fix(codex): harden Personal-Weixin Repair 3 trust boundary

- Add _reject_symlink_chain() protection against ancestor symlink escapes
- Implement dirfd-based atomic writes with O_DIRECTORY | O_NOFOLLOW
- Add mandatory --trust-policy parameter with strict validation
- Integrate SSH signature verification via ssh-keygen -Y verify
- Authority field hard fail (present: false or missing -> BLOCKED)
- Self-audit rejection (reviewer != executor/capture/credential)
- Update template with trust_policy_key field
- Update README with trust policy and dirfd documentation
- Update task file with B3 BLOCKED_EVIDENCE_REQUIRED status

Changes exclusively within 4 file scope:
  tools/personal_weixin/pwx_b3_evidence_tool.py
  tools/personal_weixin/pwx_b3_evidence_facts.template.json
  tools/personal_weixin/README-B3-EVIDENCE.md
  .agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md

.agent/authorizations/codex/AUTH-CODEX-V2R1-PERSONAL-WEIXIN-B3-B4-EVIDENCE-20260716.md

@@ -0,0 +1,397 @@
+# Personal-Weixin B3/B4 Owner Evidence Authorization
+
+```yaml
+authorization_id: AUTH-CODEX-V2R1-PERSONAL-WEIXIN-B3-B4-EVIDENCE-20260716
+owner_approved: true
+executor: Codex isolated runner
+
+foundation_implementation_commit: 2fcab6f5833a405a9a26683811600b6e5f1aa7b1
+foundation_result_commit: 64a71b6199a8e2bd609ba145349e67b874888505
+r10_lineage_commit: 74e603c0c943501110577dbe3c7f6a0b18b8ec7d
+evidence_gate_commit: 62a4067cf7a462ebe7cf29524238bc5d0a70b813
+upstream_audit_commit: b2f5f531019a70801444987dbb97dc1f69cf47de
+
+production_baseline: V1R4C6
+production_changed: false
+release_status: paused
+force_push_authorized: false
+```
+
+## 1. 授权结论
+
+Owner 明确授权 Codex：
+
+1. 完成 B3 owner evidence packet；
+2. 在 vendor `client_id → authoritative message_id` 证据缺失时，采用 B4 quote-authority-disabled amendment；
+3. B3、B4 均 PASS 后，按已有 exact allowlist 继续 B5–B7；
+4. B3–B7 全部 PASS 后才能开始 Release Preflight；
+5. Release Preflight PASS 后才允许 Canary；
+6. Codex 不得直接修改生产。
+
+该授权不允许 Codex编造 raw-wire、credential、vendor 或 reviewer 证据。
+
+## 2. B3 owner evidence 必须包含
+
+B3 evidence manifest 必须引用上述五个权威提交，并包含以下五类证据。
+
+### A. Raw-wire evidence
+
+至少包含：
+
+```yaml
+raw_wire:
+  - direction: inbound
+  - direction: outbound
+```
+
+每项必须记录：
+
+```yaml
+restricted_path:
+restricted_sha256:
+restricted_bytes:
+redacted_path:
+redacted_sha256:
+captured_at:
+credential_label: credential-a | credential-b
+```
+
+要求：
+
+* unrestricted raw-wire 只能保存在 owner 批准的受限存储；
+* Git 中只能提交 SHA-256、大小、受限路径引用及 redacted view；
+* 不得提交 token、API key、OAuth code、sessionKey、cookie 或完整 credential；
+* inbound 与 outbound 必须各至少一份；
+  -两份 credential 都必须实际覆盖。
+
+### B. Authority map
+
+必须提供 commit-safe authority map，明确：
+
+```yaml
+vendor_message_id_field:
+client_id_field:
+client_id_authoritative: false
+mapping_verified: true
+```
+
+Authority map 必须区分：
+
+```yaml
+authoritative:
+  - verified inbound vendor message_id
+
+non_authoritative:
+  - local client_id
+  - outbound correlation ID
+  - local sequence
+  - timestamp
+  - content hash
+  - outbound receipt ID
+```
+
+禁止把任一非权威值提升为 message authority。
+
+### C. 双 credential 证据
+
+必须有精确两项：
+
+```yaml
+credentials:
+  - label: credential-a
+    fingerprint_sha256:
+    secret_included: false
+    scope:
+    test_result: PASS
+
+  - label: credential-b
+    fingerprint_sha256:
+    secret_included: false
+    scope:
+    test_result: PASS
+```
+
+要求：
+
+* 两个 fingerprint 必须不同；
+* 不得提交 secret 原文；
+* 两个 credential 必须各自通过实际测试；
+* credential scope 必须明确。
+
+### D. Mode evidence
+
+必须明确处于下列模式之一：
+
+```yaml
+mode:
+  name: sandbox | shadow | restricted-capture
+  production_traffic: false
+  writes_production: false
+  capture_only: true
+```
+
+不得使用生产流量或写生产数据来补证据。
+
+### E. Reviewer evidence
+
+必须由独立 reviewer 签署：
+
+```yaml
+review:
+  reviewer:
+  independent_from_executor: true
+  decision: PASS
+  reviewed_manifest_sha256:
+  reviewed_at:
+```
+
+Reviewer 必须核对：
+
+* raw-wire 哈希；
+* redacted view；
+* authority map；
+  -两个 credential fingerprint；
+* mode；
+* manifest 完整 SHA-256。
+
+## 3. B3 PASS 条件
+
+只有以下全部成立才允许 B3 `status: PASS`：
+
+```yaml
+raw_wire_inbound: PASS
+raw_wire_outbound: PASS
+dual_credential: PASS
+authority_map: PASS
+client_id_authoritative: false
+mode_non_production: PASS
+reviewer_independent: PASS
+reviewer_decision: PASS
+secrets_committed: false
+production_changed: false
+baseline_after: V1R4C6
+release_status: paused
+```
+
+真实证据缺失时必须继续：
+
+```yaml
+status: BLOCKED_EVIDENCE_REQUIRED
