INSTALLED_PACKAGE"] = value["installed_package"]
+        env["PYTHONNOUSERSITE"] = "1"
+        env["PYTHONDONTWRITEBYTECODE"] = "1"
+    else:
+        expected = workspace / "node_modules/@iicp/client"
+        if Path(value["installed_package"]) != expected:
+            raise ValueError("TypeScript installed module path differs")
+    return argv, env, workspace, {"value": value, "artifact": artifact}
diff --git a/scripts/run_pre1_qualification_case.py b/scripts/run_pre1_qualification_case.py
index 865ce76..cb0976b 100755
--- a/scripts/run_pre1_qualification_case.py
+++ b/scripts/run_pre1_qualification_case.py
@@ -15,8 +15,9 @@
 
 sys.dont_write_bytecode = True
 sys.path.insert(0, str(Path(__file__).resolve().parent))
-from pre1_harness_binding import harness_identity, validate_harness_source
-from pre1_environment_contract import validate_modern_environment
+from pre1_environment_contract import validate_modern_environment  # noqa: E402
+from pre1_harness_binding import harness_identity, validate_harness_source  # noqa: E402
+from pre1_package_execution import package_command, validate_binding  # noqa: E402
 
 ROOT = Path(__file__).resolve().parents[1]
 COMPONENT = 'client-python'
@@ -93,7 +94,8 @@ def description() -> dict:
         "scenarios": sorted(SCENARIO_COMMANDS),
         "network_policy": "isolated-fixtures-only",
         "evidence_policy": "digest-only",
-        "artifact_consumption": "verified-candidate-root",
+        "artifact_consumption": "verified-installed-package",
+        "package_execution_schema": "iicp.pre1-package-execution.v1",
         "source_commit_binding": True,
         "supported_environment_schemas": [
             "iicp.pre1-qualification-environment.v1",
@@ -455,6 +457,8 @@ def command_environment(runtime_row: dict, runtime: str) -> dict[str, str]:
     if "IICP_PRE1_HARNESS_BINDING" in os.environ:
         env["IICP_PRE1_HARNESS_BINDING"] = os.environ["IICP_PRE1_HARNESS_BINDING"]
     env.update(runtime_row.get("env", {}))
+    primary = "python" if runtime.startswith("cpython-") else "node"
+    env["PATH"] = str(Path(runtime_row["programs"][primary]).parent) + os.pathsep + env.get("PATH", "")
     cache = Path(env["IICP_HOME"]) / "qualification-cache" / COMPONENT / runtime
     cache.mkdir(parents=True, exist_ok=True)
     env["CARGO_TARGET_DIR"] = str(cache / "cargo-target")
@@ -509,13 +513,23 @@ def main() -> int:
     if args.scenario is not None and args.scenario not in SCENARIO_COMMANDS:
         parser.error("scenario is not owned by this component")
     try:
-        runtime, runtime_row, manifest, _context = validate_context(
+        runtime, runtime_row, manifest, context = validate_context(
             args.cell, args.scenario
         )
         validate_runtime(runtime, runtime_row, manifest)
         template = SCENARIO_COMMANDS[args.scenario] if args.scenario else SUPPORT_COMMAND
         argv = expand_command(template, runtime_row)
-        result = subprocess.run(argv, cwd=ROOT, env=command_environment(runtime_row, runtime), check=False)
+        component = next(row for row in manifest["components"] if row["id"] == COMPONENT)
+        argv, env, workspace, proof = package_command(
+            ROOT, context, component, Path(os.environ["IICP_PRE1_ARTIFACT_ROOT"]),
+            argv, command_environment(runtime_row, runtime),
+        )
+        result = subprocess.run(argv, cwd=workspace, env=env, check=False)
+        validate_binding(proof["value"], context, proof["artifact"], ROOT)
+        print(json.dumps({"schema": "iicp.pre1-packaged-case-proof.v1",
+                          "package_execution_sha256": proof["value"]["binding_sha256"],
+                          "cell_id": args.cell, "scenario_id": args.scenario or "support",
+                          "exit_code": result.returncode, "non_authorizing": True}, sort_keys=True))
     except (KeyError, OSError, ValueError, json.JSONDecodeError, subprocess.CalledProcessError) as error:
         print(f"pre-1.0 {COMPONENT} case refused: {error}", file=sys.stderr)
         return 2
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
new file mode 100644
index 0000000..26f6d65
--- /dev/null
+++ b/scripts/test_pre1_package_execution.py
@@ -0,0 +1,171 @@
+"""Negative controls for installed-payload and staged-assertion provenance."""
+from __future__ import annotations
+
+import copy
+import io
+import json
+import os
+import subprocess
+import tarfile
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+from unittest.mock import patch
+
+import pre1_package_execution as adapter
+
+
+class PackageExecutionTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="pre1-package-test-")
+        self.addCleanup(self.temp.cleanup)
+        self.home = Path(self.temp.name).resolve()
+        self.root = self.home / "checkout"
+        self.workspace = self.home / "run/workspace"
+        self.root.mkdir()
+        self.workspace.mkdir(parents=True)
+        (self.root / "tests").mkdir()
+        (self.root / "tests/test_fixture.py").write_text("def test_fixture(): pass\n")
+        (self.root / "src").mkdir()
+        (self.root / "src/runtime.py").write_text("must not be staged")
+        subprocess.run(["git", "init", "-q"], cwd=self.root, check=True)
+        subprocess.run(["git", "add", "."], cwd=self.root, check=True)
+        self.installed = self.workspace / "site/iicp_client"
+        self.installed.mkdir(parents=True)
+        (self.installed / "__init__.py").write_text("__version__ = '0.7.110'\n")
+        self.artifact = self.home / "sdk.whl"
+        with zipfile.ZipFile(self.artifact, "w") as archive:
+            archive.write(self.installed / "__init__.py", "iicp_client/__init__.py")
+        self.bindings = {key: "sha256:" + "a" * 64 for key in adapter.BINDINGS}
+        self.context = {"component": "client-python", "runtime": "cpython-3.13",
+                        "target": "macos-arm64", **self.bindings}
+        self.env = patch.dict(os.environ, {"HOME": str(self.home)})
+        self.env.start()
+        self.addCleanup(self.env.stop)
+
+    def binding(self):
+        return adapter.create_binding(self.root, self.workspace, self.installed,
+            self.artifact, "client-python", "cpython-3.13", "macos-arm64", self.bindings)
+
+    def validate(self, value):
+        return adapter.validate_binding(value, self.context, self.artifact, self.root)
+
+    def test_exact_installed_payload_and_no_source_staging(self):
+        value = self.binding()
+        self.assertEqual(self.validate(value), self.workspace)
+        self.assertFalse((self.workspace / "src").exists())
+        self.assertFalse(value["qualification_credit"])
+
+    def test_payload_missing_extra_and_modified_fail(self):
+        self.binding()
+        file = self.installed / "__init__.py"
+        original = file.read_bytes()
+        for action in (lambda: file.unlink(), lambda: file.write_text("modified")):
+            action()
+            with self.assertRaises(ValueError):
+                adapter.installed_payload(self.artifact, self.installed, "client-python")
+            file.write_bytes(original)
+        (self.installed / "extra.py").write_text("extra")
+        with self.assertRaises(ValueError):
+            adapter.installed_payload(self.artifact, self.installed, "client-python")
+
+    def test_each_immutable_dimension_fails_even_when_rehashed(self):
+        value = self.binding()
+        for key in ("component", "target", "runtime"):
+            changed = copy.deepcopy(value)
+            changed[key] = "wrong"
+            changed["binding_sha256"] = None
+            changed["binding_sha256"] = adapter.digest(changed)
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                self.validate(changed)
+        for key in adapter.BINDINGS:
+            changed = copy.deepcopy(value)
+            changed["bindings"][key] = "sha256:" + "b" * 64
+            changed["binding_sha256"] = None
+            changed["binding_sha256"] = adapter.digest(changed)
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                self.validate(changed)
+
+    def test_fixture_tamper_and_checkout_source_fallback_fail(self):
+        value = self.binding()
+        (self.workspace / "tests/test_fixture.py").write_text("tamper")
+        with self.assertRaisesRegex(ValueError, "fixtures changed"):
+            self.validate(value)
+        (self.workspace / "src").mkdir()
+        with self.assertRaisesRegex(ValueError, "runtime source"):
+            self.validate(value)
+
+    def test_staged_assertions_must_match_reviewed_mapping(self):
+        adapter.stage(self.root, self.workspace, "client-python")
+        (self.workspace / "tests/test_fixture.py").write_text("tamper")
+        with self.assertRaisesRegex(ValueError, "reviewed source mapping"):
+            self.binding()
+
+    def test_symlinks_and_unsafe_ancestors_fail(self):
+        value = self.binding()
+        (self.installed / "link.py").symlink_to(self.root / "src/runtime.py")
+        with self.assertRaises(ValueError):
+            self.validate(value)
+        alias = self.home / "alias"
+        alias.symlink_to(self.workspace, target_is_directory=True)
+        with self.assertRaises(ValueError):
+            adapter.safe_path(alias / "tests")
+
+    def test_dependency_tamper_fails(self):
+        value = self.binding()
+        (self.installed.parent / "pytest.py").write_text("injected")
+        with self.assertRaisesRegex(ValueError, "dependencies changed"):
+            self.validate(value)
+
+    def test_no_binding_cannot_run_source_case(self):
+        with patch.dict(os.environ, {}, clear=True), self.assertRaises(KeyError):
+            adapter.package_command(self.root, self.context, {}, self.home, [], {})
+
+    def test_fixture_only_models_cannot_count_as_sdk_enforcement(self):
+        for filename in ("tests/test_dispatch_ticket_trust_crypto.py::test_expired_dispatch_ticket_key_fails_closed",
+                         "tests/dispatch_ticket_trust_crypto.test.ts"):
+            with self.assertRaisesRegex(ValueError, "fixture-only"):
+                adapter.package_command(self.root, self.context, {}, self.home, ["runtime", filename], {})
+
+    def test_python_command_uses_only_installed_path_and_guard(self):
+        value = self.binding()
+        path = self.home / "binding.json"
+        path.write_text(json.dumps(value))
+        component = {"artifacts": [{"kind": "wheel", "name": "sdk.whl"}]}
+        artifact_root = self.home / "artifacts"
+        (artifact_root / "client-python").mkdir(parents=True)
+        (artifact_root / "client-python/sdk.whl").write_bytes(self.artifact.read_bytes())
+        with patch.dict(os.environ, {"IICP_PRE1_PACKAGE_EXECUTION_BINDING": str(path),
+                "IICP_PRE1_PACKAGE_EXECUTION_SHA256": value["binding_sha256"]}):
+            argv, env, cwd, _ = adapter.package_command(self.root, self.context,
+                component, artifact_root, ["python", "-m", "pytest", "-q", "tests/test_fixture.py::test_fixture"], {})
+        self.assertEqual(argv[3:5], ["-p", "pre1_origin_guard"])
+        self.assertEqual(cwd, self.workspace)
+        self.assertNotIn(str(self.root), env["PYTHONPATH"])
+
+    def test_typescript_literals_and_child_worker_bind_to_dist(self):
+        text = 'import x from "../src/client.js"; require("../src/trust"); import y from "./src/service_lifecycle.ts";'
+        rewritten = adapter.rewrite_typescript(text)
+        self.assertNotIn("src/", rewritten)
+        self.assertIn('"./node_modules/@iicp/client/dist/service_lifecycle.js"', rewritten)
+        with self.assertRaises(ValueError):
+            adapter.rewrite_typescript('import "../src/../../escape.js"')
+
+    def test_typescript_archive_and_missing_compiled_file(self):
+        artifact = self.home / "sdk.tgz"
+        installed = self.workspace / "node_modules/@iicp/client"
+        (installed / "dist").mkdir(parents=True)
+        (installed / "dist/client.js").write_bytes(b"compiled")
+        with tarfile.open(artifact, "w:gz") as archive:
+            info = tarfile.TarInfo("package/dist/client.js")
+            info.size = len(b"compiled")
+            archive.addfile(info, io.BytesIO(b"compiled"))
+        adapter.installed_payload(artifact, installed, "client-typescript")
+        (installed / "dist/client.js").unlink()
+        with self.assertRaises(ValueError):
+            adapter.installed_payload(artifact, installed, "client-typescript")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/test_pre1_qualification_case.py b/scripts/test_pre1_qualification_case.py
index ac4e9bd..f25c134 100755
--- a/scripts/test_pre1_qualification_case.py
+++ b/scripts/test_pre1_qualification_case.py
@@ -6,6 +6,8 @@
 import unittest
 from pathlib import Path
 
+from test_pre1_package_execution import PackageExecutionTests  # noqa: F401
+
 ROOT = Path(__file__).resolve().parents[1]
 spec = importlib.util.spec_from_file_location(
     "pre1_driver", ROOT / "scripts/run_pre1_qualification_case.py"

From f27c198cb2d353faaea1efc88a6d117d2407795f Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Wed, 16 Sep 2026 14:08:27 +0200
Subject: [PATCH 02/13] test(pre1): exercise canonical crypto verifier and
 packaged CLI

---
 scripts/pre1_package_execution.py      | 76 ++++++++++++++++++++++++--
 scripts/test_pre1_package_execution.py | 18 ++++--
 2 files changed, 84 insertions(+), 10 deletions(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 4123fc3..4547541 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -153,6 +153,71 @@ def replace(match):
     return re.sub(r"(\.{1,2}/)src/([A-Za-z0-9_./-]+)", replace, text)
 
 
+def packaged_assertions(name: str, text: str) -> str:
+    """Strengthen three reviewed source fixtures without changing their vectors.
+
+    Crypto cases use the same canonical runtime API already exercised by each
+    SDK's runtime-verifier suite. No test-local eligibility engine survives.
+    Version qualification observes the compiled CLI, not its source spelling.
+    These substitutions are fixture-digest and harness-commit bound.
+    """
+    if name == "tests/test_dispatch_ticket_trust_crypto.py":
+        start = text.index("def _decision(vector: dict,")
+        end = text.index("def _assert_fixture_decision", start)
+        replacement = '''from iicp_client.dispatch_ticket_trust import (
+    LocalReplayCache, TicketBindings, TrustBundle, verify_dispatch_ticket_v2,
+)
+
+def _decision(vector: dict, keys: dict[str, dict], signature_valid: bool) -> str:
+    claims = vector["claims"]
+    bundle = TrustBundle.from_dict({
+        "bundle_version": 4,
+        "keys": [keys[key_id] for key_id in vector["trust_bundle_key_ids"]],
+    })
+    replay = LocalReplayCache()
+    if vector["jti_seen"]:
+        replay.remember(claims["jti"], claims["expires_at"])
+    return verify_dispatch_ticket_v2(
+        claims, vector["signature_b64url"], bundle,
+        TicketBindings(claims["issuer"], claims["provider_id"], claims["intent"], claims["constraints_digest"]),
+        now=vector["now"], minimum_bundle_version=4, replay_cache=replay,
+    ).code
+
+
+'''
+        return text[:start] + replacement + text[end:]
+    if name == "tests/dispatch_ticket_trust_crypto.test.ts":
+        start = text.index("function decision(vector: any,")
+        end = text.index("function assertFixtureDecision", start)
+        replacement = '''import { LocalDispatchReplayCache, verifyDispatchTicketV2 } from "../node_modules/@iicp/client/dist/dispatch_ticket_trust.js";
+
+function decision(vector: any, keys: Map<string, any>, signatureValid: boolean): string {
+  const replayCache = new LocalDispatchReplayCache();
+  if (vector.jti_seen) replayCache.remember(vector.claims.jti, vector.claims.expires_at);
+  return verifyDispatchTicketV2(
+    vector.claims, vector.signature_b64url,
+    { bundle_version: 4, keys: vector.trust_bundle_key_ids.map((id: string) => keys.get(id)) },
+    { issuer: vector.claims.issuer, provider_id: vector.claims.provider_id,
+      intent: vector.claims.intent, constraints_digest: vector.claims.constraints_digest },
+    { now: vector.now, minimumBundleVersion: 4, replayCache },
+  ).code;
+}
+
+'''
+        return text[:start] + replacement + text[end:]
+    if name == "tests/pre1_release_boundaries.test.ts":
+        lines = text.splitlines()
+        source_check = [line for line in lines if "assert.match(cli," in line]
+        source_read = [line for line in lines if line.startswith("const cli = ")]
+        if len(source_check) != 1 or len(source_read) != 1:
+            raise ValueError("reviewed CLI source fixture shape differs")
+        text = text.replace(source_read[0], 'import { spawnSync } from "node:child_process";')
+        return text.replace(source_check[0], '''  const version = spawnSync(process.execPath, [new URL("../node_modules/@iicp/client/dist/cli.js", import.meta.url).pathname, "--version"], { encoding: "utf8" });
+  assert.equal(version.status, 0);
+  assert.equal(version.stdout.trim(), `iicp-node ${pkg.version}`);''')
+    return text
+
+
 def fixture_tree(workspace: Path) -> dict[str, str]:
     rows = {}
     for name in ("tests", "parity", "scripts", ".github"):
@@ -178,7 +243,9 @@ def assertion_files(root: Path, component: str) -> dict[str, bytes]:
             continue
         source = safe_path(root / name)
         if component == "client-typescript" and name.endswith(".ts"):
-            result[name] = rewrite_typescript(source.read_text()).encode()
+            result[name] = packaged_assertions(name, rewrite_typescript(source.read_text())).encode()
+        elif component == "client-python" and name.endswith(".py"):
+            result[name] = packaged_assertions(name, source.read_text()).encode()
         else:
             result[name] = source.read_bytes()
     if component == "client-python":
@@ -220,6 +287,7 @@ def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
         "artifact_sha256": file_digest(artifact), "installed_payload_sha256": digest(payload),
         "fixtures_sha256": digest(fixtures), "binding_sha256": None,
         "test_dependencies_sha256": digest(dependencies(workspace, installed, component)),
+        "assertion_adapter": "canonical-runtime-verifier-and-cli.v1",
         "non_authorizing": True, "qualification_credit": False,
     }
     value["binding_sha256"] = digest(value)
@@ -233,6 +301,8 @@ def validate_binding(value: dict, context: dict, artifact: Path, root: Path) ->
         raise ValueError("package execution binding digest differs")
     if value.get("non_authorizing") is not True or value.get("qualification_credit") is not False:
         raise ValueError("package execution binding cannot authorize or grant credit")
+    if value.get("assertion_adapter") != "canonical-runtime-verifier-and-cli.v1":
+        raise ValueError("package assertion adapter binding differs")
     if any(value.get(k) != context[k] for k in ("component", "runtime", "target")) or value.get("bindings") != {k: context[k] for k in BINDINGS}:
         raise ValueError("package execution candidate/environment/runtime binding differs")
     workspace = safe_path(Path(value["workspace"]))
@@ -251,10 +321,6 @@ def validate_binding(value: dict, context: dict, artifact: Path, root: Path) ->
 
 def package_command(root: Path, context: dict, component_manifest: dict,
                     artifact_root: Path, argv: list[str], env: dict) -> tuple[list[str], dict, Path, dict]:
-    if any(Path(arg.split("::")[0]).name in {
-        "test_dispatch_ticket_trust_crypto.py", "dispatch_ticket_trust_crypto.test.ts",
-    } for arg in argv):
-        raise ValueError("mapped assertion uses a fixture-only decision model, not installed SDK enforcement")
     path = safe_path(Path(os.environ["IICP_PRE1_PACKAGE_EXECUTION_BINDING"]))
     value = json.loads(path.read_text())
     if value.get("binding_sha256") != os.environ.get("IICP_PRE1_PACKAGE_EXECUTION_SHA256"):
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index 26f6d65..6260fa8 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -122,11 +122,19 @@ def test_no_binding_cannot_run_source_case(self):
         with patch.dict(os.environ, {}, clear=True), self.assertRaises(KeyError):
             adapter.package_command(self.root, self.context, {}, self.home, [], {})
 
