Move CORA's background runtimes onto the door they actually arrive at

[xmap]

Part 4, the last code change in the plan behind #762 and #764. This is the one that removes the enforcement blocker.

The problem

35 call sites across 15 files still passed NIL_SENTINEL_ID as their arrival Surface. That resolves to the FRONT policy, bound to the HTTP door, so every one strict-denied at the surface check.

  live at 2-BM, shadow mode:
    in-process calls  →  wrong door  →  would be refused
    ~all of the near-miss volume in the log

  if you flipped to enforce today:
    live status page goes dark
    finished scans stop being registered

They now pass SYSTEM_IN_PROCESS_SURFACE_ID. conduit_id deliberately stays nil at the same sites — that axis resolves through trust_conduit_id and is a different question.

The status page also stops signing as SYSTEM_PRINCIPAL_ID (the fallback identity an unauthenticated HTTP request receives) and acts as the StatusPublisher agent #764 seeded for it.

The test that keeps it swept

An AST walk over surface_id= keyword bindings, not a grep. A grep would match the docstring in in_process_grants that quotes the very command used to find these sites, and the natural response to that misfire is an exclusion that quietly weakens the check. The allowlist is empty. A second test asserts the file enumerator actually found files, so the parametrized case cannot pass vacuously over an empty list.

What the sweep broke, and why that was the point

test_run_initiator_with_start_grant_starts_run failed. Its fixture policy takes seed_policy's default nil surface, so once the initiator changed doors the grant stopped matching and no Run was created. The test was right and the fixture was stale. Both policies in that file now bind the in-process surface, exactly as the deployment's generated rulebook does.

Its companion did NOT fail, and that was worse. ..._without_start_grant_is_denied_no_run kept passing — but post-sweep it was refused at the surface check before the command check was ever reached, so it would have passed just as well with StartRun granted. It had silently stopped testing its own name. Binding its surface restores the refusal to the command grant, verified by granting StartRun and watching it fail.

Verification

55,349 unit + architecture + contract, 1,369 integration. ruff, pyright, tach clean.

Independently re-verified rather than inherited:

• Exactly 35 sites swept; the only remaining NIL_SENTINEL_ID in src/ is the in_process_grants docstring, correctly untouched. In-process sites went 10 → 45.
• Cross-checked the sweep against Declare in source what each in-process agent may do, and give the status page a name #764's grant table: every named agent constant now authorizing in-process has a table entry, no gaps. The six sites whose principal is injected or caller-supplied are the documented parameterized cases.
• Both required mutation checks run myself: reverting one swept site turns the architecture test red naming that file and line; reverting the status page's principal turns a test red, so that switch is genuinely pinned.
• Swept the rest of the integration tier for the same latent problem (nil-surface fixture policy plus a now-in-process caller). The two other TrustAuthorize integration files call authorize() directly with no surface argument, so port default and policy both sit at nil and stay self-consistent.

Deploying this

Order matters, and it is not the obvious one:

  1. post the generated 44-pair rulebook   ← inert; nothing knocks yet
  2. re-point TRUST_IN_PROCESS_POLICY_ID
  3. deploy this sweep                      ← callers arrive, rules already there
  4. re-read the log, near-misses → ~zero

Reversed, the callers move to a door with no rules and simply fail differently: "not on the list" instead of "wrong door". POLICY_POSTURE stays shadow throughout; enforcement remains a separate decision after step 4 reads clean.

Process

Implemented by a Sonnet subagent from a scoped brief; it stopped mid-verification without reporting, so the contract and integration tiers, both mutation checks, the grant-table cross-check, and the two test fixes above are mine.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
apps/api/src/cora/agent/subscribers
authority_revocation_holder.py
caution_promoter.py
ratification_hold.py					114
ratification_release.py					138
apps/api/src/cora/api
_calibration_watcher.py
_campaign_watcher.py
_clearance_expirer.py
_clearance_watcher.py
_durable_copy_registrar.py
_experiment_steerer.py
_flag_watcher.py
_procedure_watcher.py
_run_initiator.py
_run_supervisor.py					918
_status_push.py
Project Total

This report was generated by python-coverage-comment-action