+```
+
+不得生成模拟证据代替 owner/vendor 证据。
+
+## 4. B4 Owner Amendment
+
+Owner 明确批准以下 B4 amendment：
+
+```json
+{
+  "schemaVersion": 1,
+  "contract": "personal-weixin-b4-outbound-quote-authority-amendment",
+  "ownerApproved": true,
+  "lineage": {
+    "foundationImplementationCommit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
+    "foundationResultCommit": "64a71b6199a8e2bd609ba145349e67b874888505",
+    "r10LineageCommit": "74e603c0c943501110577dbe3c7f6a0b18b8ec7d",
+    "evidenceGateCommit": "62a4067cf7a462ebe7cf29524238bc5d0a70b813",
+    "upstreamAuditCommit": "b2f5f531019a70801444987dbb97dc1f69cf47de"
+  },
+  "vendorClientIdMessageIdEvidence": {
+    "status": "absent",
+    "clientIdPromotable": false
+  },
+  "authorityPolicy": {
+    "outboundQuoteAuthority": "disabled",
+    "clientIdRole": "non-authoritative-correlation-only",
+    "authoritativeMessageIdSources": [
+      "validated-inbound-raw-wire.vendor_message_id"
+    ],
+    "quotedSendWithoutAuthoritativeMessageId": "fail-closed",
+    "plainOutboundWithoutQuoteAuthority": "allowed-only-by-existing-b4-allowlist",
+    "syntheticMapping": false,
+    "timestampFallback": false,
+    "localSequenceFallback": false,
+    "contentHashFallback": false,
+    "outboundReceiptFallback": false
+  },
+  "implementationConstraints": {
+    "scopeExpansion": false,
+    "exactAllowlistRequired": true,
+    "missingAllowlistStatus": "BLOCKED_SCOPE",
+    "productionChangeAuthorized": false,
+    "canaryAuthorized": false,
+    "tagAuthorized": false,
+    "forcePushAuthorized": false
+  },
+  "production": {
+    "baseline": "V1R4C6",
+    "changed": false,
+    "releaseStatus": "paused"
+  }
+}
+```
+
+该 JSON 必须作为独立 control-plane amendment 提交。
+
+## 5. B4 强制语义
+
+B4 实现必须遵守：
+
+```yaml
+client_id:
+  role: correlation-only
+  authoritative: false
+
+vendor_message_id:
+  authoritative_only_when:
+    - observed in validated inbound raw-wire
+    - present in committed authority map
+
+quoted_send:
+  without_authoritative_vendor_message_id: fail-closed
+
+plain_outbound:
+  allowed_only_when:
+    - existing B4 exact allowlist permits it
+    - no quote/reply authority field is emitted
+```
+
+禁止：
+
+* `client_id` → `message_id` alias；
+* client ID hash fallback；
+* timestamp fallback；
+* local sequence fallback；
+* content hash fallback；
+* outbound receipt fallback；
+* synthetic message ID；
+  -“先发送后补 authority”。
+
+## 6. B4 路径授权
+
+该 amendment 不增加任何实现路径。
+
+Codex必须先找到已有 B4 exact allowlist。
+
+若不存在或不完整：
+
+```yaml
+status: BLOCKED_SCOPE
+```
+
+不得由 Codex自行发明路径。
+
+## 7. B5–B7 条件
+
+只有 B3 和 B4 均有 qualifying PASS RESULT 后，才可继续 B5–B7。
+
+每个阶段必须：
+
+* 独立 branch；
+* 独立 worktree；
+* 已提交 exact allowlist；
+* 一个非 merge implementation commit；
+* 独立 RESULT；
+* 依赖实际 F0 commit 与 immutable image digest；
+* 不修改生产；
+* 不 force push。
+
+任一阶段缺少 exact allowlist：
+
+```yaml
+status: BLOCKED_SCOPE
+```
+
+## 8. Release Preflight
+
+只有以下全部 PASS 后才能开始：
+
+```yaml
+F0: PASS
+B3: PASS
+B4: PASS
+B5: PASS
+B6: PASS
+B7: PASS
+R10_lineage: PASS
+immutable_image_digest: present
+gitleaks: PASS
+rollback_contract: present
+```
+
+Preflight 不得创建 tag 或部署生产。
+
+## 9. Canary
+
+仅在 Release Preflight PASS 后授权一次 Canary。
+
+Canary 必须：
+
+* 使用固定 immutable image digest；
+* 使用已验证 rollback target；
+* 不修改生产 schema；
+* 不暴露 secrets；
+* 有明确成功指标；
+* 有自动/立即 rollback 条件。
+
+Canary 失败：
+
+```yaml
+rollback: required
+release_status: paused
+production_baseline: V1R4C6
+```
+
+不得继续 production promotion。
+
+## 10. Production 边界
+
+Codex不得直接执行生产部署。
+
+只有以下全部提交并核验后，Codex才可创建 deployment request：
+
+```yaml
+F0_and_B3_B7: PASS
+release_preflight: PASS
+canary: PASS
+immutable_release_digest: present
+rollback_target: verified
+rollback_procedure: verified
+go_live_evidence: committed
+```
+
+实际 V2R1C0 部署只能由：
+
+```text
+owner/admin GitOps release action
+```
+
+执行。
+
+在该动作前：
+
+```yaml
+production: V1R4C6
+production_changed: false
+release: paused
+V2R1C0_tag: absent
+```
+
+必须保持不变。
+
+## 11. Codex 下一步
+
+立即执行顺序：
+
+1. 在现有 control branch 提交本授权文件；
+2. 提交 byte-exact B4 amendment；
+3. 检查 B3 packet 中是否已有真实 owner raw-wire、双 credential、authority map、mode 和 reviewer evidence；
+4. 有真实证据则完成 B3 manifest 与审核；
+5. 无真实证据则继续 `BLOCKED_EVIDENCE_REQUIRED`，明确缺失项；
+6. B3 PASS 后按已有 exact allowlist执行 B3；
+7. B4 按 quote-authority-disabled 模式执行；
+8. B3/B4 PASS 后再检查 B5–B7；
+9. 不得跳到 Release Preflight、Canary 或生产。
+
+本授权已解除 B4 vendor mapping 阻塞，但没有伪造或豁免 B3 owner evidence。

