docs: enforce phase-1 product contract evidence and boundaries

[ErenAri]

What this starts

This starts the trusted-product program by locking down Phase 1 (product contract) with explicit, test-enforced evidence.

Changes

• adds docs/PHASE1_PRODUCT_CONTRACT_EVIDENCE.md as the Phase-1 evidence pack
• expands docs/THREAT_MODEL.md with:
  • syscall path coverage boundaries
  • filesystem caveats (including OverlayFS)
  • container/orchestration caveats (including user namespaces and privileged Kubernetes pods)
  • accepted vs non-accepted bypass controls
• expands docs/POLICY_SEMANTICS.md with deterministic precedence/conflict rules and namespace/mount consistency contract
• wires new contract test tests/check_phase1_product_contract.py into CTest as phase1_product_contract
• updates README.md, docs/MATURITY_PROGRAM.md, docs/PRODUCT.md, docs/PRODUCTION_READINESS.md, and docs/QUALITY_GATES.md to reference Phase-1 contract evidence

Validation

• cmake -S . -B build-phase1 -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON -DSKIP_BPF_BUILD=ON
• cmake --build build-phase1 -j$(nproc)
• ctest --test-dir build-phase1 --output-on-failure -R 'phase1_product_contract|phase2_evidence_contract|phase3_safety_contract|phase7_reviewability_contract'

[ErenAri]

Update included in latest commit e08cc1a:

• expanded Phase-2 correctness evidence with a mandatory basis set (direct/symlink/hardlink/rename + documented namespace/filesystem caveats)
• strengthened scripts/e2e_file_enforcement_matrix.sh with rename-bypass checks and JSON summary output (SUMMARY_OUT)
• added artifact capture/upload in both .github/workflows/e2e.yml and .github/workflows/kernel-matrix.yml (summary + kernel/os/fs metadata)
• upgraded tests/check_phase2_evidence_contract.py and CTest wiring to enforce workflow/script evidence markers

Validation rerun:

• bash -n scripts/e2e_file_enforcement_matrix.sh
• python3 tests/check_phase2_evidence_contract.py docs/PHASE2_CORRECTNESS_EVIDENCE.md .github/workflows/e2e.yml .github/workflows/kernel-matrix.yml scripts/e2e_file_enforcement_matrix.sh
• ctest --test-dir build-phase2 --output-on-failure -R 'phase1_product_contract|phase2_evidence_contract|phase3_safety_contract|phase4_portability_contract'

[ErenAri]

Added another hardening slice in commit 9ef4d35 (Phase-3 operational safety guardrails):

• added explicit canary self-DoS guard in scripts/canary_gate.sh:
  • rejects ENFORCE_SIGNAL=kill unless ALLOW_SIGKILL_CANARY=1
• expanded Phase-3 evidence doc and maturity criteria:
  • docs/PHASE3_OPERATIONAL_SAFETY_EVIDENCE.md
  • docs/MATURITY_PROGRAM.md
  • docs/CANARY_RUNBOOK.md
• added break-glass fail-safe regression test:
  • TracingTest.DaemonRunForcesAuditOnlyWhenBreakGlassActive
• added daemon test hook for break-glass detection override:
  • src/daemon_test_hooks.hpp
  • src/daemon.cpp
• strengthened Phase-3 contract checker to enforce workflow/script guardrails:
  • tests/check_phase3_safety_contract.py
  • CMakeLists.txt test wiring updated

Validation run:

• bash -n scripts/canary_gate.sh
• python3 tests/check_phase3_safety_contract.py docs/PHASE3_OPERATIONAL_SAFETY_EVIDENCE.md .github/workflows/canary.yml .github/workflows/go-live-gate.yml scripts/canary_gate.sh tests/test_tracing.cpp tests/test_policy.cpp
• ctest --test-dir build-phase3 --output-on-failure -R 'TracingTest.DaemonRunGuardsSigkillBehindBuildAndRuntimeFlags|TracingTest.DaemonRunForcesAuditOnlyWhenBreakGlassActive|phase1_product_contract|phase2_evidence_contract|phase3_safety_contract'

[ErenAri]

Added another Phase-2 correctness hardening commit: 2212770

What changed:

• scripts/e2e_file_enforcement_matrix.sh
  • added directory traversal blocked-open assertion
  • added bind-mount alias blocked-open/inode checks when supported
  • emits skipped_checks in summary JSON for environments lacking bind-mount support
• tests/check_phase2_evidence_contract.py
  • now enforces markers for traversal, bind-mount alias checks, and skipped_checks
• docs updated:
  • docs/PHASE2_CORRECTNESS_EVIDENCE.md
  • docs/PRODUCTION_READINESS.md

Validation rerun:

• bash -n scripts/e2e_file_enforcement_matrix.sh
• python3 tests/check_phase2_evidence_contract.py docs/PHASE2_CORRECTNESS_EVIDENCE.md .github/workflows/e2e.yml .github/workflows/kernel-matrix.yml scripts/e2e_file_enforcement_matrix.sh
• ctest --test-dir build-phase3 --output-on-failure -R 'TracingTest.DaemonRunGuardsSigkillBehindBuildAndRuntimeFlags|TracingTest.DaemonRunForcesAuditOnlyWhenBreakGlassActive|phase1_product_contract|phase2_evidence_contract|phase3_safety_contract'

