Portable authenticated worker identity: semantic identity plus audit-only aliases for the primary-QRF worker binding (fixes #863)

[MaxGhenis]

Summary

Fixes #863. The authenticated US multispine pool loader bound the late primary-QRF worker to the build worktree's absolute interpreter path (argv_template[0] and interpreter.executable), so a byte-identical interpreter reached through another virtualenv path was refused and no sealed pool could be scored out of tree (the c-27 root-cause lane's STOP.md).

This PR versions the worker binding into a semantic identity and audit-only aliases:

• Semantic identity binds what determines the computation: interpreter-byte digest, implementation and version/ABI, cache tag, canonicalized semantic pyvenv.cfg fields, worker-module source and transitive-import digests, the exact uv.lock digest, the installed-distribution RECORD digest, arguments after argv[0] (with argv[0] canonicalized to an interpreter placeholder), and the semantic fit controls (fit jobs, predict workers). Authentication compares this identity.
• Audit aliases (sys.executable, sys.prefix, raw argv_template[0]) are recorded and never compared.
• Legacy gate-failed pools can be scored from another worktree only with an explicit, plan-authorized compatibility attestation that binds the sealed manifest and H5 digests, the exact campaign tree, the lock, the installed environment/code digest, the recorded worker fields, the permitted two-alias mismatch, and the scoring-only purpose. The release loader ignores the attestation and refuses.
• The primary execution-config schema and every enclosing identity version are bumped; US spec mirrors, checked-in YAML, and the coverage evidence are regenerated; exact-k release receipts carry the worker schema, digest, and audit receipt so the identity survives into build and release manifests.

Verification

Implemented by a sol build lane from the c-27 lane's FIX-PLAN.md §F1 with fail-before evidence recorded in docs/f1-portable-worker-identity/; the lane's Codex lane ran out before its final verification, which was completed by hand: the resolver-binding case in the spec-bundle identity allowlist, the builder fake's manifest-payload binding, and the resource-semantics and full-checkpoint identity pins were fixed and the coverage evidence regenerated (42154/42154 configuration fields, 41/41 inventory checks). CI on this branch is the verification of record.

Not in this PR

The immigration composition gate's anchor (#864) and the c-27 replay itself, which this PR unblocks.

Rebase onto post-#847 main and CI fixes (9/4)

Rebased onto main at 5e9ef2e (graph amendments 11–18). Pins that both sides moved were regenerated from the rebased tree: US spec_sha256 9db29b4d…, late_resource_semantics c7d26e86…, full_checkpoint 5deaf532…, and docs/evidence/spec-engine/us-f0-coverage.json (42154/42154 fields, 41/41 inventory checks). The materializer version 13 and pool manifest schema 10 bumps from this branch are unchanged.

Two defects CI found on the rebased head that the macOS lane run could not:

• uv 0.12 writes version_info = 3.13 (major.minor) to pyvenv.cfg for uv-managed interpreters; the parser demanded a triplet, so every uv sync job failed at _canonical_pyvenv_config. It now accepts major.minor or major.minor.micro, requires the declared prefix to match the running interpreter, and canonicalizes to sys.version_info[:3], so the semantic identity does not depend on which uv wrote the venv. Verified locally: uvx uv@0.12.9 venv writes 3.13, uv 0.11.7 writes 3.13.9.
• Wheels job: Duplicate source modules for worker identity: 'microcosm.build'. _module_source_index now walks the namespace search locations in import order and lets a later root shadow an earlier one only with byte-identical source (an installed wheel next to its checkout, lib64 beside lib); differing shadowed source still refuses, naming both paths.

Tests cover both accept paths and every refusal (test_worker_source_index_accepts_a_byte_identical_shadow_root, ..._rejects_a_shadow_root_with_different_source, test_canonical_pyvenv_config_accepts_uv_major_minor_and_triplet_versions, ..._rejects_versions_that_are_not_the_interpreter).

Two further omissions CI surfaced on the rebased head, both fixed: us_runtime/worker_identity.py is now classified as a reviewed non-registry module in the spine-blindness registry (the pool-build tool's pinned runtime import graph is 70 modules), and the release-gate preflight test's fake AuthenticatedPoolH5 binds manifest_payload_sha256, which the release receipt re-derives from the manifest it is handed.

Digest portability. Linux CI computed different late_resource_semantics and full_checkpoint inventory digests from the macOS pins. This branch had narrowed inventory_coverage._without_operational_bindings from stripping the whole worker_execution subtree (main's rule) to stripping only its audit aliases, on the premise that the new semantic identity is spec evidence. It is not: it hashes the interpreter binary, ABI, pyvenv.cfg, the installed distributions' RECORD files and the resolved CPU count, all of which legitimately differ between platforms and authenticate an environment for replay. Main's rule is restored, the two digests re-pinned from the stripped receipts, and test_operational_free_digest_ignores_the_worker_execution_binding pins the invariant (a macOS binding, a Linux binding and no binding digest identically).

