build: make verify-build take an explicit expectation and a build receipt (closes #309)

verify-build read its expectation from AUTISTMASK_DEBUG in its own environment
and the Makefile invoked it bare, so an operator with that variable exported
who ran the release target got an INSECURE debug build — every wallet it
creates uses the publicly committed test phrase — verified green, exit 0. It
also had no provenance: a 26-byte file containing the right marker string
passed, the content script and manifest.json were never inspected, and an
entire hand-written dist/ passed.

--expect release|debug and --receipt PATH are now both required, with no
defaults and nothing read from the environment. build.js records every file it
emits with its sha256 and writes the receipt; the Makefile mktemps it outside
the repo per invocation with a trap, and build.js refuses a receipt path inside
dist/. Verification runs three passes in a load-bearing order — receipt shape,
full dist/ walk, then per-file bytes — so an unwalkable subtree cannot make
files look absent. dist/constants-bundles.txt, which was an unsigned trust root
living inside the tree it vouched for, is gone.

What this proves is bounded and stated as such: dist/ is byte-for-byte the
output of the build.js run that just finished, within one make build
invocation. It proves nothing about the honesty of the source tree or build.js,
and nothing to anyone handed a dist/ from elsewhere — that is signing, #310.
The standalone make verify-build target is removed because its only input would
be dist/ itself, i.e. the artifact vouching for itself.

Verified: make check green, test-verify-build 39 cases (was 18), test-e2e 55/55
and test-e2e-firefox 8/8 with make build running uncached inside both images.
All four original bypasses now exit 1. Mutations: digests disabled fails
exactly 4 cases, dropping the dist/ walk fails exactly 8, restoring the ambient
fallback fails exactly 1.

README.md

@@ -48,28 +48,57 @@ Load the extension:
 
 ### Debug Builds
 
-`make build` always produces a release build: the build-time `DEBUG` constant is
-`false`, so wallet creation uses real entropy and the red banner is off. To
-produce a debug build instead, set `AUTISTMASK_DEBUG=1` in the environment:
+`make build` never hands back a debug build. `make build-debug` is the only
+target that produces one:
 
 ```bash
-make build-debug          # or: AUTISTMASK_DEBUG=1 make build
+make build-debug
 ```
 
-Only the exact value `1` enables it; any other value (including unset, empty, or
-`true`) yields a release build, so a typo cannot accidentally ship the debug
-behavior. The build prints which mode it used. See the
+`AUTISTMASK_DEBUG=1` still selects the debug compile, and only the exact value
+`1` does; any other value (including unset, empty, or `true`) yields a release
+build, so a typo cannot accidentally ship the debug behavior. But it is the
+compiler's input, not the verifier's: if it happens to be exported in the shell
+that runs `make build`, that target compiles a debug bundle and then **fails**,
+because it tells `script/verify-build` in so many words that it was supposed to
+produce a release build. It used to be that the verifier read the same variable
+out of its own environment, agreed with itself, and reported a debug artifact as
+verified. The build prints which mode it used. See the
 [DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
 distribute a debug build** — every wallet it creates gets the same publicly
 known test recovery phrase.
 
-Both builds end by running `script/verify-build`, which reads the compiled
+Both targets end by running `script/verify-build`, which reads the compiled
 `DEBUG` state back out of the emitted bundles and fails the build if it is not
 the one that was asked for. The test suite cannot check this: it loads
 `src/shared/constants.js` outside a bundle, so it only ever sees the fallback
 value. The assertion is on the artifacts because that is where the property
 lives.
 
