Fix registry quarantine provenance and write integrity

[cursor]

Bug and impact

• Forged .json payloads under registry_fetch/ could self-certify as their own sidecar and become merge-eligible, bypassing the intended fetch-produced .txt payload provenance check.
• Symlinked quarantine layout directories could expose or purge files outside the quarantine root.
• Quarantine quota eviction ran before the new evidence was durably written, so write failures could delete existing evidence.
• Registry fetch quarantine write failures could crash callers instead of failing closed.
• Fresh installs could resolve MCP 2.x even though runtime imports use the MCP 1.x FastMCP API.

Root cause

Registry-fetch merge eligibility trusted path/layout shape too broadly, layout walkers followed symlinks, and quarantine capacity enforcement coupled destructive eviction with pre-write validation. The package dependency metadata also lacked the existing MCP 1.x compatibility upper bound.

Fix

• Require registry merge payloads to be real .txt fetch content files with separate sidecar metadata.
• Reject symlinked/equal-root registry-fetch layouts and skip unsafe layout dirs during list/purge/quota walking.
• Validate entry size before staging, write via temp files, avoid qid collisions, commit the new pair before retention/eviction, and preserve existing evidence on write failures.
• Return quarantine_failed from registry fetch when quarantine writes fail.
• Bound mcp to <2.0.0 in project metadata.

Validation

• RED/GREEN regressions for forged self-sidecar payloads, symlinked layout escape, write-failure evidence preservation, and fail-closed registry fetch quarantine errors.
• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py tests/test_registry_ssot.py tests/test_registry_fetch_r4.py tests/test_registry_load_order_r5.py -q -> 56 passed.
• python3 -m compileall -q src/scp and git diff --check passed.
• Full suite with optional antigen deps: 360 passed / 3 skipped / 3 known baseline failures (two vendored contract hash mismatches and RT11 authority-only residual).

  

[ManintheCrowds]

Audit: same lineage as #55 plus egg-info noise; #60 ports the security hunks without src/scp_mcp.egg-info/. Closing as superseded by #60.