[D][Security] Unify Biscuit cold-lineage hash domain

[gnanirahulnutakki]

Part of #170 (Epic D, Phase 2). This is the remaining cold-verification lineage gap documented by ADR-018. It is separate from #295 / PR #298, which rejects holder-authored authority widening.

Goal

Make a Biscuit-derived A→B→C delegation chain independently verifiable across proxy process boundaries using one cryptographically verified ancestor hash domain. A holder-authored hash declaration must never become trusted ancestry merely because it is signed by the holder-controlled append key.

Verified current gap

• python/vibap/biscuit_passport.py::_context_from_blocks() synthesizes lineage entries with sha256(block_source_text).
• The proxy trusted lineage index stores sha256(whole_credential_bytes).
• Those domains cannot match during cold verification.
• ADR-016 documents the limitation; ADR-018 is still Proposed.
• [Critical] Reject holder-authored Biscuit authority widening #295 / PR fix(biscuit): reject holder authority widening #298 hardens authority monotonicity but intentionally leaves ADR-018 out of scope.

Biscuit's official format is an append-only signature chain and carries the last private key for offline attenuation. Therefore a fact added by the holder cannot be accepted as proof of its own parent bytes without verifier recomputation.

What to build

• Select and document one canonical ancestor hash domain that a cold verifier can recompute from the received credential and trusted state.
• Prefer whole-credential/verified-accumulator bytes. If the current Biscuit library cannot expose an authenticated prefix serialization, document the limitation and use a fail-closed sidecar/index design rather than trusting a declared fact.
• Bind each immediate parent edge and every ancestor used for revocation/cascade checks.
• Define legacy-token behavior explicitly. Unsupported legacy cold verification must fail closed with a stable reason, not silently fall back to live-session assumptions.
• Accept ADR-018 and synchronize the decision index/source-backed documentation.

Acceptance criteria

• Cross-process root→child→grandchild verification succeeds without live in-memory parent sessions.
• The verifier rejects forged declared parent hashes, re-parenting/splicing, block reordering/truncation, missing ancestors, and hash-domain confusion.
• Revoking any verified ancestor denies the descendant in cold verification.
• Valid live-session JWT and Biscuit paths remain compatible; the proof boundary is documented.
• Focused adversarial/property tests plus the full relevant Python suite pass.
• ADR-018 is Accepted with the actual implemented construction and alternatives.
• Public fixtures contain no credential private material, raw tokens, secrets, or host paths.
• PR targets dev from an isolated EXTENDED worktree with signed DCO commits and green CI.

Dependencies and non-goals

• Depends on the verifier monotonicity foundation in [Critical] Reject holder-authored Biscuit authority widening #295 / PR fix(biscuit): reject holder authority widening #298; rebase onto dev only after that PR lands, or explicitly stack without rewriting its history.
• Does not add monetary budgets or dangerous-action policy; those are separate Epic D — Provable delegation narrowing + cost/blast-radius gates #170 children.
• Does not claim generic Biscuit or DRP interoperability without independent evidence.

Primary sources

• Biscuit specification: https://doc.biscuitsec.org/reference/specifications
• Biscuit Datalog block scoping: https://doc.biscuitsec.org/reference/datalog
• DRP draft-10 multi-agent chain verification: https://datatracker.ietf.org/doc/html/draft-nelson-agent-delegation-receipts-10#section-10

[gnanirahulnutakki]

Claimed for a focused stacked implementation on gnanirahulnutakki/issue-309-biscuit-cold-lineage in an isolated EXTENDED worktree.

Verified entry state:

• live dev remains eb63d22361c45621df7c04884ee978b9bf0195c3
• dependency PR fix(biscuit): reject holder authority widening #298 is open, cleanly mergeable, exact-head green, and has no review decision
• this branch starts at immutable fix(biscuit): reject holder authority widening #298 head f395203db23ac1d49b4c8df49d903c855197cf73
• fix(biscuit): reject holder authority widening #298 history will not be rewritten; any [D][Security] Unify Biscuit cold-lineage hash domain #309 PR will explicitly stack on its feature branch until the dependency lands

Security patch contract: reproduce the current cross-process cold-lineage mismatch through the real Biscuit verifier, prove the authenticated serialization/accumulator material exposed by the installed library, then implement the narrowest fail-closed construction. Holder-authored hash declarations will not be accepted as trusted ancestry. Organic tests will cover a legitimate root→child→grandchild chain plus forged hashes, splicing/re-parenting, block manipulation, missing/revoked ancestors, legacy behavior, and live-path compatibility. ADR-018 will record the implemented proof boundary and alternatives.

No merge or completion is claimed.