M27b implementation record

Status: Complete for the selected Executable Host Foundation on 19 September

1. The final closure section supersedes historical progress notes below; those notes preserve their original scope and evidence identity. The owner requested every specified task, selected the installed CUDA 13.2.2 reference, removed milestone activation gates, and requested focused testing rather than the full suite. No broader performance, target or use-case acceptance is inferred.

Title/ID: m27b-native-workload-and-package-convergence
Milestone: 27b / m27b-gpu-workload-and-mig-executor,
  m27b-external-executor-conformance, m27b-packaging-deployment-profiles
Goal: Bind root-admitted CUDA work to native execution and Worker receipts,
  and preserve canonical host filesystem and package behavior.
Inputs: production QEMU authority profile at writer epoch 7; Merlin Linux
  AArch64 CUDA 13.2.2, driver/runtime 13020, Orin compute capability 8.7.
Changes:
  - GPU bridge and host-ticket-agent — exact published UUID/topology/helper,
    Worker reservation checks, bounded execution and matching control lane.
  - root-task NineDoor — one matching pending workload control request;
    canonical Worker directory listing and bounded CAT over the retained ring.
  - coh mount — acknowledged append offsets and macFUSE published-EOF placement.
  - compiler release inventory — explicit SDK product sources, excluding tests.
  - scripts/install/build_python_package.py — isolated wheel/sdist build,
    exact archive contents, source digests, types and wheel RECORD verification.
Commands: See the focused command list below.
Checks: Native first-kernel and terminal state; exact root/Worker identity;
  canonical shard bytes and write refusals on four mounted paths; clean
  distribution inventory and supported-interpreter installation.
Deliverables: Source changes, retained local evidence, and as-built docs.

The live GPU records at out/m27b/live-session-02 correlate root admission on the provisioned QEMU image with Merlin execution and the executable Worker. gpu-worker-result-02.json records lease grant, vector-add and matrix-multiply. gpu-worker-cancel-result-01.json records a CUDA child paused after its first completed kernel, followed by a matching admitted cancel: the submit is rejected and the cancel confirmed, with completed Worker receipt sequences. The native state copy is out/m27b/native-live-02. Fixture-admission IPC tests remain separate observations and are not substituted for these root/Worker records. The signed causal evidence producer chain is still outstanding.

out/m27b/fuse-parity.json binds the four mounted macOS/Linux direct/REST lanes to out/m27b/qemu-production-03. Each reads the same 288-byte canonical Worker telemetry window, SHA-256 84dd0960b70fe055c91b4ca6a70b8d1b2b5ea28f1397b62150bdd7d20c941553. Each acknowledges a valid finite-lifetime host-ticket append, rejects an invalid schema and a path outside the mount allowlist, and unmounts successfully. The append is explicitly not an external provider execution claim. The gateway releases its sole TCP console connection before direct mounts; all owned session processes are retired afterward.

The original FUSE failure is retained: root listed the shard and Worker but neither listed the Worker directory nor supported CAT on its telemetry leaf. Both now reuse existing bounded telemetry state. A separate native macFUSE probe found that O_APPEND is absent from OPEN and WRITE; the host fix accepts only sequential offsets or the exact EOF last reported to that kernel. The probe is under ignored out/; it is not a shipped integration surface.

out/m27b/python-distributions-02/distributions.json records a target-neutral wheel and sdist built from the compiler’s explicit SDK source list in a private temporary directory. The wheel SHA-256 is 344ce6c5b48f20f532eee467e37a0538502d97adb045dbc64ffe39a331d2bec6. out/m27b/python-package-smoke-01 records clean installation on CPython 3.11 and 3.13. This package inspection is not release signing or target proof.

