Milestone 27a implementation and qualification record

Status: Complete. Owner approval: Lukas Bower, 14 September 2026. Implementation baseline: b848b5cbb; pre-publication main was 13020a33dba0832e2297fe119fedf6d302704bdc. Reviewed candidate F is 58140c1a5c79124a8dd7a4ff4bd547a52c8bd362. Its separate owner review is recorded below. Publication preserves candidate F in the commit ancestry; completion documentation does not rebind its qualification artifacts.

Title/ID: m27a-authority-hardening Milestone: Milestone 27a — Authority Hardening: Delegated REST Identity, Fenced Failover, Idempotent Queen Intents. Goal: Close the single-host Release A authority floor while preserving existing transport and accepted Worker/driver boundaries. Inputs: canonical target manifests, manifest schema 1.21, upstream selected seL4 profiles, existing v2 execution journal, exact pre-change gateway binary at out/m27a/baseline-target/debug/hive-gateway from detached b848b5cbb.

Scoped task coverage

Optional admission correlation is retained in strict intents, host tickets, execution journals, receipts, audit and evidence: admission_id, intent_hash, policy_hash, state_epoch, resource_generation, decision_expiry. No component evaluates or fabricates a Milestone 28a decision. writer_epoch remains an independent writer fence.

Compatibility review

The public migration contract is M27A_AUTHORITY.md.

Retained command evidence

All paths below are local retained evidence, not portable release attestations. Earlier failed attempts remain in place and are not relabeled.

Current build-script audit contract

The selected-manifest preflight added to apps/root-task/build.rs resolves each configured secret reference before compilation and registers its env/file source through the existing validated Cargo directive emitter. The six existing OUT_DIR generators and their include contracts are unchanged. The reviewed current build-script SHA-256 is 8b70f0ab92bbc18c4e63b25aedabd6527ab448d056f1eacd7fded42125463b14. The scanner constants and current baseline bindings are updated together; historical fingerprints and every risk ceiling remain unchanged. This records implementation review, not human Rust approval.

Measured unsafe / unwrap / expect / panic counts are global 823 / 38 / 242 / 100, linked HAL 173 / 0 / 2 / 0, and outside HAL 650 / 38 / 240 / 100. Each is within its existing independent ceiling.

Gateway comparison

The 32-iteration host-model run has no unexpected HTTP/protocol responses, client retries or backpressure. Current status p50/p95 is 0.433/0.623 ms; strict delegated writes 1.288/2.612 ms; exact duplicate acknowledgements 2.115/2.155 ms. Conflicting identities, non-current future epochs (2 against 1), and missing delegation each produce exactly 32 expected refusals. This run does not prove refusal of an older writer epoch. Against the same-host pre-27a binary, status p95 increases 0.182 ms and write p95 increases 1.015 ms. This is a small absolute host-model latency cost; it does not establish equivalent target performance or dismiss the relative status increase. The accepted 26d status-read comparator remains required and has been requested from the owner.

Direct production QEMU observation

out/m27a/qemu-production-5/authority/result.json passes the direct production profile diagnostic: compiled epoch 7, a documented policy approval, one fresh strict write, exact duplicate ACK, identity conflict, stale epoch 6 refusal, legacy path refusal and readable full audit/replay records. It uses the pinned QEMU 10.1.0 HVF binary and the canonical four-core 24 MHz seL4 build. The packaged CPIO is 152,064 bytes. Build log and exact retained image bindings are beside the result. This is convergence evidence, not staged acceptance. The subsequent console-shortcut and durable dedupe-label changes require a fresh image.

The first compatibility authority diagnostic refused the missing policy approval. The prior TCP response-matrix failure was a client sending a literal secret reference; the repaired probe resolves it before connecting. The shared Pi reboot and raw TCP credential preflights now follow the same contract; out/m27a/probe-auth-20b.log records 381 passing focused tests.

