Confine publish archive reads

docs/internal/stage-publish.md

@@ -26,10 +26,14 @@ Exact remote placement and the operator workflow belong in
 
 - stage can self-skip when publish disabled or run upload disabled.
 - validates prerequisite stage success and object-store availability.
-- collects a deterministic run file list plus run `manifest.json`, excluding
-  `audio/**` and the run-local `extract/notarius-output/**` staging bundle.
-- keeps run-local Notarius receipt and stderr diagnostics eligible for the run
-  archive.
+- derives a deterministic run-archive allowlist from the validated run
+  `manifest.json`: declared run-local outputs, logs, generated configs, and the
+  manifest itself. Unlisted workspace files are not archive candidates.
+- opens each archive candidate beneath its archive root without following
+  symlinked ancestors or leaf entries, verifies that it is a regular file and
+  checks a declared checksum when present, then streams the opened descriptor.
+- derives the durable previous-cache archive from its validated manifest using
+  the same confinement and regular-file checks.
 - resolves publish output sources through runtime artifact catalog and manifest-aware resolution.
 - publishes extraction lanes only through explicit configured output rules;
   neither run-local nor durable Notarius bundles are scanned or uploaded wholesale.
@@ -53,9 +57,11 @@ Includes counts/lists for:
 ## Invariants
 
 - `current/run_id.txt` is the remote commit marker and is written last.
-- run upload excludes `audio/**` and `extract/notarius-output/**`.
-- `extract/notarius.receipt.json` and `extract/notarius.stderr.log` remain
-  eligible run-record diagnostics.
+- run and previous uploads contain only manifest-declared regular files opened
+  from verified descriptors; symlinks, special files, replacement races, and
+  undeclared entries are rejected or ignored before uploads begin.
+- run-local diagnostics, including Notarius receipt and stderr files, are
+  archived only when recorded by the run manifest.
 - publish locks are not overridden by `--force`.
 
 The commit boundary and cleanup gate are normative architecture invariants; see

docs/operations.md

@@ -160,11 +160,12 @@ Run-local diagnostics are:
 - `runs/{run_id}/extract/notarius.stderr.log`
 - `runs/{run_id}/extract/notarius-output/` before durable promotion
 
-The run-record upload excludes the complete
-`extract/notarius-output/**` subtree. The receipt and stderr files remain
-eligible run-record diagnostics. The durable bundle is never scanned for
-implicit publication; only lanes named by explicit `pipeline.publish.outputs`
-rules are uploaded.
+The run-record upload is an allowlist derived from the validated run manifest,
+not a workspace scan. Each declared source is opened without following
+symlinked ancestors or the leaf, verified as a regular file, and streamed from
+that verified descriptor. Unlisted files and unsafe entries are never uploaded.
+The durable bundle is never scanned for implicit publication; only lanes named
+by explicit `pipeline.publish.outputs` rules are uploaded.
 
 To intentionally replace the current extraction result, run:
 

docs/roadmap/implementation.md

@@ -25,7 +25,7 @@ All stages are pending when this plan is created.
 | 7 | Bound and verify external result acquisition | RSK-013, TST-007 | Completed |
 | 8 | Terminate owned subprocess trees | RSK-011 | Completed |
 | 9 | Redact and cap subprocess diagnostics | RSK-012 | Completed |
-| 10 | Confine publish archive reads | COR-005 | Pending |
+| 10 | Confine publish archive reads | COR-005 | Completed |
 | 11 | Make manifest and run identity singular | COR-001, TST-006 | Pending |
 | 12 | Centralize handled terminal-failure persistence | RSK-001, TST-002, SIM-001, COM-001 | Pending |
 | 13 | Introduce the immutable remote-commit model and legacy boundary | ARC-003 | Pending |