T100, 16.3a: a served repository's bindings are trusted per machine (plan 034)

.github/workflows/validate.yml

@@ -279,6 +279,30 @@ jobs:
           # xfail as a skip. T084 landed (openDox-code#77, `e49b17c3`), T082
           # merged `main` and removed the five markers in that merge, and the
           # five now pass. So T082 adds no skip.
+          #
+          # MOVED FROM 11 TO 14 BY plan 034 T100 (#1144 16.3a), for its three
+          # strict-xfail cases in `tests/test_model_binding_trust.py`, each of
+          # which waits on another draft and names it: the trust store's
+          # default location (openDox-code#69's `config.state_dir`), the chat
+          # rail's trust remedy (openDox-code#74's visible no-model line), and
+          # a served turn that reaches its model step standalone
+          # (openDox-code#77's scope seam). JUnit reports an xfail as a skip.
+          # Each turns into a pass when T100 merges `main` after that draft has
+          # landed, so this moves back by one with each, WITH the reason, and
+          # is 11 again once all three are in.
+          # BACK FROM 14 TO 13: #74 landed on `main` (`9a490405`) and reached
+          # this branch through #64's merge of `main` `1130e996` (`63e534cb`),
+          # so the rail case runs and passes, with the rail's trust line it
+          # waited on.
+          # BACK FROM 13 TO 12: #69 landed on `main` (`5e7ab003`) and reached
+          # this branch through #64's final head (`04bcb68e`), so the store's
+          # default-home case runs and passes. One remains: #77's.
+          # BACK FROM 12 TO 11: #77 landed on `main` (`e49b17c3`) and this
+          # branch merged it, so the served-turn case runs and passes. All
+          # three are in, and the pin is `main`'s again. T100 moves neither
+          # floor: the floors are T082's re-pin above (3977 / 3966, #76), and
+          # T100 only adds cases, so its selected and passed counts sit above
+          # them.
           EXPECT_SKIPPED: "11"
         run: |
           python3 - <<'PY' > triple.env

src/opendox/doxbench_install.py

@@ -264,20 +264,25 @@ def brokered_catalog(binding) -> ModelCatalog:
     ])
 
 
-def brokered_model_port_factory(binding, *, runner=None, opener=None,
-                                clock=None, notice=None):
+def brokered_model_port_factory(binding, *, trust=None, runner=None,
+                                opener=None, clock=None, notice=None):
     """The ZERO-ARGUMENT factory for a BROKER-BACKED port, memoized per process.
 
     Same shape and same reason as `model_port_factory` above: the accessor is
     called per REQUEST, and a port built per call would mint a fresh token for
     every turn and discard a live one. The seams (`runner`, `opener`, `clock`,
     `notice`) pass through so a test can exercise a turn without a broker and
-    without a provider; production declares none of them."""
+    without a provider; production declares none of them.
+
+    `trust` is the verdict that covers this exact binding (#1144 16.3a;
+    `doxbench_trust`). The port asks it again before every act, so a port
+    built without one spawns, reads and contacts nothing."""
     from opendox import doxbench_provider as provider_mod
 
     seams = {name: value for name, value in (
         ("runner", runner), ("opener", opener), ("clock", clock),
         ("notice", notice)) if value is not None}
+    seams["trust"] = trust
     catalog = brokered_catalog(binding)
     lock = threading.Lock()
     holder: dict[str, object] = {}
@@ -297,6 +302,77 @@ def resolve():
     return resolve
 