Host and root audit checks now retain fresh/duplicate with the complete strict envelope, and preflight journal capacity before reservation or effects. out/m27a/ninedoor-audit-22.log and out/m27a/root-intent-22.log pass. Rust/Python C1 reassembly accepts bounded 8192-byte logical records while preserving the 256-byte frame and 64-chunk ceilings; focused validation is retained in rust-chunks-19.log, python-chunks-19.log, and root-chunk-21.log under out/m27a/.

out/bench/m27a-gateway-authority-05/report.json verifies actual stale epoch 6 refusal against a compiled epoch-7 gateway, plus all expected positive/negative HTTP outcomes. Its release-versus-debug baseline and overlapping root compile make its comparative latency unsuitable for final write-overhead qualification. A matching optimized baseline and an idle-host rerun remain required.

Source-freeze qualification boundary

out/m27a/check-generated-23.log and check-test-plan-23.log pass. The second Stage 01 attempt passes generated consistency, formatting, Clippy, workspace check and the catalogued workspace tests. It was stopped before completion because concurrent main documentation commits changed its Git source identity; out/m27a/stage1-02-cancellation.txt records the reason. No stage marker from that attempt is accepted. Remaining qualification uses a fixed isolated source.

Frozen candidate and current qualification

Implementation candidate 275922fde5c607de38f767e8c19115093c27e9a1 was frozen without moving main. Candidate 72bffffd1b35dffaf65d1ae1525a8ac7112a1ec5 adds only the missing public verification keys to the release-qualification fixture; production implementation bytes are identical. The original archive SHA-256 is 5ca00473f80a89e7efd32f0a387a7d3e80d43923a77b8a85b7e06cf728491af2. out/m27a/qualification-candidate*.json retains both source records.

The native Linux AArch64 release build and 449 host tests pass on Merlin2 for the implementation candidate. The canonical Python SDK gate passes 139 tests with one skip on Python 3.12.3. Logs, toolchain versions and binary hashes are in out/m27a/merlin2-275922fde5c6/logs/. This proves native host contracts, not GPU provider execution or target behavior. An earlier manually selected Python command named a nonexistent test file and collected no tests; the subsequent canonical SDK command supplies the reported evidence.

The corrected Mac Stage 01 attempt passes formatting, Clippy, workspace check, the catalogued Rust suites, 2,559 Python tests and example smokes. It stops at the Rust bootstrap guard because a checkout nested under the main repository inherits that parent’s Cargo configuration. The guard correctly refuses this external configuration. Both candidate checkouts were moved to sibling directories outside the parent repository; all seven bootstrap tests then pass in out/m27a/candidate-risk-bootstrap-41.log. Full staged qualification is restarted there. No failed attempt supplies a stage marker. Earlier absent local Python environments and externally resolving compiler caches were also repaired without weakening their checks.

The compatibility Pi image built from the clean corrected candidate is sha256:35512e394a9266b9c0df28ff129d1679d15bf3b7f3fc449ed9650848f5ef623d. out/m27a/pi4-boot-36/ retains its fresh RAM-load/reset CRC checks, exact BUILD marker, settled serial log and first raw TCP sample: 64/64 requests, one connection, zero application retries or reconnects. The same boot passes strict intent first/duplicate acknowledgement, identity-conflict refusal and full fresh/duplicate audit labels. Its compiled writer epoch is 1; the diagnostic named stale-epoch actually tests future epoch 2, so it is only a non-current epoch refusal. Actual older-epoch and disabled legacy-path checks require the separate production epoch-7 run. The first raw CLI invocation rejected a missing ticket before connection; the retained successful invocation supplies a minted ticket and is the first target TCP connection. These observations remain non-claiming diagnostics until the applicable staged target checks complete.

The production Pi image also builds with clean source binding: sha256:e863b609e4c6ea8b462f69d3155f652669ae8a51ee10187e63198849f7e609a2. Build evidence is out/m27a/pi4-production-build-40.log; its current hardware run is separate from the compatibility boot. out/m27a/pi4-production-42/ now records a fresh exact BUILD, CRC checks before and after reset, a settled GENET lifetime and a first-connection 64/64 raw sample without retries or reconnects. The production authority diagnostic passes epoch 7, true stale epoch 6 refusal, stable duplicate acknowledgement with full dedupe audit labels, legacy-path refusal and explicit SPAWN/KILL refusal. A subsequent bounded check refuses both upper- and lowercase memory-dump commands on the production operator surface; it does not exercise the emergency fallback or a kernel fault. Paired continuous captures are retained under out/m27a/pi4-capture-36/ and must be closed and sealed before final capture claims.