.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md

@@ -0,0 +1,138 @@
+# TASK-CODEX-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716
+
+```yaml
+task_id: TASK-CODEX-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716
+executor: Codex isolated runner
+source_base: 53c67bd9780074bad9781fb97971463156bc6609
+authorization_commit: a1f933e500151dc8afc1b25b30448a31899a8f64 # gitleaks:allow
+b4_amendment_commit: 1d334b1ccaac54c3c3ec4dd84693ab68fc67cef3
+production: V1R4C6
+release: paused
+```
+
+## Status
+
+**B3 status**: `BLOCKED_EVIDENCE_REQUIRED` (evidence collection not started, owner must prepare facts and produce restricted raw data)
+**B2 status**: `NOT_APPLICABLE` (reserved, not yet reached)
+**Production baseline**: V1R4C6 (the most recent approved production release)
+**Repair 3**: `PREPARED_NOT_ACCEPTED`；只有 `OPENCLAW_GATE0=PASS` 后才允许复测、推送、OID 与 RESULT-only 审查。
+
+## Scope
+
+本任务仅使用 Git 中的以下工具与模板，采集并验证真实 owner evidence：
+
+```text
+tools/personal_weixin/pwx_b3_evidence_tool.py
+tools/personal_weixin/pwx_b3_evidence_facts.template.json
+tools/personal_weixin/README-B3-EVIDENCE.md
+```
+
+工具是 verifier/generator，不是网络 capture client。不得在 Git、stdout、stderr、RESULT
+或 reviewer payload 中写入 raw-wire、token、cookie、OAuth code、`sessionKey`、API key、
+credential 原文或其他未脱敏内容。
+
+## Two-stage evidence flow
+
+1. Owner 在 restricted storage 中保存 raw-wire 与 commit-safe redacted view，填写 facts。
+2. `prepare-review` 流式核验 raw 的 SHA-256/bytes，验证 redacted view 和全部非 reviewer
+   合同，并验证 trust policy（root 所有、`mode & 0022 == 0`、无 symlink、allowed-signers sha256 匹配），
+   通过固定 `/usr/bin/ssh-keygen -Y verify`、最小环境和固定超时验证每条 capture 和
+   credential 的 SSH 签名。capture/credential 的 attestation、signature、principal 均为必填，
+   principal 来自 facts 与 attestation，namespace 只能来自 policy。
+   生成 byte-exact canonical reviewer payload 与 SHA-256。该阶段始终返回
+   `BLOCKED_EVIDENCE_REQUIRED`，不能作为 B3 PASS。
+3. 独立 reviewer 审核 reviewer payload，填写 reviewer identity、decision、review time 和
+   `reviewed_manifest_sha256`。
+4. `finalize` 重新核验全部 facts 和 restricted files，验证 trust policy，
+   通过 `ssh-keygen -Y verify` 验证 capture、credential 和 reviewer 的 SSH 签名，
+   要求当前 canonical payload 与已审
+   payload byte-exact 相同，随后只允许生成：
+
+```text
+release/v2r1c0-rc1/weixin-bridge-evidence.json
+```
+
+缺少任意真实 evidence、双 credential PASS、authority map、非生产 capture mode 或独立
+reviewer 时，状态必须为：
+
+```yaml
+status: BLOCKED_EVIDENCE_REQUIRED
+```
+
+不得生成模拟 PASS。
+
+## Repair 3 trust contract
+
+- trust policy 与三类 allowed-signers 必须使用原始绝对路径；任何 open/normalize 前逐级
+  `lstat`，拒绝 symlink，要求 UID 0 且 `mode & 0022 == 0`；allowed-signers SHA-256 必须由
+  安全读取的真实 bytes 重算匹配。
+- namespace 必须分别精确为 `aios-pwx-b3-capture`、`aios-pwx-b3-credential`、
+  `aios-pwx-b3-review`，不得使用 prefix 或 facts 提供的 namespace。
+- reviewer identity/principal 必须相同，并与 executor、全部 capture principal、全部 credential
+  principal 不同；reviewer attestation 必须签署 byte-exact manifest SHA-256，且 `reviewed_at`