Focused commands run for these changes:

SEL4_BUILD_DIR="$PWD/out/sel4/profile-v2/qemu-smp-production" \
  cargo test -p root-task --lib --no-default-features \
  --features driver-tests-qemu,mock-sel4,test-support \
  ninedoor::tests::host_ticket_workload_admits -- --nocapture
SEL4_BUILD_DIR="$PWD/out/sel4/profile-v2/qemu-smp-production" \
  cargo test -p root-task --lib --no-default-features \
  --features driver-tests-qemu,mock-sel4,test-support \
  ninedoor::tests::worker_directory_and_cat -- --nocapture
cargo test -p coh --features fuse --test mount
cargo build -p coh --features fuse
.venv/bin/python -m pytest -q tests/test_python_package.py
.venv/bin/python scripts/install/build_python_package.py \
  --out out/m27b/python-distributions-02
scripts/ci/python_compat_run.sh --wheel-smoke \
  --wheel-dir out/m27b/python-distributions-02 \
  --package-manifest out/m27b/python-distributions-02/python-package.json \
  --state-dir out/m27b/python-package-smoke-01

The production QEMU build commands and exact source/image/manifest observations are retained under out/m27b/qemu-production-02 and qemu-production-03. Merlin source copies m27b-host-source-16 and m27b-host-source-17 are separately retained; the latter compiles coh for aarch64-unknown-linux-gnu. Focused host checks and live convergence evidence do not replace the unimplemented tasks.

Still required: complete signed authority/provider/Worker producers, live native snapshot publication, capable-host MIG and macOS provider actions, generated nine-playbook DAGs and public claim matrix, container/Kubernetes deployment assets and release integration, full selected conformance matrix, live SIEM/federation acknowledgement recovery, MODBUS/DNP3 restoration under reopened M18, and targeted provider/exporter timing. The complete host-tool, SDK and benchmark compatibility review and final generated/documentation checks remain open.

Signed host packaging implementation (15 September): the compiler declares four bounded deployment profiles. coh package validates Ed25519 signatures against external trust, exact file inventories, executable entry/segment and architecture bounds, selected configuration hashes, production authority, secret references and the CycloneDX file SBOM. The installer publishes a fresh verified snapshot, and the service renderer consumes signed templates without activating them. coh doctor --package reports credential resolution separately from unobserved service health.

Focused package tests pass: four signing/inventory/native-boundary tests, three service-rendering tests, the REST read/write credential-file test, and three shared secret-reference tests. The macOS production host build and package round trip are retained under out/m27b/package-mac-01 and out/m27b/package-mac-proof-02: 15 files, 190716300 artifact bytes, manifest SHA-256 3a4673473da7199e7bac2a1625c97e50cd2a4bad1ffa0c551aa4b140aa785f29. Both rendered plists pass plutil -lint; no service was activated. The signer is a freshly generated conformance-only key, not a production release signer. The temporary signing seed and credential values were removed after the check. Historical failed attempts remain recorded: an invalid source-digest prefix was refused before signing, and oversized Linux debug artifacts were refused before packaging. out/m27b/package-linux-proof-02 records the separate successful Linux AArch64 CUDA release package check: 21 artifacts, 39372189 bytes, manifest SHA-256 5d25284259505cbe2668ff73d204a7e2000b878b6ed1a71c55be5503d0ae6dcd. The six rendered systemd units pass systemd-analyze verify. Both package records bind provider graph 9a40f3c63aa2f74725a443e58af4eb610d365524322330d895ad62573b4b0e1d. The native source copy is /mnt/nvme/cohesix-dev/m27b-host-source-19; release compilation uses aarch64-unknown-linux-gnu and the exact production generated files retained in out/m27b/package-mac-01/generated. Package checks do not update the earlier root/Worker/CUDA runtime evidence graph or assert service activation.

cargo test -p coh --lib package::tests --features fuse
cargo test -p cohesix-authority --features std secret::tests
cargo test -p cohesix-rest credential_files_resolve -- --nocapture
.venv/bin/python -m pytest -q tests/test_host_services.py
cargo clippy -p coh --features fuse --all-targets -- -D warnings
cargo build --locked -p coh --features coh/fuse -p cohsh -p hive-gateway \
  -p host-ticket-agent -p host-sidecar-bridge

The follow-up package review refuses a trust file located inside the package itself, caps package path depth at 16 components, and makes an installed config/coh_policy.toml or config/cohsh_policy.toml take precedence over a checkout’s development policy. Four focused package tests and the compiler profile test pass; the macOS coh clippy check passes. The updated host tools also pass cargo check --locked --target aarch64-unknown-linux-gnu on Merlin from source copy m27b-host-source-20. These final boundary checks extend the earlier package round-trip observations; they do not relabel the earlier artifact digests as new builds. The full workspace suite was not run.