+### Build Receipts
+
+`build.js` records every file it emits — path, sha256, and whether the file is
+one of the bundles containing `src/shared/constants.js` — into a build receipt,
+and `script/verify-build` checks `dist/` against that receipt: every recorded
+file present with exactly the recorded bytes, every audited bundle carrying the
+requested `DEBUG` marker, and nothing under `dist/` that the build did not
+write. The `Makefile` creates the receipt path with `mktemp` per invocation,
+outside the repo, and deletes it afterwards.
+
+That is what ties the check to a build rather than to a directory. What it
+establishes is narrow and worth stating exactly: `dist/` is byte for byte the
+output of the `build.js` run that just finished, with nothing added, removed or
+altered in between. It establishes nothing about whether the source tree or
+`build.js` were honest, and it offers nothing to someone handed a `dist/` from
+elsewhere — without the receipt from its own build there is no input to the
+check. Verifiable provenance for a third party is signing, which this is not.
+
+There is deliberately no target that re-verifies an existing `dist/` on its own.
+The list of files to check has to come from the build that produced them; read
+back out of `dist/`, it is the artifact vouching for itself, which is how a
+26-byte file containing only the marker string, a hostile content script, and an
+entire hand-written `dist/` all used to verify green.
+
 ## Entrypoints
 
 This repository adheres to the
@@ -114,20 +143,26 @@ provide:
   serves. Run deliberately, never as part of a build: the output is committed
   and there is no runtime fetch, so the shipped list is as fresh as the last
   vendoring run that was released
-- `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
-  `dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
-  off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
-  `make build` and `make build-debug`; fails loudly rather than passing if it
-  cannot determine a bundle's state. Not part of `make check`, which does not
-  depend on build artifacts existing.
+- `script/verify-build --expect release|debug --receipt PATH` — assert that
+  `dist/` is exactly what the build that just ran emitted, and that the compiled
+  `DEBUG` state of the bundles in it is the one that was asked for. Both
+  arguments are required and neither has a default: the expected mode is stated
+  by the caller rather than read from `AUTISTMASK_DEBUG`, and the file list
+  comes from the build's receipt rather than from `dist/` (see
+  [Build Receipts](#build-receipts)). Run automatically at the end of
+  `make build` and `make build-debug`; fails loudly rather than passing whenever
+  it cannot determine something. Not part of `make check`, which does not depend
+  on build artifacts existing.
 - `script/test-verify-build` — exercise every failure mode of
   `script/verify-build` against a fixture tree in a temp dir, asserting the exit
-  status and the message of each. Part of `make check`; it reads no build
-  artifacts and writes nothing under `dist/`. The cases that depend on file
-  permissions cannot mean anything for a process that is not subject to them, so
-  the harness proves its runner against a mode-000 file before counting them,
-  dropping to an unprivileged user when run as root; if it cannot, it skips
-  those cases and says so in a banner rather than passing them.
+  status and the message of each, and read the `make build` and
+  `make build-debug` recipes back out of `make -n` to check that they pass the
+  mode as an argument on a scrubbed environment. Part of `make check`; it reads
+  no build artifacts and writes nothing under `dist/`. The cases that depend on
+  file permissions cannot mean anything for a process that is not subject to
+  them, so the harness proves its runner against a mode-000 file before counting
+  them, dropping to an unprivileged user when run as root; if it cannot, it
+  skips those cases and says so in a banner rather than passing them.
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: plain `docker build .`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
@@ -140,9 +175,10 @@ The Makefile shims to those. It also carries a few targets that have no
   of `script/bootstrap`. Frozen so a stale `yarn.lock` fails instead of being
   silently rewritten. Use `make setup` for a fresh clone.
 - `make hooks` — shims to `script/install-precommit`
-- `make build` — build the extension into `dist/chrome/` and `dist/firefox/`
-- `make build-debug` — the same build with `AUTISTMASK_DEBUG=1` (see
-  [Debug Builds](#debug-builds))
+- `make build` — build the extension into `dist/chrome/` and `dist/firefox/`,
+  then verify the result against the build's receipt as a release build
+- `make build-debug` — the same build with `AUTISTMASK_DEBUG=1`, verified as a
+  debug build (see [Debug Builds](#debug-builds))
 - `make clean` — remove `dist/`
 - `make dev` — build in watch mode