Flint 0.5

.github/workflows/ci.yml

@@ -2,9 +2,16 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # `main` is the live line. The feature branch is included so we can run the full
+    # gate on our own work in isolation (this entry lives only on the branch; it does
+    # NOT affect main or other branches until/unless it is merged). Drop or generalise
+    # to `feat/**` at merge time.
+    branches: [main, feat/ddrm-hardening-and-creator-parity]
   pull_request:
     branches: [main]
+  # Manual trigger so a feature branch can be put through the full Linux gate
+  # (incl. the Linux-only carrier smoke in `just verify`) before merge.
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
@@ -36,6 +43,11 @@ jobs:
       - name: cargo check
         working-directory: elastos
         run: cargo check --workspace
+      # Type-check the network-gated live-buy test so a rename can't silently rot the operator's
+      # only live tool (it stays #[ignore]d + feature-off in the gate; this never runs it). S45 F3.
+      - name: cargo check (live-chain test)
+        working-directory: elastos
+        run: cargo check -p elastos-server --features live-chain --tests
 
   test:
     name: Test
@@ -51,6 +63,13 @@ jobs:
         run: cargo test --workspace
         # Network-sensitive tests are #[ignore] and won't run.
         # Run them explicitly with: cargo test --workspace -- --ignored
+      - name: cargo test (dev-modes lane)
+        working-directory: elastos
+        # The money-path construction ratchets (S43 typed BuyError, the S46 prepare-leg
+        # deadline, chain-mock buys) are `#[cfg(feature = "dev-modes")]` — without this lane
+        # the gate never compiles them, and a ratchet outside the gate cannot ratchet
+        # (council S46 guardian F3). Lib-only; shares the workspace build cache.
+        run: cargo test -p elastos-server --lib --features dev-modes
 
   build-release:
     name: Build Release (x86_64)
@@ -64,3 +83,94 @@ jobs:
       - name: cargo build --release
         working-directory: elastos
         run: cargo build --workspace --release
+
+  # The canonical gate on Linux, MINUS the Carrier-network setup smoke: alignment-check +
+  # command smoke + candidate-command-audit + fmt/clippy/test (elastos workspace) + the dDRM
+  # capsule build+test (verify-capsules). This turns "manually covered" into "green on a clean
+  # runner". The `local-carrier-setup-smoke` step is excluded here because it fetches the
+  # net-provider artifact over Elastos Carrier, which a stock GitHub runner cannot reach — run
+  # the full `just verify` on a Carrier-capable Linux box / self-hosted runner before merge.
+  # RUSTFLAGS=-D warnings is inherited from `env` above.
+  verify:
+    name: Verify (Linux CI gate)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            elastos
+            capsules/decrypt-provider
+            capsules/ddrm-envelope
+            scripts/dev/ddrm-media-authority
+      - uses: extractions/setup-just@v2
+      - name: Install ripgrep (required by alignment-check; not preinstalled on the runner)
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+      - name: just verify-ci
+        run: just verify-ci
+
+  # Isolated, fast signal for the protected-content capsule crates that live OUTSIDE
+  # the elastos workspace (so the `check`/`test` jobs and `cargo --workspace` never
+  # reach them): the watermark codec, the grant-digest envelope, the media-authority.
+  # Independent of the carrier smoke, so a flaky/heavy smoke run never masks a capsule
+  # regression. Build+test only (these crates still carry pre-existing clippy debt).
+  capsules:
+    name: dDRM Capsule Gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            capsules/decrypt-provider
+            capsules/ddrm-envelope
+            scripts/dev/ddrm-media-authority
+      - uses: extractions/setup-just@v2
+      - name: just verify-capsules
+        run: just verify-capsules
+
+  # Pre-mainnet deploy invariant (fix-pack ②): a PRODUCTION dkms-authority node must be a release
+  # build with DEFAULT features — the legacy unsigned-receipt path (`legacy-receipt-authz`) and the
+  # `dev-modes` opt-in that pulls it in must NEVER ship. The crate enforces this with a
+  # `compile_error!` keyed on a release build (no `debug_assertions`); this job asserts BOTH
+  # directions so the guard can't silently rot. See `docs/DEPLOY_CHECKLIST.md`.
+  # `dkms-authority` lives OUTSIDE the elastos workspace, so the other jobs never reach it.
+  dkms-release-invariant:
+    name: dKMS Release Invariant (no dev-modes/legacy)
+    runs-on: ubuntu-latest
+    # Assert the FEATURE invariant only; do not let unrelated pre-existing rustc warnings in this
+    # out-of-workspace crate mask it (the rest of CI keeps -D warnings).
+    env:
+      RUSTFLAGS: ""
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: capsules/dkms-authority
+      - name: Release build with DEFAULT features must succeed (no legacy path compiled)
+        run: cargo build --release --manifest-path capsules/dkms-authority/Cargo.toml
+      - name: Release build with legacy-receipt-authz must FAIL closed (compile guard)
+        run: |
+          if out=$(cargo build --release --manifest-path capsules/dkms-authority/Cargo.toml --features legacy-receipt-authz 2>&1); then
+            echo "::error::release build ACCEPTED legacy-receipt-authz — the release-invariant guard is missing"
+            exit 1
+          fi
+          echo "$out" | grep -q "release build must not enable" || {
+            echo "::error::release build failed, but NOT via the release-invariant guard:"; echo "$out"; exit 1;
+          }
+          echo "ok: release + legacy-receipt-authz rejected at compile time"
+      - name: Release build with dev-modes must FAIL closed (compile guard)
+        run: |
+          if out=$(cargo build --release --manifest-path capsules/dkms-authority/Cargo.toml --features dev-modes 2>&1); then
+            echo "::error::release build ACCEPTED dev-modes — the release-invariant guard is missing"
+            exit 1
+          fi
+          echo "$out" | grep -q "release build must not enable" || {
+            echo "::error::release build failed, but NOT via the release-invariant guard:"; echo "$out"; exit 1;
+          }
+          echo "ok: release + dev-modes rejected at compile time"

