Bind audit publishers and randomize operation IDs

Why: Clock-derived IDs could collide and string-scoped hosts could impersonate a registered audit publisher.

Evidence: Fixed-clock concurrent, ambiguous private offset, forged scoped-host, and registered publisher RED-to-GREEN tests; go test ./... -count=1 and targeted race test passed locally as SELF.

Impact: Generate 192-bit host IDs, reject ambiguous explicit offsets, and issue a publication-only capability at verifier registration.

Refs: Stage 5 W9; approved Stage 6 audit-link design adjustment r1; review of a8fa2fe

.task/feature-rdm-two-trees-project-audit.md

@@ -13,6 +13,8 @@
 - Command audit stores the current verified account display name at write time; old rows expose `not-recorded`. Public receipts omit raw payload and parameter digest. Cursor uses project-and-owner scoped source cutoff.
 - Initial commit `c8dd169a1fdc1451fab3b475c14f9636a7f5bf6c` exposed only the actor-owned project slice. The next local increment fixes button actor propagation and adds a trusted domain-commit link publisher, verifier callback, exact linked metadata read, current `audit.read` and per-object metadata checks, and durable idempotency. Unlinked personal conversations remain private.
 - Trusted command dispatch now creates an operation ID before calling the compiled handler and passes that ID through `extension.Request`. The handler can commit the same ID with its domain event/outbox; the final Backend audit/receipt uses it. Client `params.operationId` is ignored. An outbox link request with `HostAuditOffset=0` resolves a unique committed host row by owner, fixed project, and operation ID; a missing row returns retryable `ErrProjectAuditPending`, while duplicate rows fail closed. The separate idempotency key still controls retry equivalence.
+- Independent review of `a8fa2fe` found two P2 security defects: clock-based operation IDs could collide; and `NewScopedHost(owner,"rdm")` let another compiled plugin self-report the publisher's plugin ID. The new local increment uses 192 bits from `crypto/rand` for each host-generated operation ID. Both zero-offset and explicit-offset publication require a unique committed row for owner/project/operation; a historical duplicate rejects publication, including attempts to link another private command. Verifier registration returns a private `ProjectAuditPublisherFactory` for the registering plugin's background outbox; a generic scoped Host has no publisher method. Fixed-clock concurrent IDs, forged params, ambiguous private offset, forged scoped Host, and legitimate registered publisher each have focused tests.
+- The minted publisher exposes only `ProjectAuditPublisher`, not the full owner-scoped `Host`; tests reject attempts to use `NewScopedHost` with a self-reported `rdm` string as publisher authority. A publisher is a registration-time capability, while `IdempotencyKey` remains the separate retry identity.
 - Exact-source linked reads do not enumerate hidden links or reveal raw payload, private conversation ID, or content. Body disclosure and a broad project link list are not implemented; the public coverage reports the narrower capability.
 
 ## Verification and remaining work

internal/app/project_audit.go

@@ -13,11 +13,41 @@ import (
 // projectAuditSlot binds the audit.read policy to its registering domain plugin.
 // A different plugin cannot borrow that policy through its own Host handle.
 type projectAuditSlot struct {
-	mu       sync.RWMutex
-	holder   string
-	check    extension.ProjectAuditAuthorizer
-	verifier extension.ProjectAuditLinkVerifier
-	disclose extension.ProjectAuditDisclosureAuthorizer
+	mu             sync.RWMutex
+	holder         string
+	check          extension.ProjectAuditAuthorizer
+	verifier       extension.ProjectAuditLinkVerifier
+	disclose       extension.ProjectAuditDisclosureAuthorizer
+	publisherToken *auditPublisherToken
+}
+
+// This identity is available only to the publisher factory returned at
+// registration. A caller-provided pluginID cannot manufacture the pointer.
+type auditPublisherToken struct{ marker byte }
+
+type projectAuditPublisherFactory struct {
+	caps     hostcaps
+	pluginID string
+	token    *auditPublisherToken
+}
+
+func (f projectAuditPublisherFactory) ForOwner(owner string) (extension.ProjectAuditPublisher, error) {
+	if owner == "" || f.token == nil {
+		return nil, extension.ErrProjectAuditDenied
+	}
+	return projectAuditPublisher{caps: f.caps, owner: owner, pluginID: f.pluginID, token: f.token}, nil
+}
+
+type projectAuditPublisher struct {
+	caps     hostcaps
+	owner    string
+	pluginID string
+	token    *auditPublisherToken
+}
+
+func (p projectAuditPublisher) PublishProjectAuditLink(ctx context.Context, req extension.ProjectAuditLinkRequest) (extension.ProjectAuditLinkReceipt, error) {
+	h := inprocHost{caps: p.caps, owner: p.owner, pluginID: p.pluginID}
+	return h.publishProjectAuditLink(ctx, req, p.token)
 }
 