Relocation also exposed cached host binaries with their old compile-time paths; the owned build caches were cleared before the clean staged rerun. Copied QEMU kernel trees fail the path-bound profile contract and remain unqualified. A fresh canonical toolchain setup and 303-step seL4 build in the sibling Pi checkout passes qemu_smp_production validation in out/m27a/pi-worktree-qemu-profile-{configure,build,validate}-48.log. The QEMU acceptance checkout needs its own corresponding profile build.

The clean sibling Mac Stage 01 now passes all 22 common actions in out/m27a/candidate-stage1-43.log, including the Rust bootstrap and risk ratchet. The immutable common attestation is retained in /Users/lukasbower/GitHub/cohesix-m27a-qualification/out/test-plan/m27a-qemu-43/. The Pi checkout imports that exact verified common evidence in out/m27a/pi4-stage1-import-50.log; target-bound stages remain separate.

The refreshed production QEMU diagnostic also passes for candidate 72bffffd1b35dffaf65d1ae1525a8ac7112a1ec5 in the sibling Pi checkout at out/m27a/qemu-production-49/authority/result.json. Compiled epoch 7 admits one fresh strict intent and the exact duplicate, retains one dedupe entry and one duplicate, refuses actual stale epoch 6, conflicting identity, the legacy path, SPAWN/KILL shortcuts and the normal HEXDUMP console command, and exposes full fresh/duplicate audit records plus replay status. The canonical pinned HVF QEMU build, source identity, selected manifest and runtime logs are retained beside it. This is target convergence evidence, not staged acceptance or a dynamic kernel fault/wake test.

The QEMU sibling’s own toolchain setup and fresh seL4 profile build now pass in out/m27a/qemu-worktree-toolchain-50.log and qemu-profile-{configure,build,validate}-52.log. Both target Stage 02 actions pass initially (pi4-stage2-51.log, qemu-stage2-55.log). The first attempted Pi Stage 03 refuses changed environment selectors before a hardware boot; pi4-stage3-56.log preserves that failure. Stage 02 is rerun with the complete stable target settings before either target progresses to Stage 03. The immutable source identity and acceptance checks remain unchanged.

out/m27a/production-payload-scan-54.log passes selected production policy and private-fixture, canary and symlink scans for both built target artifact sets. This is an artifact payload check, not a full release assembly claim.

The stable-settings Stage 02 refresh passes on QEMU and Pi in out/m27a/{qemu,pi4}-stage2-57.log. QEMU Stage 03 then starts normally. Pi Stage 03 attempt 58 records a fresh exact compatibility boot and a successful first raw sample, then refuses the production-built client’s mismatch with the restored compatibility policy before regression operations reach the target. The matching compatibility clients are built and the policy check passes in pi4-compat-clients-62.log and pi4-client-policy-62.log. The earlier temporary production coh client installation is superseded by this ordinary Cargo build; its retained production artifact remains unchanged. Pi qualification restarts with those clients and a newly bound Stage 02; failed results are preserved.

Merlin2’s additional production-profile build first refuses the archive’s missing Git tracked-file inventory. The exact candidate Git objects are transferred with pack SHA-256 00c0ad7a951dda722399ffa2e9603efef2a90c39d0566ba01958e657c55f9d3e. Two vendor metadata files omitted by Git archive’s export-ignore rules are restored from those immutable objects. The earlier host build’s generated Linux UI schema is retained under ignored evidence. The resulting checkout is clean at candidate 275922fde5c607de38f767e8c19115093c27e9a1, tree 37f84e6de0503cacda6aeafc3a2381ad29d987fe; native production build 61 remains pending. This does not change or relabel the original native compatibility tests.

