Layer 5: extract the Hookwall and compose the gates tighten-only
Claude+1: Claude Opus 5.5
Unverified signature
ad39d98
gate/hookwall extracts six modules (hookwall, spawn_gate, sign_gate,
tier_gate, crypto, cosign_chain) plus the first 75 lines of syscall from
asolaria-federation-1024@dc1da1a9 kernel/core/src. The parent kernel-core
crate is not copied: its other modules carry third-party data. Library logic
is unchanged; only doc comments (false persistence, policy-file, GNN,
enforcement and wiring claims, one drive path) and crypto test-key literals
(same values, routed through a TEST-ONLY helper) differ. PROVENANCE.md
records each file's upstream blob SHA-1, its sha256 here, and every edited
line before and after. The only dependency is sha2; the upstream declared
ed25519-dalek and zeroize, but no copied code calls them.
Two upstream limits are pinned by tests and documented rather than patched:
crypto's tags are sha256 placeholders derived from the public key, so they
are forgeable and are not ed25519; and sign_gate's VIRUS rescue clears any
deny tag. Two style lints are allowed at the CI gate so …
