merge: join pacman custody to Desktop

The helper now accepts verified pacman envelopes on the same line as the native console. This preserves the three reviewed custody fixes; it does not yet teach the Agent to resolve and mint pacman closures.

agent/internal/capability/mutation_manifest.go

@@ -13,8 +13,8 @@ import (
 
 const (
 	// MutationProtocolVersion belongs to the manifest namespace, independently
-	// of the current closure-based Token format. The manifest path is dormant
-	// until a backend explicitly opts into it.
+	// of the current closure-based Token format. Backends opt into the envelope
+	// path explicitly; pacman begins at the helper boundary.
 	MutationProtocolVersion = 1
 
 	// MaxAuthorizationLifetimeSeconds is the ceiling on expires_at - not_before.

helper/Cargo.lock

@@ -213,6 +213,7 @@ version = "0.2.9"
 dependencies = [
  "ed25519-dalek",
  "hex",
+ "libc",
  "serde",
  "serde_json",
  "sha2",

helper/Cargo.toml

@@ -12,6 +12,7 @@ serde_json = "1.0"
 sha2 = "0.10"
 hex = "0.4"
 subtle = "2"
+libc = "0.2"
 
 [[bin]]
 name = "redflag-helper"

helper/src/mutation_protocol.rs

@@ -1,7 +1,8 @@
-//! Dormant mutation manifest and authorization contract.
+//! Mutation manifest and authorization contract.
 //!
-//! Current closure-token execution remains unchanged. This module pins the
-//! backend-neutral bytes that Server, Agent, and helper will adopt together.
+//! Current closure-token execution remains unchanged. Pacman is the first
+//! envelope executor; the bytes remain backend-neutral across Server, Agent,
+//! and helper.
 
 use ed25519_dalek::{Signature, Verifier, VerifyingKey};
 use serde::{Deserialize, Serialize};

protocol/README.md

@@ -217,12 +217,21 @@ Go tests live in both capability packages. Rust tests live in
 `redflag-helper verify-envelope --envelope-file <path> [--receipt-file <path>]` verifies an
 envelope through the helper's real pipeline — parse, host binding, trusted keyring,
 signature, time, lifetime ceiling, backend payload shape — and then refuses with
-`backend_not_migrated`, because no backend executes through this path yet.
+`backend_not_migrated`. This remains the inspection-only compatibility path and consumes no
+replay state.
 
-It records **no replay state**. Execute mode records a token only after a plan is built, so
-an operation that cannot run never burns its slot; nothing here can run, so nothing here
-records. Replay identity stays unproven until the first backend migrates.
+`redflag-helper execute-envelope --envelope-file <path> [--receipt-file <path>]` admits the
+first migrated backend: pacman `install` and `upgrade` over exact cached package archives.
+The helper opens every signed cache path without following a final symlink, copies it into
+a root-owned `0700` operation directory, and verifies the signed SHA-256 and archive
+`name@version`. It then queries installed state with a cleared environment and pacman's
+`vercmp`; any resolved action older than its installed version fails closed. Absent and
+equal packages remain valid closure members because format 1 does not distinguish requested
+roots from resolved dependencies. Only then does it atomically consume
+`authorization_id` before one fixed `pacman -U` invocation without `--needed`, so exit zero
+cannot conceal an already-satisfied no-op. A receipt records the joined operation, manifest,
+authorization, verified-action count, and outcome.
 
-It also enforces no artifact custody. When a backend carries a local cached artifact as
-executor input, the helper must rehash it before use. Remote repository execution keeps the
-limits `RAF/security/05-supply-chain-gate.md` already states.
+Every other backend still fails closed with `backend_not_migrated`. The Agent request,
+resolver, authorization mint, and Desktop handoff remain separate cuts; this executor does
+not infer or create any of them.

server/internal/capability/mutation_manifest.go

@@ -13,8 +13,8 @@ import (
 
 const (
 	// MutationProtocolVersion belongs to the manifest namespace, independently
-	// of the current closure-based Token format. The manifest path is dormant
-	// until a backend explicitly opts into it.
+	// of the current closure-based Token format. Backends opt into the envelope
+	// path explicitly; pacman begins at the helper boundary.
 	MutationProtocolVersion = 1
 
 	// MaxAuthorizationLifetimeSeconds is the ceiling on expires_at - not_before.