MOB-74 — plugin envelope v2: verify signature before eval

[GenericJam]

Security fix. Before this change, MobDev.Plugin.Manifest.load/1 called Code.eval_file("priv/mob_plugin.exs") before any signature check. The v1 signature covered the eval'd manifest map plus source hashes but not the manifest bytes themselves, so a malicious plugin could put a side-effect expression alongside an innocent map literal:

# priv/mob_plugin.exs
File.write!("/tmp/pwned", "evil ran")   # side effect
%{name: :innocent, mob_version: "~> 0.7", ...}

Code.eval_file executed the side effect on the consumer's machine, the returning map matched what was signed, verification passed clean — RCE at build time.

MobDev.Plugin.activated/0 (called from every mix mob.deploy), mix mob.plugins, mix mob.audit_plugins, and MobDev.Plugin.Report were all attack surfaces.

Envelope v2

• Manifest bytes join the signed file_hashes list. Sign.referenced_files/2 now always prepends priv/mob_plugin.exs.
• v2 payload signed = %{file_hashes, envelope_version: 2}. No manifest map field — its authoritative representation is the on-disk bytes.
• v2 envelope on disk carries file_hashes alongside the signature. Verifiers rebuild the payload from the envelope's own file_hashes; they don't need the eval'd manifest.
• Verify.verify_plugin/1 (was /2) reads the envelope, verifies the signature against the reconstructed payload, then re-hashes each listed file on disk to catch tampering. No Code.eval_file in the whole path.
• Verify.load_verified/2 is the new safe consumer entry point: verify → then eval. A plugin that fails verification never has its .exs bytes evaluated on the consumer's machine.
• v1 envelopes are hard-refused with :envelope_v1_unsupported — accepting them silently reopens the CVE. Every plugin signed with a mob_dev that predates this change must be re-signed on the consumer's next build.

Consumer migrations

• MobDev.Plugin.activated/0 → Verify.load_verified/2 (primary CVE surface).
• mix mob.plugins, mix mob.audit_plugins, MobDev.Plugin.Report same.
• SignatureGate.check_activated/1 tier-0 filter switched from is_map(manifest) to Manifest.manifest_present?/1 — a nil manifest can now also mean "verify refused eval", and skipping those silently would defeat the fix.
• mix mob.plugin.sign, mix mob.plugin.keygen, mix mob.plugin.trust, mix mob.validate_plugin still call Manifest.load/1 directly — they're author-side / first-trust-decision, no attack vector. Documented in the ADR; MOB-185/186/187 walk the longer-term path to data-only manifests (safe by construction).

Acknowledged-unsafe escape hatch preserved

Pre-commit adversarial review caught a regression in the initial commit — every unsigned plugin was stripped from the build silently, breaking the documented :acknowledge_unsafe_plugins opt-in for local dev. Fixed as follow-up commit:

• Verify.load_verified/2 takes acknowledged_unsafe: keyword. When true, only :missing_signature maps to a successful eval — every other failure (:invalid_signature, :missing_pubkey, :envelope_v1_unsupported) still refuses.
• MobDev.Plugin.activated_with_verify/0 fetches the acknowledged list via SignatureGate.acknowledged_unsafe/0 (now public) and passes the opt for those plugins.
• Two revert-verified tests cover the escape hatch and its narrow scope.

Tests

Load-bearing revert-verified tests:

• sign_test.exs: manifest bytes are in signed file_hashes; the priv/mob_plugin.exs contents alter the hash.
• verify_test.exs: marker-file side effect never runs when signature fails (the CVE class the fix closes).
• verify_test.exs: acknowledged_unsafe: true loads an unsigned manifest; still refuses tampered.
• signature_gate_test.exs: nil-manifest tier-1 plugins produce named errors (not silent skip).

Full suite: 2460 pass, 0 fail. Credo strict: clean. Warnings-as-errors: clean.

Pre-existing mix mob.security_scan HIGH finding on ios_device exqlite drift is inherited from master, not from this PR (verified by checking out origin/master for the scan file).

Breaking change

Every plugin signed with a mob_dev that predates envelope v2 must be re-signed. First-party plugins get re-signed as part of the next mob_dev release; third-party authors see the friendly SignatureGate error with the re-sign hint on their next consumer build.

See:

• decisions/2026-09-11-plugin-envelope-v2-verify-before-eval.md
• MOB_PLUGIN_SECURITY.md (existing)

Follow-ups on file: MOB-185 (linter), MOB-186 (migrate first-party plugins to declarative subset), MOB-187 (static manifest at 1.0).

Closes MOB-74.