+  不得早于任一 capture `captured_at` 或 credential `tested_at`。
+- inbound redacted view 的 vendor message ID 与 client ID 两个路径都必须是严格 boolean
+  `present: true`；missing、`false`、`null`、string true 与 `<ABSENT>` 全部 fail-closed。
+  `client_id_authoritative` 永远为 `false`，不得参与 authority 决策。
+- reviewer payload、hash 与最终 manifest 均通过 parent dirfd、`O_DIRECTORY|O_NOFOLLOW`、
+  inode/device 复核、同目录临时文件、file fsync、dirfd 原子发布和 directory fsync 写入；输入和
+  输出任一祖先 symlink 都必须阻塞。
+- 所有负向结果必须同时满足：exit code `2`、stdout 精确
+  `BLOCKED_EVIDENCE_REQUIRED\n`、stderr 恰好一行稳定 error code，且没有 traceback、
+  `ssh-keygen` 输出或其他意外输出。
+
+Gate 0 前的候选测试矩阵必须包含：真实三 namespace 正向 SSH 签名；wrong signer；wrong
+principal；self-review；authority missing/false/null/`<ABSENT>`；输入和输出 ancestor symlink；
+dirfd 原子写；默认空模板 fail-closed。测试材料只允许位于 `/tmp` 或 owner restricted storage，
+不得形成第五个 tracked path。
+
+## Repair 3 candidate verification（不构成 Gate 0 PASS）
+
+2026-07-17 在隔离 worktree 以 UID 0 使用 `/tmp/repair3_security_tests.py` 通过真实
+`ssh-keygen` 生成、签名和验证三类 namespace；正向 finalize 与 dirfd 原子写均 PASS。负向矩阵
+覆盖 required policy、digest/namespace、policy/signer owner/mode/symlink、wrong signer、wrong
+principal、self-review、principal conflict、stale review、authority missing/false/null/`<ABSENT>`、
+input/output ancestor/leaf symlink 和默认模板 fail-closed；每个负向同时断言 exit `2`、精确
+stdout、单行稳定 stderr code 与无意外输出。
+
+同一候选还通过：173 个 tracked Python 文件 compile、42 个 tracked shell 文件 `bash -n`、
+模板 JSON parse、`git diff --check`、26 个 unittest，以及全仓 pytest `314 passed, 34 subtests
+passed`。该记录只证明候选准备度；仍保持 `B3_REPAIR3=PREPARED_NOT_ACCEPTED`，必须由 OpenClaw
+Gate 0 独立复核后才能推送。
+
+## Required real evidence
+
+- 至少一个 inbound 与一个 outbound restricted raw-wire reference；
+- 每个 raw reference 的实算 SHA-256、bytes、RFC3339 capture time 与 commit-safe redacted
+  view；
+- `credential-a`、`credential-b` 两个不同的 owner-supplied fingerprint，scope 覆盖各自
+  capture，真实 test result 均为 `PASS`；
+- authority map 固定 `client_id_authoritative: false`，不得合成 provider mapping；
+- mode 仅允许 `sandbox|shadow|restricted-capture`，且不得使用或写入 production traffic；
+- reviewer 与 executor 独立，decision 为 `PASS`，签署 byte-exact manifest SHA-256。
+
+## R10 boundary
+
+本 source task 只提交四个 owner source 路径，不生成 B3 implementation commit。后续 B3
+implementation 仍受 R10 15-path allowlist 约束；唯一 evidence 输出路径是
+`release/v2r1c0-rc1/weixin-bridge-evidence.json`。只有 qualifying B3 PASS RESULT 后才允许
+启动 B4 implementation。
+
+## Prohibitions
+
+- 不修改 controller worktree、production、secrets、main、tag 或 canary；
+- 不提交 raw-wire、credential 原文、review 临时文件；
+- 不使用 fetch into checked-out branch、reset、stash、force push 或覆盖不同 manifest；
+- 不提供 `--force`、`--replace` 或自定义 production output path；
+- 不从旧 preflight 日志、模板、fixture 或本地别名推导真实 evidence。
+
+## Result
+
+执行后生成：
+
+```text
+.agent/results/codex/RESULT-CODEX-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-<timestamp>.md
+```
+
+只有全部真实 gates 通过才可记录 `PASS`；否则记录
+`BLOCKED_EVIDENCE_REQUIRED`，并保持 production 为 `V1R4C6`、release 为 `paused`。