 
+def unavailable_catalog(binding) -> ModelCatalog:
+    """The catalog a binding discloses when it may not be used: its one entry,
+    exactly as `brokered_catalog` declares it, with `available: false`. The
+    catalog's wire shape is closed, so no reason rides it (#1144 16.3a)."""
+    import dataclasses
+
+    return ModelCatalog.from_entries([
+        dataclasses.replace(entry, available=False)
+        for entry in brokered_catalog(binding).entries])
+
+
+def trust_gated_model_port_factory(binding, *, checkout_root: Path | str,
+                                   bindings_path: Path | str | None = None):
+    """The factory for the first approved binding, ONCE THE TRUST POLICY HAS
+    JUDGED IT (#1144 16.3a; plan 034 T100; RULED openxFactory#656 comment
+    5962785556, item 2).
+
+    THE ONE PLACE A BINDING BECOMES USABLE. The binding was read from the
+    served repository, so it is used only if the registered trust policy
+    (`doxbench_trust.policy()`: a host's, or openDox's strict per-machine
+    store where no host registered one) trusts that exact binding at
+    `checkout_root`. Trusted, it resolves the brokered port, handed the
+    verdict. Untrusted, it resolves `doxbench_trust.UntrustedBindingPort`:
+    the catalog lists the binding `available: false`, a turn is refused by
+    name, and nothing is spawned, read or contacted. The refusal is said on
+    stderr, naming the binding and the command that trusts it.
+
+    The verdict is HELD TO THIS BINDING (`doxbench_trust.verdict_for`): a
+    policy that raises trusts nothing, and its words are not repeated; one
+    that answers for another binding, trusted or not, covers nothing, and the
+    refusal names THIS binding and its command.
+
+    A BINDING THE CATALOG REFUSES IS NEVER TRUSTED, whatever the policy or
+    the store says (Copilot at openDox-code#82, r4174783280): its id or its
+    label is not one `brokered_catalog` can list, so the verdict refuses it
+    before any policy is asked (`doxbench_trust.unservable_because`), and
+    the start declares the refusing port over an empty catalog rather than
+    fail on what a repository wrote. So `brokered_catalog` below is only
+    ever built for a binding it accepts.
+
+    `bindings_path` is the document the binding was read from, where a
+    caller named one, so the command the refusal prints reads that document
+    too."""
+    from opendox import doxbench_trust as trust_mod
+    from opendox.doxbench_model import EMPTY_CATALOG, ModelCatalogError
+
+    verdict = trust_mod.verdict_for(binding, root=checkout_root)
+    if verdict.admits(binding):
+        return brokered_model_port_factory(binding, trust=verdict)
+    bindings = (None if bindings_path is None
+                else str(Path(bindings_path).resolve()))
+    sys.stderr.write("[model-provider] " + trust_mod.refusal_message(
+        verdict.binding_id, verdict.root,
+        verdict.reason or trust_mod.REASON_NEVER_TRUSTED,
+        bindings=bindings) + "\n")
+    try:
+        catalog = unavailable_catalog(binding)
+    except ModelCatalogError:
+        # An id or a label the catalog's schema refuses (a newline, a
+        # terminal escape, an id past its bound) is a binding no turn could
+        # name. It is refused by name above, and the catalog lists nothing
+        # rather than the start failing on what a repository wrote.
+        catalog = EMPTY_CATALOG
+    port = trust_mod.UntrustedBindingPort(catalog, verdict, bindings=bindings)
+
+    def resolve():
+        return port
+
+    return resolve
+
+
 def declared_model_port_factory(session_root: Path | str, *,
                                 checkout_root: Path | str,
                                 bindings_path: Path | str | None = None,
@@ -337,7 +413,14 @@ def declared_model_port_factory(session_root: Path | str, *,
     not declared. A binding the DECLARATIONS DOCUMENT SAYS NOTHING ABOUT is
     unaffected, byte for byte — it was declared by hand in the settings file by
     the operator, and the operator is who approval is a record of (see
-    `doxbench_intake`'s module docstring for why the rule is not inverted)."""
+    `doxbench_intake`'s module docstring for why the rule is not inverted).
+
+    A DECLARED BINDING IS USED ONLY ONCE IT IS TRUSTED (#1144 16.3a; plan 034
+    T100; RULED openxFactory#656 comment 5962785556, item 2). The binding was
+    read from the repository this install serves, so the registered trust
+    policy judges the first approved one (`trust_gated_model_port_factory`).
+    A checkout declaring none never asks the policy, so it never touches
+    openDox's state directory."""
     from opendox import doxbench_binding as binding_mod
     from opendox import doxbench_intake as intake_mod
 