 func (s *projectAuditSlot) register(pluginID string, check extension.ProjectAuditAuthorizer) error {
@@ -33,17 +63,18 @@ func (s *projectAuditSlot) register(pluginID string, check extension.ProjectAudi
 	return nil
 }
 
-func (s *projectAuditSlot) registerVerifier(pluginID string, verify extension.ProjectAuditLinkVerifier) error {
+func (s *projectAuditSlot) registerVerifier(pluginID string, verify extension.ProjectAuditLinkVerifier) (*auditPublisherToken, error) {
 	if pluginID == "" || verify == nil {
-		return extension.ErrProjectAuditUnsupported
+		return nil, extension.ErrProjectAuditUnsupported
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if s.verifier != nil || (s.holder != "" && s.holder != pluginID) {
-		return errors.New("extension: project audit verifier already registered")
+		return nil, errors.New("extension: project audit verifier already registered")
 	}
 	s.holder, s.verifier = pluginID, verify
-	return nil
+	s.publisherToken = &auditPublisherToken{marker: 1}
+	return s.publisherToken, nil
 }
 
 func (s *projectAuditSlot) registerDisclosure(pluginID string, disclose extension.ProjectAuditDisclosureAuthorizer) error {
@@ -78,17 +109,21 @@ func (r recordRegistry) RegisterProjectAuditAuthorizer(check extension.ProjectAu
 	return reg.RegisterProjectAuditAuthorizer(check)
 }
 
-func (r compiledRegistry) RegisterProjectAuditLinkVerifier(extension.ProjectAuditLinkVerifier) error {
-	return errors.New("extension: declarative plugins cannot register project audit link verifiers")
+func (r compiledRegistry) RegisterProjectAuditLinkVerifier(extension.ProjectAuditLinkVerifier) (extension.ProjectAuditPublisherFactory, error) {
+	return nil, errors.New("extension: declarative plugins cannot register project audit link verifiers")
 }
 func (r compiledRegistry) RegisterProjectAuditDisclosureAuthorizer(extension.ProjectAuditDisclosureAuthorizer) error {
 	return errors.New("extension: declarative plugins cannot register project audit disclosure authorizers")
 }
-func (r pluginRegistry) RegisterProjectAuditLinkVerifier(verify extension.ProjectAuditLinkVerifier) error {
+func (r pluginRegistry) RegisterProjectAuditLinkVerifier(verify extension.ProjectAuditLinkVerifier) (extension.ProjectAuditPublisherFactory, error) {
 	if r.caps.projectAudit == nil {
-		return extension.ErrProjectAuditUnsupported
+		return nil, extension.ErrProjectAuditUnsupported
 	}
-	return r.caps.projectAudit.registerVerifier(r.pluginID, verify)
+	token, err := r.caps.projectAudit.registerVerifier(r.pluginID, verify)
+	if err != nil {
+		return nil, err
+	}
+	return projectAuditPublisherFactory{caps: r.caps, pluginID: r.pluginID, token: token}, nil
 }
 func (r pluginRegistry) RegisterProjectAuditDisclosureAuthorizer(disclose extension.ProjectAuditDisclosureAuthorizer) error {
 	if r.caps.projectAudit == nil {
@@ -96,10 +131,10 @@ func (r pluginRegistry) RegisterProjectAuditDisclosureAuthorizer(disclose extens
 	}
 	return r.caps.projectAudit.registerDisclosure(r.pluginID, disclose)
 }
-func (r recordRegistry) RegisterProjectAuditLinkVerifier(verify extension.ProjectAuditLinkVerifier) error {
+func (r recordRegistry) RegisterProjectAuditLinkVerifier(verify extension.ProjectAuditLinkVerifier) (extension.ProjectAuditPublisherFactory, error) {
 	reg, ok := r.Registry.(extension.ProjectAuditLinkRegistry)
 	if !ok {
-		return extension.ErrProjectAuditUnsupported
+		return nil, extension.ErrProjectAuditUnsupported
 	}
 	return reg.RegisterProjectAuditLinkVerifier(verify)
 }
@@ -112,9 +147,10 @@ func (r recordRegistry) RegisterProjectAuditDisclosureAuthorizer(disclose extens
 }
 