patches/patch_v2r1-personal-weixin-b6b7-impl-20260715T115309UTC8.branch.json

@@ -0,0 +1,16 @@
+{
+  "task_id": "TASK-CODEX-V2R1-PERSONAL-WEIXIN-B6B7-BOOTSTRAP-AND-CANARY-20260715T120000UTC8",
+  "phase": "A",
+  "type": "branch",
+  "branch": "patch/v2r1-personal-weixin-b6b7-impl-20260715T115309UTC8",
+  "base_ref": "design/v2r1-personal-weixin-golden-contract-20260715",
+  "base_commit": "d74229927b2dadca7719455984aea10d010c5123",
+  "created_by": "aiman",
+  "created_at": "2026-07-15T03:53:09Z",
+  "direct_main_push": false,
+  "owner_approval_required": false,
+  "owner_approved": true,
+  "owner_approval_scope": "Phase A bootstrap for owner-approved B6/B7 personal-Weixin implementation; no production, runtime, database, secret, tag, baseline, or controller/ChatGPT worktree changes.",
+  "production_change": false,
+  "user_action_required": false
+}

patches/task_codex_v2r1-personal-weixin-b3-evidence-git-20260716T123454UTC8.branch.json

@@ -0,0 +1,9 @@
+{
+  "type": "branch",
+  "branch": "task/codex/v2r1-personal-weixin-b3-evidence-git-20260716T123454UTC8",
+  "base": "1d334b1ccaac54c3c3ec4dd84693ab68fc67cef3",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-16T04:35:34Z",
+  "direct_main_push": false,
+  "owner_approval_required": true
+}

release/v2r1c0-rc1/personal-weixin-b4-outbound-quote-authority-amendment.json

@@ -0,0 +1,44 @@
+{
+  "schemaVersion": 1,
+  "contract": "personal-weixin-b4-outbound-quote-authority-amendment",
+  "ownerApproved": true,
+  "lineage": {
+    "foundationImplementationCommit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
+    "foundationResultCommit": "64a71b6199a8e2bd609ba145349e67b874888505",
+    "r10LineageCommit": "74e603c0c943501110577dbe3c7f6a0b18b8ec7d",
+    "evidenceGateCommit": "62a4067cf7a462ebe7cf29524238bc5d0a70b813",
+    "upstreamAuditCommit": "b2f5f531019a70801444987dbb97dc1f69cf47de"
+  },
+  "vendorClientIdMessageIdEvidence": {
+    "status": "absent",
+    "clientIdPromotable": false
+  },
+  "authorityPolicy": {
+    "outboundQuoteAuthority": "disabled",
+    "clientIdRole": "non-authoritative-correlation-only",
+    "authoritativeMessageIdSources": [
+      "validated-inbound-raw-wire.vendor_message_id"
+    ],
+    "quotedSendWithoutAuthoritativeMessageId": "fail-closed",
+    "plainOutboundWithoutQuoteAuthority": "allowed-only-by-existing-b4-allowlist",
+    "syntheticMapping": false,
+    "timestampFallback": false,
+    "localSequenceFallback": false,
+    "contentHashFallback": false,
+    "outboundReceiptFallback": false
+  },
+  "implementationConstraints": {
+    "scopeExpansion": false,
+    "exactAllowlistRequired": true,
+    "missingAllowlistStatus": "BLOCKED_SCOPE",
+    "productionChangeAuthorized": false,
+    "canaryAuthorized": false,
+    "tagAuthorized": false,
+    "forcePushAuthorized": false
+  },
+  "production": {
+    "baseline": "V1R4C6",
+    "changed": false,
+    "releaseStatus": "paused"
+  }
+}

release/v2r1c0-rc1/personal-weixin-r10-lineage-amendment.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 1,
+  "contract": "personal-weixin-r10-lineage-amendment",
+  "foundation": {
+    "node": "F0_PERSONAL_WEIXIN_FOUNDATION",
+    "implementationCommit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
+    "resultCommit": "64a71b6199a8e2bd609ba145349e67b874888505",
+    "imageDigest": "sha256:ed741d1f028c4bd507c6eda71fb1dcc11e0815c0107afcbfcbaaaaa23d5a11bb",
+    "status": "PASS"
+  },
+  "precedes": [
+    "B3",
+    "B4",
+    "B5",
+    "B6",
+    "B7"
+  ],
+  "production": {
+    "baseline": "V1R4C6",
+    "changed": false,
+    "releaseStatus": "paused"
+  }
+}