Identity exchange and ticket compatibility

Title/ID: m27b-generated-identity-issuance
Milestone: 27b / m27b-identity-mapping, m27b-read-visibility-classes
Goal: Issue finite host-mapped tickets and enforce current provider permissions
  before the gateway forwards any caller request.
Inputs: generated providers.identity_mappings, independently enrolled public
  JWKS digests, gateway delegation secret, existing gateway authority ceiling.
Changes:
  - cohesix-identity — kernel/JWT mapping, original issuer time, policy-bound
    subjects, gateway-only signing domain and finite compact ticket issuance.
  - cohesix-ticket — explicit canonical v2 integer codec; v1 defaults retained.
  - hive-gateway — bounded authenticated exchange and current generated action
    checks for every mapped write/batch line before charging or forwarding.
  - coh — explicit enrolled issuer option, proposal default and redacted audit.
  - Python identity/ticket helpers — bounded exchange, no redirects/proxies,
    independent response bindings and compatible v1/v2 claim inspection.
  - compiler release inventory — include the new product identity module.
  - OpenAPI and canonical host/security/API docs — issuance/refusal contracts,
    read visibility, offline docs and explicit gateway restart limitations.
Commands:
  cargo test -p cohesix-ticket --lib compact_
  cargo test --locked -p cohesix-identity --test mapping
  cargo test --locked -p hive-gateway --bin hive-gateway identity_exchange_
  cargo test --locked -p hive-gateway --bin hive-gateway auth::tests
  .venv/bin/python -m pytest -q tools/cohesix-py/tests/test_identity.py tools/cohesix-py/tests/test_ticket.py
  cargo clippy --locked -p hive-gateway -p coh --features coh/fuse -p cohesix-identity -p cohesix-ticket --all-targets -- -D warnings
  cargo check --locked -p cohesix-ticket --target aarch64-unknown-none
  cargo check --locked -p hive-gateway
  cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json --embed-userland-doc docs/USERLAND_AND_CLI.md
  ssh wizard@merlin2.local 'cd /mnt/nvme/cohesix-dev/m27b-host-source-21 && CARGO_TARGET_DIR=/mnt/nvme/cohesix-dev/builds/m27b-host /home/wizard/.cargo/bin/cargo check --locked -p hive-gateway -p coh --features coh/fuse'
Checks: Signature-domain isolation; finite original expiry; exact policy/action
  and batch checks; duplicate/overbroad/unknown/stale refusals; quota reuse;
  kernel uid provenance; bounded response parsing; no credential redirects.
Deliverables: Source, identity API documentation and focused evidence logs.

identity-compact-ticket-tests-01.log records two independent Rust wire/ULEB128 checks. identity-mapping-tests-03.log records three signature/claim/kernel mapping checks; identity-gateway-tests-02.log records three issuance/action/HTTP checks; identity-delegation-regression-01.log records six existing delegation invariants; identity-python-tests-02.log records four SDK/wire checks. All are under out/m27b/ and pass. identity-clippy-01.log passes with existing vendored fuser warnings. identity-ticket-target-check-01.log compiles the shared no_std codec for AArch64. native-identity-check-21.log compiles the selected private Linux AArch64 gateway/CLI profile; its exact source inventory is native-source-21.json. This native compile precedes the later HTTP-body 413 response classification, separately checked on macOS in identity-gateway-check-02.log. No external enterprise issuer is enabled or claimed qualified. The policy defaults remain disabled. regenerate-20.log records compiler regeneration after adding the SDK product module; final release packages must be rebuilt from the final source and inventory.