-    def test_fixture_only_models_cannot_count_as_sdk_enforcement(self):
-        for filename in ("tests/test_dispatch_ticket_trust_crypto.py::test_expired_dispatch_ticket_key_fails_closed",
-                         "tests/dispatch_ticket_trust_crypto.test.ts"):
-            with self.assertRaisesRegex(ValueError, "fixture-only"):
-                adapter.package_command(self.root, self.context, {}, self.home, ["runtime", filename], {})
+    def test_crypto_bridge_uses_runtime_verifier_not_test_local_policy(self):
+        text = "def _decision(vector: dict, keys: dict, signature_valid: bool):\n    return 'fake'\n\ndef _assert_fixture_decision(): pass\n"
+        bridged = adapter.packaged_assertions("tests/test_dispatch_ticket_trust_crypto.py", text)
+        self.assertIn("verify_dispatch_ticket_v2(", bridged)
+        self.assertNotIn("return 'fake'", bridged)
+        text = "function decision(vector: any, keys: Map<string, any>, signatureValid: boolean): string { return 'fake'; }\nfunction assertFixtureDecision(): void {}"
+        bridged = adapter.packaged_assertions("tests/dispatch_ticket_trust_crypto.test.ts", text)
+        self.assertIn("verifyDispatchTicketV2(", bridged)
+        self.assertNotIn("return 'fake'", bridged)
+
+    def test_cli_fixture_requires_reviewed_shape(self):
+        with self.assertRaisesRegex(ValueError, "fixture shape differs"):
+            adapter.packaged_assertions("tests/pre1_release_boundaries.test.ts", "changed fixture")
 
     def test_python_command_uses_only_installed_path_and_guard(self):
         value = self.binding()

From 14244d19034ccfeb552859cbffeae1da46516bb5 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Wed, 16 Sep 2026 16:29:22 +0200
Subject: [PATCH 03/13] Seal packaged case proofs and reviewed fixture
 provenance

---
 scripts/pre1_package_execution.py      | 206 +++++++++++++++++++++----
 scripts/run_pre1_qualification_case.py |  11 +-
 scripts/test_pre1_package_execution.py |  74 +++++++++
 3 files changed, 256 insertions(+), 35 deletions(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 4547541..6ac4ef3 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -9,8 +9,10 @@
 import json
 import os
 import re
+import stat
 import subprocess
 import tarfile
+import tempfile
 import zipfile
 from pathlib import Path
 
@@ -71,16 +73,21 @@ def file_digest(path: Path) -> str:
 def safe_path(path: Path) -> Path:
     if not path.is_absolute() or not path.exists():
         raise ValueError("package execution path must exist and be absolute")
-    if any(p.is_symlink() for p in (path, *path.parents)):
+    if any(unsafe_link(p) for p in (path, *path.parents)):
         raise ValueError("package execution path contains a symlink")
     return path.resolve()
 
 
+def unsafe_link(path: Path) -> bool:
+    attributes = getattr(path.lstat(), "st_file_attributes", 0)
+    return path.is_symlink() or bool(attributes & getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400))
+
+
 def tree(path: Path) -> dict[str, str]:
     safe_path(path)
     result = {}
     for item in sorted(path.rglob("*")):
-        if item.is_symlink():
+        if unsafe_link(item):
             raise ValueError("package execution tree contains a symlink")
         if item.is_file():
             if "__pycache__" in item.parts or item.suffix == ".pyc":
@@ -94,26 +101,10 @@ def tree(path: Path) -> dict[str, str]:
 def installed_payload(artifact: Path, installed: Path, component: str) -> dict[str, str]:
     """Require exact package-file equality, not a self-reported install receipt."""
     safe_path(artifact)
-    expected = {}
-    if component == "client-python":
-        with zipfile.ZipFile(artifact) as archive:
-            for row in archive.infolist():
-                if row.filename.startswith("iicp_client/") and not row.is_dir():
-                    name = row.filename.removeprefix("iicp_client/")
-                    expected[name] = "sha256:" + hashlib.sha256(archive.read(row)).hexdigest()
-    elif component == "client-typescript":
-        with tarfile.open(artifact, "r:gz") as archive:
-            for row in archive.getmembers():
-                if row.isfile() and row.name.startswith("package/"):
-                    name = row.name.removeprefix("package/")
-                    handle = archive.extractfile(row)
-                    if handle is None:
-                        raise ValueError("package archive file is unavailable")
-                    expected[name] = "sha256:" + hashlib.sha256(handle.read()).hexdigest()
-                elif row.issym() or row.islnk():
-                    raise ValueError("package archive contains a link")
-    else:
+    readers = {"client-python": wheel_payload, "client-typescript": tarball_payload}
+    if component not in readers:
         raise ValueError("no packaged adapter for this component")
+    expected = readers[component](artifact)
     if not expected or any(
         Path(name).is_absolute() or ".." in Path(name).parts for name in expected
     ) or tree(installed) != expected:
@@ -121,6 +112,32 @@ def installed_payload(artifact: Path, installed: Path, component: str) -> dict[s
     return expected
 
 
+
+def wheel_payload(artifact: Path) -> dict[str, str]:
+    expected = {}
+    with zipfile.ZipFile(artifact, "r") as archive:
+        for row in archive.infolist():
+            if row.filename.startswith("iicp_client/") and not row.is_dir():
+                name = row.filename.removeprefix("iicp_client/")
+                expected[name] = "sha256:" + hashlib.sha256(archive.read(row)).hexdigest()
+    return expected
+
+
+def tarball_payload(artifact: Path) -> dict[str, str]:
+    expected = {}
+    with tarfile.open(artifact, "r:gz") as archive:
+        for row in archive.getmembers():
+            if row.isfile() and row.name.startswith("package/"):
+                name = row.name.removeprefix("package/")
+                handle = archive.extractfile(row)
+                if handle is None:
+                    raise ValueError("package archive file is unavailable")
+                expected[name] = "sha256:" + hashlib.sha256(handle.read()).hexdigest()
+            elif row.issym() or row.islnk():
+                raise ValueError("package archive contains a link")
+    return expected
+
+
 def dependencies(workspace: Path, installed: Path, component: str) -> dict[str, str]:
     base = installed.parent if component == "client-python" else workspace / "node_modules"
     rows = {}
@@ -129,8 +146,8 @@ def dependencies(workspace: Path, installed: Path, component: str) -> dict[str,
         name = item.relative_to(base).as_posix()
         if "__pycache__" in item.parts or item.suffix == ".pyc":
             continue
-        if item.is_symlink():
-            if component != "client-typescript" or not name.startswith(".bin/") or not item.resolve().is_relative_to(base):
+        if unsafe_link(item):
+            if not item.is_symlink() or component != "client-typescript" or not name.startswith(".bin/") or not item.resolve().is_relative_to(base):
                 raise ValueError("test dependency contains an unsafe link")
             rows[name] = digest({"link": os.readlink(item), "target_sha256": file_digest(item.resolve())})
         elif item.is_file():
@@ -211,8 +228,8 @@ def _decision(vector: dict, keys: dict[str, dict], signature_valid: bool) -> str
         source_read = [line for line in lines if line.startswith("const cli = ")]
         if len(source_check) != 1 or len(source_read) != 1:
             raise ValueError("reviewed CLI source fixture shape differs")
-        text = text.replace(source_read[0], 'import { spawnSync } from "node:child_process";')
-        return text.replace(source_check[0], '''  const version = spawnSync(process.execPath, [new URL("../node_modules/@iicp/client/dist/cli.js", import.meta.url).pathname, "--version"], { encoding: "utf8" });
+        text = text.replace(source_read[0], 'import { spawnSync } from "node:child_process";\nimport { fileURLToPath } from "node:url";')
+        return text.replace(source_check[0], '''  const version = spawnSync(process.execPath, [fileURLToPath(new URL("../node_modules/@iicp/client/dist/cli.js", import.meta.url)), "--version"], { encoding: "utf8" });
   assert.equal(version.status, 0);
   assert.equal(version.stdout.trim(), `iicp-node ${pkg.version}`);''')
     return text
@@ -267,12 +284,16 @@ def stage(root: Path, workspace: Path, component: str) -> dict[str, str]:
     return fixture_tree(workspace)
 
 
-def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
-                   component: str, runtime: str, target: str, bindings: dict) -> dict:
+
+def validate_immutable_bindings(bindings: dict) -> None:
     if set(bindings) != set(BINDINGS) or any(
         re.fullmatch(r"sha256:[0-9a-f]{64}", str(v)) is None for v in bindings.values()
     ):
         raise ValueError("package execution immutable bindings differ")
+
+def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
+                   component: str, runtime: str, target: str, bindings: dict) -> dict:
+    validate_immutable_bindings(bindings)
     if not safe_path(installed).is_relative_to(safe_path(workspace)):
         raise ValueError("installed package must be in the run workspace")
     payload = installed_payload(artifact, installed, component)
@@ -294,7 +315,8 @@ def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
     return value
 
 
-def validate_binding(value: dict, context: dict, artifact: Path, root: Path) -> Path:
+
+def validate_binding_identity(value: dict) -> None:
     copy = dict(value)
     copy["binding_sha256"] = None
     if value.get("schema") != SCHEMA or value.get("binding_sha256") != digest(copy):
@@ -303,22 +325,37 @@ def validate_binding(value: dict, context: dict, artifact: Path, root: Path) ->
         raise ValueError("package execution binding cannot authorize or grant credit")
     if value.get("assertion_adapter") != "canonical-runtime-verifier-and-cli.v1":
         raise ValueError("package assertion adapter binding differs")
+
+
+def validate_binding_context(value: dict, context: dict) -> None:
     if any(value.get(k) != context[k] for k in ("component", "runtime", "target")) or value.get("bindings") != {k: context[k] for k in BINDINGS}:
         raise ValueError("package execution candidate/environment/runtime binding differs")
+
+def validate_binding(value: dict, context: dict, artifact: Path, root: Path) -> Path:
+    validate_binding_identity(value)
+    validate_binding_context(value, context)
     workspace = safe_path(Path(value["workspace"]))
     home = safe_path(Path(os.environ["HOME"]))
     installed = safe_path(Path(value["installed_package"]))
-    if not workspace.is_relative_to(home) or workspace == home or workspace.is_relative_to(root.resolve()) or not installed.is_relative_to(workspace):
-        raise ValueError("package execution workspace is not run-isolated")
+    validate_workspace_boundary(workspace, home, installed, root)
     if value["artifact_sha256"] != file_digest(artifact) or value["installed_payload_sha256"] != digest(installed_payload(artifact, installed, context["component"])):
         raise ValueError("package execution installed artifact binding differs")
     if value["fixtures_sha256"] != digest(fixture_tree(workspace)):
         raise ValueError("package assertion fixtures changed")
+    expected = {name: "sha256:" + hashlib.sha256(data).hexdigest()
+                for name, data in assertion_files(root, context["component"]).items()}
+    if fixture_tree(workspace) != expected:
+        raise ValueError("package assertions differ from the reviewed source mapping")
     if value["test_dependencies_sha256"] != digest(dependencies(workspace, installed, context["component"])):
         raise ValueError("package test dependencies changed")
     return workspace
 
 
+
+def validate_workspace_boundary(workspace: Path, home: Path, installed: Path, root: Path) -> None:
+    if not workspace.is_relative_to(home) or workspace == home or workspace.is_relative_to(root.resolve()) or not installed.is_relative_to(workspace):
+        raise ValueError("package execution workspace is not run-isolated")
+
 def package_command(root: Path, context: dict, component_manifest: dict,
                     artifact_root: Path, argv: list[str], env: dict) -> tuple[list[str], dict, Path, dict]:
     path = safe_path(Path(os.environ["IICP_PRE1_PACKAGE_EXECUTION_BINDING"]))
@@ -342,3 +379,112 @@ def package_command(root: Path, context: dict, component_manifest: dict,
         if Path(value["installed_package"]) != expected:
             raise ValueError("TypeScript installed module path differs")
     return argv, env, workspace, {"value": value, "artifact": artifact}
+
+
+def execution_summary(value: dict) -> dict:
+    """Portable evidence; private execution paths never enter a receipt."""
+    keys = ("component", "runtime", "target", "bindings", "artifact_sha256",
+            "installed_payload_sha256", "fixtures_sha256", "test_dependencies_sha256")
+    return {"schema": "iicp.pre1-package-execution-summary.v1",
+            **{key: value[key] for key in keys},
+            "package_execution_sha256": value["binding_sha256"],
+            "non_authorizing": True}
+
+
+def make_case_proof(value: dict, context: dict, assertion: str, exit_code: int,
+                    run_id: str) -> dict:
+    if not isinstance(exit_code, int) or isinstance(exit_code, bool):
+        raise ValueError("case proof exit code is invalid")
+    if not isinstance(run_id, str) or not re.fullmatch(r"[a-zA-Z0-9._-]+", run_id):
+        raise ValueError("case proof run identifier is invalid")
+    if not isinstance(assertion, str) or not assertion:
+        raise ValueError("case proof assertion is missing")
+    result = {"schema": "iicp.pre1-packaged-case-proof.v2", "run_id": run_id,
+              "execution": execution_summary(value), "context": context,
+              "assertion": assertion, "exit_code": exit_code,
+              "non_authorizing": True, "proof_sha256": None}
+    result["proof_sha256"] = digest(result)
+    return result
+
+
+def validate_case_proof(value: dict, context: dict, exit_code: int,
+                        run_id: str, expected_execution: dict | None = None,
+                        expected_assertion: str | None = None) -> None:
+    validate_case_proof_identity(value)
+    validate_proof_result(value, context, exit_code, run_id)
+    summary = value["execution"]
+    if expected_execution is not None and summary != expected_execution:
+        raise ValueError("case proof installed execution differs")
+    validate_execution_summary(summary, context)
+    validate_proof_assertion(value, expected_assertion)
+
+
+def validate_case_proof_identity(value: dict) -> None:
+    fields = {"schema", "run_id", "execution", "context", "assertion", "exit_code",
+              "non_authorizing", "proof_sha256"}
+    if not isinstance(value, dict) or set(value) != fields:
+        raise ValueError("case proof fields differ")
+    copy = {**value, "proof_sha256": None}
+    if value["schema"] != "iicp.pre1-packaged-case-proof.v2" or value["proof_sha256"] != digest(copy):
+        raise ValueError("case proof schema or digest differs")
+    validate_proof_result_fields(value)
+
+
+
+def validate_proof_result(value: dict, context: dict, exit_code: int, run_id: str) -> None:
+    if value["context"] != context or value["exit_code"] != exit_code or value["run_id"] != run_id:
+        raise ValueError("case proof execution context or result differs")
+
+
+def validate_proof_assertion(value: dict, expected_assertion: str | None) -> None:
+    if not isinstance(value["assertion"], str) or not value["assertion"]:
+        raise ValueError("case proof assertion is missing")
+    if expected_assertion is not None and value["assertion"] != expected_assertion:
+        raise ValueError("case proof assertion differs from the owned mapping")
+
+
+
+def validate_proof_result_fields(value: dict) -> None:
+    if not isinstance(value["exit_code"], int) or isinstance(value["exit_code"], bool) or value["non_authorizing"] is not True:
+        raise ValueError("case proof authority or exit code differs")
+    if not isinstance(value["run_id"], str) or not re.fullmatch(r"[a-zA-Z0-9._-]+", value["run_id"]):
+        raise ValueError("case proof run identifier is invalid")
+def validate_execution_summary(summary: dict, context: dict) -> None:
+    validate_summary_identity(summary)
+    if any(summary[key] != context[key] for key in ("component", "runtime", "target")):
+        raise ValueError("package execution summary target differs")
+    if summary["bindings"] != {key: context[key] for key in BINDINGS}:
+        raise ValueError("package execution summary immutable bindings differ")
+
+
+def validate_summary_identity(summary: dict) -> None:
+    fields = {"schema", "component", "runtime", "target", "bindings",
+              "artifact_sha256", "installed_payload_sha256", "fixtures_sha256",
+              "test_dependencies_sha256", "package_execution_sha256", "non_authorizing"}
+    if not isinstance(summary, dict) or set(summary) != fields:
+        raise ValueError("package execution summary fields differ")
+    if summary["schema"] != "iicp.pre1-package-execution-summary.v1" or summary["non_authorizing"] is not True:
+        raise ValueError("package execution summary schema or authority differs")
+    for key in fields - {"schema", "component", "runtime", "target", "bindings", "non_authorizing"}:
+        if re.fullmatch(r"sha256:[0-9a-f]{64}", str(summary[key])) is None:
+            raise ValueError("package execution summary digest is invalid")
+
+
+def write_case_proof(value: dict) -> Path:
+    """Publish a complete sidecar atomically, without overwriting earlier evidence."""
+    path = Path(os.environ["IICP_PRE1_CASE_PROOF_OUTPUT"])
+    home = safe_path(Path(os.environ["HOME"]))
+    parent = safe_path(path.parent)
+    if not path.is_absolute() or not parent.is_relative_to(home) or path.exists() or path.is_symlink():
+        raise ValueError("case proof output is unsafe or already exists")
+    descriptor, temporary = tempfile.mkstemp(prefix=".case-proof-", dir=parent)
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            json.dump(value, handle, sort_keys=True)
+            handle.write("\n")
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.link(temporary, path)
+    finally:
+        Path(temporary).unlink(missing_ok=True)
+    return path
diff --git a/scripts/run_pre1_qualification_case.py b/scripts/run_pre1_qualification_case.py
index cb0976b..e5b4ecb 100755
--- a/scripts/run_pre1_qualification_case.py
+++ b/scripts/run_pre1_qualification_case.py
@@ -17,7 +17,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from pre1_environment_contract import validate_modern_environment  # noqa: E402
 from pre1_harness_binding import harness_identity, validate_harness_source  # noqa: E402
-from pre1_package_execution import package_command, validate_binding  # noqa: E402
+from pre1_package_execution import package_command, validate_binding, make_case_proof, write_case_proof  # noqa: E402
 
 ROOT = Path(__file__).resolve().parents[1]
 COMPONENT = 'client-python'
@@ -526,10 +526,11 @@ def main() -> int:
         )
         result = subprocess.run(argv, cwd=workspace, env=env, check=False)
         validate_binding(proof["value"], context, proof["artifact"], ROOT)
-        print(json.dumps({"schema": "iicp.pre1-packaged-case-proof.v1",
-                          "package_execution_sha256": proof["value"]["binding_sha256"],
-                          "cell_id": args.cell, "scenario_id": args.scenario or "support",
-                          "exit_code": result.returncode, "non_authorizing": True}, sort_keys=True))
+        case = SCENARIO_CASES[args.scenario] if args.scenario else SUPPORT_CASE
+        sidecar = make_case_proof(proof["value"], context, case["assertion"],
+                                  result.returncode, os.environ["IICP_PRE1_RUN_ID"])
+        write_case_proof(sidecar)
+
     except (KeyError, OSError, ValueError, json.JSONDecodeError, subprocess.CalledProcessError) as error:
         print(f"pre-1.0 {COMPONENT} case refused: {error}", file=sys.stderr)
         return 2
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index 6260fa8..d89e937 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -118,6 +118,80 @@ def test_dependency_tamper_fails(self):
         with self.assertRaisesRegex(ValueError, "dependencies changed"):
             self.validate(value)
 