tools/personal_weixin/README-B3-EVIDENCE.md

@@ -0,0 +1,117 @@
+# Personal-Weixin B3 evidence collection
+
+此目录提供 fail-closed 的 owner evidence intake/verification 工具。工具不访问网络、不读取
+credential 文件，也不负责制造 traffic；它只验证 owner 在受限存储中已经采集的真实材料。
+
+## 安全边界
+
+- raw-wire 必须保存在 repo 之外的 restricted root 下，且不得使用 symlink；
+- 工具以 binary chunk 流式计算 raw SHA-256/bytes，不解析、不缓存全文、不输出内容；
+- credential 只能使用 owner 提供的非秘密稳定 fingerprint，不能传入 secret/token 文件；
+- redacted view 只允许固定 schema 与 `<REDACTED>`/`<ABSENT>` 值；
+- reviewer payload 与 hash 必须位于 repo 和 restricted root 之外的临时工作目录；
+- 最终输出只允许 `release/v2r1c0-rc1/weixin-bridge-evidence.json`；
+- 模板本身证据为空，直接执行必须得到 `BLOCKED_EVIDENCE_REQUIRED`。
+- **trust policy 必须**：`prepare-review` 和 `finalize` 均强制 `--trust-policy`。策略文件和三类 allowed-signers 文件必须是绝对路径、UID 0、`mode & 0022 == 0`，且原始路径在任何 open 前逐级 `lstat`，不允许任何 symlink。工具会安全读取 allowed-signers 并重算 SHA-256；与 policy 不一致即阻塞。
+- **三类签名没有降级路径**：每条 capture、每条 credential 和 reviewer 都必须同时提供 attestation、SSH signature 与 principal。工具使用固定 `/usr/bin/ssh-keygen`、最小环境和固定超时实际执行 `ssh-keygen -Y verify`。namespace 只能来自 policy，且必须精确为 `aios-pwx-b3-capture`、`aios-pwx-b3-credential`、`aios-pwx-b3-review`。
+- **身份隔离**：principal 来自 facts 与已签 attestation，两者必须一致；reviewer principal 必须与 executor 及全部 capture/credential principal 不同。
+- **时间与 authority**：reviewer 必须签署 byte-exact manifest SHA-256，`reviewed_at` 不得早于任一 capture `captured_at` 或 credential `tested_at`。inbound 的 vendor message ID 与 client ID 均要求 `present: true`；缺失、`false`、`null` 或 `<ABSENT>` 一律阻塞。`client_id` 永远非权威。
+- **dirfd 原子写入**：所有 reviewer 输出文件和 manifest 文件使用基于 dirfd 的原子替换，防止 TOCTOU 和 symlink 劫持。
+- **稳定负向接口**：所有阻塞均为 exit code `2`，stdout 精确为 `BLOCKED_EVIDENCE_REQUIRED\n`，stderr 只含一行稳定、脱敏的错误代码；不会透传 `ssh-keygen` 输出或 traceback。
+
+## 1. 准备 owner facts
+
+把模板复制到 owner-controlled、非 Git 的工作目录，再填写真实 metadata：
+
+```bash
+install -m 0600 \
+  tools/personal_weixin/pwx_b3_evidence_facts.template.json \
+  "$OWNER_WORK/pwx-b3-facts.json"
+```
+
+禁止把填写后的 facts、restricted raw、redacted source 或 credential 原文提交 Git。
+`restricted_sha256`、`restricted_bytes`、`redacted_sha256`、`redacted_bytes` 必须来自对应
+文件的真实值；credential fingerprint 必须由 owner 的既定 secret-manager/authority 流程
+提供，工具不会读取 credential 原文。
+
+facts 中每条 `raw_wire` 必须另含 `principal`、`attestation_path` 和 `signature_path`。
+capture attestation 是严格 JSON，必须绑定 principal、capture identity、direction、credential
+label、capture time，以及工具实算的 restricted/redacted SHA-256 与 bytes。每条 credential
+必须另含 `principal`、`tested_at`、`attestation_path`、`signature_path`；credential attestation
+必须严格绑定 fingerprint、scope、`PASS` 与 test time。任何字段缺失、额外字段或不一致都会
+fail-closed。
+
+Trust Policy 固定结构如下；三份 allowed-signers 可以相同，但每份 digest 都必须实算匹配：
+
+```json
+{
+  "schema_version": 1,