@@ -368,4 +451,6 @@ def declared_model_port_factory(session_root: Path | str, *,
         if (harness_present or harness_installed)():
             return model_port_factory(Path(session_root), spawn=spawn)
         return no_model_port_factory
-    return brokered_model_port_factory(approved[0])
+    return trust_gated_model_port_factory(approved[0],
+                                          checkout_root=checkout_root,
+                                          bindings_path=bindings_path)

src/opendox/doxbench_provider.py

@@ -121,6 +121,7 @@
 from opendox import doxbench_binding as binding_mod
 from opendox import doxbench_bridge as bridge_mod
 from opendox import doxbench_model as model_mod
+from opendox import doxbench_trust as trust_mod
 
 #: THIS MODULE'S OWN NAME, declared so the structural boundary test and the
 #: module cannot drift into naming two different files. The test asserts the
@@ -864,7 +865,7 @@ def _declared_string(document: Mapping, field: str) -> str:
     return value
 
 
-def _broker_operation(binding, operation: str, read, *, runner,
+def _broker_operation(binding, operation: str, read, *, runner, trust,
                       source=None, retry_of: str | None = None):
     """Run one declared `operation` through `runner`, and return what `read`
     makes of its answer. It is the one way each of the four operations asks
@@ -886,7 +887,17 @@ def _broker_operation(binding, operation: str, read, *, runner,
     holder's answer on openDox-code#64, 2026-10-02), so a refusal of the
     answer kills what is left of the broker's group too (`_settled`). A
     runner injected in its place, such as a test's, is given the argv alone
-    and its answer is read here, as before."""
+    and its answer is read here, as before.
+
+    NO BROKER RUNS FOR A BINDING THE TRUST VERDICT DOES NOT COVER (#1144
+    16.3a; plan 034 T100; RULED openxFactory#656 comment 5962785556, item
+    2). All four operations come through here, whichever runner was
+    injected, so this is where every broker spawn asks: `trust` must be a
+    `doxbench_trust.TrustVerdict` trusting exactly this binding, or the
+    binding is refused by name before its invocation is even assembled,
+    and before either runner's branch below. `doxbench_install` asks the
+    policy first. This is the defence beneath it."""
+    trust_mod.require_admitted(binding, trust)
     argv = broker_operation_argv(binding, operation, retry_of=retry_of)
     if runner is subprocess_broker_runner:
         result, failure = _run_broker(argv, source=source,
@@ -913,7 +924,7 @@ def _broker_operation(binding, operation: str, read, *, runner,
 # ---------------------------------------------------------------------------
 
 
-def hand_off_credential(binding, source, *,
+def hand_off_credential(binding, source, *, trust=None,
                         runner=subprocess_broker_runner) -> str:
     """Hand a human's credential to the broker's `intake` and keep only the
     reference.
@@ -943,9 +954,12 @@ def hand_off_credential(binding, source, *,
     here, where both entry points already catch a broker's refusal.
 
     A refusal names `intake` and keeps nothing the broker wrote
-    (`_broker_operation`)."""
+    (`_broker_operation`).
+
+    `trust` is the verdict covering this exact binding (#1144 16.3a). Without
+    one the binding is refused by name and `source` is never read."""
     return _broker_operation(binding, OPERATION_INTAKE, _intake_reference,
-                             runner=runner, source=source)
+                             runner=runner, source=source, trust=trust)
 
 
 def _intake_reference(answer: object) -> str:
@@ -966,7 +980,7 @@ def _intake_reference(answer: object) -> str:
 # ---------------------------------------------------------------------------
 
 
-def mint(binding, *, retry_of: str | None = None,
+def mint(binding, *, trust=None, retry_of: str | None = None,
          runner=subprocess_broker_runner) -> MintedToken:
     """Ask the broker for a short-lived token.
 
