fix(status): fail closed when the baseline cannot identify the binary

[rldyourmnd]

Problem

software-status reported current: true after the managed executable was replaced.

The check that would have caught it exists:

if binary_sha != executable_baseline.get("sha256"):
    drift.append("baseline_binary_sha256")

but the whole block sits behind if isinstance(executable_baseline, dict), and the baseline declares that object for only one of six assets:

asset	executable baseline
darwin-arm64	present
darwin-x64, darwin-x64-baseline	absent
linux-arm64, linux-x64, linux-x64-baseline	absent

So on every Linux platform the strongest verification silently disappeared and status still answered current.

Why the manifest is not a substitute

binary_sha256 in software/mimocode.json is self-reported: the manifest sits beside the binary and is equally writable, so whoever replaced one replaced both. The private slice's stub does exactly that — writes a coherent manifest for a substituted binary — and was reported as current.

Change

A baseline that omits the extracted-binary identity cannot answer "is this the software we installed". Status now says so through baseline_executable_unavailable rather than skipping the question and returning current anyway.

This makes the five missing baselines visible instead of silently trusted. Populating them is vendor-observation work and is deliberately not bundled here.

status still never executes the managed binary — that property is unchanged and still asserted.

Verification

• test_software_status_reports_stub_identity_drift_without_executing_mimo — was failing, now passes
• test_software_status_never_executes_target_binary — was failing, now passes
• full runtime-launch + software-lifecycle slice: 10 passed, 4 subtests passed
• run_harnesses.py --module nddev-mimocode-app --lane platform --platform ubuntu — PASS
• cli-tools/validate_public_contracts.py — ok
• ruff check / ruff format --check clean

Reviewer finding RVR-P2-007.

https://claude.ai/code/session_017fG88hR3mfP7YMFABzbKPB