 var _ extension.ProjectAuditHost = inprocHost{}
-var _ extension.ProjectAuditPublisher = inprocHost{}
+var _ extension.ProjectAuditPublisher = projectAuditPublisher{}
+var _ extension.ProjectAuditPublisherFactory = projectAuditPublisherFactory{}
 
-func (h inprocHost) PublishProjectAuditLink(ctx context.Context, req extension.ProjectAuditLinkRequest) (extension.ProjectAuditLinkReceipt, error) {
+func (h inprocHost) publishProjectAuditLink(ctx context.Context, req extension.ProjectAuditLinkRequest, capability *auditPublisherToken) (extension.ProjectAuditLinkReceipt, error) {
 	if err := ctx.Err(); err != nil {
 		return extension.ProjectAuditLinkReceipt{}, err
 	}
@@ -123,27 +159,34 @@ func (h inprocHost) PublishProjectAuditLink(ctx context.Context, req extension.P
 	}
 	slot := h.caps.projectAudit
 	slot.mu.RLock()
-	holder, verify := slot.holder, slot.verifier
+	holder, verify, registeredToken := slot.holder, slot.verifier, slot.publisherToken
 	slot.mu.RUnlock()
-	if holder != h.pluginID || verify == nil {
+	if holder != h.pluginID || verify == nil || registeredToken == nil || capability != registeredToken {
 		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditUnsupported
 	}
 	if h.owner == "" || (h.actor != "" && h.actor != h.owner) || req.HostAuditOffset < 0 || req.ProjectID == "" || req.SourceKind != "domain-commit" || req.SourceID == "" || req.OperationID == "" || req.ResourceKind == "" || req.ResourceID == "" || req.DisclosureClass != "metadata" || req.IdempotencyKey == "" {
 		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
 	}
-	if req.HostAuditOffset == 0 {
-		resolved, err := h.caps.st.CommittedAuditOffset(h.owner, string(req.ProjectID), req.OperationID)
-		if errors.Is(err, store.ErrNotFound) {
+	// An explicit offset is only a locator. A historical collision or a forged
+	// offset must not turn a private command with the same operation ID into a
+	// published project receipt.
+	resolved, err := h.caps.st.CommittedAuditOffset(h.owner, string(req.ProjectID), req.OperationID)
+	if errors.Is(err, store.ErrNotFound) {
+		if req.HostAuditOffset == 0 {
 			return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditPending
 		}
-		if errors.Is(err, store.ErrConflict) {
-			return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
-		}
-		if err != nil {
-			return extension.ProjectAuditLinkReceipt{}, err
-		}
-		req.HostAuditOffset = resolved
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied
 	}
+	if errors.Is(err, store.ErrConflict) {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
+	}
+	if err != nil {
+		return extension.ProjectAuditLinkReceipt{}, err
+	}
+	if req.HostAuditOffset != 0 && req.HostAuditOffset != resolved {
+		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditLinkConflict
+	}
+	req.HostAuditOffset = resolved
 	row, projectID, err := h.caps.st.CommandAuditForLink(h.owner, req.HostAuditOffset)
 	if errors.Is(err, store.ErrNotFound) {
 		return extension.ProjectAuditLinkReceipt{}, extension.ErrProjectAuditDenied

