scripts, docs: CS-RG qualification harness and protocol (CSRG-U6)

[novelKR]

Step 3 of the CSRG-U6 plan: the qualification harness and its protocol, frozen together before any qualification run. Nothing here runs or claims a qualification.

No pin change. No change to the installed service.

Issue

Scope: CSRG-U6 (parity, fault qualification and completion). Tracked in #76 and novelKR/DevGuard#14. This PR does not close an issue.

Item	Value
Base	main at 7024f74 (#96's merge)
Head	7a0a748
Pins	Codex gitlink 6b9826e3 with the recorded patch (tree 19999371), DevGuard 6e7e065; both unchanged

Summary

Harness. scripts/qualify-devguard.py, with qualify_host.py and qualify_analysis.py. It needs Python 3.9 and no third-party packages, and runs on the qualification Mac in a minimal environment.

• candidate records the exact combination in candidate.json: the commit and its code-tree hash, the DevGuard client pin, the Codex patch check, the binaries, the installed release and whether it matches its manifest, the policy (host.toml hash, doctor, the codespace consumer without its credential digest), the DG-1 qualification record, the toolchain and the host.
• matrix runs the claimed modes against the installed service, in-process and uds, pipe and PTY. It covers registration, exits, I/O, termination, timeout, exec failure, shortage, an unsupported minimum, mixed governed and ungoverned executions, a missing or unusable helper, status mode, an unavailable authority and a runner socket. Each governed launch is checked against DevGuard's journal.
• faults and authority inject failures against DevGuard's fixture authority, never the installed service. The faults are surviving and escaping descendants, a stalled observer, the authority lost, restarted or stalled, a helper ending before READY, refused and missing credentials, a terminate race, shutdown, and a worker killed while preparing. authority measures process control while the authority is paused, stalled, restarted or stopped.
• control measures the control path under DG-1's load: status p99, termination acknowledgement p99 and the scope's actual end, I/O round trips, refusal latency, and the footprint against the reservation. It runs three repetitions per runner mode, each 10 minutes idle and at least 30 minutes of load.
• verify checks a sealed directory's manifest and recomputes every verdict from the raw files.

Protocol. docs/cs-rg-qualification.md, in English and Korean, covers the candidate, the supported-mode claims and every scenario's pass rule. It maps the work order's fault list to the cases and names the known gaps: a replay on the runner wire is not tested, and a journal refusal is not injected. It also gives the control-path targets (DevGuard's SLO protocol, not redefined), the verdict rules, accounting, regressions and evidence. The integration roadmap links it.

Legacy off path (CSRG-C09). The decision record keeps participation off as the compatibility path and default, unchanged. It gives the scope, the reason, what is duplicated, what off does not provide, and when to revisit or remove it. This is the U6 plan's recommendation (its open question 3), so merging this PR records it. Likewise, the control measurement qualifies under the cold load condition; a warm run is an additional condition when it is made (open question 4).

Comment fix. The doc comment on Participation::Required no longer says that CodeSpace cannot launch governed executions.

Found while building. On the qualification host the Codex submodule holds the recorded patch, so a plain git status reports the checkout as dirty. The harness leaves the submodule's files to the Codex check, and a submodule at another commit still counts as a change.

Commits:

• 9571cd1 scripts: CS-RG qualification harness (CSRG-U6)
• ca3670b docs: CS-RG qualification protocol and the legacy off path decision (CSRG-U6)
• 7a0a748 policy: say that required executions are launched through the authority

Contract changes

None. No tool schema, error code, status value or runtime behavior changes. The harness only uses the existing MCP tools.

Tests

scripts/tests/test_qualify_devguard.py has 35 tests, which CI runs in the python stage of the policy scan. They cover:

• the analysis rules: nearest-rank percentiles with missing samples, and the interval, repetition and run verdicts;
• the MCP client against a fake server, the gateway wrapper and the journal reads;
• evidence sealing, and verify, including a falsified run;
• the host.toml parser, which never returns a digest;
• the candidate rules, and the dirty check with a patched submodule.

Verified in the cloud (Linux).

• The 35 tests pass on Python 3.13 and 3.9.
• python3 scripts/validate-upstream.py policy python passed (100 tests).
• scripts/check_docs.py and the docs site's prepare pass, and clippy is clean for codespace-policy.
• A smoke run against a real gateway built with --features devguard, in-process and uds: the client and wrapper parse every payload the suites read. That covers exec, status, read, write, resize, terminate, refusals with their attempt IDs, and the gateway log's launch lines.

CI on 7a0a748: CI run 38282198652 passed all 17 jobs: plan, format and pin, policy scan, the three clippy legs, the seven unit legs, Linux isolation, integration, macOS contracts, and the rust summary. Documentation site run 38282200167 passed.

Not yet run on macOS. The suites need the installed service and the fixture authority, so the Mac validates them on this head before the merge request. Results will be added here.

Security scenarios

• Credentials. The harness never reads, prints or passes the consumer's credential; the gateway gets the file's path. The host.toml parser returns the consumer's settings without its digest, which is tested. Evidence holds no credential, digest or child environment.
• Environment. Every child gets a minimal environment: HOME, PATH, TMPDIR, LANG and the CODESPACE_* settings it names.
• The installed service. Injected faults never touch it. They run against the fixture authority in private scratch directories, so nothing can stay Suspect or charged on the owner's service, and the matrix runs nothing there that leaves a descendant.
• Evidence. Sealed evidence is read-only and never rewritten, and verify writes nothing.

Out of scope

• Any qualification run or claim, and the frozen candidate.
• The DG-1 measurement of the installed release, a separate step on the Mac.
• Pin changes, DevGuard releases and changes to the installed service.
• The final report, the supported-mode table in the operator guide, and the ledger update, which come in later PRs.
• P1-RECOVERY, and governed execution on Linux before DG-LINUX.