Add provenance gate: --require-verified-capabilities (review #3)

REIR facts already carry acquisition_mode + confidence, but nothing gated on
them: a required capability backed only by an author declaration (rsspkg.toml
binding) passed like independently-established evidence.

- CiGatePolicy gains `require_verified_capabilities`; the gate now counts
  required capability facts whose acquisition_mode is author-declared
  (binding_manifest / manual_declaration / manual_exception) as
  `total_unverified` and fails when the flag is set.
- `reir report-pr --require-verified-capabilities` and an action input
  (off by default; recommended for high-security gates).
- test: an author-declared required fact passes the default gate (counted) but
  fails under require_verified_capabilities.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

.github/actions/rsscript-review/action.yml

@@ -27,6 +27,10 @@ inputs:
     description: 'Fail the action if granted capabilities exceed requirements (over-privilege). Recommended true for protected branches.'
     required: false
     default: 'true'
+  require-verified-capabilities:
+    description: 'Fail if a required capability is only author-declared (rsspkg.toml binding) with no independent evidence. Off by default; turn on for high-security gates.'
+    required: false
+    default: 'false'
 
 outputs:
   status:
@@ -71,6 +75,7 @@ runs:
         INPUT_FAIL_ON_MISSING: ${{ inputs.fail-on-missing }}
         INPUT_FAIL_ON_UNKNOWN: ${{ inputs.fail-on-unknown }}
         INPUT_FAIL_ON_EXCESS: ${{ inputs.fail-on-excess }}
+        INPUT_REQUIRE_VERIFIED: ${{ inputs.require-verified-capabilities }}
       run: |
         TEMP_DIR="$(mktemp -d "${RUNNER_TEMP:-/tmp}/rsscript-review.XXXXXX")"
         PACKAGE_REVIEW_JSON="$TEMP_DIR/package-review.json"
@@ -105,6 +110,7 @@ runs:
         [ "$INPUT_FAIL_ON_MISSING" = "true" ] || REPORT_FLAGS+=(--allow-missing)
         [ "$INPUT_FAIL_ON_UNKNOWN" = "true" ] && REPORT_FLAGS+=(--fail-on-unknown)
         [ "$INPUT_FAIL_ON_EXCESS" = "true" ] && REPORT_FLAGS+=(--fail-on-excess)
+        [ "$INPUT_REQUIRE_VERIFIED" = "true" ] && REPORT_FLAGS+=(--require-verified-capabilities)
 
         set +e
         reir report-pr \

reir/src/format.rs

@@ -209,6 +209,8 @@ pub struct CiGateSummary {
     pub total_missing: usize,
     pub total_excess: usize,
     pub total_unknown: usize,
+    #[serde(default)]
+    pub total_unverified: usize,
     pub unknown_ratio: f64,
 }
 
@@ -277,6 +279,9 @@ pub struct CiGatePolicy {
     pub fail_on_missing: bool,
     pub fail_on_unknown: bool,
     pub fail_on_excess: bool,
+    /// Fail when a required capability is backed only by author-declared evidence
+    /// (e.g. an `rsspkg.toml` binding) with no independent corroboration.
+    pub require_verified_capabilities: bool,
 }
 
 impl Default for CiGatePolicy {
@@ -285,10 +290,22 @@ impl Default for CiGatePolicy {
             fail_on_missing: true,
             fail_on_unknown: false,
             fail_on_excess: false,
+            require_verified_capabilities: false,
         }
     }
 }
 
+/// Whether a fact's acquisition mode is an author declaration (the package author
+/// asserted it) rather than independently established evidence.
+fn is_author_declared(fact: &Fact) -> bool {
+    matches!(
+        fact.acquisition_mode,
+        AcquisitionMode::BindingManifest
+            | AcquisitionMode::ManualDeclaration
+            | AcquisitionMode::ManualException
+    )
+}
+
 /// Produce CI gate JSON output from reconciliation results, failing only on
 /// missing capabilities (the default policy).
 pub fn format_ci_gate_output(
@@ -337,11 +354,25 @@ pub fn format_ci_gate_output_with_policy(
         })
         .collect();
 
