build(cu): pin cua-driver artifact integrity

[hqhq1025]

Upstream stack notice

This is stack PR D. It depends on #893 and must not merge before it.

The Files tab is cumulative until preceding fork branches are rebased after merge.

Review the exact 9-file provenance net diff now in fork-local PR hqhq1025#3.

Current rebase verification: script/provenance/model-metadata tests 11/11; pinned artifact integrity verified.

---

Stack position

PR D, stacked on fork PR #2 (codex/cu-executor-service).

Summary

Pins and verifies the local/pre-package cua-driver artifact without claiming that it is ready for public distribution.

• immutable release URL, archive hash, extracted binary hash, source/license hashes;
• source/upstream commit claims and Cargo.lock hash recorded as unverified claims;
• arm64+x86_64 universal binary and reported version checks;
• code-signature structural verification;
• marker plus authoritative re-hash on every artifact check;
• tar traversal, absolute path, backslash, symlink, and hardlink rejection before extraction;
• tracked top-level license and source metadata;
• generated binary and marker remain ignored;
• explicit distribution blockers for Developer ID, notarization, artifact attestation, reproducible build provenance, and third-party notices/SBOM.

Trust boundary

check:cua-driver-artifact proves byte integrity for a pinned development/pre-package input. It is intentionally not part of check:release and returns releaseSigningReady: false.

The release asset and source commit are currently unsigned/self-published. The manifest therefore records:

• buildProvenance: unverified;
• artifactAttestation: missing;
• thirdPartyNotices: missing;
• notarization: missing;
• distributionReady: false.

A later release-pipeline PR must close those blockers and verify the final nested-signed/notarized Maka.app.

Codex lab alignment

The lab observed a signed bundled source copied to a canonical executable before exact-path service spawn. This PR establishes the immutable artifact input and integrity checks only; canonical refresh, packaged-app signing, and TCC responsibility-chain validation remain later slices.

Verification

• static provenance/script tests: 6/6;
• pinned artifact downloaded successfully;
• archive, binary, license, and source hashes verified;
• cua-driver 0.7.1 version verified;
• arm64+x86_64 architecture verification passed;
• current codesign verification passed;
• full repository build passed;
• full repository typecheck passed;
• git diff --check passed.

[hqhq1025]

@astrohan This Computer Use stack slice is ready for review. Please follow the dependency and merge order stated at the top of the PR; the exact net diff is linked there.

[Astro-Han]

I found no P0 or P1 in the independent #893 to #894 diff. These two P2s should be tracked, but neither blocks this layer.

P2

1. The download is read into one unbounded ArrayBuffer before the checksum is checked (scripts/prepare-cua-driver.mjs:136-146, 243-247). The release is mutable and the manifest does not pin the asset size, so a replaced asset can exhaust memory before the SHA mismatch rejects it. Pin the byte length and stream the download through an incremental hash with a hard limit.
2. prepare executes the downloaded binary with --version before the Mach-O, architecture, and signing checks (scripts/prepare-cua-driver.mjs:173-181, 269-276). The same manifest says the build provenance is unverified and the artifact attestation is missing (apps/desktop/bundled-tools.json:35-36). This command is explicit developer tooling, which keeps it at P2, but it should not execute the file until structural checks pass and provenance is either verified or accepted through an explicit unsafe-development opt-in.

The current CI is green. The provenance tests, real artifact prepare/check, hash, version, dual-architecture, codesign, and git diff --check also passed.

[Astro-Han]

Approved on the current content. There are no P0 or P1 findings. The branch now conflicts with current main after the parent merges, so it needs a restack before squash merge. I am not asking for another fix round for the two non-blocking findings.

P2

1. The download is read into one unbounded ArrayBuffer before the checksum is checked (scripts/prepare-cua-driver.mjs:136-146, 243-247). A replaced release asset can exhaust memory before the SHA mismatch rejects it. Pin the byte length and stream through an incremental hash with a hard limit.
2. prepare executes the downloaded binary with --version before the Mach-O, architecture, and signing checks (scripts/prepare-cua-driver.mjs:173-181, 269-276). The manifest also says provenance is unverified and attestation is missing. Since this is an explicit developer command, this remains P2. Structural checks should run before execution, with an explicit unsafe-development opt-in if unverified artifacts must be run.

CI and the focused provenance checks passed on this head. Please restack only; these P2s do not block merge.

[Astro-Han]

#893 is merged. #894 is approved with only two non-blocking P2 findings, but GitHub still reports a conflict with current main. Please restack #894 only; no P2 fix is requested. I will squash-merge it as soon as the new head is green and mergeable, then continue down the stack.

[Astro-Han]

Restack-only rereview on aff1c440. Its patch-id exactly matches the reviewed provenance commit, and typecheck, test, and e2e are green. No P0 or P1.

The two existing P2 findings remain non-blocking:

1. The release download is buffered without a size limit before its checksum is checked.
2. The preparation script executes the downloaded binary with --version before the Mach-O, architecture, signing, and provenance gates.

Approved for squash merge. No additional fix round is requested.