The identity compatibility review covered every catalogued host-tool family. coh adds explicit issuance; cohsh, FUSE mounts, the GPU bridge, host-ticket agent, host-sidecar bridge and SwarmUI retain their existing ordinary issued tickets and transports through the shared Rust decoder. They receive no implicit identity exchange or refresh. cas-tool has no delegation parser or identity issuance authority. Python now inspects v2 and offers an explicit exchange helper. Rust and Python collectors still redact the unchanged cohesix-ticket- prefix. The REST benchmark workloads and schemas, gateway performance probe, Worker evidence parser and frozen M26e action expectations need no identity-specific changes: they use their already enrolled tickets and do not measure an identity provider. Existing generated v1 fixture tickets remain unchanged. Manifest schema stays 1.22 because the handwritten ticket payload has its own explicit version and no generated default/bound changes.

Native host snapshot receiver (in progress)

Schema 1.23 introduces ecosystem.host.snapshots and source-specific /host/snapshots/<provider>/<source>/{ctl,status,snapshot} paths under existing namespace authority. The compiler bounds sources, pairs, byte/entry/value counts, TTL, canonical provider registry membership and console paths. The shared no_std validator refuses noncanonical records, wrong source/provider/ epoch, sequence or observation-time regression, duplicate paths and excessive bounds. The root receiver retains an atomic bounded upload per pair; expiry withdraws data while retaining the replay fence. First-byte receiver time consumes TTL, and an exact retry cannot renew it. No native producer or target acceptance is inferred from these source changes.

Focused initial evidence under out/m27b/:

• host-snapshot-contract-tests-02.log: two deterministic record, bounds, replay, failed-source and first-byte/TTL contracts pass.
• host-snapshot-root-tests-03.log: the pure root namespace upload/source separation/withdrawal contract passes; this does not simulate seL4 execution.
• host-snapshot-compiler-tests-01.log: one deterministic generated enrollment bounds/refusal contract passes.
• host-snapshot-check-01.log: the initial shared module compiles no_std for AArch64. Later receiver work still requires its exact target build.
• regenerate-21.log and regenerate-22.log retain compiler transitions. The later regenerate-23.log uses canonical provider id network, linking its publisher selection to the existing provider registry instead of introducing a new net alias. Initial test logs precede that identifier alignment.

Native collector wiring, durable publisher sequence state, SDK consumption, whole-host compatibility closure and fresh target publication/expiry evidence remain required. Previously signed packages and GPU/FUSE evidence retain their original schema/profile and digest bindings; they are not relabeled as 1.23 qualification.

Native snapshot publication and receiver check

Milestone 27b / m27b-native-provider-discovery-and-actions now connects the schema-1.23 receiver to source-enrolled native publishers and Python reads. The CLI requires an explicit source and private state root. A source/epoch lock and fsync-reserved sequence prevent publisher restart from reusing a transmitted sequence; missing/corrupt existing cursors refuse startup. Capture, disk reservation and upload consume freshness. Native failure or excessive data publishes an empty typed withdrawal. Source labels remain authenticated correlation under the existing Queen/delegated path authority, not signed execution evidence.

Native APIs cover selected systemd Manager D-Bus, Docker Engine, Kubernetes, CUDA-helper/NVML inventory, Jetson device/package/clock/thermal/power state, Linux link/address/IPv4-route tables, and macOS interface/address/default-route state. Column tables and bounded route-row groups preserve selected rows and native counters without repeated JSON names. Missing native fields remain null; unknown native counter/address column names are retained. The launchd collector requires explicit system service labels and exports no environment values. No Mac-local NVIDIA probe runs under the Mac source enrollment.