+    def test_rehashed_fixture_and_binding_cannot_replace_reviewed_assertions(self):
+        value = self.binding()
+        (self.workspace / "tests/test_fixture.py").write_text("def test_fixture(): assert True\n")
+        value["fixtures_sha256"] = adapter.digest(adapter.fixture_tree(self.workspace))
+        value["binding_sha256"] = None
+        value["binding_sha256"] = adapter.digest(value)
+        with self.assertRaisesRegex(ValueError, "reviewed source mapping"):
+            self.validate(value)
+
+    def test_cli_adapter_decodes_file_urls(self):
+        fixture = 'const cli = readFileSync("src/cli.ts");\n  assert.match(cli, /version/);\n'
+        staged = adapter.packaged_assertions("tests/pre1_release_boundaries.test.ts", fixture)
+        self.assertIn('import { fileURLToPath } from "node:url"', staged)
+        self.assertIn("fileURLToPath(new URL(", staged)
+        self.assertNotIn(".pathname", staged)
+
+    def test_cli_subprocess_with_spaces_and_unicode_path(self):
+        import shutil
+        node = shutil.which("node")
+        if not node:
+            self.fail("Node is required for the CLI portability regression")
+        directory = self.home / "IICP space ü"
+        directory.mkdir()
+        cli = directory / "cli.mjs"
+        cli.write_text('console.log("iicp-node 0.7.110");')
+        script = '''import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+const result=spawnSync(process.execPath,[fileURLToPath(new URL(process.argv[1])),'--version'],{encoding:'utf8'});
+process.stdout.write(result.stdout); process.exit(result.status ?? 1);'''
+        result = subprocess.run([node, "--input-type=module", "-e", script, cli.as_uri()],
+                                capture_output=True, text=True, check=False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.strip(), "iicp-node 0.7.110")
+
+    def test_case_proof_is_portable_and_bound_to_result(self):
+        value = adapter.make_case_proof(self.binding(), self.context, "test_fixture", 0, "pre1-test")
+        adapter.validate_case_proof(value, self.context, 0, "pre1-test")
+        self.assertNotIn(str(self.home), json.dumps(value))
+        for field, replacement in (("run_id", "different"), ("exit_code", 1),
+                                    ("context", {**self.context, "target": "windows-x86_64"})):
+            changed = copy.deepcopy(value)
+            changed[field] = replacement
+            changed["proof_sha256"] = None
+            changed["proof_sha256"] = adapter.digest(changed)
+            with self.subTest(field=field), self.assertRaises(ValueError):
+                adapter.validate_case_proof(changed, self.context, 0, "pre1-test")
+
+    def test_case_proof_atomic_non_overwriting_and_safe(self):
+        proof = adapter.make_case_proof(self.binding(), self.context, "test_fixture", 0, "pre1-test")
+        output = self.home / "proof.json"
+        with patch.dict(os.environ, {"IICP_PRE1_CASE_PROOF_OUTPUT": str(output)}):
+            adapter.write_case_proof(proof)
+            self.assertEqual(json.loads(output.read_text()), proof)
+            with self.assertRaises(ValueError):
+                adapter.write_case_proof(proof)
+        self.assertEqual(list(self.home.glob(".case-proof-*")), [])
+        link = self.home / "linked-proof"
+        link.symlink_to(output)
+        for unsafe in (link, self.home.parent / "outside-proof.json"):
+            with patch.dict(os.environ, {"IICP_PRE1_CASE_PROOF_OUTPUT": str(unsafe)}), self.assertRaises(ValueError):
+                adapter.write_case_proof(proof)
+
+    def test_case_proof_refuses_unknown_fields_and_tampered_summary(self):
+        value = adapter.make_case_proof(self.binding(), self.context, "test_fixture", 0, "pre1-test")
+        for change in (lambda v: v.update(output="secret"),
+                       lambda v: v["execution"].update(installed_package=str(self.installed)),
+                       lambda v: v["execution"]["bindings"].update(runtime_map_sha256="wrong")):
+            changed = copy.deepcopy(value)
+            change(changed)
+            changed["proof_sha256"] = None
+            changed["proof_sha256"] = adapter.digest(changed)
+            with self.assertRaises(ValueError):
+                adapter.validate_case_proof(changed, self.context, 0, "pre1-test")
+
     def test_no_binding_cannot_run_source_case(self):
         with patch.dict(os.environ, {}, clear=True), self.assertRaises(KeyError):
             adapter.package_command(self.root, self.context, {}, self.home, [], {})

From 98d3e0701f70266a09c5012b52f91a8713d942a9 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Wed, 16 Sep 2026 18:32:43 +0200
Subject: [PATCH 04/13] Preserve installed SDK imports in lifecycle subprocess
 fixture

---
 scripts/pre1_package_execution.py      | 5 +++++
 scripts/test_pre1_package_execution.py | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 6ac4ef3..0e66ea2 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -222,6 +222,11 @@ def _decision(vector: dict, keys: dict[str, dict], signature_valid: bool) -> str
 
 '''
         return text[:start] + replacement + text[end:]
+    if name == "tests/test_service_lifecycle.py":
+        source_override = '    env = {**os.environ, "PYTHONPATH": str(Path(__file__).parents[1] / "src")}'
+        if text.count(source_override) != 1:
+            raise ValueError("reviewed lifecycle subprocess fixture shape differs")
+        return text.replace(source_override, "    env = dict(os.environ)")
     if name == "tests/pre1_release_boundaries.test.ts":
         lines = text.splitlines()
         source_check = [line for line in lines if "assert.match(cli," in line]
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index d89e937..2b5e477 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -17,6 +17,13 @@
 
 
 class PackageExecutionTests(unittest.TestCase):
+    def test_lifecycle_child_preserves_installed_import_environment(self):
+        source = '    env = {**os.environ, "PYTHONPATH": str(Path(__file__).parents[1] / "src")}'
+        bridged = adapter.packaged_assertions("tests/test_service_lifecycle.py", source)
+        self.assertEqual(bridged, "    env = dict(os.environ)")
+        with self.assertRaisesRegex(ValueError, "fixture shape differs"):
+            adapter.packaged_assertions("tests/test_service_lifecycle.py", "changed")
+
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory(prefix="pre1-package-test-")
         self.addCleanup(self.temp.cleanup)

From e477db0203f8e4eb095b58422f4e5bea96821e98 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Wed, 16 Sep 2026 21:01:24 +0200
Subject: [PATCH 05/13] Extend shared packaged-proof tooling for frozen Rust
 crate execution

---
 scripts/pre1_package_execution.py      | 198 ++++++++++++++++++++++++-
 scripts/test_pre1_package_execution.py | 115 ++++++++++++++
 2 files changed, 311 insertions(+), 2 deletions(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 0e66ea2..c5ed3fb 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -297,7 +297,10 @@ def validate_immutable_bindings(bindings: dict) -> None:
         raise ValueError("package execution immutable bindings differ")
 
 def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
-                   component: str, runtime: str, target: str, bindings: dict) -> dict:
+                   component: str, runtime: str, target: str, bindings: dict,
+                   vendor_artifact: Path | None = None) -> dict:
+    if component == "client-rust":
+        return create_rust_binding(root, workspace, installed, artifact, runtime, target, bindings, vendor_artifact)
     validate_immutable_bindings(bindings)
     if not safe_path(installed).is_relative_to(safe_path(workspace)):
         raise ValueError("installed package must be in the run workspace")
@@ -336,7 +339,10 @@ def validate_binding_context(value: dict, context: dict) -> None:
     if any(value.get(k) != context[k] for k in ("component", "runtime", "target")) or value.get("bindings") != {k: context[k] for k in BINDINGS}:
         raise ValueError("package execution candidate/environment/runtime binding differs")
 
-def validate_binding(value: dict, context: dict, artifact: Path, root: Path) -> Path:
+def validate_binding(value: dict, context: dict, artifact: Path, root: Path,
+                     vendor_artifact: Path | None = None) -> Path:
+    if context["component"] == "client-rust":
+        return validate_rust_binding(value, context, artifact, root, vendor_artifact)
     validate_binding_identity(value)
     validate_binding_context(value, context)
     workspace = safe_path(Path(value["workspace"]))
@@ -367,6 +373,8 @@ def package_command(root: Path, context: dict, component_manifest: dict,
     value = json.loads(path.read_text())
     if value.get("binding_sha256") != os.environ.get("IICP_PRE1_PACKAGE_EXECUTION_SHA256"):
         raise ValueError("package execution binding pin differs")
+    if context["component"] == "client-rust":
+        return rust_package_command(root, context, component_manifest, artifact_root, argv, env, value)
     kind = "wheel" if context["component"] == "client-python" else "npm-tarball"
     artifacts = [r for r in component_manifest["artifacts"] if r["kind"] == kind]
     if len(artifacts) != 1:
@@ -493,3 +501,189 @@ def write_case_proof(value: dict) -> Path:
     finally:
         Path(temporary).unlink(missing_ok=True)
     return path
+
+
+# Rust uses the unchanged crate payload, including its packaged assertions.
+# The vendor bundle supplies only dependency/config files, never runtime source.
+def rust_archive_files(artifact: Path, prefix: str) -> dict[str, str]:
+    safe_path(artifact)
+    result, seen, total = {}, set(), 0
+    with tarfile.open(artifact, "r|gz") as archive:
+        for row in archive:
+            name = row.name.rstrip("/")
+            total = validate_rust_archive_member(row, name, seen, total)
+            if row.isfile() and name.startswith(prefix):
+                handle = archive.extractfile(row)
+                if handle is None:
+                    raise ValueError("Rust archive member is unavailable")
+                h = hashlib.sha256()
+                for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+                    h.update(chunk)
+                result[name.removeprefix(prefix)] = "sha256:" + h.hexdigest()
+    if not result:
+        raise ValueError("Rust archive payload is empty")
+    return result
+
+
+
+
+def validate_rust_archive_name(name):
+    if not name or name.startswith("/") or "\\" in name or ":" in name:
+        raise ValueError("Rust archive contains an unsafe member name")
+    if any(part in {"", ".", ".."} for part in name.split("/")):
+        raise ValueError("Rust archive contains an unsafe member path")
+
+
+def validate_rust_archive_member(row, name, seen, total):
+    validate_rust_archive_name(name)
+    if name in seen or not (row.isfile() or row.isdir()):
+        raise ValueError("Rust archive contains an unsafe or duplicate member")
+    seen.add(name)
+    total += row.size
+    if len(seen) > 20000 or total > 1024 * 1024 * 1024:
+        raise ValueError("Rust archive exceeds bounded extraction limits")
+    return total
+
+
+def rust_dependencies(workspace: Path) -> dict[str, str]:
+    return {**{"vendor/" + k: v for k, v in tree(workspace / "vendor").items()},
+            **{".cargo/" + k: v for k, v in tree(workspace / ".cargo").items()}}
+
+
+def verify_rust_payload(workspace, installed, artifact, vendor_artifact):
+    if vendor_artifact is None:
+        raise ValueError("Rust vendor artifact must be candidate-bound")
+    crate = rust_archive_files(artifact, artifact.stem + "/")
+    if tree(installed) != crate:
+        raise ValueError("installed Rust SDK differs from the frozen crate")
+    source = rust_archive_files(vendor_artifact, "source/")
+    if source != crate:
+        raise ValueError("Rust vendor source differs from the frozen crate")
+    vendor = rust_archive_files(vendor_artifact, "vendor/")
+    config = rust_archive_files(vendor_artifact, ".cargo/")
+    expected = {**{"vendor/" + k: v for k, v in vendor.items()},
+                **{".cargo/" + k: v for k, v in config.items()}}
+    if rust_dependencies(workspace) != expected:
+        raise ValueError("Rust vendor dependencies/config differ from the candidate")
+    return crate, expected
+
+
+def rust_fixtures(root: Path, installed: Path) -> dict[str, str]:
+    mapping = "qualification/pre1-cases.json"
+    if (installed / mapping).read_bytes() != (root / mapping).read_bytes():
+        raise ValueError("Rust packaged assertion mapping differs from reviewed source")
+    return {mapping: file_digest(installed / mapping),
+            **{"tests/" + k: v for k, v in tree(installed / "tests").items()}}
+
+
+def create_rust_binding(root, workspace, installed, artifact, runtime, target, bindings, vendor_artifact):
+    validate_immutable_bindings(bindings)
+    validate_workspace_boundary(safe_path(workspace), safe_path(Path(os.environ["HOME"])),
+                               safe_path(installed), root)
+    payload, deps = verify_rust_payload(workspace, installed, artifact, vendor_artifact)
+    value = {"schema": SCHEMA, "component": "client-rust", "runtime": runtime,
+        "target": target, "bindings": bindings, "workspace": str(workspace),
+        "installed_package": str(installed), "artifact_sha256": file_digest(artifact),
+        "vendor_artifact_sha256": file_digest(vendor_artifact),
+        "installed_payload_sha256": digest(payload),
+        "fixtures_sha256": digest(rust_fixtures(root, installed)),
+        "test_dependencies_sha256": digest(deps), "binding_sha256": None,
+        "assertion_adapter": "canonical-runtime-verifier-and-cli.v1",
+        "non_authorizing": True, "qualification_credit": False}
+    value["binding_sha256"] = digest(value)
+    return value
+
+
+def validate_rust_binding(value, context, artifact, root, vendor_artifact):
+    validate_binding_identity(value)
+    validate_binding_context(value, context)
+    workspace = safe_path(Path(value["workspace"]))
+    installed = safe_path(Path(value["installed_package"]))
+    validate_workspace_boundary(workspace, safe_path(Path(os.environ["HOME"])), installed, root)
+    payload, deps = verify_rust_payload(workspace, installed, artifact, vendor_artifact)
+    expected = {"artifact_sha256": file_digest(artifact),
+                "vendor_artifact_sha256": file_digest(vendor_artifact),
+                "installed_payload_sha256": digest(payload),
+                "test_dependencies_sha256": digest(deps),
+                "fixtures_sha256": digest(rust_fixtures(root, installed))}
+    if any(value.get(k) != v for k, v in expected.items()):
+        raise ValueError("Rust package execution inputs changed")
+    return installed
+
+
+def rust_artifacts(component, artifact_root):
+    paths = []
+    for kind in ("crate", "vendored-offline-package"):
+        rows = [row for row in component["artifacts"] if row["kind"] == kind]
+        if len(rows) != 1:
+            raise ValueError("Rust candidate artifact is ambiguous")
+        path = safe_path(artifact_root / "client-rust" / rows[0]["name"])
+        if file_digest(path) != rows[0]["sha256"]:
+            raise ValueError("Rust candidate artifact digest differs")
+        paths.append(path)
+    return paths
+
+
+def rust_package_command(root, context, component, artifact_root, argv, env, value):
+    artifact, vendor = rust_artifacts(component, artifact_root)
+    installed = validate_binding(value, context, artifact, root, vendor)
+    workspace = safe_path(Path(value["workspace"]))
+    home = safe_path(Path(env["HOME"]))
+    cargo_home = home / "rust-cargo-home"
+    cargo_home.mkdir(mode=0o700, exist_ok=True)
+    safe_path(cargo_home)
+    target = home / "rust-build" / context["runtime"]
+    target.mkdir(mode=0o700, parents=True, exist_ok=True)
+    safe_path(target)
+    env = {**env, "CARGO_HOME": str(cargo_home), "CARGO_TARGET_DIR": str(target),
+           "CARGO_NET_OFFLINE": "true", "CARGO_INCREMENTAL": "0"}
+    # Cargo can otherwise discover unrelated configs above the run workspace.
+    if workspace.parent != home or installed.parent != workspace:
+        raise ValueError("Rust package workspace layout differs")
+    for ancestor in (home, *home.parents):
+        for name in ("config", "config.toml"):
+            path = ancestor / ".cargo" / name
+            if path.exists() or path.is_symlink():
+                raise ValueError("Rust inherited Cargo configuration is forbidden")
+    if (cargo_home / "config").exists() or (cargo_home / "config.toml").exists():
+        raise ValueError("Rust inherited Cargo home configuration is forbidden")
+    argv = [*argv[:3], "--offline", *argv[3:]]
+    return argv, env, installed, {"value": value, "artifact": artifact, "vendor_artifact": vendor}
+
+
+
+def extract_rust_packages(artifact: Path, vendor_artifact: Path, workspace: Path) -> Path:
+    """Extract only into an empty caller-owned workspace after validating both archives."""
+    safe_path(workspace)
+    if any(workspace.iterdir()):
+        raise ValueError("Rust extraction workspace must be empty")
+    crate = rust_archive_files(artifact, artifact.stem + "/")
+    if crate != rust_archive_files(vendor_artifact, "source/"):
+        raise ValueError("Rust vendor source differs from the frozen crate")
+    rust_archive_files(vendor_artifact, "vendor/")
+    rust_archive_files(vendor_artifact, ".cargo/")
+    extract_rust_prefix(artifact, artifact.stem + "/", workspace / "source")
+    extract_rust_prefix(vendor_artifact, "vendor/", workspace / "vendor")
+    extract_rust_prefix(vendor_artifact, ".cargo/", workspace / ".cargo")
+    return safe_path(workspace / "source")
+
+
+def extract_rust_prefix(artifact: Path, prefix: str, destination: Path) -> None:
+    destination.mkdir(mode=0o700)
+    with tarfile.open(artifact, "r|gz") as archive:
+        for row in archive:
+            if not row.isfile() or not row.name.startswith(prefix):
+                continue
+            relative = row.name.removeprefix(prefix)
+            if Path(relative).is_absolute() or any(p in {"", ".", ".."} for p in relative.split("/")):
+                raise ValueError("Rust extraction path is unsafe")
+            path = destination / relative
+            path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+            safe_path(path.parent)
+            handle = archive.extractfile(row)
+            if handle is None:
+                raise ValueError("Rust extraction member is unavailable")
+            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o700 if row.mode & 0o111 else 0o600)
+            with os.fdopen(fd, "wb") as output:
+                for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+                    output.write(chunk)
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index 2b5e477..921e5bc 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -256,5 +256,120 @@ def test_typescript_archive_and_missing_compiled_file(self):
             adapter.installed_payload(artifact, installed, "client-typescript")
 
 
+
+class RustPackageExecutionTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="pre1-rust-package-test-")
+        self.addCleanup(self.temp.cleanup)
+        self.home = Path(self.temp.name).resolve()
+        self.root = self.home / "checkout"
+        self.workspace = self.home / "workspace"
+        self.root.mkdir()
+        self.workspace.mkdir()
+        self.mapping = b'{"support":{},"scenarios":{}}'
+        (self.root / "qualification").mkdir()
+        (self.root / "qualification/pre1-cases.json").write_bytes(self.mapping)
+        self.files = {"Cargo.toml": b'[package]\nname="iicp-client"\nversion="0.7.110"\n',
+            "Cargo.lock": b"# locked\n", "src/lib.rs": b"pub fn run() {}\n",
+            "tests/exact.rs": b"#[test] fn exact() {}\n",
+            "qualification/pre1-cases.json": self.mapping}
+        self.artifact = self.home / "iicp-client-0.7.110.crate"
+        self.vendor = self.home / "vendor.tar.gz"
+        self.archive(self.artifact, {"iicp-client-0.7.110/" + k: v for k,v in self.files.items()})
+        self.archive(self.vendor, {**{"source/"+k:v for k,v in self.files.items()},
+            "vendor/dependency/src/lib.rs": b"pub fn dep() {}\n",
+            ".cargo/config.toml": b'[source.crates-io]\nreplace-with="vendored-sources"\n'})
+        self.env = patch.dict(os.environ, {"HOME": str(self.home)})
+        self.env.start()
+        self.addCleanup(self.env.stop)
+        self.installed = adapter.extract_rust_packages(self.artifact, self.vendor, self.workspace)
+        self.bindings = {key: "sha256:"+"a"*64 for key in adapter.BINDINGS}
+        self.context = {"component":"client-rust", "runtime":"msrv-1.86", "target":"macos-arm64", **self.bindings}
+
+    def archive(self, path, files):
+        with tarfile.open(path, "w:gz") as archive:
+            for name,data in files.items():
+                row=tarfile.TarInfo(name); row.size=len(data)
+                archive.addfile(row, io.BytesIO(data))
+
+    def binding(self):
+        return adapter.create_binding(self.root, self.workspace, self.installed, self.artifact,
+            "client-rust", "msrv-1.86", "macos-arm64", self.bindings, self.vendor)
+
+    def validate(self, value):
+        return adapter.validate_binding(value, self.context, self.artifact, self.root, self.vendor)
+
+    def test_frozen_crate_and_vendor_source_are_identical(self):
+        value=self.binding()
+        self.assertEqual(self.validate(value), self.installed)
+        self.assertFalse(value["qualification_credit"])
+        proof=adapter.make_case_proof(value,self.context,"exact",0,"rust-test")
+        adapter.validate_case_proof(proof,self.context,0,"rust-test")
+        self.assertNotIn(str(self.home),json.dumps(proof))
+
+    def test_modified_missing_extra_source_and_vendor_fail(self):
+        value=self.binding()
+        for file in (self.installed/"src/lib.rs",self.workspace/"vendor/dependency/src/lib.rs",self.workspace/".cargo/config.toml"):
+            original=file.read_bytes(); file.write_bytes(b"tamper")
+            with self.assertRaises(ValueError): self.validate(value)
+            file.unlink()
+            with self.assertRaises(ValueError): self.validate(value)
+            file.write_bytes(original)
+        (self.installed/"extra.rs").write_text("extra")
+        with self.assertRaises(ValueError): self.validate(value)
+
+    def test_forged_binding_cannot_replace_packaged_assertions(self):
+        value=self.binding(); (self.installed/"tests/exact.rs").write_text("#[test] fn exact() {} // forged")
+        value["installed_payload_sha256"]=adapter.digest(adapter.tree(self.installed))
+        value["binding_sha256"]=None; value["binding_sha256"]=adapter.digest(value)
+        with self.assertRaises(ValueError):self.validate(value)
+
+    def test_all_semantic_dimensions_fail_even_after_rehash(self):
+        value=self.binding()
+        for key in ("component","runtime","target"):
+            changed=copy.deepcopy(value); changed[key]="wrong"
+            changed["binding_sha256"]=None; changed["binding_sha256"]=adapter.digest(changed)
+            with self.assertRaises(ValueError):self.validate(changed)
+        for key in adapter.BINDINGS:
+            changed=copy.deepcopy(value); changed["bindings"][key]="sha256:"+"b"*64
+            changed["binding_sha256"]=None; changed["binding_sha256"]=adapter.digest(changed)
+            with self.assertRaises(ValueError):self.validate(changed)
+
+    def test_vendor_artifact_must_be_bound_and_source_must_match(self):
+        with self.assertRaises(ValueError):adapter.validate_binding(self.binding(),self.context,self.artifact,self.root)
+        self.archive(self.vendor,{"source/forged.rs":b"forged"})
+        with self.assertRaisesRegex(ValueError,"vendor source differs"):self.binding()
+
+    def test_reviewed_mapping_and_symlink_checks(self):
+        (self.root/"qualification/pre1-cases.json").write_text("changed")
+        with self.assertRaisesRegex(ValueError,"mapping differs"):self.binding()
+        (self.root/"qualification/pre1-cases.json").write_bytes(self.mapping)
+        (self.workspace/"vendor/link").symlink_to(self.root)
+        with self.assertRaises(ValueError):self.binding()
+
+    def test_archive_rejects_traversal_links_and_duplicates(self):
+        for name in ("../escape", "/absolute", "vendor/../escape", "vendor/a:b", "vendor/evil\\file"):
+            self.archive(self.vendor,{name:b"unsafe"})
+            with self.assertRaises(ValueError):adapter.rust_archive_files(self.vendor,"vendor/")
+        for kind in (tarfile.SYMTYPE,tarfile.LNKTYPE,tarfile.FIFOTYPE):
+            with tarfile.open(self.vendor,"w:gz") as archive:
+                row=tarfile.TarInfo("vendor/link");row.type=kind;row.linkname="escape";archive.addfile(row)
+            with self.assertRaises(ValueError):adapter.rust_archive_files(self.vendor,"vendor/")
+        with tarfile.open(self.vendor,"w:gz") as archive:
+            for _ in range(2):
+                row=tarfile.TarInfo("vendor/same");row.size=1;archive.addfile(row,io.BytesIO(b"x"))
+        with self.assertRaises(ValueError):adapter.rust_archive_files(self.vendor,"vendor/")
+
+    def test_extraction_refuses_nonempty_workspace_and_has_restrictive_permissions(self):
+        with self.assertRaisesRegex(ValueError,"empty"):adapter.extract_rust_packages(self.artifact,self.vendor,self.workspace)
+        self.assertEqual((self.installed/"src/lib.rs").stat().st_mode & 0o777,0o600)
+
+    def test_rust_archive_bytes_are_bounded_before_allocation(self):
+        row=tarfile.TarInfo("vendor/large");row.size=1024*1024*1024+1
+        from unittest.mock import MagicMock
+        opened=MagicMock();opened.__enter__.return_value.__iter__.return_value=iter([row])
+        with patch.object(adapter.tarfile,"open",return_value=opened):
+            with self.assertRaisesRegex(ValueError,"bounded"):adapter.rust_archive_files(self.vendor,"vendor/")
+
 if __name__ == "__main__":
     unittest.main()

