[A3S Cloud/H0] Define digest-bound node enforcement and audit integration

[ZhiXiao-Lin]

Cloud gate

H0 — digest-bound node enforcement and production audit evidence.

Planning reference: https://github.com/A3S-Lab/Cloud/blob/e2a05b7f1f63486b2fda866b22aa84eea89aadb4/docs/development-plan.md

Problem

Cloud needs node enforcement to prove which exact ACL policy protected each workload revision. Sentry must bind policy to immutable workload identity, fail closed when enforcement cannot be established, and produce redacted audit evidence.

Scope

• Define a canonical ACL policy envelope bound to workload, revision, replica, node, and policy digest.
• Enforce workload-scoped egress, exec, and file-access policy through typed capabilities.
• Define fail-closed behavior for missing, invalid, stale, mismatched, or partially applied policy.
• Make policy apply, replace, restore, and remove operations idempotent and restart-safe.
• Emit structured, redacted audit records carrying correlation, decision, policy digest, and enforcement evidence.
• Add Linux fault fixtures for process restart, policy replacement, partial failure, and attempted bypass.

Acceptance criteria

• A workload cannot enter ready state until the expected policy digest is reported as enforced.
• A digest or identity mismatch is rejected and cannot silently reuse another workload's policy.
• Failed replacement retains or restores the prior safe policy without an unenforced interval.
• Audit records distinguish allow, deny, enforcement failure, and policy drift without leaking secret values.
• Restart reconstructs the same enforcement state or keeps the workload blocked.

Non-goals

• Scheduling, placement, autoscaling, or Cloud authorization.
• Storing secret plaintext in policy or audit events.
• Claiming universal isolation beyond the explicitly supported Linux enforcement mechanisms.

[ZhiXiao-Lin]

First bounded scope slice merged in #6 at c1b45120662224fe1f3065d6888da0d291b4ff07.

Delivered:

• canonical native-ACL envelope bound to workload, revision, replica, node, generation, and SHA-256 policy digest;
• bounded closed-header admission, exact canonical wire bytes, digest recomputation, and fail-closed identity/generation/digest verification;
• producer/consumer 1 MiB wire-budget parity and redacted contract errors;
• 72 unit, 13 daemon integration, and 7 policy contract tests, plus Rust 1.88/stable, TypeScript, and Python SDK validation.

The issue remains open. Payload semantics are intentionally opaque in this slice; typed workload-scoped egress/exec/file enforcement, atomic restart-safe apply/restore/remove, readiness evidence, audit records, and Linux fault fixtures are still outstanding.