Security review P2s:
- A binding proposal keeps only its structured request fields. The
free-text reason is never written to the private proposal or covered
by its digest.
- A root copy's receipts are checked at prepare, at check, and again
under the organization lock before the write and before publication.
A copy removed, replaced or unreadable since boot refuses with
instance-fired, copy-stale or root-policy-unreadable.
Build review P2:
- A root copy's admitted projects come from the project unions,
recomputed from the current document and the boot's root agents. A
project that excludes the copy, or whose union refuses, is never in
reach; a request naming it refuses with credential-scope-exceeded.
Build review P3s: tests for proposal-time shadowing, the loader's
copyBindings validation, a pending record that covers every service,
a stricter path check on the refusal table, and refusal codes on every
bare rejects in the binding tests.
jason.woltje
5dbd7e72d3