From ee458849cc9ef6f5cb1bf9756e16b4797033086a Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Wed, 16 Sep 2026 21:04:01 +0200
Subject: [PATCH 06/13] Keep Rust archive validation and Cargo isolation guards
 structurally bounded

---
 scripts/pre1_package_execution.py | 48 ++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 20 deletions(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index c5ed3fb..b9c6c4f 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -640,13 +640,7 @@ def rust_package_command(root, context, component, artifact_root, argv, env, val
     # Cargo can otherwise discover unrelated configs above the run workspace.
     if workspace.parent != home or installed.parent != workspace:
         raise ValueError("Rust package workspace layout differs")
-    for ancestor in (home, *home.parents):
-        for name in ("config", "config.toml"):
-            path = ancestor / ".cargo" / name
-            if path.exists() or path.is_symlink():
-                raise ValueError("Rust inherited Cargo configuration is forbidden")
-    if (cargo_home / "config").exists() or (cargo_home / "config.toml").exists():
-        raise ValueError("Rust inherited Cargo home configuration is forbidden")
+    reject_inherited_cargo_config(home, cargo_home)
     argv = [*argv[:3], "--offline", *argv[3:]]
     return argv, env, installed, {"value": value, "artifact": artifact, "vendor_artifact": vendor}
 
@@ -674,16 +668,30 @@ def extract_rust_prefix(artifact: Path, prefix: str, destination: Path) -> None:
         for row in archive:
             if not row.isfile() or not row.name.startswith(prefix):
                 continue
-            relative = row.name.removeprefix(prefix)
-            if Path(relative).is_absolute() or any(p in {"", ".", ".."} for p in relative.split("/")):
-                raise ValueError("Rust extraction path is unsafe")
-            path = destination / relative
-            path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
-            safe_path(path.parent)
-            handle = archive.extractfile(row)
-            if handle is None:
-                raise ValueError("Rust extraction member is unavailable")
-            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o700 if row.mode & 0o111 else 0o600)
-            with os.fdopen(fd, "wb") as output:
-                for chunk in iter(lambda: handle.read(1024 * 1024), b""):
-                    output.write(chunk)
+            extract_rust_file(archive, row, prefix, destination)
+
+
+def extract_rust_file(archive, row, prefix, destination):
+    relative = row.name.removeprefix(prefix)
+    if Path(relative).is_absolute() or any(p in {"", ".", ".."} for p in relative.split("/")):
+        raise ValueError("Rust extraction path is unsafe")
+    path = destination / relative
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    safe_path(path.parent)
+    handle = archive.extractfile(row)
+    if handle is None:
+        raise ValueError("Rust extraction member is unavailable")
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o700 if row.mode & 0o111 else 0o600)
+    with os.fdopen(fd, "wb") as output:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            output.write(chunk)
+
+
+def reject_inherited_cargo_config(home, cargo_home):
+    for ancestor in (home, *home.parents):
+        for name in ("config", "config.toml"):
+            path = ancestor / ".cargo" / name
+            if path.exists() or path.is_symlink():
+                raise ValueError("Rust inherited Cargo configuration is forbidden")
+    if (cargo_home / "config").exists() or (cargo_home / "config.toml").exists():
+        raise ValueError("Rust inherited Cargo home configuration is forbidden")

From 2fe9037e795c85503f962edfc0d63f26577af3c1 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Thu, 17 Sep 2026 16:47:22 +0200
Subject: [PATCH 07/13] test(pre1): stage immutable Management consumers and
 seal packaged case proofs

---
 scripts/pre1_package_execution.py      | 184 +++++++++++++++++++++++++
 scripts/test_pre1_package_execution.py | 100 ++++++++++++++
 2 files changed, 284 insertions(+)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index b9c6c4f..16eae96 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -299,6 +299,8 @@ def validate_immutable_bindings(bindings: dict) -> None:
 def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
                    component: str, runtime: str, target: str, bindings: dict,
                    vendor_artifact: Path | None = None) -> dict:
+    if component == "management":
+        return create_management_binding(root, workspace, installed, artifact, runtime, target, bindings)
     if component == "client-rust":
         return create_rust_binding(root, workspace, installed, artifact, runtime, target, bindings, vendor_artifact)
     validate_immutable_bindings(bindings)
@@ -341,6 +343,8 @@ def validate_binding_context(value: dict, context: dict) -> None:
 
 def validate_binding(value: dict, context: dict, artifact: Path, root: Path,
                      vendor_artifact: Path | None = None) -> Path:
+    if context["component"] == "management":
+        return validate_management_binding(value, context, artifact, root)
     if context["component"] == "client-rust":
         return validate_rust_binding(value, context, artifact, root, vendor_artifact)
     validate_binding_identity(value)
@@ -375,6 +379,21 @@ def package_command(root: Path, context: dict, component_manifest: dict,
         raise ValueError("package execution binding pin differs")
     if context["component"] == "client-rust":
         return rust_package_command(root, context, component_manifest, artifact_root, argv, env, value)
+    if context["component"] == "management":
+        rows = [r for r in component_manifest["artifacts"] if r["kind"] == "crate"]
+        if len(rows) != 1:
+            raise ValueError("Management candidate crate is ambiguous")
+        artifact = safe_path(artifact_root / "management" / rows[0]["name"])
+        if file_digest(artifact) != rows[0]["sha256"]:
+            raise ValueError("Management candidate crate digest differs")
+        consumer = validate_management_binding(value, context, artifact, root)
+        home = safe_path(Path(env["HOME"]))
+        cargo_home = home / "rust-cargo-home"
+        cargo_home.mkdir(mode=0o700, exist_ok=True)
+        reject_inherited_cargo_config(home, safe_path(cargo_home))
+        env = {**env, "CARGO_HOME": str(cargo_home), "CARGO_NET_OFFLINE": "true", "CARGO_INCREMENTAL": "0"}
+        argv = [*argv[:3], "--offline", *argv[3:]]
+        return argv, env, consumer, {"value": value, "artifact": artifact, "vendor_artifact": None}
     kind = "wheel" if context["component"] == "client-python" else "npm-tarball"
     artifacts = [r for r in component_manifest["artifacts"] if r["kind"] == kind]
     if len(artifacts) != 1:
@@ -695,3 +714,168 @@ def reject_inherited_cargo_config(home, cargo_home):
                 raise ValueError("Rust inherited Cargo configuration is forbidden")
     if (cargo_home / "config").exists() or (cargo_home / "config.toml").exists():
         raise ValueError("Rust inherited Cargo home configuration is forbidden")
+
+
+def management_consumer_files(root: Path, payload: Path) -> dict[str, bytes]:
+    """Keep frozen runtime source separate from reviewed external assertions.
+
+    Cargo disables automatic tests in the published Management crate. A
+    separate consumer manifest names only the existing mapped integration
+    fixtures and points its library/binaries at the untouched crate source.
+    No dependency, lockfile, assertion or runtime source is rewritten.
+    """
+    root, payload = safe_path(root), safe_path(payload)
+    mapping = safe_path(root / "qualification/pre1-cases.json")
+    cases = json.loads(mapping.read_text())
+    if cases.get("component") != "management" or cases.get("schema") != "iicp.pre1-component-case-map.v2":
+        raise ValueError("Management consumer case map differs")
+    names = set()
+    for case in [cases["support"], *cases["scenarios"].values()]:
+        command = case["command"]
+        if "--test" in command:
+            name = command[command.index("--test") + 1]
+            if not isinstance(name, str) or re.fullmatch(r"[a-z][a-z0-9_]*", name) is None:
+                raise ValueError("Management consumer test name is unsafe")
+            names.add(name)
+    tracked = set(subprocess.check_output(["git", "ls-files", "-z", "--", "tests"], cwd=root).decode().split("\0"))
+    files = {}
+    for name in sorted(names):
+        path = f"tests/{name}.rs"
+        if path not in tracked:
+            raise ValueError("Management consumer assertion is not Git-bound")
+        source = safe_path(root / path).read_text()
+        files[path] = management_assertions(path, source).encode()
+    for name in tree(payload):
+        if not name.startswith(("src/", "examples/")) and name != "Cargo.toml":
+            files[name] = (payload / name).read_bytes()
+    manifest = (payload / "Cargo.toml").read_text()
+    for path in re.findall(r'^path = "([^"\n]+)"$', manifest, flags=re.M):
+        validate_rust_archive_name(path)
+        if not path.startswith(("src/", "examples/")):
+            raise ValueError("Management consumer manifest source path differs")
+    manifest = re.sub(r'^path = "((?:src|examples)/[^"\n]+)"$',
+                      lambda match: f'path = "../payload/{match[1]}"', manifest, flags=re.M)
+    for name in sorted(names):
+        manifest += f'\n[[test]]\nname = "{name}"\npath = "tests/{name}.rs"\n'
+    files["Cargo.toml"] = manifest.encode()
+    return files
+
+
+def management_assertions(name, source):
+    """Validate pre-1 builder metadata; retain the older publisher assertions."""
+    if name != "tests/release_manifest.rs":
+        return source
+    marker = '    let manifest: Value = serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap();'
+    optional = '    let Some(path) = env::var_os("IICP_RELEASE_MANIFEST") else {\n        return;\n    };'
+    if source.count(marker) != 1 or source.count(optional) != 1:
+        raise ValueError("Management release fixture shape differs")
+    branch = '''
+    if manifest["schema"] == "iicp.pre1-management-release-manifest.v1" {
+        let candidate: Value = serde_json::from_str(&fs::read_to_string(
+            env::var_os("IICP_PRE1_CANDIDATE_MANIFEST").expect("candidate required")
+        ).unwrap()).unwrap();
+        let component = candidate["components"].as_array().unwrap().iter()
+            .find(|row| row["id"] == "management").unwrap();
+        assert_eq!(manifest["source_commit"], component["source_commit"]);
+        assert_eq!(manifest["version"], env!("CARGO_PKG_VERSION"));
+        assert_eq!(manifest["version"], component["version"]);
+        assert_eq!(manifest["product"], "iicp-management-core");
+        assert_eq!(manifest["channel"], "developer-preview");
+        assert_eq!(manifest["non_authorizing"], true);
+        for flag in ["publication_authorized", "deployment_authorized", "management_service", "directory_authority"] {
+            assert_eq!(manifest[flag], false);
+        }
+        assert_eq!(manifest["binaries"], json!(["iicp-management", "iicp-management-controller", "iicp-management-conformance"]));
+        assert_eq!(manifest.as_object().unwrap().len(), 11);
+        return;
+    }
+'''
+    return source.replace(optional, '    let path = env::var_os("IICP_RELEASE_MANIFEST").expect("release manifest required");').replace(marker, marker + branch)
+
+
+def stage_management_consumer(root: Path, artifact: Path, workspace: Path) -> dict:
+    """Prepare only; the caller owns dependency acquisition and isolation."""
+    root, artifact, workspace = safe_path(root), safe_path(artifact), safe_path(workspace)
+    home = safe_path(Path(os.environ["HOME"]))
+    if workspace == home or not workspace.is_relative_to(home) or workspace.is_relative_to(root) or any(workspace.iterdir()):
+        raise ValueError("Management consumer workspace is not empty and run-isolated")
+    expected = rust_archive_files(artifact, artifact.stem + "/")
+    extract_rust_prefix(artifact, artifact.stem + "/", workspace / "payload")
+    payload = workspace / "payload"
+    if tree(payload) != expected:
+        raise ValueError("Management extracted crate differs")
+    files = management_consumer_files(root, payload)
+    consumer = workspace / "consumer"
+    consumer.mkdir(mode=0o700)
+    for name, data in files.items():
+        path = consumer / name
+        path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        path.write_bytes(data)
+    return {"schema": "iicp.pre1-management-consumer.v1",
+            "artifact_sha256": file_digest(artifact), "payload_sha256": digest(expected),
+            "consumer_sha256": digest(tree(consumer)),
+            "non_authorizing": True, "qualification_credit": False}
+
+
+def validate_management_consumer(root: Path, artifact: Path, workspace: Path, binding: dict) -> Path:
+    """Recheck artifact and reviewed assertions, even after a forged rehash."""
+    workspace = safe_path(workspace)
+    home = safe_path(Path(os.environ["HOME"]))
+    if workspace == home or not workspace.is_relative_to(home) or workspace.is_relative_to(root.resolve()):
+        raise ValueError("Management consumer workspace is not run-isolated")
+    payload = safe_path(workspace / "payload")
+    consumer = safe_path(workspace / "consumer")
+    expected = rust_archive_files(artifact, artifact.stem + "/")
+    actual = tree(consumer)
+    fixtures = {name: "sha256:" + hashlib.sha256(data).hexdigest()
+                for name, data in management_consumer_files(root, payload).items()}
+    if binding != {"schema": "iicp.pre1-management-consumer.v1",
+                   "artifact_sha256": file_digest(artifact), "payload_sha256": digest(expected),
+                   "consumer_sha256": digest(actual),
+                   "non_authorizing": True, "qualification_credit": False} or tree(payload) != expected or actual != fixtures:
+        raise ValueError("Management consumer artifact or reviewed fixtures changed")
+    return consumer
+
+
+def management_consumer_binding(artifact, workspace):
+    return {"schema": "iicp.pre1-management-consumer.v1",
+            "artifact_sha256": file_digest(artifact),
+            "payload_sha256": digest(rust_archive_files(artifact, artifact.stem + "/")),
+            "consumer_sha256": digest(tree(workspace / "consumer")),
+            "non_authorizing": True, "qualification_credit": False}
+
+
+def management_dependencies(workspace):
+    expected = ('[source.crates-io]\nreplace-with = "vendored-sources"\n\n'
+                '[source.vendored-sources]\ndirectory = ' + json.dumps(str(workspace / "vendor")) + '\n')
+    if tree(workspace / ".cargo") != {"config.toml": "sha256:" + hashlib.sha256(expected.encode()).hexdigest()}:
+        raise ValueError("Management offline Cargo configuration differs")
+    return rust_dependencies(workspace)
+
+
+def create_management_binding(root, workspace, installed, artifact, runtime, target, bindings):
+    validate_immutable_bindings(bindings)
+    staged = management_consumer_binding(artifact, workspace)
+    if safe_path(installed) != validate_management_consumer(root, artifact, workspace, staged):
+        raise ValueError("Management consumer path differs")
+    value = {"schema": SCHEMA, "component": "management", "runtime": runtime,
+        "target": target, "bindings": bindings, "workspace": str(workspace),
+        "installed_package": str(installed), "artifact_sha256": staged["artifact_sha256"],
+        "installed_payload_sha256": staged["payload_sha256"],
+        "fixtures_sha256": staged["consumer_sha256"],
+        "test_dependencies_sha256": digest(management_dependencies(workspace)),
+        "binding_sha256": None, "assertion_adapter": "canonical-runtime-verifier-and-cli.v1",
+        "non_authorizing": True, "qualification_credit": False}
+    value["binding_sha256"] = digest(value)
+    return value
+
+
+def validate_management_binding(value, context, artifact, root):
+    validate_binding_identity(value)
+    validate_binding_context(value, context)
+    workspace = safe_path(Path(value["workspace"]))
+    expected = create_management_binding(root, workspace, Path(value["installed_package"]),
+        artifact, context["runtime"], context["target"], {key: context[key] for key in BINDINGS})
+    if value != expected:
+        raise ValueError("Management package execution inputs changed")
+    return safe_path(workspace / "consumer")
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index 921e5bc..de43e29 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -17,6 +17,106 @@
 
