docs: bind the supply-chain claims to the helper

README.md

@@ -16,7 +16,7 @@
 
 One dashboard for updates across Linux, Windows, and the Docker containers running on those hosts. Agents check in, scan their package managers, and queue what they find. Nothing installs until a human approves it.
 
-What makes RedFlag different: the software that patches your fleet runs as root on every box, which makes it part of your attack surface — XZ Utils came through a build pipeline, SolarWinds came through an update. So every command here is Ed25519-signed, agents reject anything forged or replayed, and approved packages are hash-pinned down to their dependency closure before anything touches a machine. A known vulnerability anywhere in that chain stops the install cold. The full trust model is in [SECURITY.md](SECURITY.md).
+What makes RedFlag different: the software that patches your fleet runs as root on every box, which makes it part of your attack surface — XZ Utils came through a build pipeline, SolarWinds came through an update. So every command here is Ed25519-signed and agents reject anything forged or replayed. On APT and DNF, direct package mutation must cross a privileged Rust helper: a short-lived capability binds the host, operation, and artifact entries whose hashes resolved, and the helper validates that authority before executing a fixed argv plan with a cleared environment. Docker, Winget, and Windows Update still use the default-strict signed-command path. The full trust model is in [SECURITY.md](SECURITY.md).
 
 ConnectWise charges $50/agent/month. RedFlag doesn't.
 
@@ -87,7 +87,9 @@ Agents run at the OS level and query the Docker socket directly — there's no s
 
 ## Security
 
-The update manager *is* attack surface, so it gets treated like one: Ed25519-signed commands with replay protection, hardware-bound agent identity, rotating refresh tokens that burn loudly when stolen, and a supply-chain gate that hash-pins entire dependency closures behind a network-less executor. Signing and hash verification have no skip path — that's doctrine, not a setting.
+The update manager *is* attack surface, so it gets treated like one: Ed25519-signed commands with replay protection, hardware-bound agent identity, rotating refresh tokens that burn loudly when stolen, and a separate privileged executor for APT/DNF mutation. The helper checks token version and time, host binding, signature, and replay state, then executes fixed package-manager argv without a shell or inherited environment.
+
+The APT/DNF dry-run must resolve the top-level artifact hash before a capability can be minted. Successfully resolved dependency hashes are included, but unresolved dependency hashes can currently be omitted. The helper rehashes artifacts supplied by local path and refuses a missing or mismatched mirror artifact; normal registry entries without local paths are not rehashed helper-side. Its current `systemd-run` unit is short-lived but **not network-isolated**. Complete transitive closure pinning, local custody of every byte, and network isolation remain design work rather than implied guarantees.
 
 The full trust model lives in [SECURITY.md](SECURITY.md), including how to report a vulnerability. The architecture and its honest gaps are documented in the RedFlag Architecture Framework (RAF).
 
@@ -138,8 +140,8 @@ The full trust model lives in [SECURITY.md](SECURITY.md), including how to repor
 - Failed state recovery: reopen, resolve, and transition out of failed
 - Lifecycle history with status badges, version transitions, and failure reasons
 - Scan-set closure reconciler (close-by-absence) — fixes out-of-band false positives
-- Dry-run dependency checking with full closure resolution
-- Supply chain gate: OSV batch checks across transitive closures, vuln-is-a-full-stop enforcement, audited override path
+- Dry-run dependency checking with a mandatory top-level hash and best-effort transitive hash resolution
+- Supply chain gate: OSV batch checks across reported resolved entries, vuln-is-a-full-stop enforcement for the checked set, audited override path
 - Version soak-gating and package age gate as configurable policies
 - Capability-token minting for dnf/apt with Ed25519-signed token verification
 - Ed25519 key rotation and replay protection
@@ -159,6 +161,10 @@ The full trust model lives in [SECURITY.md](SECURITY.md), including how to repor
 - macOS agent binaries not signed
 - Mobile dashboard usable, not optimized
 - Cert pinning and enforced TLS verification
+- Complete transitive closure hashing for APT/DNF; unresolved dependency hashes can currently be omitted
+- Helper-side rehashing of normal registry artifacts before mutation
+- Network isolation for the privileged helper invocation
+- Capability-helper execution for Docker, Winget, and Windows Update
 
 ---