Native production host compilation completes for all nine selected packages in out/m27a/merlin2-production-61/host-build.log. Artifact collection initially mistakes the coh-status library package for an executable; the eight actual executables and libcoh_status.rlib are subsequently retained without a rebuild. The correction does not relabel the failed collection process. The native production gateway probe passes all 32 positive and negative cases per scenario in gateway-probe-65/report.json, including actual stale epoch refusal, with no operation retries or backpressure. The original native compatibility logs remain separate; production evidence is not a physical GPU/provider execution claim.

The matching optimized Mac comparison in out/bench/m27a-gateway-authority-70/report.json passes on an idle build host. The production epoch-7 gateway has status p50/p95 0.567/0.698 ms, delegated-write 2.020/2.510 ms and duplicate-ACK 1.888/2.088 ms. All 32 conflicts, stale-epoch writes and missing-ticket writes are refused as expected; no unexpected error, client retry, reconnect or backpressure occurs. The queue high-water mark is 1; one ticket cache entry records 127 hits and one miss. The 160 authority audit records cost 4.636 ms in total. Against the matching optimized pre-27a binary, status p95 increases 0.273 ms (about 64%) and write p95 1.118 ms (about 80%). These are measured host-model latency regressions with bounded absolute costs; there is no target-throughput or improvement claim. The equivalent accepted 26d status comparator is still missing and remains required.

QEMU Stage 03 attempt 58 passes the complete base group and fixed response matrix, then fails the telemetry fixture: its published-key MAC is correctly refused by the provisioned issuer before the expected expiry check. The m27a-production-secret-profile compatibility closure therefore adds coh-rtc-regression-tickets and runner integration. It verifies the original fixture MAC, replaces only the MAC with the selected issuer’s signature, and asserts exact claim-byte preservation. Original scripts and expected outcomes remain unchanged; transport records retain the private materialized copies and hash bindings. Five independent fixture/bound tests, 21 wrapper tests and compiler Clippy pass in out/m27a/regression-ticket-{tests,clippy}-67.log and regression-ticket-runner-tests-66.log. Regeneration and Test Plan integrity pass in check-generated-69.log and check-test-plan-69.log.

Pi Stage 02 attempt 63 passes with matching compatibility clients. The queued Stage 03 attempt 64 is interrupted after its fresh exact-image boot and first raw sample while the fixture mismatch is corrected; its incomplete record is not accepted. This is distinct from the earlier policy-file refusal. All target results retain their original source identity. The fixture workflow change requires a new frozen candidate and refreshed staged qualification.

Candidate cargo audit and cargo deny check advisories pass under the existing advisory policy in out/m27a/candidate-cargo-{audit,deny}-38.log.

Candidate C is d00eaad4bc1e3bc709de04c3ed4529a90fda6b95, tree 8496c4c5713947af981407f13fa90b90ab4ec7bf. Its new fixture compiler passes five native Linux tests in native-candidate-c-tests-72.log. The provisioned telemetry fixture passes on the physical B compatibility image, including expiry, scope/quota refusals, Worker readiness, ring wraparound and clean QUIT (pi-fixture-convergence-72.log, pi-fixture-output-check-73.log). That is C-host/B-image convergence, not C target acceptance. C’s initial Pi rebuild fails on the qualification manifest’s obsolete checkout path; the path is corrected in the ignored local manifest and rebuild 74 retains the new result. C’s complete common Stage 01 passes in candidate-c-stage1-71.log, including Python suites/examples and the unchanged Rust risk ceilings. Pi build 74 also passes and seals its source-bound image; it is not booted before the REST runner correction below.

Pre-execution review of the local REST stage finds that its temporary delegation issuer name was not secret-classified by the evidence recorder and that the issuer reference was omitted from context restoration. The issuer now uses TP_STAGE4_DELEGATION_SECRET; the reference, delegated ticket and issuer variable join the existing exact inherited-environment restoration contract. Focused tests verify exclusion/redaction and restoration before either finalization path. No Stage 04 with the faulty local issuer setup was executed. This is part of m27a-production-secret-profile and requires a new candidate identity. All 16 focused REST runner tests, generated consistency and Test Plan integrity pass in rest-stage4-context-tests-76.log, check-generated-76.log and check-test-plan-76.log.