.gitignore

@@ -42,6 +42,9 @@ elastos/storage/
 artifacts/
 artifacts-aarch64/
 
+# Local scratch build tree (vendored linux kernel source, cargo output, etc.)
+build/
+
 # Secrets and credentials
 .env
 *.pem

README.md

@@ -212,6 +212,11 @@ See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md),
 - device DID, passkey principals, wallet proof bindings, and Recovery Kit
   foundations without making wallet addresses the Runtime identity root
 - agent capsule with signed gossip and verified-only AI responses
+- Flint mandates: grant an AI agent scoped, expiring, revocable authority (a mandate, not
+  your keys), watch and kill it from the Mandates shell app, let it spend real money under a
+  durable spend cap on a payment rail (HTTPS adapter or on-chain DRM marketplace), and export
+  a portable signed receipt verifiable off-box with `elastos verify-receipt` — see
+  [docs/FLINT_MANDATE_ENGINE.md](docs/FLINT_MANDATE_ENGINE.md)
 
 Important Browser status: the Browser ABI and hosted proof path are real, but
 the final product browser is not complete. Stable arbitrary-site media, accepted
@@ -273,6 +278,8 @@ and release/docs slices.
 | [docs/CONTENT_AVAILABILITY.md](docs/CONTENT_AVAILABILITY.md) | SmartWeb content availability, IPLD-compatible manifests, and provider boundary |
 | [docs/WALLET_PROVIDER.md](docs/WALLET_PROVIDER.md) | Wallet, account, approval, proof, and signer/provider boundary |
 | [docs/CHAIN_PROVIDER.md](docs/CHAIN_PROVIDER.md) | Typed blockchain provider boundary |
+| [docs/FLINT_MANDATE_ENGINE.md](docs/FLINT_MANDATE_ENGINE.md) | Flint — mandates for AI agents: scoped, revocable authority, spend-capped payments, portable signed receipts |
+| [docs/DRM_MARKETPLACE_RAIL.md](docs/DRM_MARKETPLACE_RAIL.md) | The DRM marketplace payment rail (on-chain settlement under a mandate) |
 | [docs/BROWSER_CAPSULE.md](docs/BROWSER_CAPSULE.md) | Browser/Net/Exit/Engine ABI and current proof boundary |
 | [docs/BROWSER_PROVIDER_BAKEOFF.md](docs/BROWSER_PROVIDER_BAKEOFF.md) | Browser provider comparison and acceptance gates |
 | [docs/SITES.md](docs/SITES.md) | Local site hosting and public exposure |

ROADMAP.md

@@ -924,6 +924,13 @@ clean.
 Encrypted capsules, remote trust, reproducible builds, TPM/TEE-backed attestation, and dDRM-like flows remain future work.
 They matter, but they should not distort the core runtime contract before the local base is stable.
 