+  "contract": "personal-weixin-b3-trust-policy",
+  "capture": {
+    "allowed_signers": "/root/aios-pwx-b3-capture.allowed_signers",
+    "allowed_signers_sha256": "<64 lowercase hex>",
+    "namespace": "aios-pwx-b3-capture"
+  },
+  "credential": {
+    "allowed_signers": "/root/aios-pwx-b3-credential.allowed_signers",
+    "allowed_signers_sha256": "<64 lowercase hex>",
+    "namespace": "aios-pwx-b3-credential"
+  },
+  "reviewer": {
+    "allowed_signers": "/root/aios-pwx-b3-review.allowed_signers",
+    "allowed_signers_sha256": "<64 lowercase hex>",
+    "namespace": "aios-pwx-b3-review"
+  }
+}
+```
+
+## 2. 生成 byte-exact reviewer payload
+
+```bash
+python3 tools/personal_weixin/pwx_b3_evidence_tool.py prepare-review \
+  --facts "$OWNER_WORK/pwx-b3-facts.json" \
+  --trust-policy "$OWNER_WORK/pwx-b3-trust-policy.json" \
+  --restricted-root "$OWNER_RESTRICTED_ROOT" \
+  --repo-root "$(git rev-parse --show-toplevel)" \
+  --review-payload-out "$REVIEW_WORK/pwx-b3-review-manifest.json" \
+  --review-hash-out "$REVIEW_WORK/pwx-b3-review-manifest.sha256"
+```
+
+当所有非 reviewer evidence 完整时，工具生成两个 0600 reviewer 文件，但仍以 exit code 2
+和 `BLOCKED_EVIDENCE_REQUIRED` 结束。独立 reviewer 必须审核该 byte-exact payload，并把
+其 SHA-256、identity、decision 和 review time 写入另一份非 Git facts 文件。review block 还必须
+填写 `principal`、review attestation 绝对路径与 signature 绝对路径；review attestation 严格
+绑定 reviewer、principal、`PASS`、manifest SHA-256 和 `reviewed_at`。
+
+## 3. Finalize
+
+```bash
+python3 tools/personal_weixin/pwx_b3_evidence_tool.py finalize \
+  --facts "$OWNER_WORK/pwx-b3-facts-reviewed.json" \
+  --trust-policy "$OWNER_WORK/pwx-b3-trust-policy.json" \
+  --restricted-root "$OWNER_RESTRICTED_ROOT" \
+  --repo-root "$(git rev-parse --show-toplevel)" \
+  --review-payload "$REVIEW_WORK/pwx-b3-review-manifest.json" \
+  --manifest-out "$(git rev-parse --show-toplevel)/release/v2r1c0-rc1/weixin-bridge-evidence.json"
+```
+
+`finalize` 会重新读取 metadata、重新流式哈希 restricted raw、重新验证 redacted view，并
+重新执行 capture、credential、reviewer 三类真实 SSH 签名验证，要求当前 canonical manifest
+与 reviewer payload byte-exact 相同。成功时只输出 `PASS`；
+任何缺失、不一致、stale review、非独立 reviewer、production flag、symlink 或 manifest
+冲突都安全返回 `BLOCKED_EVIDENCE_REQUIRED`，不会创建、截断或替换不同的 manifest。
+
+## Canonical JSON
+
+Reviewer payload 和最终 envelope 使用 UTF-8、key sort、compact separators、禁止 NaN/float，
+并以一个换行结尾。重复 JSON key、未知字段和非 timezone RFC3339 timestamp 都会阻塞。
+
+## 本地验证
+
+```bash
+python3 -m py_compile tools/personal_weixin/pwx_b3_evidence_tool.py
+python3 -m json.tool tools/personal_weixin/pwx_b3_evidence_facts.template.json >/dev/null
+python3 tools/personal_weixin/pwx_b3_evidence_tool.py --help
+```
+
+不要把 reviewer 临时文件或真实 owner facts 放入 repository。