 
 class PackageExecutionTests(unittest.TestCase):
+    def management_artifact(self):
+        self.workspace = self.home / "run/management"
+        self.workspace.mkdir(parents=True)
+        (self.root / "qualification").mkdir(exist_ok=True)
+        case = {"assertion": "test_fixture", "command": ["@cargo", "test", "--locked", "--test", "fixture", "test_fixture", "--", "--exact"]}
+        (self.root / "qualification/pre1-cases.json").write_text(json.dumps({
+            "schema": "iicp.pre1-component-case-map.v2", "component": "management",
+            "support": case, "scenarios": {}}))
+        (self.root / "tests/fixture.rs").write_text("#[test]\nfn test_fixture() { assert!(true); }\n")
+        subprocess.run(["git", "add", "."], cwd=self.root, check=True)
+        artifact = self.home / "iicp-management-core-0.11.0.crate"
+        files = {"Cargo.toml": b'[package]\nname = "iicp-management-core"\nversion = "0.11.0"\nautotests = false\n[lib]\npath = "src/lib.rs"\n',
+                 "Cargo.lock": b'unchanged lock', "src/lib.rs": b'pub fn frozen() {}',
+                 "contracts/test.json": b'{"frozen":true}'}
+        with tarfile.open(artifact, "w:gz") as archive:
+            for name, data in files.items():
+                row = tarfile.TarInfo(artifact.stem + "/" + name)
+                row.size = len(data)
+                archive.addfile(row, io.BytesIO(data))
+        return artifact
+
+    def test_management_manifest_bridge_requires_actual_candidate_and_retains_legacy(self):
+        source = '    let Some(path) = env::var_os("IICP_RELEASE_MANIFEST") else {\n        return;\n    };\n    let manifest: Value = serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap();\nassert_eq!(manifest["authorizes_deployment"], false);' 
+        staged = adapter.management_assertions("tests/release_manifest.rs", source)
+        self.assertIn('component["source_commit"]', staged)
+        self.assertIn('expect("release manifest required")', staged)
+        self.assertIn('assert_eq!(manifest["authorizes_deployment"], false)', staged)
+        self.assertIn('"management_service", "directory_authority"', staged)
+        with self.assertRaisesRegex(ValueError, "fixture shape differs"):
+            adapter.management_assertions("tests/release_manifest.rs", "unexpected")
+
+    def test_management_consumer_keeps_frozen_source_and_lock(self):
+        artifact = self.management_artifact()
+        value = adapter.stage_management_consumer(self.root, artifact, self.workspace)
+        consumer = adapter.validate_management_consumer(self.root, artifact, self.workspace, value)
+        self.assertFalse(value["qualification_credit"])
+        self.assertEqual((self.workspace / "payload/src/lib.rs").read_bytes(), b'pub fn frozen() {}')
+        self.assertFalse((consumer / "src").exists())
+        self.assertEqual((consumer / "Cargo.lock").read_bytes(), b'unchanged lock')
+        self.assertIn('path = "../payload/src/lib.rs"', (consumer / "Cargo.toml").read_text())
+        self.assertIn('name = "fixture"', (consumer / "Cargo.toml").read_text())
+        self.assertEqual((consumer / "tests/fixture.rs").read_bytes(), (self.root / "tests/fixture.rs").read_bytes())
+
+    def test_management_rehashed_consumer_tamper_fails(self):
+        artifact = self.management_artifact()
+        value = adapter.stage_management_consumer(self.root, artifact, self.workspace)
+        (self.workspace / "consumer/tests/fixture.rs").write_text("weakened assertion")
+        value["consumer_sha256"] = adapter.digest(adapter.tree(self.workspace / "consumer"))
+        with self.assertRaisesRegex(ValueError, "reviewed fixtures changed"):
+            adapter.validate_management_consumer(self.root, artifact, self.workspace, value)
+
+    def test_management_runtime_tamper_and_extra_files_fail(self):
+        artifact = self.management_artifact()
+        value = adapter.stage_management_consumer(self.root, artifact, self.workspace)
+        (self.workspace / "payload/src/lib.rs").write_text("checkout fallback")
+        value["payload_sha256"] = adapter.digest(adapter.tree(self.workspace / "payload"))
+        with self.assertRaises(ValueError):
+            adapter.validate_management_consumer(self.root, artifact, self.workspace, value)
+
+    def test_management_untracked_or_unsafe_test_name_fails(self):
+        artifact = self.management_artifact()
+        mapping = self.root / "qualification/pre1-cases.json"
+        value = json.loads(mapping.read_text())
+        for name in ["../escape", "untracked"]:
+            value["support"]["command"][4] = name
+            mapping.write_text(json.dumps(value))
+            if (self.workspace / "payload").exists():
+                import shutil
+                shutil.rmtree(self.workspace / "payload")
+            with self.subTest(name=name), self.assertRaises(ValueError):
+                adapter.stage_management_consumer(self.root, artifact, self.workspace)
+
+    def test_management_staging_refuses_nonempty_or_outside_home(self):
+        artifact = self.management_artifact()
+        (self.workspace / "preserved").write_text("user work")
+        with self.assertRaises(ValueError):
+            adapter.stage_management_consumer(self.root, artifact, self.workspace)
+        self.assertEqual((self.workspace / "preserved").read_text(), "user work")
+
+    def test_management_binding_is_context_bound_and_offline(self):
+        artifact = self.management_artifact()
+        adapter.stage_management_consumer(self.root, artifact, self.workspace)
+        (self.workspace / "vendor").mkdir()
+        (self.workspace / "vendor/dependency").write_text("locked dependency")
+        (self.workspace / ".cargo").mkdir()
+        config = ('[source.crates-io]\nreplace-with = "vendored-sources"\n\n'
+                  '[source.vendored-sources]\ndirectory = ' + json.dumps(str(self.workspace / "vendor")) + '\n')
+        (self.workspace / ".cargo/config.toml").write_text(config)
+        installed = self.workspace / "consumer"
+        value = adapter.create_binding(self.root, self.workspace, installed, artifact,
+            "management", "rust-1.98.0", "macos-arm64", self.bindings)
+        context = {**self.context, "component": "management", "runtime": "rust-1.98.0"}
+        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), installed)
+        self.assertEqual(adapter.make_case_proof(value, context, "test_fixture", 0, "test-run")["schema"], "iicp.pre1-packaged-case-proof.v2")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, {**context, "target": "wrong"}, artifact, self.root)
+        (self.workspace / ".cargo/config.toml").write_text(config + '\n[build]\nrustc-wrapper = "fake"\n')
+        with self.assertRaisesRegex(ValueError, "offline Cargo configuration differs"):
+            adapter.validate_binding(value, context, artifact, self.root)
+
     def test_lifecycle_child_preserves_installed_import_environment(self):
         source = '    env = {**os.environ, "PYTHONPATH": str(Path(__file__).parents[1] / "src")}'
         bridged = adapter.packaged_assertions("tests/test_service_lifecycle.py", source)

From 31973b094878cc6544f6acce9451ae4c4efa6b20 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Thu, 17 Sep 2026 16:56:28 +0200
Subject: [PATCH 08/13] test(pre1): remove fixture trailing whitespace

---
 scripts/test_pre1_package_execution.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index de43e29..db49dda 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -39,7 +39,7 @@ def management_artifact(self):
         return artifact
 
     def test_management_manifest_bridge_requires_actual_candidate_and_retains_legacy(self):
-        source = '    let Some(path) = env::var_os("IICP_RELEASE_MANIFEST") else {\n        return;\n    };\n    let manifest: Value = serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap();\nassert_eq!(manifest["authorizes_deployment"], false);' 
+        source = '    let Some(path) = env::var_os("IICP_RELEASE_MANIFEST") else {\n        return;\n    };\n    let manifest: Value = serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap();\nassert_eq!(manifest["authorizes_deployment"], false);'
         staged = adapter.management_assertions("tests/release_manifest.rs", source)
         self.assertIn('component["source_commit"]', staged)
         self.assertIn('expect("release manifest required")', staged)

From 2fe7a0d5f000097c76231dcf793fcaa011bfffb8 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Thu, 17 Sep 2026 17:42:56 +0200
Subject: [PATCH 09/13] test(pre1): advertise the emitted packaged case proof
 version

---
 scripts/run_pre1_qualification_case.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/run_pre1_qualification_case.py b/scripts/run_pre1_qualification_case.py
index e5b4ecb..8e7c28d 100755
--- a/scripts/run_pre1_qualification_case.py
+++ b/scripts/run_pre1_qualification_case.py
@@ -96,6 +96,7 @@ def description() -> dict:
         "evidence_policy": "digest-only",
         "artifact_consumption": "verified-installed-package",
         "package_execution_schema": "iicp.pre1-package-execution.v1",
+        "case_proof_schema": "iicp.pre1-packaged-case-proof.v2",
         "source_commit_binding": True,
         "supported_environment_schemas": [
             "iicp.pre1-qualification-environment.v1",

From 1d973d33f68a3714a1e21ff3721b3246cab6c135 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Thu, 17 Sep 2026 18:20:57 +0200
Subject: [PATCH 10/13] test(pre1): bind Management manifest to candidate
 source_version

---
 scripts/pre1_package_execution.py      | 2 +-
 scripts/test_pre1_package_execution.py | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 16eae96..44320e2 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -778,7 +778,7 @@ def management_assertions(name, source):
             .find(|row| row["id"] == "management").unwrap();
         assert_eq!(manifest["source_commit"], component["source_commit"]);
         assert_eq!(manifest["version"], env!("CARGO_PKG_VERSION"));
-        assert_eq!(manifest["version"], component["version"]);
+        assert_eq!(manifest["version"], component["source_version"]);
         assert_eq!(manifest["product"], "iicp-management-core");
         assert_eq!(manifest["channel"], "developer-preview");
         assert_eq!(manifest["non_authorizing"], true);
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index db49dda..fa0d47e 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -42,6 +42,8 @@ def test_management_manifest_bridge_requires_actual_candidate_and_retains_legacy
         source = '    let Some(path) = env::var_os("IICP_RELEASE_MANIFEST") else {\n        return;\n    };\n    let manifest: Value = serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap();\nassert_eq!(manifest["authorizes_deployment"], false);'
         staged = adapter.management_assertions("tests/release_manifest.rs", source)
         self.assertIn('component["source_commit"]', staged)
+        self.assertIn('component["source_version"]', staged)
+        self.assertNotIn('component["version"]', staged)
         self.assertIn('expect("release manifest required")', staged)
         self.assertIn('assert_eq!(manifest["authorizes_deployment"], false)', staged)
         self.assertIn('"management_service", "directory_authority"', staged)

From 95f70e23293e96b3f104720ddd0bba21d11f2439 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Thu, 17 Sep 2026 22:44:46 +0200
Subject: [PATCH 11/13] test(pre1): allowlist exact disposable PHP CI tooling
 paths

---
 scripts/pre1_harness_binding.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/pre1_harness_binding.py b/scripts/pre1_harness_binding.py
index 8225a22..a00cde1 100644
--- a/scripts/pre1_harness_binding.py
+++ b/scripts/pre1_harness_binding.py
@@ -19,6 +19,8 @@
     "scripts/pre1_environment_contract.py",
     "scripts/pre1_package_execution.py",
     "scripts/test_pre1_package_execution.py",
+    "scripts/run_php83_local_ci.py",
+    "scripts/test_php83_local_ci.py",
 })
 
 

From 637f94de9270fa94ea598024edd92f85da908e6b Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Fri, 18 Sep 2026 10:01:13 +0200
Subject: [PATCH 12/13] test(pre1): execute isolated packaged Rust HTTP refusal
 cases

---
 scripts/pre1_package_execution.py      | 353 ++++++++++++++++++++++++-
 scripts/test_pre1_package_execution.py | 270 +++++++++++++++++++
 2 files changed, 622 insertions(+), 1 deletion(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 44320e2..202fdbe 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -1,4 +1,4 @@
-"""Bind staged assertions to byte-verified installed frozen SDK payloads.
+"""Bind staged assertions to byte-verified installed frozen component payloads.
 
 Preparation never installs dependencies or grants qualification credit. The
 caller owns network isolation, runtime selection and workspace lifetime.
@@ -11,6 +11,7 @@
 import re
 import stat
 import subprocess
+import sys
 import tarfile
 import tempfile
 import zipfile
@@ -299,6 +300,8 @@ def validate_immutable_bindings(bindings: dict) -> None:
 def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
                    component: str, runtime: str, target: str, bindings: dict,
                    vendor_artifact: Path | None = None) -> dict:
+    if component in {"directory-php", "directory-rust"}:
+        return create_directory_binding(root, workspace, installed, artifact, component, runtime, target, bindings)
     if component == "management":
         return create_management_binding(root, workspace, installed, artifact, runtime, target, bindings)
     if component == "client-rust":
@@ -343,6 +346,8 @@ def validate_binding_context(value: dict, context: dict) -> None:
 