[ErenAri]

Added Phase-4 portability hardening in commit dc898a4:

• portability workflows now emit explicit compatibility evidence artifacts:
  • .github/workflows/kernel-matrix.yml
  • .github/workflows/e2e.yml
  • artifacts now include compatibility-evidence*.md plus e2e-matrix-summary*.json, kernel-info*, os-release*, and fs-type*
• compatibility docs now include CI-backed evidence contract:
  • docs/COMPATIBILITY.md (new CI-Backed Evidence Matrix + review procedure)
  • docs/PHASE4_PORTABILITY_EVIDENCE.md (artifact contract section)
• contract enforcement tightened:
  • tests/check_phase4_portability_contract.py now checks for artifact markers and workflow evidence-note generation

Validation rerun:

• python3 tests/check_phase4_portability_contract.py .github/workflows/kernel-matrix.yml docs/COMPATIBILITY.md docs/PHASE4_PORTABILITY_EVIDENCE.md tests/test_kernel_features.cpp
• python3 tests/check_phase2_evidence_contract.py docs/PHASE2_CORRECTNESS_EVIDENCE.md .github/workflows/e2e.yml .github/workflows/kernel-matrix.yml scripts/e2e_file_enforcement_matrix.sh
• ctest --test-dir build-phase4 --output-on-failure -R 'phase1_product_contract|phase2_evidence_contract|phase3_safety_contract|phase4_portability_contract'

[ErenAri]

Added Phase-5 hardening in commit 79bbdde:

• strict perf workflow now produces a machine-verifiable evidence pack:
  • .github/workflows/perf.yml captures workload JSON, percentile JSONs, and host metadata (kernel/os/cpu/fs)
  • adds schema validation step using scripts/validate_perf_artifacts.py
  • emits artifacts/perf/perf-evidence-report.md
• new validator script:
  • scripts/validate_perf_artifacts.py
  • validates required keys/types, percentile ordering, workload row completeness, and with-agent labeling consistency
• docs/contracts updated:
  • docs/PERF.md (artifact schema validation + perf artifact contract)
  • docs/PHASE5_PERFORMANCE_EVIDENCE.md (artifact contract)
  • docs/MATURITY_PROGRAM.md, docs/QUALITY_GATES.md, docs/PRODUCTION_READINESS.md
  • tests/check_phase5_performance_contract.py tightened to enforce workflow/doc markers and validator presence

Validation rerun:

• python3 tests/check_phase5_performance_contract.py docs/PERF.md docs/PHASE5_PERFORMANCE_EVIDENCE.md .github/workflows/perf.yml scripts/perf_open_bench.sh scripts/perf_connect_bench.sh
• ctest --test-dir build-phase5 --output-on-failure -R 'phase1_product_contract|phase2_evidence_contract|phase3_safety_contract|phase4_portability_contract|phase5_performance_contract'

[ErenAri]

Phase-6 hardening chunk pushed in 7ee230b.

What changed:

• Added capability contract validator script: scripts/validate_capability_contract.py
  • Enforces SECURITY.md minimum-capabilities == systemd CapabilityBoundingSet == AmbientCapabilities
  • Can emit capability-contract-report.md
• Upgraded key-rotation drill workflow:
  • SUMMARY_OUT=artifacts/meta-security/key-rotation-summary.json
  • capability contract report generation
  • artifact upload (meta-security-drill)
• Upgraded release workflow:
  • validates capability contract during release
  • includes release/capability-contract-report.md in provenance subjects
  • signs capability report with cosign
• Extended test gates:
  • phase6_meta_security_contract now enforces workflow/script/artifact markers
  • added capability_contract CTest
  • phase7 reviewability contract now requires Phase-6 evidence link
• Updated evidence docs/checklists accordingly:
  • docs/PHASE6_META_SECURITY_EVIDENCE.md
  • docs/KEY_MANAGEMENT.md
  • docs/GO_LIVE_CHECKLIST.md
  • docs/PRODUCTION_READINESS.md
  • docs/QUALITY_GATES.md
  • docs/MATURITY_PROGRAM.md
  • docs/PHASE7_REVIEWABILITY_EVIDENCE.md

Local validation run:

• python3 scripts/validate_capability_contract.py SECURITY.md packaging/systemd/aegisbpf.service
• python3 tests/check_phase6_meta_security_contract.py docs/PHASE6_META_SECURITY_EVIDENCE.md .github/workflows/release.yml SECURITY.md docs/KEY_MANAGEMENT.md tests/test_commands.cpp packaging/systemd/aegisbpf.service .github/workflows/key-rotation-drill.yml scripts/key_rotation_drill.sh scripts/validate_capability_contract.py
• python3 tests/check_phase7_reviewability_contract.py docs/PHASE7_REVIEWABILITY_EVIDENCE.md .github/PULL_REQUEST_TEMPLATE.md docs/GO_LIVE_CHECKLIST.md docs/MATURITY_PROGRAM.md README.md
• ctest --test-dir build-phase6 --output-on-failure -R 'phase6_meta_security_contract|phase7_reviewability_contract|capability_contract'
• BUILD_DIR=build-phase6 SKIP_BPF_BUILD=ON SUMMARY_OUT=/tmp/key-rotation-summary.json scripts/key_rotation_drill.sh