internal/app/project_audit_link_test.go

@@ -56,9 +56,10 @@ func TestProjectAuditLinkSharesOnlyVerifiedCommittedMetadata(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
-	if err := reg.RegisterProjectAuditLinkVerifier(func(_ context.Context, proof extension.ProjectAuditLinkProof) (bool, error) {
+	publisherFactory, err := (recordRegistry{Registry: reg}).RegisterProjectAuditLinkVerifier(func(_ context.Context, proof extension.ProjectAuditLinkProof) (bool, error) {
 		return proof.Owner == "alice" && proof.ProjectID == p.ID && proof.SourceKind == "domain-commit" && proof.SourceID == "commit-1" && proof.OperationID == "op-1" && proof.ResourceKind == "document" && proof.ResourceID == "doc-1", nil
-	}); err != nil {
+	})
+	if err != nil {
 		t.Fatal(err)
 	}
 	metadataAllowed := true
@@ -72,8 +73,27 @@ func TestProjectAuditLinkSharesOnlyVerifiedCommittedMetadata(t *testing.T) {
 	if _, err := bob.QueryProjectAudit(context.Background(), q); !errors.Is(err, extension.ErrProjectAuditDenied) {
 		t.Fatalf("unlinked private audit: %v", err)
 	}
-	alicePublisher := inprocHost{caps: caps, pluginID: "rdm", owner: "alice"} // trusted outbox-scoped host
+	alicePublisher, err := publisherFactory.ForOwner("alice") // capability retained by trusted RDM outbox
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := alicePublisher.(extension.Host); ok {
+		t.Fatal("publisher factory exposed a full owner-scoped Host")
+	}
 	linkReq := extension.ProjectAuditLinkRequest{ProjectID: p.ID, SourceKind: "domain-commit", SourceID: "commit-1", OperationID: "op-1", ResourceKind: "document", ResourceID: "doc-1", DisclosureClass: "metadata", IdempotencyKey: "outbox-1"}
+	// A different compiled plugin can call the public scoped-host factory with
+	// "rdm" as text. That must not mint RDM's audit publication authority.
+	wireScopedHostFactory(caps)
+	t.Cleanup(func() { extension.SetScopedHostFactory(nil) })
+	forged, err := extension.NewScopedHost("alice", "rdm")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if publisher, ok := forged.(extension.ProjectAuditPublisher); ok {
+		if _, err := publisher.PublishProjectAuditLink(context.Background(), linkReq); !errors.Is(err, extension.ErrProjectAuditUnsupported) {
+			t.Fatalf("self-reported plugin ID minted audit publisher: %v", err)
+		}
+	}
 	if rows, err := bob.QueryProjectAudit(context.Background(), extension.ProjectAuditQuery{ProjectID: p.ID}); err != nil || len(rows.Receipts) != 0 {
 		t.Fatalf("private owner row visible without exact link: %+v %v", rows, err)
 	}
@@ -88,8 +108,8 @@ func TestProjectAuditLinkSharesOnlyVerifiedCommittedMetadata(t *testing.T) {
 	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), uncommitted); !errors.Is(err, extension.ErrProjectAuditDenied) {
 		t.Fatalf("uncommitted source: %v", err)
 	}
-	if _, err := (inprocHost{caps: caps, pluginID: "other", owner: "alice"}).PublishProjectAuditLink(context.Background(), linkReq); !errors.Is(err, extension.ErrProjectAuditUnsupported) {
-		t.Fatalf("other plugin: %v", err)
+	if _, err := (pluginRegistry{pluginID: "other", caps: caps}).RegisterProjectAuditLinkVerifier(func(context.Context, extension.ProjectAuditLinkProof) (bool, error) { return true, nil }); err == nil {
+		t.Fatal("other plugin replaced the registered verifier")
 	}
 	pending := linkReq
 	pending.OperationID, pending.IdempotencyKey = "op-not-yet-recorded", "outbox-pending"
@@ -121,6 +141,24 @@ func TestProjectAuditLinkSharesOnlyVerifiedCommittedMetadata(t *testing.T) {
 	if strings.Contains(string(raw), "secret-digest") || strings.Contains(string(raw), string(c.ID)) {
 		t.Fatalf("private receipt fields leaked: %s", raw)
 	}
+	if err := st.AppendAudit("alice", agentcommand.AuditEnvelope{Time: time.Now(), Actor: "alice", CommandID: "private.note", OperationID: "op-1", ConversationID: string(c.ID), State: agentcommand.StateCommitted}); err != nil {
+		t.Fatal(err)
+	}
+	duplicates, _, _, err := st.ListProjectCommandAudits("alice", string(p.ID), 0, 0, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	privateOffset := duplicates[0].Offset
+	mislink := linkReq
+	mislink.HostAuditOffset, mislink.IdempotencyKey = privateOffset, "outbox-private"
+	if _, err := alicePublisher.PublishProjectAuditLink(context.Background(), mislink); !errors.Is(err, extension.ErrProjectAuditLinkConflict) {
+		t.Fatalf("ambiguous operation linked a private command: %v", err)
+	}
+	privateQuery := q
+	privateQuery.LinkedHostOffset = privateOffset
+	if _, err := bob.QueryProjectAudit(context.Background(), privateQuery); !errors.Is(err, extension.ErrProjectAuditDenied) {
+		t.Fatalf("private command disclosed through ambiguous operation: %v", err)
+	}
 	metadataAllowed = false
 	if _, err := bob.QueryProjectAudit(context.Background(), q); !errors.Is(err, extension.ErrProjectAuditDenied) {
 		t.Fatalf("revoked object metadata: %v", err)