 def validate_binding(value: dict, context: dict, artifact: Path, root: Path,
                      vendor_artifact: Path | None = None) -> Path:
+    if context["component"] in {"directory-php", "directory-rust"}:
+        return validate_directory_binding(value, context, artifact, root)
     if context["component"] == "management":
         return validate_management_binding(value, context, artifact, root)
     if context["component"] == "client-rust":
@@ -377,6 +382,8 @@ def package_command(root: Path, context: dict, component_manifest: dict,
     value = json.loads(path.read_text())
     if value.get("binding_sha256") != os.environ.get("IICP_PRE1_PACKAGE_EXECUTION_SHA256"):
         raise ValueError("package execution binding pin differs")
+    if context["component"] in {"directory-php", "directory-rust"}:
+        return directory_package_command(root, context, component_manifest, artifact_root, env, value)
     if context["component"] == "client-rust":
         return rust_package_command(root, context, component_manifest, artifact_root, argv, env, value)
     if context["component"] == "management":
@@ -879,3 +886,347 @@ def validate_management_binding(value, context, artifact, root):
     if value != expected:
         raise ValueError("Management package execution inputs changed")
     return safe_path(workspace / "consumer")
+
+# Directory adapters deliberately refuse unimplemented cases and modes. A
+# source-test command is never used as a fallback for a released binary.
+DIRECTORY_RUST_SCENARIOS = frozenset({"package-version-self-report", "config-missing", "config-malformed",
+                                     "credential-missing", "unsupported-version"})
+
+DIRECTORY_PROBE = r'''import json, os, resource, signal, subprocess, sys, tempfile, time
+from pathlib import Path
+import xml.etree.ElementTree as ET
+import urllib.request, urllib.error
+
+def http_postcondition(request, scenario):
+    if scenario == "credential-missing":
+        status, value = request("/v1/peers", {"node_id": "fixture", "known_peers": []})
+        if status != 401:
+            raise ValueError("unauthenticated peer access was not refused")
+    elif scenario == "unsupported-version":
+        status, value = request("/v1/register", {
+            "endpoint": "https://provider.invalid", "region": "eu-central",
+            "capabilities": [{"intent": "urn:iicp:intent:llm:chat:v1", "models": ["fixture"]}],
+            "sdk_compatibility_version": "0.7.101", "sdk_version": "0.7.100"})
+        if status != 422 or "sdk_compatibility_version must match sdk_version" not in json.dumps(value):
+            raise ValueError("conflicted version refusal cause differs")
+    else:
+        raise ValueError("Directory HTTP scenario remains unimplemented")
+
+def rust_http_case(binary, env, scenario, version):
+    # The frozen listener binds 0.0.0.0:8090. Admit this in-memory fixture only
+    # in a Linux network namespace with loopback alone, never on the host LAN.
+    import fcntl, socket, struct
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as control:
+        active = {name for _, name in socket.if_nameindex()
+            if struct.unpack_from("H", fcntl.ioctl(control.fileno(), 0x8913,
+                struct.pack("256s", name.encode())), 16)[0] & 1}
+    if active != {"lo"}:
+        raise ValueError("Directory HTTP fixture requires loopback-only isolation")
+    class NoRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, *args, **kwargs):
+            return None
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect())
+    def request(path, body=None):
+        req = urllib.request.Request("http://127.0.0.1:8090" + path,
+            data=None if body is None else json.dumps(body).encode(),
+            headers={"Content-Type": "application/json"})
+        try:
+            response = opener.open(req, timeout=2)
+        except urllib.error.HTTPError as error:
+            response = error
+        with response:
+            raw = response.read(65537)
+            if len(raw) > 65536:
+                raise ValueError("Directory HTTP evidence exceeds bound")
+            return response.code, json.loads(raw)
+    with tempfile.TemporaryFile() as log:
+        process = subprocess.Popen([str(binary)], cwd=binary.parent,
+            env={**env, "IICP_ALLOW_IN_MEMORY": "true"}, stdout=log, stderr=subprocess.STDOUT,
+            start_new_session=True)
+        try:
+            deadline = time.monotonic() + 30
+            while True:
+                if process.poll() is not None:
+                    raise ValueError("Directory HTTP fixture exited before readiness")
+                listening = b"listening on 0.0.0.0:8090" in os.pread(log.fileno(), 65536, 0)
+                if listening:
+                    status, health = request("/health")
+                    if status != 200 or health.get("ok") is not True or health.get("version") != "v" + version + "-rs":
+                        raise ValueError("Directory HTTP fixture identity differs")
+                    break
+                if time.monotonic() >= deadline:
+                    raise ValueError("Directory HTTP fixture readiness timed out")
+                time.sleep(0.1)
+            http_postcondition(request, scenario)
+        finally:
+            try:
+                os.killpg(process.pid, signal.SIGKILL)
+            except ProcessLookupError:
+                pass
+            process.wait(timeout=10)
+
+context = json.loads(os.environ["IICP_PRE1_EXECUTION_CONTEXT"])
+component, scenario = context["component"], context["scenario_id"]
+if context["mode"] != "local-only":
+    raise ValueError("Directory packaged mode is not implemented")
+installed = Path(os.environ["IICP_PRE1_DIRECTORY_INSTALLED"])
+assertion = sys.argv[1]
+env = {k: os.environ[k] for k in ("HOME", "PATH", "TMPDIR", "TEMP", "TMP") if k in os.environ}
+env.update(APP_ENV="testing", NO_COLOR="1")
+if component == "directory-rust":
+    argv = [str(installed / "iicp-directory-rs")]
+    if scenario in {"credential-missing", "unsupported-version"}:
+        resource.setrlimit(resource.RLIMIT_FSIZE, (32 * 1024 * 1024, 32 * 1024 * 1024))
+        rust_http_case(Path(argv[0]), env, scenario, os.environ["IICP_PRE1_DIRECTORY_VERSION"])
+        print("IICP_PRE1_DIRECTORY_ASSERTION_PASS " + assertion)
+        raise SystemExit(0)
+    elif scenario == "package-version-self-report":
+        argv.append("--version")
+        expected = "iicp-directory-rs " + os.environ["IICP_PRE1_DIRECTORY_VERSION"]
+        expected_code = 0
+    elif scenario == "config-missing":
+        expected = "DATABASE_URL is required"
+        expected_code = 1
+    elif scenario == "config-malformed":
+        env.update(IICP_ALLOW_IN_MEMORY="true", IICP_REPLICA_MODE="true",
+            IICP_SEED_URL="https://seed.invalid/v1", IICP_SEED_DID="did:web:seed.invalid",
+            IICP_REPLICA_DID="did:web:replica.invalid", IICP_REPLICA_ENDPOINT="https://replica.invalid/v1",
+            IICP_DIRECTORY_DID="did:web:other.invalid")
+        expected = "IICP_DIRECTORY_DID must equal IICP_REPLICA_DID"
+        expected_code = 1
+    else:
+        raise ValueError("Directory packaged scenario is not implemented")
+else:
+    mapping = json.loads(Path("directory-case-map.json").read_text())
+    case = mapping["support"] if scenario == "support" else mapping["scenarios"][scenario]
+    argv = [os.environ["IICP_PRE1_DIRECTORY_PHP"], *case["command"][1:]]
+    if case["command"][0] != "@php" or case["assertion"] != assertion:
+        raise ValueError("structural Python checks are not packaged Directory operations")
+    report = Path("directory-junit.xml").resolve()
+    if report.exists():
+        raise ValueError("Directory case result already exists")
+    argv.extend(["--do-not-cache-result", "--bootstrap", str(Path("directory-origin.php").resolve()),
+                 "--log-junit", str(report)])
+    env.update(PRE1_DIRECTORY_INSTALLED=str(installed))
+    expected_code, expected = 0, None
+limit = 32 * 1024 * 1024
+resource.setrlimit(resource.RLIMIT_FSIZE, (limit, limit))
+with tempfile.NamedTemporaryFile(prefix="directory-output-", dir=Path.cwd(), delete=False) as log:
+    output_file = Path(log.name)
+    process = subprocess.Popen(argv, cwd=installed, env=env, stdout=log, stderr=subprocess.STDOUT,
+                               start_new_session=True)
+    try:
+        process.wait(timeout=180)
+    finally:
+        try:
+            os.killpg(process.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+        process.wait(timeout=10)
+    size = log.tell()
+    if size > 32 * 1024 * 1024:
+        raise ValueError("Directory case output exceeds the diagnostic bound")
+    log.seek(0)
+    output = log.read().decode("utf-8", errors="replace")
+if process.returncode != expected_code or (expected is not None and expected not in output) or (
+    component == "directory-rust" and scenario == "package-version-self-report" and output.strip() != expected
+):
+    raise ValueError("Directory packaged postcondition failed")
+if component == "directory-php":
+    document = ET.parse(report)
+    cases = list(document.iter("testcase"))
+    if len(cases) != 1 or cases[0].get("name") != assertion or any(
+        list(document.iter(tag)) for tag in ("skipped", "failure", "error")
+    ):
+        raise ValueError("Directory exact assertion did not pass once without skips")
+    report.unlink()
+output_file.unlink()
+print("IICP_PRE1_DIRECTORY_ASSERTION_PASS " + assertion)
+'''
+DIRECTORY_ORIGIN = r'''<?php
+$root = realpath(getenv('PRE1_DIRECTORY_INSTALLED'));
+if (!$root) { throw new RuntimeException('Directory package root unavailable'); }
+require $root . '/vendor/autoload.php';
+register_shutdown_function(function () use ($root) {
+    foreach (get_declared_classes() as $class) {
+        $expected = null;
+        foreach (['App\\' => 'app', 'Tests\\' => 'tests', 'Database\\' => 'database'] as $prefix => $directory) {
+            if (str_starts_with($class, $prefix)) {
+                $expected = $root . DIRECTORY_SEPARATOR . $directory . DIRECTORY_SEPARATOR;
+                break;
+            }
+        }
+        if ($expected !== null) {
+            $file = (new ReflectionClass($class))->getFileName();
+            if (!$file || !str_starts_with(realpath($file), $expected)) {
+                fwrite(STDERR, "Directory application class escaped packaged origin\n");
+                exit(2);
+            }
+        }
+    }
+});
+'''
+
+
+def directory_archive_payload(artifact):
+    files = rust_archive_files(artifact, "")
+    prefixes = {name.split("/", 1)[0] for name in files}
+    if len(prefixes) != 1:
+        raise ValueError("Directory archive must have one package root")
+    prefix = prefixes.pop() + "/"
+    if not re.fullmatch(r"iicp-directory-php-v\d+\.\d+\.\d+/", prefix):
+        raise ValueError("Directory archive package root differs")
+    result = {name.removeprefix(prefix): value for name, value in files.items()}
+    if not {"artisan", "composer.json", "composer.lock"}.issubset(result) or any(
+        name.startswith("vendor/") for name in result
+    ):
+        raise ValueError("Directory archive lacks locked source or contains vendor")
+    return result
+
+
+def stage_directory_payload(artifact, workspace, component):
+    workspace = safe_path(workspace)
+    home = safe_path(Path(os.environ["HOME"]))
+    if workspace == home or not workspace.is_relative_to(home) or list(workspace.iterdir()):
+        raise ValueError("Directory staging requires an empty run workspace")
+    safe_path(artifact)
+    installed = workspace / "payload"
+    if component == "directory-rust":
+        installed.mkdir(mode=0o700)
+        (installed / "iicp-directory-rs").write_bytes(artifact.read_bytes())
+        (installed / "iicp-directory-rs").chmod(0o700)
+    elif component == "directory-php":
+        expected = directory_archive_payload(artifact)
+        installed.mkdir(mode=0o700)
+        with tarfile.open(artifact, "r:gz") as archive:
+            for row in archive:
+                if row.isfile():
+                    name = row.name.split("/", 1)[1]
+                    if name not in expected:
+                        raise ValueError("Directory archive contains an unexpected member")
+                    dest = installed / name
+                    dest.parent.mkdir(parents=True, exist_ok=True)
+                    handle = archive.extractfile(row)
+                    if handle is None:
+                        raise ValueError("Directory archive member unavailable")
+                    with dest.open("xb") as output:
+                        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+                            output.write(chunk)
+                    dest.chmod(0o600)
+        if tree(installed) != expected:
+            raise ValueError("Directory staged archive differs")
+        provision_directory_runtime_paths(installed)
+    else:
+        raise ValueError("Directory staging component differs")
+    return installed
+
+
+def provision_directory_runtime_paths(installed):
+    # Release archives need not contain empty runtime directories. Provision
+    # only Laravel's private writable paths before Composer's locked scripts
+    # execute; these are not alternate application or dependency sources.
+    for relative in ("bootstrap/cache", "storage/logs", "storage/framework/cache/data",
+                     "storage/framework/sessions", "storage/framework/views"):
+        directory = installed
+        for part in relative.split("/"):
+            directory = directory / part
+            if directory.exists() or directory.is_symlink():
+                safe_path(directory)
+                if not directory.is_dir():
+                    raise ValueError("Directory runtime path is not a directory")
+            else:
+                directory.mkdir(mode=0o700)
+
+
+def directory_fixtures(root, component):
+    result = {"directory-probe.py": DIRECTORY_PROBE.encode(),
+              "directory-case-map.json": safe_path(root / "qualification/pre1-cases.json").read_bytes()}
+    if component == "directory-php":
+        result["directory-origin.php"] = DIRECTORY_ORIGIN.encode()
+    return result
+
+
+def directory_payload(artifact, installed, component, target):
+    files = tree(installed)
+    if component == "directory-rust":
+        binary = safe_path(installed / "iicp-directory-rs")
+        with binary.open("rb") as handle:
+            header = handle.read(20)
+        machine = {"linux-aarch64": 183, "linux-x86_64": 62}.get(target)
+        if len(header) != 20 or header[:6] != b"\x7fELF\x02\x01" or machine is None or int.from_bytes(header[18:20], "little") != machine:
+            raise ValueError("Directory binary architecture differs")
+        if stat.S_IMODE(binary.stat().st_mode) != 0o700 or files != {"iicp-directory-rs": file_digest(artifact)}:
+            raise ValueError("Directory installed binary differs")
+        return files, {}
+    expected = directory_archive_payload(artifact)
+    volatile = ("vendor/", "storage/", "bootstrap/cache/")
+    immutable = {k: v for k, v in files.items() if not k.startswith(volatile)}
+    if immutable != {k: v for k, v in expected.items() if not k.startswith(volatile)}:
+        raise ValueError("Directory installed archive differs")
+    deps = {"vendor/" + k: v for k, v in tree(safe_path(installed / "vendor")).items()}
+    cache = installed / "bootstrap/cache"
+    if cache.exists() or cache.is_symlink():
+        deps.update({"bootstrap-cache/" + k: v for k, v in tree(safe_path(cache)).items()})
+    return immutable, deps
+
+
+def create_directory_binding(root, workspace, installed, artifact, component, runtime, target, bindings, *, stage_fixtures=True):
+    validate_immutable_bindings(bindings)
+    validate_workspace_boundary(safe_path(workspace), safe_path(Path(os.environ["HOME"])), safe_path(installed), root)
+    payload, deps = directory_payload(artifact, installed, component, target)
+    fixtures = directory_fixtures(root, component)
+    for name, data in fixtures.items():
+        dest = workspace / name
+        if not dest.exists() and stage_fixtures:
+            with dest.open("xb") as output:
+                output.write(data)
+            dest.chmod(0o600)
+        if not dest.exists() or dest.is_symlink() or dest.read_bytes() != data:
+            raise ValueError("Directory packaged fixtures changed")
+    value = {"schema": SCHEMA, "component": component, "runtime": runtime, "target": target,
+        "bindings": bindings, "workspace": str(workspace), "installed_package": str(installed),
+        "artifact_sha256": file_digest(artifact), "installed_payload_sha256": digest(payload),
+        "fixtures_sha256": digest({k: "sha256:" + hashlib.sha256(v).hexdigest() for k, v in fixtures.items()}),
+        "test_dependencies_sha256": digest(deps), "binding_sha256": None,
+        "assertion_adapter": "canonical-runtime-verifier-and-cli.v1",
+        "non_authorizing": True, "qualification_credit": False}
+    value["binding_sha256"] = digest(value)
+    return value
+
+
+def validate_directory_binding(value, context, artifact, root):
+    validate_binding_identity(value)
+    validate_binding_context(value, context)
+    expected = create_directory_binding(root, Path(value["workspace"]), Path(value["installed_package"]),
+        artifact, context["component"], context["runtime"], context["target"], {k: context[k] for k in BINDINGS}, stage_fixtures=False)
+    if value != expected:
+        raise ValueError("Directory package execution inputs changed")
+    return safe_path(Path(value["workspace"]))
+
+
+def directory_package_command(root, context, component_manifest, artifact_root, env, value):
+    component, scenario = context["component"], context["scenario_id"]
+    if context["mode"] != "local-only":
+        raise ValueError("Directory packaged mode remains unimplemented")
+    kind = "release-artifact" if component == "directory-rust" else "release-archive"
+    rows = [r for r in component_manifest["artifacts"] if r["kind"] == kind and r["target"] in {context["target"], "any"}]
+    if len(rows) != 1:
+        raise ValueError("Directory execution artifact is ambiguous")
+    artifact = safe_path(artifact_root / component / rows[0]["name"])
+    if file_digest(artifact) != rows[0]["sha256"]:
+        raise ValueError("Directory candidate artifact digest differs")
+    workspace = validate_directory_binding(value, context, artifact, root)
+    mapping = json.loads((workspace / "directory-case-map.json").read_text())
+    case = mapping["support"] if scenario == "support" else mapping["scenarios"][scenario]
+    if component == "directory-rust" and scenario not in DIRECTORY_RUST_SCENARIOS:
+        raise ValueError("Directory black-box scenario remains unimplemented")
+    if component == "directory-php" and case["command"][0] != "@php":
+        raise ValueError("Directory structural checks are not packaged operation evidence")
+    env = {**env, "IICP_PRE1_EXECUTION_CONTEXT": json.dumps(context, sort_keys=True),
+           "IICP_PRE1_DIRECTORY_INSTALLED": value["installed_package"],
+           "IICP_PRE1_DIRECTORY_VERSION": component_manifest["source_version"]}
+    if component == "directory-php":
+        runtime_map = json.loads(Path(os.environ["IICP_PRE1_RUNTIME_MAP"]).read_text())
+        env["IICP_PRE1_DIRECTORY_PHP"] = runtime_map["runtimes"][context["runtime"]]["programs"]["php"]
+    argv = [sys.executable, "-I", "-S", str(workspace / "directory-probe.py"), case["assertion"]]
+    return argv, env, workspace, {"value": value, "artifact": artifact, "vendor_artifact": None}
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index fa0d47e..192ae0d 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -17,6 +17,276 @@
 
 
 class PackageExecutionTests(unittest.TestCase):
+    def directory_http_functions(self):
+        import ast
+        import signal
+        import time
+        import urllib.request
+        import urllib.error
+        parsed = ast.parse(adapter.DIRECTORY_PROBE)
+        functions = ast.Module(body=[n for n in parsed.body if isinstance(n, ast.FunctionDef)], type_ignores=[])
+        namespace = dict(json=json, os=os, signal=signal,
+                         subprocess=subprocess, tempfile=tempfile, time=time, Path=Path, urllib=urllib)
+        exec(compile(functions, "directory-probe.py", "exec"), namespace)
+        return namespace
+
+    def test_directory_http_postconditions_reject_status_only_false_positives(self):
+        check = self.directory_http_functions()["http_postcondition"]
+        for status in (200, 403, 404, 500):
+            with self.subTest(status=status), self.assertRaises(ValueError):
+                check(lambda *a: (status, {}), "credential-missing")
+        check(lambda *a: (401, {}), "credential-missing")
+        with self.assertRaises(ValueError):
+            check(lambda *a: (422, {"message": "endpoint invalid"}), "unsupported-version")
+        check(lambda *a: (422, {"message": "sdk_compatibility_version must match sdk_version when both are supplied"}), "unsupported-version")
+        with self.assertRaises(ValueError):
+            check(lambda *a: (200, {}), "backup-restore")
+
+    def directory_network(self, active):
+        import struct
+        from unittest.mock import Mock
+        from contextlib import ExitStack
+        import socket
+        stack = ExitStack()
+        ioctl = Mock()
+        ioctl.ioctl.side_effect = lambda fd, op, name: b"\0" * 16 + struct.pack("H", int(name.rstrip(b"\0").decode() in active))
+        stack.enter_context(patch.dict("sys.modules", {"fcntl": ioctl}))
+        stack.enter_context(patch.object(socket, "if_nameindex", return_value=[(1, "lo"), (2, "eth0"), (3, "gre0")]))
+        return stack
+
+    def test_directory_http_fixture_refuses_host_network_before_process_start(self):
+        run = self.directory_http_functions()["rust_http_case"]
+        with self.directory_network({"lo", "eth0"}), \
+             patch.object(subprocess, "Popen") as launch:
+            with self.assertRaisesRegex(ValueError, "loopback-only"):
+                run(Path("/fixture/binary"), {}, "credential-missing", "0.1.15")
+            launch.assert_not_called()
+
+    def test_directory_http_fixture_wrong_identity_kills_owned_process(self):
+        from unittest.mock import Mock, MagicMock
+        import urllib.request
+        run = self.directory_http_functions()["rust_http_case"]
+        process = Mock(pid=123)
+        process.poll.return_value = None
+        response = MagicMock(code=200)
+        response.__enter__.return_value = response
+        response.read.return_value = b'{"ok":true,"version":"v9.9.9-rs"}'
+        with self.directory_network({"lo"}), \
+             patch.object(subprocess, "Popen", return_value=process), \
+             patch.object(os, "pread", return_value=b"listening on 0.0.0.0:8090", create=True), \
+             patch.object(os, "killpg", create=True) as kill, \
+             patch.object(urllib.request, "build_opener") as opener:
+            opener.return_value.open.return_value = response
+            with self.assertRaisesRegex(ValueError, "identity differs"):
+                run(Path("/fixture/binary"), {}, "credential-missing", "0.1.15")
+            kill.assert_called_once()
+            process.wait.assert_called_once_with(timeout=10)
+
+    def test_directory_http_fixture_timeout_and_early_exit_preserve_cleanup(self):
+        from unittest.mock import Mock
+        import time
+        run = self.directory_http_functions()["rust_http_case"]
+        for exit_code, cause in ((None, "timed out"), (1, "exited before readiness")):
+            process = Mock(pid=123)
+            process.poll.return_value = exit_code
+            with self.subTest(exit_code=exit_code), \
+                 self.directory_network({"lo"}), \
+                 patch.object(subprocess, "Popen", return_value=process), \
+                 patch.object(os, "pread", return_value=b"", create=True), \
+                 patch.object(os, "killpg", create=True) as kill, \
+                 patch.object(time, "monotonic", side_effect=[0, 31]):
+                with self.assertRaisesRegex(ValueError, cause):
+                    run(Path("/fixture/binary"), {}, "credential-missing", "0.1.15")
+                kill.assert_called_once()
+                process.wait.assert_called_once_with(timeout=10)
+
+    def directory_inputs(self, component="directory-rust"):
+        import shutil
+        shutil.rmtree(self.workspace)
+        self.workspace.mkdir()
+        (self.root / "qualification").mkdir(exist_ok=True)
+        mapping = {"support": {"assertion": "support", "command": ["@php", "vendor/bin/phpunit"]},
+                   "scenarios": {name: {"assertion": name, "command": ["@php", "vendor/bin/phpunit"]}
+                     for name in ["package-version-self-report", "config-missing", "config-malformed", "backup-restore"]}}
+        (self.root / "qualification/pre1-cases.json").write_text(json.dumps(mapping))
+        if component == "directory-rust":
+            artifact = self.home / "iicp-directory-rs-0.1.15-linux-aarch64"
+            header = bytearray(20)
+            header[:6] = b"\x7fELF\x02\x01"
+            header[18:20] = (183).to_bytes(2, "little")
+            artifact.write_bytes(header)
+        else:
+            artifact = self.home / "php.tar.gz"
+            with tarfile.open(artifact, "w:gz") as archive:
+                for name in ["artisan", "composer.json", "composer.lock", "app/runtime.php"]:
+                    data = name.encode()
+                    member = tarfile.TarInfo("iicp-directory-php-v1.10.94/" + name)
+                    member.size = len(data)
+                    archive.addfile(member, io.BytesIO(data))
+        installed = adapter.stage_directory_payload(artifact, self.workspace, component)
+        if component == "directory-php":
+            (installed / "vendor").mkdir()
+            (installed / "vendor/autoload.php").write_text("locked vendor")
+        value = adapter.create_binding(self.root, self.workspace, installed, artifact,
+            component, "php-8.3" if component == "directory-php" else "rust-1.98.0", "linux-aarch64", self.bindings)
+        context = {**self.context, "component": component, "runtime": value["runtime"],
+                   "target": "linux-aarch64", "mode": "local-only", "scenario_id": "config-missing"}
+        return artifact, installed, value, context
+
+    def test_directory_binary_binding_and_proof_are_candidate_bound(self):
+        artifact, installed, value, context = self.directory_inputs()
+        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), self.workspace)
+        proof = adapter.make_case_proof(value, context, "config-missing", 0, "directory-test")
+        adapter.validate_case_proof(proof, context, 0, "directory-test",
+            adapter.execution_summary(value), "config-missing")
+        self.assertFalse(value["qualification_credit"])
+        self.assertEqual((installed / "iicp-directory-rs").read_bytes(), artifact.read_bytes())
+
+    def test_directory_binary_rehashed_tamper_and_wrong_architecture_fail(self):
+        artifact, installed, value, context = self.directory_inputs()
+        binary = installed / "iicp-directory-rs"
+        binary.write_bytes(binary.read_bytes() + b"tamper")
+        value["installed_payload_sha256"] = adapter.digest(adapter.tree(installed))
+        value["binding_sha256"] = adapter.digest({**value, "binding_sha256": None})
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+        binary.write_bytes(artifact.read_bytes())
+        with self.assertRaisesRegex(ValueError, "architecture differs"):
+            adapter.create_binding(self.root, self.workspace, installed, artifact,
+                "directory-rust", "rust-1.98.0", "linux-x86_64", self.bindings)
+
+    def test_directory_fixtures_cannot_be_deleted_or_rehashed(self):
+        artifact, installed, value, context = self.directory_inputs()
+        (self.workspace / "directory-probe.py").unlink()
+        with self.assertRaisesRegex(ValueError, "fixtures changed"):
+            adapter.validate_binding(value, context, artifact, self.root)
+        self.assertFalse((self.workspace / "directory-probe.py").exists())
+        (self.workspace / "directory-probe.py").write_text("fake success")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+
+    def test_directory_binary_modes_and_extra_runtime_files_fail(self):
+        artifact, installed, value, context = self.directory_inputs()
+        binary = installed / "iicp-directory-rs"
+        binary.chmod(0o755)
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+        binary.chmod(0o700)
+        (installed / "fallback-runtime").write_text("checkout substitute")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+
+    def test_directory_archive_source_and_vendor_are_separately_bound(self):
+        artifact, installed, value, context = self.directory_inputs("directory-php")
+        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), self.workspace)
+        (installed / "storage").mkdir(exist_ok=True)
+        (installed / "storage/log.txt").write_text("volatile test log")
+        adapter.validate_binding(value, context, artifact, self.root)
+        (installed / "app/runtime.php").write_text("checkout fallback")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+
+    def test_directory_archive_vendor_tamper_and_symlinks_fail(self):
+        artifact, installed, value, context = self.directory_inputs("directory-php")
+        (installed / "vendor/autoload.php").write_text("unlocked dependencies")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+        (installed / "vendor/autoload.php").unlink()
+        (installed / "vendor/autoload.php").symlink_to(self.root / "src/runtime.py")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+
+    def test_directory_php_guard_checks_real_namespace_prefixes_and_cache_tamper(self):
+        self.assertIn("'App\\\\'", adapter.DIRECTORY_ORIGIN)
+        self.assertIn("'Tests\\\\'", adapter.DIRECTORY_ORIGIN)
+        self.assertIn("'Database\\\\'", adapter.DIRECTORY_ORIGIN)
+        self.assertIn("str_starts_with(realpath($file), $expected)", adapter.DIRECTORY_ORIGIN)
+        self.assertNotIn("str_starts_with(realpath($file), $root . DIRECTORY_SEPARATOR)", adapter.DIRECTORY_ORIGIN)
+        artifact, installed, value, context = self.directory_inputs("directory-php")
+        (installed / "bootstrap/cache").mkdir(parents=True, exist_ok=True)
+        (installed / "bootstrap/cache/services.php").write_text("unbound executable cache")
+        with self.assertRaises(ValueError):
+            adapter.validate_binding(value, context, artifact, self.root)
+
+    def test_directory_archive_provisions_private_runtime_directories(self):
+        import stat
+        artifact, installed, value, context = self.directory_inputs("directory-php")
+        for name in ("bootstrap/cache", "storage/logs", "storage/framework/cache/data",
+                     "storage/framework/sessions", "storage/framework/views"):
+            path = installed / name
+            self.assertTrue(path.is_dir())
+            self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o700)
+        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), self.workspace)
+
+    def test_directory_runtime_paths_refuse_symlink_and_file(self):
+        import shutil
+        artifact, installed, value, context = self.directory_inputs("directory-php")
+        cache = installed / "bootstrap/cache"
+        shutil.rmtree(cache)
+        cache.symlink_to(self.home, target_is_directory=True)
+        with self.assertRaises(ValueError):
+            adapter.provision_directory_runtime_paths(installed)
+        cache.unlink()
+        cache.write_text("not a directory")
+        with self.assertRaisesRegex(ValueError, "not a directory"):
+            adapter.provision_directory_runtime_paths(installed)
+
+    def test_directory_php_probe_self_report_and_junit_fail_closed(self):
+        import sys
+        artifact, installed, value, context = self.directory_inputs("directory-php")
+        probe = self.workspace / "directory-probe.py"
+        runtime = self.home / "fake-php"
+        runtime.write_text("#!" + sys.executable + "\n" +
+            "import sys, os\nfrom pathlib import Path\n" +
+            "p = Path(sys.argv[sys.argv.index('--log-junit') + 1])\n" +
+            "p.write_text(os.environ.get('FAKE_JUNIT', '<testsuite><testcase name=\"package-version-self-report\"/></testsuite>'))\n")
+        runtime.chmod(0o700)
+        context["scenario_id"] = "package-version-self-report"
+        env = {**os.environ, "IICP_PRE1_EXECUTION_CONTEXT": json.dumps(context),
+               "IICP_PRE1_DIRECTORY_INSTALLED": str(installed), "IICP_PRE1_DIRECTORY_PHP": str(runtime)}
+        for document, expected in [
+            ('<testsuite><testcase name="package-version-self-report"/></testsuite>', 0),
+            ('<testsuite><testcase name="package-version-self-report"><skipped/></testcase></testsuite>', 1),
+            ('<testsuite><testcase name="wrong"/></testsuite>', 1),
+            ('<testsuite><testcase name="package-version-self-report"/><testcase name="extra"/></testsuite>', 1),
+        ]:
+            (self.workspace / "directory-junit.xml").unlink(missing_ok=True)
+            # The child environment is intentionally sanitized; vary the fake
+            # runtime itself instead of relying on inherited environment values.
+            runtime.write_text("#!" + sys.executable + "\nimport sys\nfrom pathlib import Path\n" +
+                "Path(sys.argv[sys.argv.index('--log-junit') + 1]).write_text(" + repr(document) + ")\n")
+            result = subprocess.run([sys.executable, "-I", "-S", str(probe), "package-version-self-report"],
+                cwd=self.workspace, env=env, capture_output=True, text=True, timeout=15)
+            self.assertEqual(result.returncode, expected, result.stderr)
+            self.assertEqual("IICP_PRE1_DIRECTORY_ASSERTION_PASS" in result.stdout, expected == 0)
+
+    def test_directory_archive_refuses_links_traversal_and_multiple_roots(self):
+        for name, kind in [("../escape", "file"), ("iicp-directory-php-v1.10.94/link", "link"), ("other/root", "file")]:
+            artifact = self.home / "unsafe.tar.gz"
+            with tarfile.open(artifact, "w:gz") as archive:
+                member = tarfile.TarInfo(name)
+                if kind == "link":
+                    member.type, member.linkname = tarfile.SYMTYPE, "/outside"
+                archive.addfile(member)
+            with self.subTest(name=name), self.assertRaises(ValueError):
+                adapter.directory_archive_payload(artifact)
+
+    def test_directory_unimplemented_case_and_modes_never_use_checkout_commands(self):
+        artifact, installed, value, context = self.directory_inputs()
+        manifest = {"source_version": "0.1.15", "artifacts": [{"name": artifact.name,
+            "kind": "release-artifact", "target": "linux-aarch64", "sha256": adapter.file_digest(artifact)}]}
+        artifact_root = self.home / "artifacts"
+        (artifact_root / "directory-rust").mkdir(parents=True)
+        import shutil
+        shutil.copyfile(artifact, artifact_root / "directory-rust" / artifact.name)
+        for mutation in [{"mode": "restricted"}, {"mode": "public"}, {"scenario_id": "backup-restore"}]:
+            with self.subTest(mutation=mutation), self.assertRaises(ValueError):
+                adapter.directory_package_command(self.root, {**context, **mutation}, manifest, artifact_root, {}, value)
+        argv, env, cwd, proof = adapter.directory_package_command(self.root, context, manifest, artifact_root, {}, value)
+        self.assertEqual(cwd, self.workspace)
+        self.assertNotIn("cargo", argv)
+        self.assertNotIn(str(self.root), " ".join(argv))
+
     def management_artifact(self):
         self.workspace = self.home / "run/management"
         self.workspace.mkdir(parents=True)

