pgw#1008: the arm gate compares WHO THE CELL WAS FOR, not just who signed it

[PaulFidika]

Worker half of the cell trust boundary. Hub half is th#1657, merged: tensorhub c2175b44 (schema + signed tier + listing visibility) and fb23fa33 (the push-path fallback deleted).

Makes this repo's own §6.14 note actionable — "adoption authority must be tied to the producing identity, not merely to a matching key".

The defect, in this repo's own code

owning_endpoint_id has ridden the hub-signed receipt since pgw#709. It is decoded straight into Receipt (receipts.py:93, populated :248) — and compared against nothing.

verify_delivered_artifact checked signature → digest → integral size → embedded metadata → packed cell key, and armed. A valid signature was read as "this cell is genuine" instead of "the hub signed this cell for this pod". So endpoint A's cell dlopened on endpoint B's pods, in another org. We were already paying for the attestation and throwing away the one field that made it a trust decision.

Discovery did not save us either: aot_cells._discover_inner lists the shared platform repo root/family-<f> and filters on the DECLARE contract — not on endpoint, not on org, not even on equality with this pod's own computed key. The only producer property any layer checked was th#1643's cloud tier, which is a statement about the hardware, not about whose code ran on it.

The rule — Paul's ruling verbatim

A cell must have come from this endpoint, or from a publisher the platform vouches for.

• Receipt gains the th#1657 v2 claims publisher_tier + publisher_org_id.
• refuse_untrusted_publisher runs last in verify_delivered_artifact: after the signature (a tier means nothing until the claims are proven) and before the return (the caller's next act is to arm and load native code). Typed class publisher_untrusted on the existing cell_receipt_refused event, so it is countable beside every other reject class (pgw#824).
• This pod's identity comes from the credential the hub issued it — cell_read_endpoint_id, stamped on the th#1335 cell-read grant by th#1657. Not config, not an env var. The JWT payload is decoded without verifying its signature, deliberately: it is our own bearer token, not an input, and the hub verifies it on every call. The receipt is the untrusted thing, and it is signature-verified before it reaches the comparison.

Every route to "wider" is closed

shape	result
publisher_tier exactly platform	adopt (fleet-wide within family)
org, "", None, PLATFORM, platform-ish	narrower rule — same-endpoint only
org-tier receipt naming no endpoint	adoptable by nobody
pod that cannot name its own endpoint	narrowed to platform-tier only, never widened
cell-receipt-v1	refused by version, not read as v2 with the trust fields missing

That last row is §4.24 point 4: the omitempty collapse is how a limit silently stops existing, and here it would silently delete the boundary.

RED verification

With the single refuse_untrusted_publisher(...) call stubbed out, 9 of the 12 new tests fail — including:

test_another_endpoints_org_cell_is_refused
    assert receipts.gate_delivered_artifact(artifact, FAMILY) is False
E   AssertionError: assert True is False

That case is a genuine, correctly-signed, un-revoked receipt — signature verifies, digest matches, size matches, packed key matches, family matches, pair not revoked. It is simply not ours, and before this PR that made no difference at all.

The 3 that still pass under the stub are exactly the controls — our own cell arms, platform tier arms, a v1 receipt is refused by version — which is what proves the suite isn't passing by refusing everything.

The 25 pre-existing receipt tests were updated to mint v2 fixtures with a matching org-tier publisher, so the new gate is live in every one of them rather than only in the cases that name it.

Gates

mypy (235 files, clean) · ruff · http-timeout guard · unreached-surface guard · config-read guard (74 pairs, no new env conditional) · full suite 3448 passed, 37 skipped, 1 xfailed.

Blast radius today: none

Every endpoint is currently platform-authored, so every cell publishes at platform tier and arms exactly as before. That is precisely why it is cheap now — the boundary has to exist before third-party endpoint authoring goes live, not after.

Follow-on (not this PR)

• Org-level widening. This implements Paul's rule literally: same endpoint, or platform. The hub's D4 rule is org-scoped, so an org reusing one cell across two of its own endpoints would be shown it by the listing and refused here. Strictly safe (the worker is stricter), but the two layers should agree — that needs cell_read_org_id on the grant. Named in the tracker.
• Promotion metadata. th#1657 D5's seeded re-mint needs the cell to carry its autotune choices (bounded, structured ints from inductor's own tuning space). Flagged in pgw#1008's tracker entry so this lane does not shape that metadata in a way that has to be re-cut.

🤖 Generated with Claude Code