Design note for review: the semantic identity is portable across interpreter paths (the #863 ask) but remains bound to one machine's interpreter bytes and installed distributions. A c-27 replay on a different box therefore authenticates through the legacy attestation path or needs a looser projection; this PR does not decide that.

Sol gate round (9/4): four identity findings closed

• Schema-9 compatibility no longer bypasses the stacked envelope: schema 9 carries an explicit complete field set and runs the same envelope classifier as schema 10 before any attestation is read; missing/wrong pipeline and malformed envelopes are refused with the live path's errors.
• The interpreter identity binds the loaded Python image and the clean import's stdlib, not just the launcher binary; runtime or stdlib mutations change the identity.
• Torch backend autoload is disabled and bound (TORCH_DEVICE_BACKEND_AUTOLOAD=0 in the semantic environment and the worker bootstrap), torch.backends entry-point providers are enumerated and refused outside the installed-code closure, duplicate distribution identities are refused.
• The package-resource closure is traced from a real worker import (audit hook on the startup path) instead of a hand-written list; every opened Microcosm-namespace file is in the digest.

Spec-engine inventory digests still strip worker_execution; tools/spec_engine_coverage.py --check passes, so no spec pin moved.

Verification on 32ce6f5 (dispatching session, after recovering the lane's clone from a snapshot): tools/spec_engine_coverage.py --check 42154/42154 fields, 41/41 inventory checks; the worker-identity, h5_io, preflight, fiscal-builder, inventory-coverage, coverage-tool, imputation-semantics and spine-blindness suites all pass (exit 0); ruff check clean.

Astra gate round (9/4): two identity findings closed

• Torch autoload timing — TORCH_DEVICE_BACKEND_AUTOLOAD=0 is set in the worker subprocess environment before interpreter startup (the stacked-spine launch environment, bound into the execution binding), with the bootstrap guard kept as defense in depth; a fresh-process regression inherits =1 from the parent and asserts the worker's first Torch import sees 0.
• Bytecode caches — the identity probe and the worker are isolated from existing __pycache__ contents (caches disabled and redirected away from the source tree), so the executed code is the authenticated source; a valid-header stale-cache regression proves a timestamp-matched cache with different code is never executed under the identity.

No spec-engine pin moved (tools/spec_engine_coverage.py --check green); required suites 964 passed on the lane, re-verified by the dispatching session.

Astra gate 3b95309f round 2 (50c9232)

• Resume reports the retained sidecar's digest: on a relocated-checkpoint resume the primary receipt now carries the retained sidecar's sha256 (normalized digest on initialize). Regression test_relocated_checkpoint_resume_reports_the_retained_sidecar_digest (red on the unfixed code). A pool-tool-level duplicate that could not locate the sidecar was removed; the test file's import block was re-sorted.
• Identity "changed" failure, investigated: test_late_executor_authority_binds_every_transfer_bank_identity failed twice locally after the worker-identity tests, both times while a second pytest process ran in the same clone. The same 14-test selection passed three times when run alone (once under a diagnostic plugin that would have logged the differing identity paths; it logged nothing). No mechanism is claimed; the engine-us CI lane (single process) is the authoritative check.
• Verification on 50c9232: ruff check packages tools clean; ruff format --check clean on the touched files; tools/spec_engine_coverage.py --check 42154/42154 configuration fields, 41/41 inventory checks (no pin moved); the identity/autoload/late-executor selection 14 passed (×3 solo runs); CI on this head linked below.

CI crawl fix (d653c07)

• Cause: every worker-identity probe compiled its whole import closure from source (empty PYTHONPYCACHEPREFIX + PYTHONDONTWRITEBYTECODE=1): _clean_worker_import_trace() 28–31 s, primary_qrf_worker_semantic_identity() 43 s, primary_qrf_worker_execution_binding() 39 s locally; most stacked-spine pipeline and receipt tests reach the live binding (first 200 tests: 2,033 s), so the engine-us (us-am, us-qs) CI lanes never finished.
• Fix: the semantic identity is memoized per process (keyed by the uv_lock_sha256 argument and both bound fit-control environment values) with a public clear_primary_qrf_worker_identity_cache(); execution bindings copy the graph. Tests prime one real identity per session and opt out via live_worker_identity where they mutate identity inputs. The probe, validators, authenticator, launch controls, and bytecode isolation are unchanged (identical ASTs apart from the renamed factory). Fourteen regressions (memo reuse/reset, both environment keys, invalid inputs, lock separation, artifact-copy isolation, session consistency, opted-out namespace-byte changes, spec-generator ordering).
• Measured: identity-heavy selection 734 s → 161 s; full test_us_stacked_spine.py 335 passed in 348 s; us-qs + us-am CI file groups 4,352 passed, 11 skipped; ruff check packages tools clean; tools/spec_engine_coverage.py --check 42,154/42,154 fields, 41/41 inventory checks (no pin moved).