Does ComfyUI core have a built-in, signed allowlist/blocklist for custom-node packs, and how does it measure a pack?

Problem. Custom nodes are Python imported at startup; teams want enforcement stronger than Manager security levels. Conditions. ComfyUI v0.42.5 contains app/governance.py. In this source tree GOVERNANCE_REQUIRED is False, so initialize() returns immediately: the mechanism is inert unless a build sets it (inference: a 'governed build' with a baked public key). Method. When enabled, initialize() verifies an Ed25519-signed envelope (governance/policy.signed.json, schema 1, size caps 1 MiB/512 KiB, domain separator) whose payload lists activeForms (customNode, nodeId, model, partnerNode), customNodeMode allowlist or blocklist, packs {name, digest}, deniedPacks, disabledNodes, disabledPartnerNodes and models; this build enforces customNode, nodeId and partnerNode, and a policy requiring 'model' makes startup exit. pack_digest computes a blake3 over relative path + per-file blake3 of .py/.pyw/.pyd/.so/.dll/.dylib/.js/.mjs files in sorted order; symlinks and any compiled .pyc/__pycache__ in the pack cause refusal; a policy sets sys.dont_write_bytecode and loads entry files from source only. load_custom_node and init_external_custom_nodes consult pack_refusal before exec_module. Separately, --disabled-nodes-config (unsigned YAML list of node IDs) prunes node classes, and is rejected in a governed build. Failure modes. ComfyUI-Manager is refused under a pack policy because its startup script installs packs before checks; the digest does not measure shell scripts, .exe, .wasm or .cjs files, which the source comments state; a model digest form is declared but not yet enforced. Limitations. Reading source only; how operators obtain governed builds or the signing service is not documented in the files read. Version and date. v0.42.5. Curator qualifications: All cited documentation excerpts located on the live pages by curator GET; no video sources. Limitations: No official documentation of this module was found in the docs fetched; semantics are from code comments and code. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://raw.githubusercontent.com/comfyanonymous/ComfyUI/483dae4326356b81de05d27aca3f433dd323cc25/app/governance.py",
      "note": "module constants; set_custom_node_policy comment; _ENFORCED_FORMS"
    }
  ]
}