feat: carry + adjudicate agentic_posture binding (OAP spec 210 verify half)

[bartekus]

What

Complete the verify half of OAP spec 210 (agentic_posture) in tenant-tail:
carry the agenticPostureBinding certificate field and adjudicate it. Pairs with
statecrafting/tenant-emit#12 (the emit half).

Why carrying the field is mandatory (not optional)

compute_certificate_hash re-derives the certificate hash by round-tripping through
the typed GovernanceCertificate struct. If tenant-emit emits an
agenticPostureBinding and tenant-tail's struct does not know the field, serde drops
it on re-serialisation, the re-derived hash diverges, and the signature check
fails. So a cert that tenant-emit produces with a posture would fail to verify. This
is the same shape as the 203 SBOM binding (field + adjudicator).

Adjudication

verify_certificate_with_platform → append_posture_binding_findings:

• Internal consistency (agentic_posture_binding_inconsistencies, no BOM):
  none-with-surfaces, declared/governed-empty, unknown posture, governed
  surface missing / non-conformant envelope. A validly-signed but self-inconsistent
  binding is rejected.
• SBOM watchlist cross-check (adjudicate_agentic_posture, under --sbom-dir):
  a none posture (authored OR defaulted) contradicted by a watchlisted agent/LLM
  SDK dependency in the CycloneDX BOM is fatal; declared/governed acknowledge
  agency and never fail on a match; a miss is a stated-residual notice, never a silent
  pass.

The purl-matcher fix

purl_matches anchors on the purl's package-name segment (exact-equal), so the
bare ai watchlist entry no longer over-flags @scope/ai packages via the /ai@
substring — the false-positive OAP's substring matcher carries (flagged in the
spec-210 AI review). pkg:npm/%40langchain/ai@x no longer matches ai;
pkg:npm/ai@x still does.

Notes

• Watchlist embedded as JSON (data/agentic-sdk-watchlist.json, same package set
  as OAP's YAML) so tenant-tail adds no YAML dependency.
• CERTIFICATE_VERSION stays 1.5.0 (additive, skipped when absent; unbound certs
  and the parity fixture are byte-identical).
• FR-004 governed-envelope check is a top-level shape check (recognised
  schema_version + required spec-198 sections present); the full nested
  GovernanceEnvelope is not vendored (Apache-2.0). Documented in spec 001.
• No CLI change: the verify verb already surfaces notices/errors and already has
  --sbom-dir.

Test plan

• cargo test --workspace --locked green (19 new posture unit tests; existing core +
  cross-tool parity + provenance suites unchanged).
• cargo clippy --workspace --all-targets --locked -- -D warnings clean;
  cargo fmt --check clean; spec-spine compile/index check/lint --fail-on-warn/couple
  clean (no waiver).
• Cross-tool round-trip validated locally against the tenant-emit#12 binary:
  a posture-bearing cert verifies clean and reports "posture: DECLARED"; tampering the
  bound posture fails signature + hash (spec 210 AC-2); a defaulted-none cert whose
  BOM carries @anthropic-ai/sdk is rejected "contradicted by SBOM dependency" (AC-3).

Version bump lands in a follow-up release PR.

[github-actions]

AI Code Review

Now I have enough context for a complete review.

---

Code Review

Bugs and Logic Errors

[HIGH] purl_matches ignores the purl type/ecosystem

The function strips pkg:<type>/ but does not validate that the type matches the watchlist entry's ecosystem field. A pkg:pypi/openai@1.0.0 or pkg:cargo/ai@0.1.0 purl would match npm watchlist entries named openai / ai. CycloneDX BOMs produced by non-npm ecosystems will contain false positives, causing spurious Contradicted errors on mixed-language projects.

Fix: compare the extracted type against the entry's ecosystem (e.g., npm → pkg:npm/):

let (type_part, coord) = match core.split_once('/') {
    Some((scheme, rest)) if scheme.starts_with("pkg:") =>
        (&scheme["pkg:".len()..], rest),
    _ => ("", core),
};
// guard: watchlist entry is npm-only
if !type_part.eq_ignore_ascii_case(&entry.ecosystem) { continue; }

There is no test exercising pkg:pypi/openai@1.0.0 against the npm openai entry.

---

[MEDIUM] Unknown posture string emits a misleading Declared notice

In append_posture_binding_findings, agentic_posture_binding_inconsistencies correctly pushes an error for posture "maybe", but then adjudicate_agentic_posture short-circuits on binding.posture != "none" and returns Declared, appending "agentic posture: DECLARED (agency acknowledged)" as a notice. The result carries both an error and a reassuring notice for the same binding, which is contradictory. The adjudicate_agentic_posture caller should skip the cross-check when internal consistency already failed (i.e., unknown posture string).

---

[LOW] load_agentic_sdk_watchlist panics at runtime, not compile time

The expect in load_agentic_sdk_watchlist fires at runtime during the first BOM cross-check. The comment calls it a "build-time invariant" but include_str! only bakes the bytes in; schema validity is tested, not guaranteed by the compiler. The tests do exercise this path (which is sufficient gating), but a corrupted workspace artefact would produce an uncaught panic in the verifier rather than an exit-2 I/O error consistent with the rest of the error surface.

---

[LOW] _comment field implicitly tolerated

AgenticSdkWatchlist derives Deserialize with default serde behaviour (unknown fields ignored). The _comment key in the committed JSON works today but is invisible contract: a future schema version adding deny_unknown_fields would silently break it. No field for it, no #[serde(deny_unknown_fields)] either way, but the asymmetry should be documented or the comment moved out of band.

---

Security

[LOW] Recursive walk in first_watchlist_match_in_bom has no depth limit

The inner walk recurses on components[].components without bound. A maliciously crafted BOM (--sbom-dir takes user-supplied paths) with a pathologically deep nesting could overflow the stack. In practice CycloneDX nesting is shallow, but for a tool that explicitly processes untrusted build artefacts a bounded walk (e.g., max depth 32) is safer.

---

Spec-Spine Compliance

Spec 210 is an OAP reference, not a tenant-tail spec — that is fine; the code is correctly claimed by specs/001-certificate-verify-core/spec.md, and the spec is updated in this PR. The derived artefacts (.derived/) are regenerated and committed. No coupling-gate violation.

The new data/agentic-sdk-watchlist.json file is correctly added to establishes: in the spec and reflected in both .derived/ shards. ✓

---

Performance

load_agentic_sdk_watchlist() re-parses the embedded JSON on every call

first_watchlist_match_in_bom calls load_agentic_sdk_watchlist() each invocation, re-deserialising the embedded 1 KB JSON. For a one-shot CLI this is negligible, but a std::sync::OnceLock<AgenticSdkWatchlist> static would make the intent ("static constant data") explicit without any meaningful cost change.

validate_governance_envelope_shape clones potentially large JSON values

serde_json::from_value::<GovernanceEnvelopeShape>(env.clone()) — the clone allocates for every governed surface's envelope. If a governance envelope carries large nested data (e.g., deep constituents), this doubles peak memory briefly. The straightforward fix is serde_json::from_str(&env.to_string()) or restructuring the API to take bytes; for typical envelopes it's immaterial.

---

Summary

The purl-ecosystem mismatch (bug 1) and the unknown-posture/Declared notice contradiction (bug 2) are the only issues that could produce incorrect verification verdicts in the field. The rest are quality/robustness concerns. The spec-spine coupling discipline is correctly followed — spec updated, derives regenerated, new file claimed.

---

Automated review by Claude. Diff size: 784 lines.