internal/app/surface_audit_actor_test.go

@@ -88,9 +88,10 @@ func TestCompiledHandlerReceivesHostOperationID(t *testing.T) {
 	if err := reg.RegisterProjectAuditAuthorizer(func(actor string, project core.ID) (bool, error) { return actor == "bob" && project == p.ID, nil }); err != nil {
 		t.Fatal(err)
 	}
-	if err := reg.RegisterProjectAuditLinkVerifier(func(_ context.Context, proof extension.ProjectAuditLinkProof) (bool, error) {
+	publisherFactory, err := (recordRegistry{Registry: reg}).RegisterProjectAuditLinkVerifier(func(_ context.Context, proof extension.ProjectAuditLinkProof) (bool, error) {
 		return proof.Owner == "alice" && proof.ProjectID == p.ID && proof.OperationID == seen && proof.SourceID == "domain-commit-1" && proof.ResourceID == "doc-1", nil
-	}); err != nil {
+	})
+	if err != nil {
 		t.Fatal(err)
 	}
 	if err := reg.RegisterProjectAuditDisclosureAuthorizer(func(_ context.Context, actor string, r extension.ProjectAuditLinkedResource) (extension.ProjectAuditDisclosure, error) {
@@ -98,7 +99,10 @@ func TestCompiledHandlerReceivesHostOperationID(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
-	publisher := inprocHost{caps: caps, owner: "alice", pluginID: "rdm"}
+	publisher, err := publisherFactory.ForOwner("alice")
+	if err != nil {
+		t.Fatal(err)
+	}
 	linked, err := publisher.PublishProjectAuditLink(context.Background(), extension.ProjectAuditLinkRequest{ProjectID: p.ID, OperationID: seen, SourceKind: "domain-commit", SourceID: "domain-commit-1", ResourceKind: "document", ResourceID: "doc-1", DisclosureClass: "metadata", IdempotencyKey: "outbox-1"})
 	if err != nil || linked.HostAuditOffset != rows[0].Offset {
 		t.Fatalf("publish by trusted operation: %+v %v", linked, err)

internal/cmdbus/cmdbus.go

@@ -5,6 +5,7 @@ package cmdbus
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
@@ -281,9 +282,13 @@ func (b *Bus) Dispatch(ctx context.Context, req Request) Response {
 		return receipt(agentcommand.StateRejected, "", "no host handler bound for "+req.ID)
 	}
 	// The domain handler can persist this trusted ID with its transaction/outbox.
-	// Never accept an ID from Params or the incoming Request. A handler failure
-	// still writes only a rejected audit receipt with no committed operation ID.
-	req.OperationID = fmt.Sprintf("op_%s_%d", strings.ReplaceAll(req.ID, ".", "_"), b.now().UnixNano())
+	// Entropy, not the clock or caller Params, distinguishes concurrent operations.
+	// A handler failure still writes only a rejected audit receipt without an ID.
+	var opBytes [24]byte
+	if _, err := rand.Read(opBytes[:]); err != nil {
+		return receipt(agentcommand.StateUnknown, "", "operation ID unavailable")
+	}
+	req.OperationID = "op_" + hex.EncodeToString(opBytes[:])
 	payload, err := h(ctx, req)
 	if err != nil {
 		return receipt(agentcommand.StateRejected, "", "rejected: "+err.Error())

internal/cmdbus/cmdbus_test.go

@@ -115,6 +115,38 @@ func TestHandlerReceivesCommittedOperationIDBeforeDomainWrite(t *testing.T) {
 	}
 }
 