@@ -1013,7 +1027,7 @@ def mint(binding, *, retry_of: str | None = None,
     return _broker_operation(
         binding, OPERATION_MINT,
         lambda answer: _minted_token(answer, binding),
-        runner=runner, retry_of=retry_of)
+        runner=runner, retry_of=retry_of, trust=trust)
 
 
 def _minted_token(answer: object, binding) -> MintedToken:
@@ -1036,7 +1050,7 @@ def _minted_token(answer: object, binding) -> MintedToken:
         audit_ref=_declared_string(document, "audit_ref"))
 
 
-def revoke(binding, *, runner=subprocess_broker_runner) -> str:
+def revoke(binding, *, trust=None, runner=subprocess_broker_runner) -> str:
     """Destroy the broker's custody of this binding's credential.
 
     Returns the revocation's own `audit_ref`. The declaration keeps the audit
@@ -1046,7 +1060,7 @@ def revoke(binding, *, runner=subprocess_broker_runner) -> str:
     or the same returned reference, never as the broker's own words. A
     refusal names `revoke` (`_broker_operation`)."""
     return _broker_operation(binding, OPERATION_REVOKE, _revocation_audit_ref,
-                             runner=runner)
+                             runner=runner, trust=trust)
 
 
 def _revocation_audit_ref(answer: object) -> str:
@@ -1058,7 +1072,8 @@ def _revocation_audit_ref(answer: object) -> str:
     return _declared_string(document, "audit_ref")
 
 
-def list_references(binding, *, runner=subprocess_broker_runner) -> list:
+def list_references(binding, *, trust=None,
+                    runner=subprocess_broker_runner) -> list:
     """The broker's NON-SECRET reference index, as the declaration returns it.
 
     Safe to read and safe to print: `list` never opens a custody file, and the
@@ -1067,7 +1082,7 @@ def list_references(binding, *, runner=subprocess_broker_runner) -> list:
     an index it does not own invents a second contract for it. A refusal
     names `list` (`_broker_operation`)."""
     return _broker_operation(binding, OPERATION_LIST, _reference_index,
-                             runner=runner)
+                             runner=runner, trust=trust)
 
 
 def _reference_index(answer: object) -> list:
@@ -1137,7 +1152,7 @@ def _os_keyring():
     return keyring
 
 
-def resolve_credential_reference(binding, *, environ=None,
+def resolve_credential_reference(binding, *, trust=None, environ=None,
                                  keyring_backend=None) -> str:
     """THE BUILT-IN RESOLVER: the credential an `env:NAME` or
     `keyring:SERVICE/USERNAME` reference names, read NOW.
@@ -1167,7 +1182,15 @@ def resolve_credential_reference(binding, *, environ=None,
     that check here. The check is repeated before the first read all the
     same, because this is the function that holds the key. What reaches it
     is a programming error, like a broker's reference, and nothing has been
-    read when it is raised."""
+    read when it is raised.
+
+    NOTHING IS READ FOR A BINDING THE TRUST VERDICT DOES NOT COVER (#1144
+    16.3a; plan 034 T100; RULED openxFactory#656 comment 5962785556, item 2).
+    `trust` must be a `doxbench_trust.TrustVerdict` trusting exactly this
+    binding. It is asked after the two programming-error checks above and
+    BEFORE THE FIRST READ, so a binding a repository declared and nobody
+    trusted reads no variable and no keyring entry. `doxbench_install` asks
+    the policy before any port is built. This is the defence beneath it."""
     reference = binding_mod.built_in_reference_parts(binding.credential_ref)
     if reference is None:
         raise AssertionError(
@@ -1179,6 +1202,7 @@ def resolve_credential_reference(binding, *, environ=None,
             f"binding {binding.id!r} routes a credential the built-in "
             "resolver reads over a route that is not private, which the "
             "record refuses when it is declared; nothing was read")
+    trust_mod.require_admitted(binding, trust)
     if reference.form == binding_mod.CREDENTIAL_REF_ENV:
         value = (os.environ if environ is None else environ).get(
             reference.name)
@@ -1539,6 +1563,7 @@ class BrokeredProviderPort:
     every capabilities probe."""
 