From 824de284995c13ef7fcaf23e7ada1ebab2080183 Mon Sep 17 00:00:00 2001
From: RobLe3 <github@roblemumin.com>
Date: Fri, 18 Sep 2026 10:01:32 +0200
Subject: [PATCH 13/13] test(pre1): keep Directory adapters scoped to Directory
 owners

---
 scripts/pre1_package_execution.py      | 353 +------------------------
 scripts/test_pre1_package_execution.py | 270 -------------------
 2 files changed, 1 insertion(+), 622 deletions(-)

diff --git a/scripts/pre1_package_execution.py b/scripts/pre1_package_execution.py
index 202fdbe..44320e2 100644
--- a/scripts/pre1_package_execution.py
+++ b/scripts/pre1_package_execution.py
@@ -1,4 +1,4 @@
-"""Bind staged assertions to byte-verified installed frozen component payloads.
+"""Bind staged assertions to byte-verified installed frozen SDK payloads.
 
 Preparation never installs dependencies or grants qualification credit. The
 caller owns network isolation, runtime selection and workspace lifetime.
@@ -11,7 +11,6 @@
 import re
 import stat
 import subprocess
-import sys
 import tarfile
 import tempfile
 import zipfile
@@ -300,8 +299,6 @@ def validate_immutable_bindings(bindings: dict) -> None:
 def create_binding(root: Path, workspace: Path, installed: Path, artifact: Path,
                    component: str, runtime: str, target: str, bindings: dict,
                    vendor_artifact: Path | None = None) -> dict:
-    if component in {"directory-php", "directory-rust"}:
-        return create_directory_binding(root, workspace, installed, artifact, component, runtime, target, bindings)
     if component == "management":
         return create_management_binding(root, workspace, installed, artifact, runtime, target, bindings)
     if component == "client-rust":
@@ -346,8 +343,6 @@ def validate_binding_context(value: dict, context: dict) -> None:
 
 def validate_binding(value: dict, context: dict, artifact: Path, root: Path,
                      vendor_artifact: Path | None = None) -> Path:
-    if context["component"] in {"directory-php", "directory-rust"}:
-        return validate_directory_binding(value, context, artifact, root)
     if context["component"] == "management":
         return validate_management_binding(value, context, artifact, root)
     if context["component"] == "client-rust":
@@ -382,8 +377,6 @@ def package_command(root: Path, context: dict, component_manifest: dict,
     value = json.loads(path.read_text())
     if value.get("binding_sha256") != os.environ.get("IICP_PRE1_PACKAGE_EXECUTION_SHA256"):
         raise ValueError("package execution binding pin differs")
-    if context["component"] in {"directory-php", "directory-rust"}:
-        return directory_package_command(root, context, component_manifest, artifact_root, env, value)
     if context["component"] == "client-rust":
         return rust_package_command(root, context, component_manifest, artifact_root, argv, env, value)
     if context["component"] == "management":
@@ -886,347 +879,3 @@ def validate_management_binding(value, context, artifact, root):
     if value != expected:
         raise ValueError("Management package execution inputs changed")
     return safe_path(workspace / "consumer")
-
-# Directory adapters deliberately refuse unimplemented cases and modes. A
-# source-test command is never used as a fallback for a released binary.
-DIRECTORY_RUST_SCENARIOS = frozenset({"package-version-self-report", "config-missing", "config-malformed",
-                                     "credential-missing", "unsupported-version"})
-
-DIRECTORY_PROBE = r'''import json, os, resource, signal, subprocess, sys, tempfile, time
-from pathlib import Path
-import xml.etree.ElementTree as ET
-import urllib.request, urllib.error
-
-def http_postcondition(request, scenario):
-    if scenario == "credential-missing":
-        status, value = request("/v1/peers", {"node_id": "fixture", "known_peers": []})
-        if status != 401:
-            raise ValueError("unauthenticated peer access was not refused")
-    elif scenario == "unsupported-version":
-        status, value = request("/v1/register", {
-            "endpoint": "https://provider.invalid", "region": "eu-central",
-            "capabilities": [{"intent": "urn:iicp:intent:llm:chat:v1", "models": ["fixture"]}],
-            "sdk_compatibility_version": "0.7.101", "sdk_version": "0.7.100"})
-        if status != 422 or "sdk_compatibility_version must match sdk_version" not in json.dumps(value):
-            raise ValueError("conflicted version refusal cause differs")
-    else:
-        raise ValueError("Directory HTTP scenario remains unimplemented")
-
-def rust_http_case(binary, env, scenario, version):
-    # The frozen listener binds 0.0.0.0:8090. Admit this in-memory fixture only
-    # in a Linux network namespace with loopback alone, never on the host LAN.
-    import fcntl, socket, struct
-    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as control:
-        active = {name for _, name in socket.if_nameindex()
-            if struct.unpack_from("H", fcntl.ioctl(control.fileno(), 0x8913,
-                struct.pack("256s", name.encode())), 16)[0] & 1}
-    if active != {"lo"}:
-        raise ValueError("Directory HTTP fixture requires loopback-only isolation")
-    class NoRedirect(urllib.request.HTTPRedirectHandler):
-        def redirect_request(self, *args, **kwargs):
-            return None
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect())
-    def request(path, body=None):
-        req = urllib.request.Request("http://127.0.0.1:8090" + path,
-            data=None if body is None else json.dumps(body).encode(),
-            headers={"Content-Type": "application/json"})
-        try:
-            response = opener.open(req, timeout=2)
-        except urllib.error.HTTPError as error:
-            response = error
-        with response:
-            raw = response.read(65537)
-            if len(raw) > 65536:
-                raise ValueError("Directory HTTP evidence exceeds bound")
-            return response.code, json.loads(raw)
-    with tempfile.TemporaryFile() as log:
-        process = subprocess.Popen([str(binary)], cwd=binary.parent,
-            env={**env, "IICP_ALLOW_IN_MEMORY": "true"}, stdout=log, stderr=subprocess.STDOUT,
-            start_new_session=True)
-        try:
-            deadline = time.monotonic() + 30
-            while True:
-                if process.poll() is not None:
-                    raise ValueError("Directory HTTP fixture exited before readiness")
-                listening = b"listening on 0.0.0.0:8090" in os.pread(log.fileno(), 65536, 0)
-                if listening:
-                    status, health = request("/health")
-                    if status != 200 or health.get("ok") is not True or health.get("version") != "v" + version + "-rs":
-                        raise ValueError("Directory HTTP fixture identity differs")
-                    break
-                if time.monotonic() >= deadline:
-                    raise ValueError("Directory HTTP fixture readiness timed out")
-                time.sleep(0.1)
-            http_postcondition(request, scenario)
-        finally:
-            try:
-                os.killpg(process.pid, signal.SIGKILL)
-            except ProcessLookupError:
-                pass
-            process.wait(timeout=10)
-
-context = json.loads(os.environ["IICP_PRE1_EXECUTION_CONTEXT"])
-component, scenario = context["component"], context["scenario_id"]
-if context["mode"] != "local-only":
-    raise ValueError("Directory packaged mode is not implemented")
-installed = Path(os.environ["IICP_PRE1_DIRECTORY_INSTALLED"])
-assertion = sys.argv[1]
-env = {k: os.environ[k] for k in ("HOME", "PATH", "TMPDIR", "TEMP", "TMP") if k in os.environ}
-env.update(APP_ENV="testing", NO_COLOR="1")
-if component == "directory-rust":
-    argv = [str(installed / "iicp-directory-rs")]
-    if scenario in {"credential-missing", "unsupported-version"}:
-        resource.setrlimit(resource.RLIMIT_FSIZE, (32 * 1024 * 1024, 32 * 1024 * 1024))
-        rust_http_case(Path(argv[0]), env, scenario, os.environ["IICP_PRE1_DIRECTORY_VERSION"])
-        print("IICP_PRE1_DIRECTORY_ASSERTION_PASS " + assertion)
-        raise SystemExit(0)
-    elif scenario == "package-version-self-report":
-        argv.append("--version")
-        expected = "iicp-directory-rs " + os.environ["IICP_PRE1_DIRECTORY_VERSION"]
-        expected_code = 0
-    elif scenario == "config-missing":
-        expected = "DATABASE_URL is required"
-        expected_code = 1
-    elif scenario == "config-malformed":
-        env.update(IICP_ALLOW_IN_MEMORY="true", IICP_REPLICA_MODE="true",
-            IICP_SEED_URL="https://seed.invalid/v1", IICP_SEED_DID="did:web:seed.invalid",
-            IICP_REPLICA_DID="did:web:replica.invalid", IICP_REPLICA_ENDPOINT="https://replica.invalid/v1",
-            IICP_DIRECTORY_DID="did:web:other.invalid")
-        expected = "IICP_DIRECTORY_DID must equal IICP_REPLICA_DID"
-        expected_code = 1
-    else:
-        raise ValueError("Directory packaged scenario is not implemented")
-else:
-    mapping = json.loads(Path("directory-case-map.json").read_text())
-    case = mapping["support"] if scenario == "support" else mapping["scenarios"][scenario]
-    argv = [os.environ["IICP_PRE1_DIRECTORY_PHP"], *case["command"][1:]]
-    if case["command"][0] != "@php" or case["assertion"] != assertion:
-        raise ValueError("structural Python checks are not packaged Directory operations")
-    report = Path("directory-junit.xml").resolve()
-    if report.exists():
-        raise ValueError("Directory case result already exists")
-    argv.extend(["--do-not-cache-result", "--bootstrap", str(Path("directory-origin.php").resolve()),
-                 "--log-junit", str(report)])
-    env.update(PRE1_DIRECTORY_INSTALLED=str(installed))
-    expected_code, expected = 0, None
-limit = 32 * 1024 * 1024
-resource.setrlimit(resource.RLIMIT_FSIZE, (limit, limit))
-with tempfile.NamedTemporaryFile(prefix="directory-output-", dir=Path.cwd(), delete=False) as log:
-    output_file = Path(log.name)
-    process = subprocess.Popen(argv, cwd=installed, env=env, stdout=log, stderr=subprocess.STDOUT,
-                               start_new_session=True)
-    try:
-        process.wait(timeout=180)
-    finally:
-        try:
-            os.killpg(process.pid, signal.SIGKILL)
-        except ProcessLookupError:
-            pass
-        process.wait(timeout=10)
-    size = log.tell()
-    if size > 32 * 1024 * 1024:
-        raise ValueError("Directory case output exceeds the diagnostic bound")
-    log.seek(0)
-    output = log.read().decode("utf-8", errors="replace")
-if process.returncode != expected_code or (expected is not None and expected not in output) or (
-    component == "directory-rust" and scenario == "package-version-self-report" and output.strip() != expected
-):
-    raise ValueError("Directory packaged postcondition failed")
-if component == "directory-php":
-    document = ET.parse(report)
-    cases = list(document.iter("testcase"))
-    if len(cases) != 1 or cases[0].get("name") != assertion or any(
-        list(document.iter(tag)) for tag in ("skipped", "failure", "error")
-    ):
-        raise ValueError("Directory exact assertion did not pass once without skips")
-    report.unlink()
-output_file.unlink()
-print("IICP_PRE1_DIRECTORY_ASSERTION_PASS " + assertion)
-'''
-DIRECTORY_ORIGIN = r'''<?php
-$root = realpath(getenv('PRE1_DIRECTORY_INSTALLED'));
-if (!$root) { throw new RuntimeException('Directory package root unavailable'); }
-require $root . '/vendor/autoload.php';
-register_shutdown_function(function () use ($root) {
-    foreach (get_declared_classes() as $class) {
-        $expected = null;
-        foreach (['App\\' => 'app', 'Tests\\' => 'tests', 'Database\\' => 'database'] as $prefix => $directory) {
-            if (str_starts_with($class, $prefix)) {
-                $expected = $root . DIRECTORY_SEPARATOR . $directory . DIRECTORY_SEPARATOR;
-                break;
-            }
-        }
-        if ($expected !== null) {
-            $file = (new ReflectionClass($class))->getFileName();
-            if (!$file || !str_starts_with(realpath($file), $expected)) {
-                fwrite(STDERR, "Directory application class escaped packaged origin\n");
-                exit(2);
-            }
-        }
-    }
-});
-'''
-
-
-def directory_archive_payload(artifact):
-    files = rust_archive_files(artifact, "")
-    prefixes = {name.split("/", 1)[0] for name in files}
-    if len(prefixes) != 1:
-        raise ValueError("Directory archive must have one package root")
-    prefix = prefixes.pop() + "/"
-    if not re.fullmatch(r"iicp-directory-php-v\d+\.\d+\.\d+/", prefix):
-        raise ValueError("Directory archive package root differs")
-    result = {name.removeprefix(prefix): value for name, value in files.items()}
-    if not {"artisan", "composer.json", "composer.lock"}.issubset(result) or any(
-        name.startswith("vendor/") for name in result
-    ):
-        raise ValueError("Directory archive lacks locked source or contains vendor")
-    return result
-
-
-def stage_directory_payload(artifact, workspace, component):
-    workspace = safe_path(workspace)
-    home = safe_path(Path(os.environ["HOME"]))
-    if workspace == home or not workspace.is_relative_to(home) or list(workspace.iterdir()):
-        raise ValueError("Directory staging requires an empty run workspace")
-    safe_path(artifact)
-    installed = workspace / "payload"
-    if component == "directory-rust":
-        installed.mkdir(mode=0o700)
-        (installed / "iicp-directory-rs").write_bytes(artifact.read_bytes())
-        (installed / "iicp-directory-rs").chmod(0o700)
-    elif component == "directory-php":
-        expected = directory_archive_payload(artifact)
-        installed.mkdir(mode=0o700)
-        with tarfile.open(artifact, "r:gz") as archive:
-            for row in archive:
-                if row.isfile():
-                    name = row.name.split("/", 1)[1]
-                    if name not in expected:
-                        raise ValueError("Directory archive contains an unexpected member")
-                    dest = installed / name
-                    dest.parent.mkdir(parents=True, exist_ok=True)
-                    handle = archive.extractfile(row)
-                    if handle is None:
-                        raise ValueError("Directory archive member unavailable")
-                    with dest.open("xb") as output:
-                        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
-                            output.write(chunk)
-                    dest.chmod(0o600)
-        if tree(installed) != expected:
-            raise ValueError("Directory staged archive differs")
-        provision_directory_runtime_paths(installed)
-    else:
-        raise ValueError("Directory staging component differs")
-    return installed
-
-
-def provision_directory_runtime_paths(installed):
-    # Release archives need not contain empty runtime directories. Provision
-    # only Laravel's private writable paths before Composer's locked scripts
-    # execute; these are not alternate application or dependency sources.
-    for relative in ("bootstrap/cache", "storage/logs", "storage/framework/cache/data",
-                     "storage/framework/sessions", "storage/framework/views"):
-        directory = installed
-        for part in relative.split("/"):
-            directory = directory / part
-            if directory.exists() or directory.is_symlink():
-                safe_path(directory)
-                if not directory.is_dir():
-                    raise ValueError("Directory runtime path is not a directory")
-            else:
-                directory.mkdir(mode=0o700)
-
-
-def directory_fixtures(root, component):
-    result = {"directory-probe.py": DIRECTORY_PROBE.encode(),
-              "directory-case-map.json": safe_path(root / "qualification/pre1-cases.json").read_bytes()}
-    if component == "directory-php":
-        result["directory-origin.php"] = DIRECTORY_ORIGIN.encode()
-    return result
-
-
-def directory_payload(artifact, installed, component, target):
-    files = tree(installed)
-    if component == "directory-rust":
-        binary = safe_path(installed / "iicp-directory-rs")
-        with binary.open("rb") as handle:
-            header = handle.read(20)
-        machine = {"linux-aarch64": 183, "linux-x86_64": 62}.get(target)
-        if len(header) != 20 or header[:6] != b"\x7fELF\x02\x01" or machine is None or int.from_bytes(header[18:20], "little") != machine:
-            raise ValueError("Directory binary architecture differs")
-        if stat.S_IMODE(binary.stat().st_mode) != 0o700 or files != {"iicp-directory-rs": file_digest(artifact)}:
-            raise ValueError("Directory installed binary differs")
-        return files, {}
-    expected = directory_archive_payload(artifact)
-    volatile = ("vendor/", "storage/", "bootstrap/cache/")
-    immutable = {k: v for k, v in files.items() if not k.startswith(volatile)}
-    if immutable != {k: v for k, v in expected.items() if not k.startswith(volatile)}:
-        raise ValueError("Directory installed archive differs")
-    deps = {"vendor/" + k: v for k, v in tree(safe_path(installed / "vendor")).items()}
-    cache = installed / "bootstrap/cache"
-    if cache.exists() or cache.is_symlink():
-        deps.update({"bootstrap-cache/" + k: v for k, v in tree(safe_path(cache)).items()})
-    return immutable, deps
-
-
-def create_directory_binding(root, workspace, installed, artifact, component, runtime, target, bindings, *, stage_fixtures=True):
-    validate_immutable_bindings(bindings)
-    validate_workspace_boundary(safe_path(workspace), safe_path(Path(os.environ["HOME"])), safe_path(installed), root)
-    payload, deps = directory_payload(artifact, installed, component, target)
-    fixtures = directory_fixtures(root, component)
-    for name, data in fixtures.items():
-        dest = workspace / name
-        if not dest.exists() and stage_fixtures:
-            with dest.open("xb") as output:
-                output.write(data)
-            dest.chmod(0o600)
-        if not dest.exists() or dest.is_symlink() or dest.read_bytes() != data:
-            raise ValueError("Directory packaged fixtures changed")
-    value = {"schema": SCHEMA, "component": component, "runtime": runtime, "target": target,
-        "bindings": bindings, "workspace": str(workspace), "installed_package": str(installed),
-        "artifact_sha256": file_digest(artifact), "installed_payload_sha256": digest(payload),
-        "fixtures_sha256": digest({k: "sha256:" + hashlib.sha256(v).hexdigest() for k, v in fixtures.items()}),
-        "test_dependencies_sha256": digest(deps), "binding_sha256": None,
-        "assertion_adapter": "canonical-runtime-verifier-and-cli.v1",
-        "non_authorizing": True, "qualification_credit": False}
-    value["binding_sha256"] = digest(value)
-    return value
-
-
-def validate_directory_binding(value, context, artifact, root):
-    validate_binding_identity(value)
-    validate_binding_context(value, context)
-    expected = create_directory_binding(root, Path(value["workspace"]), Path(value["installed_package"]),
-        artifact, context["component"], context["runtime"], context["target"], {k: context[k] for k in BINDINGS}, stage_fixtures=False)
-    if value != expected:
-        raise ValueError("Directory package execution inputs changed")
-    return safe_path(Path(value["workspace"]))
-
-
-def directory_package_command(root, context, component_manifest, artifact_root, env, value):
-    component, scenario = context["component"], context["scenario_id"]
-    if context["mode"] != "local-only":
-        raise ValueError("Directory packaged mode remains unimplemented")
-    kind = "release-artifact" if component == "directory-rust" else "release-archive"
-    rows = [r for r in component_manifest["artifacts"] if r["kind"] == kind and r["target"] in {context["target"], "any"}]
-    if len(rows) != 1:
-        raise ValueError("Directory execution artifact is ambiguous")
-    artifact = safe_path(artifact_root / component / rows[0]["name"])
-    if file_digest(artifact) != rows[0]["sha256"]:
-        raise ValueError("Directory candidate artifact digest differs")
-    workspace = validate_directory_binding(value, context, artifact, root)
-    mapping = json.loads((workspace / "directory-case-map.json").read_text())
-    case = mapping["support"] if scenario == "support" else mapping["scenarios"][scenario]
-    if component == "directory-rust" and scenario not in DIRECTORY_RUST_SCENARIOS:
-        raise ValueError("Directory black-box scenario remains unimplemented")
-    if component == "directory-php" and case["command"][0] != "@php":
-        raise ValueError("Directory structural checks are not packaged operation evidence")
-    env = {**env, "IICP_PRE1_EXECUTION_CONTEXT": json.dumps(context, sort_keys=True),
-           "IICP_PRE1_DIRECTORY_INSTALLED": value["installed_package"],
-           "IICP_PRE1_DIRECTORY_VERSION": component_manifest["source_version"]}
-    if component == "directory-php":
-        runtime_map = json.loads(Path(os.environ["IICP_PRE1_RUNTIME_MAP"]).read_text())
-        env["IICP_PRE1_DIRECTORY_PHP"] = runtime_map["runtimes"][context["runtime"]]["programs"]["php"]
-    argv = [sys.executable, "-I", "-S", str(workspace / "directory-probe.py"), case["assertion"]]
-    return argv, env, workspace, {"value": value, "artifact": artifact, "vendor_artifact": None}
diff --git a/scripts/test_pre1_package_execution.py b/scripts/test_pre1_package_execution.py
index 192ae0d..fa0d47e 100644
--- a/scripts/test_pre1_package_execution.py
+++ b/scripts/test_pre1_package_execution.py
@@ -17,276 +17,6 @@
 
