Private hosted owner-bound package read and discovery adapter #1802

Outcome

Hosted/portable Astrid privately lists and verifies principal-owned package snapshots using an authenticated admitted principal UID and durable package generation, without native process mounts or caller-minted identity.

Parent

#1750

Scope and ownership

Repository: astrid-runtime/astrid.

Private hosted package read/discovery adapter only. Owned paths after a post-landing re-pin:

• crates/astrid-kernel/src/kernel_router/identity.rs
• a private package-service inventory ingress near existing kernel inventory routing
• crates/astrid-capsule-install/src/principal_introspection.rs
• crates/astrid-storage/src/capsule_registry.rs

Do not widen into astrid-kernel/src/lib.rs, public WIT/API, daemon/gateway, installer write paths, activation, publication, Station, native process-storage composition, or PR #1770.

Frozen provider

Authenticated kernel AuthorizedPrincipal binds an admitted immutable PrincipalUid. That UID is the only owner selector passed to RuntimePrincipalStore and principal_introspection read APIs. Inventory is principal-owned only. Fleet/System inventory requires a later graph-authorized private extension.

Caller paths, ASTRID_HOME, mountpoints, configuration, acting_principal_hint, raw StateOwner/UID bytes, and native ProcessProjectionBinding/ProcessStorageMount are not hosted identity sources.

Dependencies

• Exact-head independent ACCEPT and landing of Implement the registry-neutral package-service contract and state model #1750 on os/universal.
• The frozen hosted owner/identity provider above.
• HQ reauthorization from the exact landed trunk before any implementation writer is staffed.
• Re-pin and collision review of the named paths after Implement the registry-neutral package-service contract and state model #1750 lands.

Exit gate

• Hosted restart lists and verifies exact principal-owned packages from durable snapshots/generations.
• Unvalidated UID or alias pairs cannot serve a package.
• Alias rename/reuse and delete/recreate cannot attach a stale package or branch view to a different identity.
• Restart reconstructs the validated principal directory/ownership; old process mounts/tokens/PID generations are not reused.
• Fleet transfer cannot leave a stale owner view usable through this adapter.
• Path, home, mountpoint, config, hint, or raw owner tag cannot mint owner authority.
• Partial or tampered package bytes, missing names, or generation/digest mismatch fail closed.
• Native package behavior remains unchanged.

Claim boundary

This is hosted/portable read and discovery only. It does not prove native confidentiality, durable package writes, activation, publication, Station integration, public WIT compatibility, or native process-storage lifecycle.

Verification

Exact-head independent review against the falsifiers above, focused tests for admission/restart/stale-generation/tamper cases, and required CI on os/universal. Green tests are not landing proof.