+    // Required capabilities backed only by author declaration (not unknown, which
+    // is reported separately).
+    let unverified_facts: Vec<_> = required_capability_facts
+        .iter()
+        .copied()
+        .filter(|f| {
+            is_author_declared(f)
+                && f.value != FactValue::Unknown
+                && f.unknown_reason.is_none()
+                && f.confidence.level != ConfidenceLevel::Unknown
+        })
+        .collect();
+
     let total_required = required_capability_facts.len();
     let total_granted = granted_capability_facts.len();
     let total_missing = missing.len();
     let total_excess = excess.len();
     let total_unknown = unknown_facts.len();
+    let total_unverified = unverified_facts.len();
     let unknown_ratio = if total_required > 0 {
         total_unknown as f64 / total_required as f64
     } else {
@@ -350,7 +381,8 @@ pub fn format_ci_gate_output_with_policy(
 
     let fail = (policy.fail_on_missing && !missing.is_empty())
         || (policy.fail_on_unknown && !unknown_facts.is_empty())
-        || (policy.fail_on_excess && !excess.is_empty());
+        || (policy.fail_on_excess && !excess.is_empty())
+        || (policy.require_verified_capabilities && !unverified_facts.is_empty());
     let status = if fail {
         CiGateStatus::Fail
     } else if !unknown_facts.is_empty() {
@@ -424,6 +456,7 @@ pub fn format_ci_gate_output_with_policy(
             total_missing,
             total_excess,
             total_unknown,
+            total_unverified,
             unknown_ratio,
         },
         required_capabilities,
@@ -1477,9 +1510,40 @@ mod tests {
             std::slice::from_ref(&granted),
             std::slice::from_ref(&excess),
             CiGatePolicy {
-                fail_on_missing: true,
-                fail_on_unknown: false,
                 fail_on_excess: true,
+                ..Default::default()
+            },
+        );
+        assert_eq!(strict.status, CiGateStatus::Fail);
+    }
+
+    #[test]
+    fn require_verified_capabilities_blocks_author_declared() {
+        let mut required = capability_fact("fact.req.s3", FactRole::Required, FactValue::True);
+        required.acquisition_mode = AcquisitionMode::BindingManifest; // author-declared
+        let granted = capability_fact("fact.grant.s3", FactRole::Granted, FactValue::True);
+        let recon = crate::reconcile_capabilities(
+            std::slice::from_ref(&required),
+            std::slice::from_ref(&granted),
+        );
+
+        // Default policy accepts author-declared evidence (but counts it).
+        let default_out = format_ci_gate_output(
+            std::slice::from_ref(&required),
+            std::slice::from_ref(&granted),
+            &recon,
+        );
+        assert_ne!(default_out.status, CiGateStatus::Fail);
+        assert_eq!(default_out.summary.total_unverified, 1);
+
+        // require_verified_capabilities blocks it.
+        let strict = format_ci_gate_output_with_policy(
+            std::slice::from_ref(&required),
+            std::slice::from_ref(&granted),
+            &recon,
+            CiGatePolicy {
+                require_verified_capabilities: true,
+                ..Default::default()
             },
         );
         assert_eq!(strict.status, CiGateStatus::Fail);

reir/src/main.rs

@@ -298,6 +298,7 @@ fn try_run_report_pr(args: &[String]) -> Result<(ExitCode, String), CliError> {
             "--ci-json" => ci_json = true,
             "--fail-on-unknown" => policy.fail_on_unknown = true,
             "--fail-on-excess" => policy.fail_on_excess = true,
+            "--require-verified-capabilities" => policy.require_verified_capabilities = true,
             "--allow-missing" => policy.fail_on_missing = false,
             unknown => {
                 return Err(CliError::usage(format!(