     def __init__(self, binding, catalog, *,
+                 trust=None,
                  timeout_seconds: float = 60.0,
                  runner=subprocess_broker_runner,
                  opener=urllib.request.urlopen,
@@ -1555,6 +1580,10 @@ def __init__(self, binding, catalog, *,
                 f"catalog must be a ModelCatalog, got {type(catalog).__name__}")
         self._binding = binding
         self._declared_catalog = catalog
+        # THE TRUST VERDICT (#1144 16.3a). Held, and asked again by every act
+        # below, so a port built around a binding nobody trusted spawns,
+        # reads and contacts nothing (`dispatch`).
+        self._trust = trust
         self._timeout_seconds = model_mod.validated_timeout_seconds(
             timeout_seconds)
         self._runner = runner
@@ -1584,8 +1613,12 @@ def catalog(self) -> model_mod.ModelCatalog:
         The same honesty the harness bridge keeps: a declaration is available
         until something is measured, and a broker that has refused is measured.
         Nothing here contacts the broker, or reads a reference, to find out.
-        A later turn that succeeds makes the entry available again."""
-        if self._available:
+        A later turn that succeeds makes the entry available again.
+
+        A BINDING THE TRUST VERDICT DOES NOT COVER IS NEVER AVAILABLE (#1144
+        16.3a), so no turn can select it."""
+        if self._available and isinstance(self._trust, trust_mod.TrustVerdict) \
+                and self._trust.admits(self._binding):
             return self._declared_catalog
         return model_mod.ModelCatalog.from_entries([
             dataclasses.replace(entry, available=False)
@@ -1624,12 +1657,20 @@ def dispatch(self, prompt_envelope: object) -> object:
         A RECORD NO BROKER ANSWERS takes `_dispatch_without_a_broker` instead
         (#1144 box 16.3): no mint, no ledger event, and no retry.
 
+        A BINDING THE TRUST VERDICT DOES NOT COVER IS REFUSED FIRST, by name,
+        before the prompt is rendered, a broker is spawned, a reference is
+        read or the endpoint is contacted (#1144 16.3a; RULED openxFactory#656
+        comment 5962785556, item 2). That holds for the auth kind `none` too:
+        it presents no credential, but it would still send the turn to an
+        endpoint the binding chose.
+
         EITHER WAY, THE PROVIDER IS CALLED THROUGH `_call_provider`, so a
         broker's minted token keeps every rule a built-in credential keeps: no
         redirect, no proxy over plain `http://`, and a refusal that chains
         nothing (Brett Heap's word of 2026-09-29). The re-mint and the retry
         above therefore happen outside every handler, so a refusal raised by
         either keeps no context either."""
+        trust_mod.require_admitted(self._binding, self._trust)
         handle = getattr(prompt_envelope, "model_id", None)
         if not isinstance(handle, str) or not handle:
             entries = self._declared_catalog.entries
@@ -1687,7 +1728,7 @@ def _dispatch_without_a_broker(self, *, model: str, prompt: str) -> str:
                 == binding_mod.CREDENTIAL_FROM_BUILT_IN_RESOLVER):
             try:
                 credential = _PresentedCredential(resolve_credential_reference(
-                    self._binding, environ=self._environ,
+                    self._binding, trust=self._trust, environ=self._environ,
                     keyring_backend=self._keyring_backend))
             except BrokerRefused:
                 with self._lock:
@@ -1768,8 +1809,8 @@ def _current_token(self, reason: str, *,
                 return held
             self._token = None
             try:
-                minted = mint(self._binding, retry_of=retry_of,
-                              runner=self._runner)
+                minted = mint(self._binding, trust=self._trust,
+                              retry_of=retry_of, runner=self._runner)
             except BrokerRefused:
                 self._available = False
                 raise