+Forensic watermarking for **audio/video** is a dedicated track: rasterizable types already ship a
+two-layer (visible + invisible) per-buyer mark, but AV is key-protected, not yet fingerprinted. The
+plan — A/B forensic variant watermarking (video) and spread-spectrum/echo-hiding (audio), produced
+once at mint and selected per buyer from their signed grant at serve time, keeping the CEK boundary
+and one canonical path intact — is designed in [docs/AV_WATERMARKING.md](docs/AV_WATERMARKING.md).
+The heavy lift is a mint-time transcode pipeline, so it is a roadmap item, not a patch.
+
 ### AI and operator surfaces
 
 Agent and AI provider surfaces should keep moving toward one stable runtime contract with explicit policy, identity, and budget boundaries instead of ad hoc special cases.

capsules/act-emitter/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "act-emitter"
+version = "0.1.0"
+edition = "2021"
+description = "ElastOS spend/audit verification fixture: emits exactly N metered carrier_invoke acts"
+license = "MIT"
+
+[[bin]]
+name = "act-emitter"
+path = "src/main.rs"
+
+[dependencies]
+elastos-guest = { path = "../../elastos/crates/elastos-guest" }
+serde_json = "1.0"
+base64 = "0.22"
+
+[profile.release]
+opt-level = "s"
+lto = true
+
+[workspace]

capsules/act-emitter/README.md

@@ -0,0 +1,65 @@
+# act-emitter — spend/audit VERIFICATION FIXTURE (not a shipped product capsule)
+
+This capsule exists **only** to verify the microVM spend-meter and durable-audit
+path on real hardware. It is intentionally tiny, non-interactive, and
+deterministic. Do **not** ship it, list it in a product catalog, or treat it as
+an example app — it is a test instrument.
+
+## What it does
+
+On boot it reads `count` from the launch config (`elastos.command` →
+`ELASTOS_COMMAND_B64`, default `7`), acquires a write capability, then performs
+**exactly `count`** `carrier_invoke` storage writes via the *shipped* guest
+carrier client (`elastos_guest::runtime::RuntimeClient` — the same
+`carrier_invoke` path `capsules/chat/src/carrier.rs` uses). It prints a
+machine-greppable trace to the guest console:
+
+```
+ACT_EMITTER_START count=<N>
+ACT_EMITTER_CAP ok | ERR <msg>
+ACT <i> ok | ACT <i> REFUSED budget_exhausted | ACT <i> ERR <msg>
+ACT_EMITTER_DONE ok=<n> exhausted=<n> other_err=<n>
+```
+
+So with `ELASTOS_DEFAULT_SPEND_BUDGET=N` and `count=N+1`, the run yields exactly
+`N` successful debits (`spent=N`, `remaining=0`) and a `budget_exhausted`
+refusal on the `N+1`-th act — counted, reproducible evidence.
+
+## Storage root: `localhost://Public/ActEmitter/*` (deliberate)
+
+The fixture targets the `Public/` root, **not** `Users/self`. `Public` is a
+plaintext, file-backed root that the bridge's `scope_current_user_alias` passes
+through without a principal — so the fixture exercises the metered carrier path
+under the plain `elastos capsule` CLI, which cannot inject a signed Home
+launch-grant (that is the production identity flow).
+
+The spend meter / carrier / audit code is **byte-identical regardless of storage
+root** (the debit is `CARRIER_ACT_COST` per `carrier_invoke`, charged before
+dispatch; the `SpendDebit`/`BudgetExhausted` records are the same), so the
+verification is valid. The one honest residual: `Users/self`-scoped storage
+metering is still unverified on hardware — see `docs/KNOWN_GAPS.md` (G-HWV).
+
+## How to run (real nested-KVM box)
+
+Prereqs: a box prepared per `docs/MICROVM_LOCAL_KVM_PROVISIONING.md` (a kernel
+that actually boots crosvm + the AppArmor sysctl + the offline catalog).
+
+```bash
+# 1. build the rootfs (musl-static binary + busybox + vsock-proxy → ext4)
+bash scripts/build/build-rootfs.sh act-emitter --output <artifacts>
+
+# 2. stage into the data-dir catalog (capsules/act-emitter/ + components.json entry)
+
+# 3. start serve with durable audit + a budget
+ELASTOS_AUDIT_LOG_PATH=<data_dir>/audit/custody.log \
+ELASTOS_DEFAULT_SPEND_BUDGET=5 \
+elastos serve
+
+# 4. launch through the supervisor (the metered path)
+elastos capsule act-emitter --config '{"count":6}'
+# → ACT 1..5 ok ; ACT 6 REFUSED budget_exhausted ; ok=5 exhausted=1
+```
+
+First verified 7/7 on real nested-KVM (`flint @ 5d4f4c7d1`, 2026-06-29). The
+build is self-contained (`[workspace]` in `Cargo.toml`); it is not part of the
+main Rust workspace.