tools/personal_weixin/pwx_b3_evidence_facts.template.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": 1,
+  "contract": "personal-weixin-b3-owner-evidence-facts",
+  "executor": "Codex isolated runner",
+  "lineage": {
+    "foundation_implementation_commit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
+    "foundation_result_commit": "64a71b6199a8e2bd609ba145349e67b874888505",
+    "r10_lineage_commit": "74e603c0c943501110577dbe3c7f6a0b18b8ec7d",
+    "evidence_gate_commit": "62a4067cf7a462ebe7cf29524238bc5d0a70b813",
+    "upstream_audit_commit": "b2f5f531019a70801444987dbb97dc1f69cf47de",
+    "authorization_commit": "\u00611f933e500151dc8afc1b25b30448a31899a8f64",
+    "b4_amendment_commit": "1d334b1ccaac54c3c3ec4dd84693ab68fc67cef3",
+    "authorization_result_commit": "8af40af62927caf631ea6fc682155f0f65cbd1a6"
+  },
+  "raw_wire": [],
+  "credentials": [],
+  "authority_map": {
+    "vendor_message_id_field": "$.msgs[*].message_id",
+    "client_id_field": "$.msgs[*].client_id",
+    "client_id_authoritative": false,
+    "mapping_verified": null,
+    "authoritative": [
+      "verified inbound vendor message_id"
+    ],
+    "non_authoritative": [
+      "local client_id",
+      "outbound correlation ID",
+      "local sequence",
+      "timestamp",
+      "content hash",
+      "outbound receipt ID"
+    ]
+  },
+  "mode": {
+    "name": null,
+    "production_traffic": false,
+    "writes_production": false,
+    "capture_only": true
+  },
+  "review": {
+    "reviewer": null,
+    "principal": null,
+    "independent_from_executor": null,
+    "decision": null,
+    "reviewed_manifest_sha256": null,
+    "reviewed_at": null,
+    "attestation_path": null,
+    "signature_path": null
+  },
+  "production": {
+    "baseline": "V1R4C6",
+    "changed": false,
+    "release_status": "paused"
+  }
+}