+func TestOperationIDsRemainUniqueWithFixedClockAndConcurrentDispatch(t *testing.T) {
+	audit := &memAudit{}
+	bus := New(audit, nil, func() time.Time { return time.Unix(1700000000, 123).UTC() })
+	if err := bus.RegisterBuiltin(agentcommand.CommandSpec{ID: "rdm.confirm", Title: "Confirm"}, "", func(_ context.Context, req Request) (any, error) {
+		return req.OperationID, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	const count = 64
+	var wg sync.WaitGroup
+	ids := make([]string, count)
+	for i := range ids {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			resp := bus.Dispatch(context.Background(), Request{ID: "rdm.confirm", Actor: "alice", Owner: "alice"})
+			ids[i] = resp.Receipt.OperationID
+		}(i)
+	}
+	wg.Wait()
+	seen := map[string]bool{}
+	for _, id := range ids {
+		if id == "" || seen[id] {
+			t.Fatalf("fixed clock produced a missing or duplicate trusted operation ID: %q", id)
+		}
+		seen[id] = true
+	}
+	if len(audit.logs) != count {
+		t.Fatalf("audit rows=%d want=%d", len(audit.logs), count)
+	}
+}
+
 func TestDispatchUnknownAndBadParams(t *testing.T) {
 	a := &memAudit{}
 	b := newTestBus(a, &memCards{})

pkg/extension/extension.go

@@ -40,7 +40,9 @@ import (
 // verifier, disclosure callback, and exact linked receipt read.
 // 2.15.0-experimental: trusted Request.OperationID before handler execution and
 // retryable ProjectAuditLinkRequest.HostAuditOffset=0 resolution.
-const SurfaceVersion = "2.15.0-experimental"
+// 2.16.0-experimental: cryptographic operation IDs and registration-bound
+// ProjectAuditPublisherFactory; scoped Host string IDs cannot publish links.
+const SurfaceVersion = "2.16.0-experimental"
 
 // ErrNotLinked 表示进程没有空白导入 link 包，Main 无法启动服务。
 var ErrNotLinked = errors.New("extension: runner not linked; blank-import agent-system-backend/pkg/extension/link")

pkg/extension/project_audit.go

@@ -76,10 +76,18 @@ type ProjectAuditDisclosure struct {
 
 type ProjectAuditDisclosureAuthorizer func(context.Context, string, ProjectAuditLinkedResource) (ProjectAuditDisclosure, error)
 
+// ProjectAuditPublisherFactory is issued only by successful verifier
+// registration. A domain outbox may retain it and bind an owner for each job;
+// owner and committed-source attribution are checked again when publishing.
+// NewScopedHost(owner, pluginID) cannot mint this capability.
+type ProjectAuditPublisherFactory interface {
+	ForOwner(owner string) (ProjectAuditPublisher, error)
+}
+
 // ProjectAuditLinkRegistry is optional. Only the registering compiled domain
-// plugin may publish or read its links.
+// plugin receives a publisher factory; string plugin IDs carry no authority.
 type ProjectAuditLinkRegistry interface {
-	RegisterProjectAuditLinkVerifier(ProjectAuditLinkVerifier) error
+	RegisterProjectAuditLinkVerifier(ProjectAuditLinkVerifier) (ProjectAuditPublisherFactory, error)
 	RegisterProjectAuditDisclosureAuthorizer(ProjectAuditDisclosureAuthorizer) error
 }
 

pkg/extension/surface.txt

@@ -54,6 +54,8 @@ ProjectAuditLinkedResource
 ProjectAuditPage
 ProjectAuditPublisher
 ProjectAuditPublisher.PublishProjectAuditLink
+ProjectAuditPublisherFactory
+ProjectAuditPublisherFactory.ForOwner
 ProjectAuditQuery
 ProjectAuditRegistry
 ProjectAuditRegistry.RegisterProjectAuditAuthorizer