The DD30 preflight still refuses the changed protected kernel.rs fingerprint. The existing approval is scoped to Milestone 27 and does not approve 27a’s secret-registration and debug-memory changes. Fresh human Rust review and an explicit applicable DD30 disposition remain required before merge. The dynamic fault/wake test remains unexecuted; no static check or policy refusal replaces it.

Candidate D a761eec4662f6def20b5b3272acde79efd3f1fb7 adds only the REST runner secret/context correction and documentation. Its 16 focused REST tests pass natively on Linux in native-candidate-d-tests-80.log; attempt 78 used the wrong virtual-environment path and remains failed. Pi build 77 passes. The fresh RAM boot and first raw sample in the Pi checkout’s out/m27a/pi4-d-initial-81 pass with 64/64 requests, one connection and no retries/reconnects. Its initial transport-record command then refuses an incorrect gateway hostname field; pi4-d-initial-81.log remains failed and grants no staged acceptance.

Final review of m27a-console-debug-memory-gate finds an incomplete bring-up boundary: release refusal was implemented, but explicit non-release diagnostics still trusted arbitrary addresses. HAL now classifies only the immutable root code RX span; the console rejects oversized, unclassified and overflowing reads before dereference and emits bounded serial audit lines. The existing volatile read stays within that admitted range. Four deterministic bounds/policy tests, root Clippy, generated consistency and Test Plan integrity pass in diagnostic-range-{tests,clippy}-83.log, check-generated-84.log and check-test-plan-84.log. diagnostic-range-risk-83.log confirms no increase in non-test unsafe, unwrap, expect or panic counts. Exact target builds and the refreshed candidate’s staged qualification remain required.

Candidate E 1d4745c32881dbb04ae53d135bdc30f457825106 passes the Pi image build and fresh RAM boot with 64/64 raw requests, one connection and no retries or reconnects. Its initial transport record is in the Pi checkout’s out/m27a/pi4-e-initial-85/target-evidence.json; the corrected gateway host is the local gateway endpoint, 127.0.0.1. Four native Linux bounds tests and root Clippy pass in native-candidate-e-tests-86.log. E’s dependency audit and advisory checks pass under the existing policy in candidate-e-cargo-{audit,deny}-91.log.

The non-release QEMU debug-input build first exposes an existing incomplete bootstrap branch: normal bootstrap was compiled out even when the early debug shell was unavailable. The supported early shell diverges; unavailable cases now retain normal serial/runtime bootstrap and its declared owner. Build 88 retains the original type errors. Build 92 passes with that correction, but its background TCP launch does not deliver UART stdin; that attempt is stopped without a memory-read result. The canonical direct launch of the same immutable artifact passes all six live console cases in out/m27a/qemu-diagnostic-range-95/result.json: permitted bytes exactly match the ELF, and unclassified, crossing, oversized, overflowing and extra-argument requests are refused. Range admission/refusal audit lines are observed. The code span is [0, 0x164000). This is a non-release QEMU diagnostic, not staged acceptance or the unrelated DD30 dynamic fault/wake test. The bootstrap correction requires the final candidate and refreshed applicable stages. E’s complete common Stage 01 passes in candidate-e-stage1-87.log; generated consistency and Test Plan integrity pass after the correction in check-generated-96.log and check-test-plan-96.log.

Candidate F’s exact compatibility Pi image passes the fresh RAM boot, CRC checks across reset, passive settle and first raw sample (64/64, one connection, zero retries/reconnects) in pi4-f-initial-100.log. Its source-bound transport record is in the Pi checkout’s out/m27a/pi4-f-initial-97/. The final production QEMU image also passes strict-intent, dedupe, stale-epoch, legacy-command and audit/replay observations in the QEMU checkout’s out/m27a/qemu-f-production-101/authority/result.json. These are focused M27a target observations, not a complete staged chain. The direct compatibility pack and production REST/memory/evidence observations remain pending.

