fix(runtime): fix identity derivation disarming in canonical root guard (Closes #973)

canonical_repository_root.py

@@ -132,6 +132,7 @@ def assess_canonical_repository_root(
     process_project_root: str,
     remote: str | None = None,
     require_binding: bool = False,
+    mode: str = "validation",
 ) -> dict:
     """Validate the canonical repository root binding, failing closed on forgery.
 
@@ -140,14 +141,13 @@ def assess_canonical_repository_root(
     ``configured`` (whether a cross-repo binding was declared),
     ``resolved_slug`` and ``source``.
 
-    Without a configured binding the single-repo default is preserved: the
-    canonical root is derived from *process_project_root* and never blocks
-    (unless *require_binding* explicitly demands one).
-
-    With a configured binding the path must exist, be a git repository, and —
-    when *expected_slug* is known — carry a matching repository identity. A
-    mismatched or (when *require_binding*) unprovable identity is a forged or
-    conflicting binding and fails closed.
+    *mode*:
+    - ``"validation"`` (default): an independently trusted expected repository
+      slug is known (or required). Candidate root's observed identity must match.
+      Unprovable or missing expected identity fails closed when *require_binding* is True.
+    - ``"derivation"``: caller is deriving the canonical repository identity.
+      No expected slug exists yet by design. Derivation succeeds if the configured
+      root exists, is a git repository, and carries a resolvable git remote identity.
     """
     process_root = os.path.realpath(process_project_root)
     declared = (configured_value or "").strip()
@@ -168,12 +168,28 @@ def assess_canonical_repository_root(
             )
         # Single-repo default: canonical root follows the install checkout.
         derived = resolve_repo_toplevel(process_root) or process_root
+        resolved_slug = repository_identity_slug(derived, remote=remote)
+        reasons: list[str] = []
+        if mode == "validation" and expected_slug:
+            expected = expected_slug.strip()
+            if resolved_slug and resolved_slug.lower() != expected.lower():
+                reasons.append(
+                    f"canonical repository root identity mismatch: '{derived}' resolves "
+                    f"to repository '{resolved_slug}' but expected repository identity "
+                    f"is '{expected}' (forged or conflicting binding, fail closed)"
+                )
+            elif not resolved_slug and require_binding:
+                reasons.append(
+                    f"canonical repository root '{derived}' has no resolvable git "
+                    f"remote identity to confirm authorization for '{expected}' "
+                    "(fail closed)"
+                )
         return _assessment(
-            proven=True,
-            reasons=[],
+            proven=not reasons,
+            reasons=reasons,
             configured=False,
             canonical_repo_root=derived,
-            resolved_slug=None,
+            resolved_slug=resolved_slug,
             source=None,
         )
 
@@ -207,26 +223,34 @@ def assess_canonical_repository_root(
 
     resolved_slug = repository_identity_slug(toplevel, remote=remote)
     reasons: list[str] = []
-    expected = (expected_slug or "").strip() or None
-    if expected:
-        if resolved_slug and resolved_slug.lower() != expected.lower():
+
+    if mode == "derivation":
+        if not resolved_slug:
             reasons.append(
-                f"canonical repository root identity mismatch: '{toplevel}' resolves "
-                f"to repository '{resolved_slug}' but the session is authorized for "
-                f"'{expected}' (forged or conflicting binding, fail closed)"
+                f"configured canonical repository root '{toplevel}' has no resolvable "
+                "git remote identity (fail closed)"
             )
-        elif not resolved_slug and require_binding:
+    else:
+        expected = (expected_slug or "").strip() or None
+        if expected:
+            if resolved_slug and resolved_slug.lower() != expected.lower():
+                reasons.append(
+                    f"canonical repository root identity mismatch: '{toplevel}' resolves "
+                    f"to repository '{resolved_slug}' but the session is authorized for "
+                    f"'{expected}' (forged or conflicting binding, fail closed)"
+                )
+            elif not resolved_slug and require_binding:
+                reasons.append(
+                    f"canonical repository root '{toplevel}' has no resolvable git "
+                    f"remote identity to confirm authorization for '{expected}' "
+                    "(fail closed)"
+                )
+        elif require_binding:
             reasons.append(
-                f"canonical repository root '{toplevel}' has no resolvable git "
-                f"remote identity to confirm authorization for '{expected}' "
-                "(fail closed)"
+                f"canonical repository root '{toplevel}' has configured value "
+                f"'{configured_value}' but authoritative expected repository identity "
+                "is unprovable or missing (fail closed)"
             )
-    elif require_binding:
-        reasons.append(
-            f"canonical repository root '{toplevel}' has configured value "
-            f"'{configured_value}' but authoritative expected repository identity "
-            "is unprovable or missing (fail closed)"
-        )
 
     return _assessment(
         proven=not reasons,