Strict mode gates (signatures + caps)

[Zyonic88]

Strict mode gates (signatures + caps)

Labels: phase:1, area:security, type:feature
Milestone: Self-Incorporation v1

Description

Enable strict mode which enforces .aether HMAC signatures, plugin ed25519 signatures,
and deny-by-default capability policy.

Acceptance Criteria

• When AETHERRA_SELFINC_STRICT=1:
  • .aether HMAC signature verification must pass, else quarantine
  • Plugin artifacts must verify ed25519 signature, else quarantine
  • Deny-by-default capability policy; require explicit allowlist
• Quarantine includes remediation guidance in logs/messages
• Unit tests for positive path and quarantine path

[Zyonic88]

Tracking links for this issue

• Backlog source: docs/issues/selfinc_v1_backlog.md
• Related bodies directory: docs/issues/bodies/
• Release notes template: docs/issues/release_notes_template.md

When closing this issue, please link corresponding PR(s) and note any new tests added under tests/ and documentation updates under docs/.

[Zyonic88]

Checklist — Strict mode gates

• Gates: AETHERRA_SELFINC_STRICT=1 path in integrator/kernel
• Signatures: verify .aether HMAC + plugin ed25519; quarantine on failure
• Caps: deny-by-default + allowlist enforcement
• Tests: positive + quarantine paths under tests/
• Docs: env flags and remediation guidance