Harden SSH parsing and add notice tooling

- Enforce exact service and channel names with bounded failure parsing
- Add hash-pinned offline notice assembly and regression coverage
- Record advisory dispositions, provenance, integration evidence, and
  remaining gates

tests/wolfssh_parser_contract/run.py

@@ -18,15 +18,17 @@ entry = next(e for e in ENTRIES if e.name == 'wolfssh_internal')
 assert entry.sha256 == '81ff1f9166708abd5c2911e9fe57c0aee01c88b5d3f68c909ee8a856d37f36a9'
 original, generated = render_entry(entry, {'project': ROOT})
 names = ('GetUint32', 'GetSize', 'GetString', 'GetSkip', 'GetStringRef',
-         'DoIgnore', 'DoServiceRequest', 'DoChannelWindowAdjust', 'DoUserAuthRequestEcc',
+         'DoIgnore', 'DoServiceRequest', 'DoChannelFailure', 'DoChannelWindowAdjust', 'DoUserAuthRequestEcc',
                   'DoUserAuthRequestEd25519')
 # Parser edits must not change the independently applied ordering/password logic.
 from security_overrides import apply_edits, MODIFICATION_NOTICE, WOLFSSH_PARSER_EDITS
 baseline = MODIFICATION_NOTICE + apply_edits(original.read_text(), tuple(
     edit for edit in entry.edits if edit not in WOLFSSH_PARSER_EDITS))
-for name in ('DoUserAuthRequestPassword', 'DoPacket', 'DoChannelFailure',
+for name in ('DoUserAuthRequestPassword', 'DoPacket',
              'ParseRSAPubKey', 'ParseECCPubKey', 'DoUserAuthRequestPublicKey'):
     assert extract(generated.decode(), name) == extract(baseline, name), name
+from review import check_sources
+check_sources(original, generated)
 with tempfile.TemporaryDirectory(prefix='wolfssh-parser-') as directory:
     work = Path(directory)
     # Read back the actual generated bytes, not a parallel implementation.
@@ -46,6 +48,18 @@ with tempfile.TemporaryDirectory(prefix='wolfssh-parser-') as directory:
     # Prove negative fixtures detect removal of each new boundary/type guard.
     # Mutations affect only temporary extracted host copies, never the override.
     mutations = (
+        ('Service exact length', 'DoServiceRequest',
+         (('nameSz != sizeof("ssh-userauth") - 1 ||', '0 ||'),)),
+        ('Service exact bytes', 'DoServiceRequest',
+         (('WMEMCMP(serviceName, "ssh-userauth", sizeof("ssh-userauth") - 1) != 0', '0'),)),
+        ('Failure bounded recipient', 'DoChannelFailure',
+         (('ret = GetUint32(&channelId, buf, len, &begin);',
+           'ato32(buf + begin, &channelId); begin += 4; ret = WS_SUCCESS;'),)),
+        ('Failure exact consumption', 'DoChannelFailure',
+         (('if (begin != len)', 'if (0)'),)),
+        ('Failure known recipient', 'DoChannelFailure',
+         (('if (ChannelFind(ssh, channelId, WS_CHANNEL_ID_SELF) == NULL)',
+           'if (0 && ChannelFind(ssh, channelId, WS_CHANNEL_ID_SELF) == NULL)'),)),
         ('ECC nested read boundary', 'DoUserAuthRequestEcc',
          (('pk->signature, sz, &i)', 'pk->signature, pk->signatureSz, &i)'),)),
         ('ECC inner exact consumption', 'DoUserAuthRequestEcc',
@@ -76,5 +90,7 @@ with tempfile.TemporaryDirectory(prefix='wolfssh-parser-') as directory:
         result = subprocess.run([str(binary)], capture_output=True, timeout=30)
         assert result.returncode != 0, f'Undetected mutation: {label}'
     print(f'PASS: {len(mutations)} parser guard-removal mutations rejected')
+    from channel_request import run_contracts
+    run_contracts(work, source.read_text(), extract)
 print('PASS: exact original hash; generated parser; parser-isolated ordering/password/deferred functions')
 print('NOTE: production build-tree registration/firmware not regenerated or validated')