capsules/act-emitter/capsule.json

@@ -0,0 +1,20 @@
+{
+  "schema": "elastos.capsule/v1",
+  "name": "act-emitter",
+  "version": "0.1.0",
+  "description": "Spend/audit verification fixture: performs exactly N metered carrier_invoke storage writes via the shipped guest carrier client, so a budget of N yields spent=N and budget_exhausted at N+1.",
+  "author": "elastos",
+  "role": "app",
+  "type": "microvm",
+  "entrypoint": "rootfs.ext4",
+  "requires": [],
+  "interfaces": [],
+  "resources": {
+    "memory_mb": 256,
+    "gpu": false
+  },
+  "permissions": {
+    "storage": ["localhost://Public/ActEmitter/*"],
+    "messaging": []
+  }
+}

capsules/act-emitter/src/main.rs

@@ -0,0 +1,95 @@
+//! ElastOS spend/audit verification fixture.
+//!
+//! Performs exactly N metered `carrier_invoke` storage writes via the SAME shipped
+//! guest carrier client (`elastos_guest::runtime::RuntimeClient`) that real capsules
+//! (e.g. chat) use. Each successful write debits one unit of the capsule's spend
+//! budget under the canonical `vm-{name}` key, so a serve daemon started with
+//! `ELASTOS_DEFAULT_SPEND_BUDGET=N` yields `spent=N` and `budget_exhausted` on the
+//! (N+1)-th act. Deterministic, counted evidence — not a hand-rolled vsock call.
+//!
+//! Act count is read from the launch config (`ELASTOS_COMMAND`/`ELASTOS_COMMAND_B64`
+//! JSON `{"count": N}`), defaulting to 7.
+
+use elastos_guest::runtime::RuntimeClient;
+use serde_json::json;
+
+const STORAGE_RESOURCE: &str = "localhost://Public/ActEmitter/*";
+const DEFAULT_COUNT: u64 = 7;
+
+fn act_count() -> u64 {
+    let payload = std::env::var("ELASTOS_COMMAND")
+        .ok()
+        .filter(|s| !s.is_empty())
+        .or_else(|| {
+            std::env::var("ELASTOS_COMMAND_B64")
+                .ok()
+                .filter(|s| !s.is_empty())
+                .and_then(|b64| {
+                    use base64::Engine as _;
+                    base64::engine::general_purpose::STANDARD
+                        .decode(b64)
+                        .ok()
+                        .and_then(|bytes| String::from_utf8(bytes).ok())
+                })
+        });
+
+    payload
+        .and_then(|p| serde_json::from_str::<serde_json::Value>(&p).ok())
+        .and_then(|v| v.get("count").and_then(|c| c.as_u64()))
+        .unwrap_or(DEFAULT_COUNT)
+}
+
+fn act_uri(i: u64) -> String {
+    format!("localhost://Public/ActEmitter/act-{i}.txt")
+}
+
+fn main() {
+    let count = act_count();
+    println!("ACT_EMITTER_START count={count}");
+
+    let mut client = RuntimeClient::new();
+
+    let token = match client.request_capability(STORAGE_RESOURCE, "write") {
+        Ok(t) => {
+            println!("ACT_EMITTER_CAP ok");
+            t
+        }
+        Err(e) => {
+            println!("ACT_EMITTER_CAP ERR {e}");
+            println!("ACT_EMITTER_DONE ok=0 exhausted=0 other_err=0");
+            return;
+        }
+    };
+
+    let mut ok = 0u64;
+    let mut exhausted = 0u64;
+    let mut other_err = 0u64;
+
+    for i in 1..=count {
+        let uri = act_uri(i);
+        let body = json!({
+            "path": uri,
+            "token": token,
+            "content": format!("act {i}").into_bytes(),
+            "append": false,
+        });
+        match client.carrier_invoke(&uri, "write", &body, &token) {
+            Ok(_) => {
+                ok += 1;
+                println!("ACT {i} ok");
+            }
+            Err(e) => {
+                let msg = e.to_string();
+                if msg.contains("budget_exhausted") {
+                    exhausted += 1;
+                    println!("ACT {i} REFUSED budget_exhausted");
+                } else {
+                    other_err += 1;
+                    println!("ACT {i} ERR {msg}");
+                }
+            }
+        }
+    }
+
+    println!("ACT_EMITTER_DONE ok={ok} exhausted={exhausted} other_err={other_err}");
+}