security(registry): enforce persistent dual-use content metadata and DISCLOSURE

Goal

Support npm-style dual-use declarations so legitimate security tooling can explain security-relevant behavior without bypassing malware controls.

Reference: https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/

Policy

• Accept a bounded contentPolicy declaration in package metadata.
• A declared package must include a root DISCLOSURE text file in the actual uploaded archive.
• Reject binary, oversized, missing, nested-only, or empty disclosures.
• Once any semantic version of a package declares dual-use content, future versions must retain both contentPolicy and the root disclosure.
• Declaration does not force a clean verdict and does not permit malware.
• Persist the declaration and disclosure digest/size, not disclosure text, in public metadata.
• Require a strongly authenticated publication method when auth provenance can distinguish it; reject known bypass-2FA/direct-token methods. Document current Pantry auth limitations and the rollout path.

Acceptance criteria

• Archive inspection handles npm package/DISCLOSURE roots and rejects traversal/ambiguous duplicate paths.
• Tests cover valid text, missing/empty/binary/oversized/nested disclosures.
• Tests prove declaration persistence across versions.
• Existing non-dual-use packages continue to publish.
• Documentation gives maintainers a concrete package.json and DISCLOSURE example.

Implementation status (2026-07-28): policy enforcement is code complete in the current worktree, pending review/merge.

Implemented:

• contentPolicy must match between request metadata and packaged package.json.
• Exactly one root DISCLOSURE text file is required, bounded to 64 KiB and valid non-empty UTF-8.
• Only disclosure digest and size are retained; disclosure contents are never logged.
• Once a package declares dual-use content, later versions cannot silently remove the declaration.
• Pantry bearer tokens do not currently carry 2FA/OIDC assurance, so dual-use releases fail with DUAL_USE_STRONG_AUTH_REQUIRED unless they use the operator-reviewed legacy credential. This avoids claiming stronger authentication than the token model can prove.
• Tests cover valid declarations, missing/mismatched/invalid disclosures, persistence, and the strong-auth restriction.

A future token model with verifiable 2FA or trusted-publisher provenance can replace the operator-review bridge without weakening the policy.

Reusable implementation update (local worktree, pending merge/deploy): dual-use disclosure is enforced at publish time for every package archive surface. Packages that declare dual-use/security-sensitive functionality must include the required content-policy metadata and DISCLOSURE file; malformed or missing disclosure fails publication before any installable object or metadata is committed. Coverage includes route tests and the shared validation module. This issue should remain open until the change is merged and production behavior is exercised.

Implemented on main in a65b2bda8 and 02b16e2ff. Publish-time dual-use disclosure validation and its API enforcement are now landed.