Final generated consistency, Test Plan integrity and diff whitespace checks pass in check-generated-103.log, check-test-plan-103.log and diff-check-103.log. The first QEMU-checkout Pi production build stops before compilation because its repository mkimage executable is absent (attempt 105). The exact already-built canonical mkimage is copied and byte-compared; attempt 106 retains the subsequent build independently.

The final production Pi image build 106 passes at clean candidate F with image SHA-256 2b2b23161c4d6eff614a3d5992fca91a627d87fa3cbecc4af265498876d283ae. The image is retained in the QEMU checkout’s out/m27a/pi4-f-production-106-sd/; its fresh physical boot remains pending. The same immutable production QEMU artifact passes the remaining live REST and memory checks in out/m27a/qemu-f-rest-107/rest/result.json: uppercase/lowercase memory commands are refused, missing delegation and wrong scope return 403, two concurrent callers each admit one write and independently exhaust their one-operation quota with 429, and the refusal audit lines are retained. The shipped coh evidence pack command captures production epoch and dedupe state. The Python REST client reads live state with one attempt. These observations use one gateway console owner and record zero reconnects.

The final Pi compatibility pack passes all 17 scripts with zero failures in out/m27a/pi4-f-tcp-104.log. Each of the telemetry, shard, gated and base groups has a fresh candidate-F boot, paired captures and a first raw sample. The canonical transport aggregate is retained in the Pi checkout at out/m27a/pi4-f-tcp-104/transport-results/stage-03.json; it binds source sha256:35971ac6bd068e0ab1e50570a3f4828ac25195cd85f2cb634e3cbb85df546952. The direct action did not create a full staged-chain acceptance marker.

On the same final base boot, Pi REST observations pass six delegated-identity, scope and independent quota cases, core compatibility 3/3, parity 1/1 and Python live state reads in out/m27a/pi4-f-rest-112/result.json in the Pi checkout. The gateway remains the sole TCP owner and records zero reconnects. Both final production artifact payload scans pass in production-payload-scan-111.json; this checks selected policy and streamed private-fixture/canary/symlink exclusion, without claiming a new release assembly.

The final QEMU compatibility pack also passes all 19 entries: the fixed seven-case response matrix and all 18 selected .coh scripts. Its four source-bound transport results and aggregate are in the QEMU checkout’s out/m27a/qemu-f-tcp-108/transport-results/; qemu-f-tcp-108.log retains the command output. Both checkouts restore their generated outputs after the pack. The three Mac clients used for the final Pi production observation compile against that exact production Pi manifest at clean candidate F in out/m27a/pi4-f-production-clients-113/ in the Pi checkout; their binaries, policies and hashes are retained and canonical generated outputs restored.

The final production Pi boot passes exact BUILD and CRC checks across reset, passive settle, and 64/64 first raw requests on one connection without retries or reconnects. The strict-intent, stable duplicate, changed-envelope, stale-epoch, legacy/SPAWN/KILL refusal, memory-command refusal, complete fresh/duplicate audit and replay observations pass in the Pi checkout’s out/m27a/pi4-f-production-114/authority/result.json. All six live REST authority cases and three Python state reads also pass before evidence export.

That export initially fails its policy fingerprint check: the temporary client collector retained canonical configs/generated policy files, while its compiler command wrote the production TOML policies under out/. The executable is correct; the policy copies are stale. Attempt 114 remains FAIL as an aggregate. Collection attempt 119 also remains failed after assuming an incorrect public-key output path. Corrected collection 120 retains the actual compiler policy outputs and verifies the already-correct compiler public key; every client binary hash is unchanged. Only the failed export is repeated, on the same physical boot. out/m27a/pi4-f-evidence-121/result.json passes and the shipped coh evidence pack captures epoch 7 with one dedupe entry and one duplicate. No boot or passing operation suite is repeated. The native Linux collector used the same shorthand compiler command; its original generated production policy files are likewise retained separately in out/m27a/merlin2-production-policies-123/, preserving original candidate A compilation/probe identities without rebuilding or retesting.

