Infrastructure: Tighten Storybook manifest provenance and native helper trust handoff #4445

Current status - 2026-11-07

Blocked by F2 #4442's ownership/publication contract (in #4463). This trust-hardening work is not delivered by the controlled-ingress or native-smoke fixes.

Remaining acceptance stays: separate runtime-bridge and attach-credential secrets; centralized/versioned generated schemas with unknown-field rejection; independent helper provenance verification in the actual spawning process; owner-private POSIX/Windows storage boundaries; controlled Metro generation fixtures. A hash in the same editable manifest is not independent trust.

Keep the existing F3/F5/F6 server.cjs integration ordering. This issue is the remaining trust gate for F9 #4449; it does not require relocating the channel process first.

Goal

Native helper provenance crosses an editable generated manifest, the macOS attach lease and the runtime bridge reuse the same nonce, and generated schemas are not centralized or versioned. Tighten the trust handoff so tampered artifacts fail before spawn and each secret has one purpose.

Part of #4435 (plan item F6).

Scope

• Owner: Storybook generated configuration.
• Paths (under packages/agentic/): storybook-desktop/src/driver/driverManifest.ts, nonce and lease handling in storybook-desktop/src/cli/DesktopStorybookCli.ts, storybook-desktop/config/server.cjs, storybook-desktop-runtime/config/metro.cjs, and controlled config fixtures.
• Separate runtime bridge and attach-credential secrets.
• Centralize and version generated schemas; reject unknown manifest fields.
• Reverify helper provenance in the process that actually spawns it. A hash stored in the same editable record is not independent trust.
• Exercise Metro generation only in controlled fixtures, because loading its config has write effects.

Dependencies

• Blocked by: F2 Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442 (ownership and publication contract).
• Unblocks: F9 Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449.
• Parallel with: F5 Infrastructure: Authorize and settle every controlled Storybook mutation entrance #4443, F10-M Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446, F10-W Infrastructure: Implement neutral Windows desktop application ownership and containment #4447, and F11 Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448.
• Coordination: merge after F3 Infrastructure: Add owned-process lifelines and typed desktop service readiness #4444's server.cjs edits and sequence with F5's. F6 and F9 each own their phase of DesktopStorybookCli.ts.

Acceptance

• Tampered or mismatched artifacts fail before spawn.
• Unknown manifest fields fail.
• Bridge and attach nonces are independent.
• Secrets use owner-private POSIX modes and the appropriate Windows ACL or private-storage boundary.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: the Storybook row of "Full-submission checklist" in packages/agentic/desktop-test/references/current-status.md.
• Retired plan: driver-next.md at 0569e1b86, section 8 (F6).