 
 class PackageExecutionTests(unittest.TestCase):
-    def directory_http_functions(self):
-        import ast
-        import signal
-        import time
-        import urllib.request
-        import urllib.error
-        parsed = ast.parse(adapter.DIRECTORY_PROBE)
-        functions = ast.Module(body=[n for n in parsed.body if isinstance(n, ast.FunctionDef)], type_ignores=[])
-        namespace = dict(json=json, os=os, signal=signal,
-                         subprocess=subprocess, tempfile=tempfile, time=time, Path=Path, urllib=urllib)
-        exec(compile(functions, "directory-probe.py", "exec"), namespace)
-        return namespace
-
-    def test_directory_http_postconditions_reject_status_only_false_positives(self):
-        check = self.directory_http_functions()["http_postcondition"]
-        for status in (200, 403, 404, 500):
-            with self.subTest(status=status), self.assertRaises(ValueError):
-                check(lambda *a: (status, {}), "credential-missing")
-        check(lambda *a: (401, {}), "credential-missing")
-        with self.assertRaises(ValueError):
-            check(lambda *a: (422, {"message": "endpoint invalid"}), "unsupported-version")
-        check(lambda *a: (422, {"message": "sdk_compatibility_version must match sdk_version when both are supplied"}), "unsupported-version")
-        with self.assertRaises(ValueError):
-            check(lambda *a: (200, {}), "backup-restore")
-
-    def directory_network(self, active):
-        import struct
-        from unittest.mock import Mock
-        from contextlib import ExitStack
-        import socket
-        stack = ExitStack()
-        ioctl = Mock()
-        ioctl.ioctl.side_effect = lambda fd, op, name: b"\0" * 16 + struct.pack("H", int(name.rstrip(b"\0").decode() in active))
-        stack.enter_context(patch.dict("sys.modules", {"fcntl": ioctl}))
-        stack.enter_context(patch.object(socket, "if_nameindex", return_value=[(1, "lo"), (2, "eth0"), (3, "gre0")]))
-        return stack
-
-    def test_directory_http_fixture_refuses_host_network_before_process_start(self):
-        run = self.directory_http_functions()["rust_http_case"]
-        with self.directory_network({"lo", "eth0"}), \
-             patch.object(subprocess, "Popen") as launch:
-            with self.assertRaisesRegex(ValueError, "loopback-only"):
-                run(Path("/fixture/binary"), {}, "credential-missing", "0.1.15")
-            launch.assert_not_called()
-
-    def test_directory_http_fixture_wrong_identity_kills_owned_process(self):
-        from unittest.mock import Mock, MagicMock
-        import urllib.request
-        run = self.directory_http_functions()["rust_http_case"]
-        process = Mock(pid=123)
-        process.poll.return_value = None
-        response = MagicMock(code=200)
-        response.__enter__.return_value = response
-        response.read.return_value = b'{"ok":true,"version":"v9.9.9-rs"}'
-        with self.directory_network({"lo"}), \
-             patch.object(subprocess, "Popen", return_value=process), \
-             patch.object(os, "pread", return_value=b"listening on 0.0.0.0:8090", create=True), \
-             patch.object(os, "killpg", create=True) as kill, \
-             patch.object(urllib.request, "build_opener") as opener:
-            opener.return_value.open.return_value = response
-            with self.assertRaisesRegex(ValueError, "identity differs"):
-                run(Path("/fixture/binary"), {}, "credential-missing", "0.1.15")
-            kill.assert_called_once()
-            process.wait.assert_called_once_with(timeout=10)
-
-    def test_directory_http_fixture_timeout_and_early_exit_preserve_cleanup(self):
-        from unittest.mock import Mock
-        import time
-        run = self.directory_http_functions()["rust_http_case"]
-        for exit_code, cause in ((None, "timed out"), (1, "exited before readiness")):
-            process = Mock(pid=123)
-            process.poll.return_value = exit_code
-            with self.subTest(exit_code=exit_code), \
-                 self.directory_network({"lo"}), \
-                 patch.object(subprocess, "Popen", return_value=process), \
-                 patch.object(os, "pread", return_value=b"", create=True), \
-                 patch.object(os, "killpg", create=True) as kill, \
-                 patch.object(time, "monotonic", side_effect=[0, 31]):
-                with self.assertRaisesRegex(ValueError, cause):
-                    run(Path("/fixture/binary"), {}, "credential-missing", "0.1.15")
-                kill.assert_called_once()
-                process.wait.assert_called_once_with(timeout=10)
-
-    def directory_inputs(self, component="directory-rust"):
-        import shutil
-        shutil.rmtree(self.workspace)
-        self.workspace.mkdir()
-        (self.root / "qualification").mkdir(exist_ok=True)
-        mapping = {"support": {"assertion": "support", "command": ["@php", "vendor/bin/phpunit"]},
-                   "scenarios": {name: {"assertion": name, "command": ["@php", "vendor/bin/phpunit"]}
-                     for name in ["package-version-self-report", "config-missing", "config-malformed", "backup-restore"]}}
-        (self.root / "qualification/pre1-cases.json").write_text(json.dumps(mapping))
-        if component == "directory-rust":
-            artifact = self.home / "iicp-directory-rs-0.1.15-linux-aarch64"
-            header = bytearray(20)
-            header[:6] = b"\x7fELF\x02\x01"
-            header[18:20] = (183).to_bytes(2, "little")
-            artifact.write_bytes(header)
-        else:
-            artifact = self.home / "php.tar.gz"
-            with tarfile.open(artifact, "w:gz") as archive:
-                for name in ["artisan", "composer.json", "composer.lock", "app/runtime.php"]:
-                    data = name.encode()
-                    member = tarfile.TarInfo("iicp-directory-php-v1.10.94/" + name)
-                    member.size = len(data)
-                    archive.addfile(member, io.BytesIO(data))
-        installed = adapter.stage_directory_payload(artifact, self.workspace, component)
-        if component == "directory-php":
-            (installed / "vendor").mkdir()
-            (installed / "vendor/autoload.php").write_text("locked vendor")
-        value = adapter.create_binding(self.root, self.workspace, installed, artifact,
-            component, "php-8.3" if component == "directory-php" else "rust-1.98.0", "linux-aarch64", self.bindings)
-        context = {**self.context, "component": component, "runtime": value["runtime"],
-                   "target": "linux-aarch64", "mode": "local-only", "scenario_id": "config-missing"}
-        return artifact, installed, value, context
-
-    def test_directory_binary_binding_and_proof_are_candidate_bound(self):
-        artifact, installed, value, context = self.directory_inputs()
-        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), self.workspace)
-        proof = adapter.make_case_proof(value, context, "config-missing", 0, "directory-test")
-        adapter.validate_case_proof(proof, context, 0, "directory-test",
-            adapter.execution_summary(value), "config-missing")
-        self.assertFalse(value["qualification_credit"])
-        self.assertEqual((installed / "iicp-directory-rs").read_bytes(), artifact.read_bytes())
-
-    def test_directory_binary_rehashed_tamper_and_wrong_architecture_fail(self):
-        artifact, installed, value, context = self.directory_inputs()
-        binary = installed / "iicp-directory-rs"
-        binary.write_bytes(binary.read_bytes() + b"tamper")
-        value["installed_payload_sha256"] = adapter.digest(adapter.tree(installed))
-        value["binding_sha256"] = adapter.digest({**value, "binding_sha256": None})
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-        binary.write_bytes(artifact.read_bytes())
-        with self.assertRaisesRegex(ValueError, "architecture differs"):
-            adapter.create_binding(self.root, self.workspace, installed, artifact,
-                "directory-rust", "rust-1.98.0", "linux-x86_64", self.bindings)
-
-    def test_directory_fixtures_cannot_be_deleted_or_rehashed(self):
-        artifact, installed, value, context = self.directory_inputs()
-        (self.workspace / "directory-probe.py").unlink()
-        with self.assertRaisesRegex(ValueError, "fixtures changed"):
-            adapter.validate_binding(value, context, artifact, self.root)
-        self.assertFalse((self.workspace / "directory-probe.py").exists())
-        (self.workspace / "directory-probe.py").write_text("fake success")
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-
-    def test_directory_binary_modes_and_extra_runtime_files_fail(self):
-        artifact, installed, value, context = self.directory_inputs()
-        binary = installed / "iicp-directory-rs"
-        binary.chmod(0o755)
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-        binary.chmod(0o700)
-        (installed / "fallback-runtime").write_text("checkout substitute")
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-
-    def test_directory_archive_source_and_vendor_are_separately_bound(self):
-        artifact, installed, value, context = self.directory_inputs("directory-php")
-        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), self.workspace)
-        (installed / "storage").mkdir(exist_ok=True)
-        (installed / "storage/log.txt").write_text("volatile test log")
-        adapter.validate_binding(value, context, artifact, self.root)
-        (installed / "app/runtime.php").write_text("checkout fallback")
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-
-    def test_directory_archive_vendor_tamper_and_symlinks_fail(self):
-        artifact, installed, value, context = self.directory_inputs("directory-php")
-        (installed / "vendor/autoload.php").write_text("unlocked dependencies")
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-        (installed / "vendor/autoload.php").unlink()
-        (installed / "vendor/autoload.php").symlink_to(self.root / "src/runtime.py")
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-
-    def test_directory_php_guard_checks_real_namespace_prefixes_and_cache_tamper(self):
-        self.assertIn("'App\\\\'", adapter.DIRECTORY_ORIGIN)
-        self.assertIn("'Tests\\\\'", adapter.DIRECTORY_ORIGIN)
-        self.assertIn("'Database\\\\'", adapter.DIRECTORY_ORIGIN)
-        self.assertIn("str_starts_with(realpath($file), $expected)", adapter.DIRECTORY_ORIGIN)
-        self.assertNotIn("str_starts_with(realpath($file), $root . DIRECTORY_SEPARATOR)", adapter.DIRECTORY_ORIGIN)
-        artifact, installed, value, context = self.directory_inputs("directory-php")
-        (installed / "bootstrap/cache").mkdir(parents=True, exist_ok=True)
-        (installed / "bootstrap/cache/services.php").write_text("unbound executable cache")
-        with self.assertRaises(ValueError):
-            adapter.validate_binding(value, context, artifact, self.root)
-
-    def test_directory_archive_provisions_private_runtime_directories(self):
-        import stat
-        artifact, installed, value, context = self.directory_inputs("directory-php")
-        for name in ("bootstrap/cache", "storage/logs", "storage/framework/cache/data",
-                     "storage/framework/sessions", "storage/framework/views"):
-            path = installed / name
-            self.assertTrue(path.is_dir())
-            self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o700)
-        self.assertEqual(adapter.validate_binding(value, context, artifact, self.root), self.workspace)
-
-    def test_directory_runtime_paths_refuse_symlink_and_file(self):
-        import shutil
-        artifact, installed, value, context = self.directory_inputs("directory-php")
-        cache = installed / "bootstrap/cache"
-        shutil.rmtree(cache)
-        cache.symlink_to(self.home, target_is_directory=True)
-        with self.assertRaises(ValueError):
-            adapter.provision_directory_runtime_paths(installed)
-        cache.unlink()
-        cache.write_text("not a directory")
-        with self.assertRaisesRegex(ValueError, "not a directory"):
-            adapter.provision_directory_runtime_paths(installed)
-
-    def test_directory_php_probe_self_report_and_junit_fail_closed(self):
-        import sys
-        artifact, installed, value, context = self.directory_inputs("directory-php")
-        probe = self.workspace / "directory-probe.py"
-        runtime = self.home / "fake-php"
-        runtime.write_text("#!" + sys.executable + "\n" +
-            "import sys, os\nfrom pathlib import Path\n" +
-            "p = Path(sys.argv[sys.argv.index('--log-junit') + 1])\n" +
-            "p.write_text(os.environ.get('FAKE_JUNIT', '<testsuite><testcase name=\"package-version-self-report\"/></testsuite>'))\n")
-        runtime.chmod(0o700)
-        context["scenario_id"] = "package-version-self-report"
-        env = {**os.environ, "IICP_PRE1_EXECUTION_CONTEXT": json.dumps(context),
-               "IICP_PRE1_DIRECTORY_INSTALLED": str(installed), "IICP_PRE1_DIRECTORY_PHP": str(runtime)}
-        for document, expected in [
-            ('<testsuite><testcase name="package-version-self-report"/></testsuite>', 0),
-            ('<testsuite><testcase name="package-version-self-report"><skipped/></testcase></testsuite>', 1),
-            ('<testsuite><testcase name="wrong"/></testsuite>', 1),
-            ('<testsuite><testcase name="package-version-self-report"/><testcase name="extra"/></testsuite>', 1),
-        ]:
-            (self.workspace / "directory-junit.xml").unlink(missing_ok=True)
-            # The child environment is intentionally sanitized; vary the fake
-            # runtime itself instead of relying on inherited environment values.
-            runtime.write_text("#!" + sys.executable + "\nimport sys\nfrom pathlib import Path\n" +
-                "Path(sys.argv[sys.argv.index('--log-junit') + 1]).write_text(" + repr(document) + ")\n")
-            result = subprocess.run([sys.executable, "-I", "-S", str(probe), "package-version-self-report"],
-                cwd=self.workspace, env=env, capture_output=True, text=True, timeout=15)
-            self.assertEqual(result.returncode, expected, result.stderr)
-            self.assertEqual("IICP_PRE1_DIRECTORY_ASSERTION_PASS" in result.stdout, expected == 0)
-
-    def test_directory_archive_refuses_links_traversal_and_multiple_roots(self):
-        for name, kind in [("../escape", "file"), ("iicp-directory-php-v1.10.94/link", "link"), ("other/root", "file")]:
-            artifact = self.home / "unsafe.tar.gz"
-            with tarfile.open(artifact, "w:gz") as archive:
-                member = tarfile.TarInfo(name)
-                if kind == "link":
-                    member.type, member.linkname = tarfile.SYMTYPE, "/outside"
-                archive.addfile(member)
-            with self.subTest(name=name), self.assertRaises(ValueError):
-                adapter.directory_archive_payload(artifact)
-
-    def test_directory_unimplemented_case_and_modes_never_use_checkout_commands(self):
-        artifact, installed, value, context = self.directory_inputs()
-        manifest = {"source_version": "0.1.15", "artifacts": [{"name": artifact.name,
-            "kind": "release-artifact", "target": "linux-aarch64", "sha256": adapter.file_digest(artifact)}]}
-        artifact_root = self.home / "artifacts"
-        (artifact_root / "directory-rust").mkdir(parents=True)
-        import shutil
-        shutil.copyfile(artifact, artifact_root / "directory-rust" / artifact.name)
-        for mutation in [{"mode": "restricted"}, {"mode": "public"}, {"scenario_id": "backup-restore"}]:
-            with self.subTest(mutation=mutation), self.assertRaises(ValueError):
-                adapter.directory_package_command(self.root, {**context, **mutation}, manifest, artifact_root, {}, value)
-        argv, env, cwd, proof = adapter.directory_package_command(self.root, context, manifest, artifact_root, {}, value)
-        self.assertEqual(cwd, self.workspace)
-        self.assertNotIn("cargo", argv)
-        self.assertNotIn(str(self.root), " ".join(argv))
-
     def management_artifact(self):
         self.workspace = self.home / "run/management"
         self.workspace.mkdir(parents=True)