Continuous paired captures run from 08:12:22 to 10:44:50 UTC. Both tcpdump children exit zero and report zero kernel drops (en0: 887758 captured packets; en8: 601532). The supervisor receives the requested interrupt and completes its finally block; its KeyboardInterrupt exit is retained. out/m27a/pi4-capture-seal-124.json binds the closed pcap files, logs, ownership and shutdown record with SHA-256 hashes. The final physical production image remains running; all task-owned serial, TCP client and gateway processes are closed.

scoped-metadata-review-116.log passes current-year author/purpose metadata on changed human-authored comment-capable files and all 27 new local Markdown file links. Baseline recovery checked repository/sibling outputs, Merlin2, GitHub Actions artifacts, Spotlight and retained local worktrees. Historical commit 29a6c034b retains the narrative and filenames, but the referenced M26d status JSON is absent. out/m27a/missing-baseline-118.json records this evidence gap; the owner subsequently accepted its absence for M27a closure. The pre-27a host-model report is not substituted for it.

Owner review and focused completion scope

Lukas Bower answered “Sign off” to the explicit candidate-F Rust review and M27a-specific DD30 disposition request on 14 September 2026. The request bound source 58140c1a5c79124a8dd7a4ff4bd547a52c8bd362 and the retained full patch out/m27a/candidate-f-review.patch. The separate approval record binds every reviewed implementation path and ten protected IPC source hashes. DD30 remains P1 / ACCEPTED_RISK, expires on 13 October 2026, and its dynamic fault/wake test is UNEXECUTED. No static or functional observation is relabeled as that test.

The focused lifecycle suite passes 48 tests and 125 subtests in out/m27a/approval-lifecycle-tests-99.log. The actual DD_MILESTONE_ID=27a blocking-findings and exceptions-register preflights pass in m27a-blocking-preflight-99.log and m27a-exceptions-preflight-99.log. The original release and M27 approvals remain separately selected.

The owner’s later instruction is: “Only run tests required to mark this milestone ‘Complete’, not the full suite”. Candidate F’s common Stage 01 run was interrupted with exit 143 accordingly; its partial results are retained in candidate-f-stage1-97.log and do not constitute Stage 01 PASS. Earlier completed common suites remain evidence at their original candidate identities. Completed validation follows the M27a definition of done and focused scope recorded in TEST_PLAN.md; no final-source full five-stage chain or replacement staged markers are claimed.

The final actual DD30 blocking-findings and exception-register preflights, Test Plan integrity and diff whitespace checks pass in final-blocking-preflight-125.log, final-exceptions-preflight-125.log, check-test-plan-125.log and diff-check-125.log. The reviewed implementation still matches candidate F exactly. out/m27a/final-review-126.patch retains the full patch before the final completion decision, when main was still at 13020a33dba0832e2297fe119fedf6d302704bdc.

Completion decision

On 14 September 2026, Lukas Bower explicitly directed:

Not sure where the json went, 26d is approved and you don’t need it. Finish the milestone, mark Complete, commit and push

This decision accepts M26d and closes M27a without recovering the missing M26d status-baseline JSON or performing its equivalent status comparison. The comparison remains NOT_PERFORMED. It is a scoped milestone-status exception, separate from Rust sign-off and the DD30 decision; it does not establish performance equivalence, replace target proof, create staged PASS markers or waive another milestone’s benchmark requirements. The pre-27a host-model comparison and its measured status/write latency regressions remain recorded.

M27a is Complete using the retained host contracts, exact builds, TCP/REST compatibility, production authority observations, scoped security and generated checks, together with the explicit owner dispositions above. The approved implementation remains byte-identical to candidate F. The completion commit updates BUILD_PLAN, STATUS and the owning evidence/benchmark documents together. Production failover/federation remains disabled in the single-Jetson Release A profile. No physical failover or future VM authority qualification is claimed.

Final publication checks pass after recording the owner decision:

The final whitespace, documentation-link and reviewed-source comparisons also pass. No full workspace suite or additional target run is performed for this publication step.