eval: guard authenticated live-daemon registry recovery

[schickling-assistant]

Closes #54.

Paired implementation: compoundingtech/pty#128, the selected issue #126 protocol.

Summary

Rewrites the deterministic, model-free pty-live-recovery cell for PTY PR #128’s authenticated snapshot/revision contract. This is a held-out protocol rewrite, not a metadata-only retarget of the incompatible, superseded PR #127 oracle.

The cell uses only eval-owned synthetic PTY roots and providers. It proves:

• the exact PR #128 source and built CLI/server artifacts;
• pty recover <name> --snapshot <metadata.json> as the explicit surface;
• complete private-root capability fields for protocol, secret, process-start token, launch identity, root/recovery-directory identity, and signed metadata revision;
• stable daemon PID, generation, process-start token, launch identity, attached client, and provider across recovery;
• secret and revision rotation after recovery;
• fresh-client attachability and exactly one provider launch plus one session_start;
• replay refusal after rotation;
• stale pre-tag snapshot refusal without metadata rollback;
• secret-tampered snapshot refusal without registry publication;
• fail-closed root and .recovery permission downgrades before request/result, lock, socket, PID, or metadata publication;
• unsupported-daemon refusal while the original daemon stays alive;
• cleanup limited to captured synthetic daemon PIDs and exact eval roots.

Exact dependency

PTY PR #128 head: f70f85baa89145136a63cc9909fc2423bd3d1e7d.

Local exact-source build provenance:

• package lock SHA256 43189b5b5b1d560be4b9102d2ed0793d89b9b01dbb3bbd976948f10c6669118d
• CLI launcher SHA256 60e90a8a0041845c0e382e2cf3873c005bed2a95db8991697e0449c3a71a558d
• compiled CLI SHA256 f0dfc647f0592f9b273559d561ff9111b2af71c48ba569f4105401994808c0a0
• compiled server SHA256 3f6bfd8ab6a1544cd4f2dbd2bd05eb11c3a631e15f1a4e15bddb1124f4277490

This is exact-source draft evidence, not a merged PTY release artifact.

Review-red closure

The predecessor cleanup could ignore a daemon termination timeout and prove only that registry roots were removed. Cleanup now binds every captured PID to its Linux process-start token, sends bounded TERM, uses bounded KILL only while that exact captured identity remains alive, and fails if any tracked identity survives. A TERM-resistant synthetic sentinel forces the KILL path on every green run. The judge requires the receipt’s allTrackedDaemonsDead fact, a positive captured-daemon count, and a positive fallback count in addition to root removal.

Validation

At eval head eed04b13ea26d984e0192c10da0e76b9aba37a03:

• old PR #127 oracle against selected PR #128: expected RED, 0/8
• rewritten pty-live-recovery: 11 PASS / 0 FAIL / 11 gating judges
• cleanup receipt: 5 captured daemons, 6 tracked processes, all tracked identities dead, 1 forced KILL fallback, both exact roots absent
• complete 46-cell model-free corpus preflight: PASS on pinned st2 9887b2842222def0838c2cd82e6c24c218f7efa6, binary SHA256 d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d
• Bash syntax and generated catalog checks: PASS
• zero model/provider calls and no residual eval roots

No production recovery, paid call, provider call, merge, or deployment was performed.