Commands and focused results under out/m27b:

• cargo test --locked -p host-sidecar-bridge --lib snapshots::tests::durable_cursor_refuses_reuse_missing_state_and_foreign_domains -- --test-threads=1: host-snapshot-publisher-tests-02.log, one PASS. The first fixture run refused an insufficiently private directory; the fixture was corrected to mode 0700.
• cargo test --locked -p host-sidecar-bridge --lib observations::tests:: -- --test-threads=1: host-snapshot-native-bound-tests-01.log, two PASS including child timeout after stdout EOF and descendant pipe ownership. The later column contract test is host-snapshot-network-column-tests-02.log, one PASS, covering native address fields, 64-bit counters and complete route-row grouping.
• cargo clippy --locked -p host-sidecar-bridge --all-targets -- -D warnings: host-snapshot-sidecar-clippy-04.log. Final package compiles will include the subsequent early refusal of unenrolled library publication requests.
• Python snapshot/service tests: host-snapshot-python-services-tests-02.log, five PASS; host-snapshot-service-enrollment-tests-01.log, one PASS. Service rendering now binds the source/systemd pair to the verified package manifest.
• Exact QEMU build: qemu-production-04/build.log and source.json retain the production epoch-7 schema-1.23 target profile, binary/image identities and restored canonical generated outputs. This build compiled affected target components and exercised the new receiver in the following live checks.
• Mac native build and exact sidecar source hashes: host-snapshot-mac-01/provenance.json; binary SHA-256 a014a5251971d3b2392e6dfd20aa4fe49c4875576e1904955e60d3a5de3c8712. live-session-04/snapshots-mac-01/summary.json is PASS: 48 real network records, sequence 1 then 2 after process restart, explicit unenrolled-launchd withdrawal, client source refusal and receiver expiry after 31 seconds.
• Linux native build: native-source-24.json and native-snapshot-build-24.log; binary SHA-256 5a60288af10084f6ec11c252db0d6fcfa1747fec3c4bf2cc832f82a4b5ce32bf. live-session-04/snapshots-linux-02/summary.json is PASS: systemd, Docker, network, Jetson and CUDA-helper NVIDIA records reached QEMU and passed Python digest/domain/status checks. Network has 26 records; Jetson has 25. Kubernetes is explicitly not_enabled because no API is enrolled. Target expiry passes. Sequence 7–12 continues the same private source cursor from the retained first attempt; it was not reset. Docker used only the owned process’s docker group through the authorized administrative credentials, with no account or daemon configuration changes.

The first Linux run remains a failure: network projection size exceeded the receiver bound and the host had no nvidia-smi. Both published honest withdrawals. The corrected projection retains every selected row, and the NVIDIA lane uses the already-tested, digest-pinned CUDA 13.2.2 reference helper with exact UUID checking. Historical package, GPU, identity and FUSE artifacts retain their original source/profile/digests. The owned QEMU, gateway and tunnel were stopped after this check; the full staged suite was not run.

Compatibility review: cohsh direct/REST framing uses the existing ECHO and CAT bounds; hive-gateway applies existing delegated write/read visibility; coh/FUSE and SwarmUI can enumerate the new generated namespace without new write powers. The Python wheel inventory includes the new explicit-target SnapshotReader. GPU bridge, host-ticket-agent, Worker schemas, telemetry ingest and benchmark report contracts are unchanged by these read-only snapshots. The host-sidecar CLI and systemd service template require source/state enrollment. Legacy unversioned library publication helpers remain compatibility surfaces and are not used by the new live CLI; further public-surface/deployment closure remains part of M27b. This check proves native observations and QEMU receiver behavior, not provider actions, Pi execution or a complete production use case.

Native executor result delivery correction (in progress)

The live snapshot work exposed an M27b integration defect: systemd, Docker and Kubernetes executors observed native completion and then attempted writes to legacy /host control/status fixtures. The production root makes those status projections read-only, so an already committed provider operation could be misreported as pending or failed solely because that obsolete mirror failed. The adapters now retain the complete native observation in the private CAS and return its compact digest through the host-ticket agent’s existing durable result channel. Read-only systemd/Docker checks use the same bounded reference rather than unbounded inline JSON. Native operation postcondition checks remain unchanged; the independent source-scoped sidecar owns current host observations.

native-executor-result-check-01.log records the focused host compilation. Native ticket-to-result integration and final profile compilation for this correction are still pending. No completion or action receipt is claimed from this source edit alone.

The first production ticket-to-result attempt is retained as native-ticket-results-01.log: Root refused the request with invalid-payload before the native agent ran. Inspection found the version-1 Root validator still uses its original flat JSON parser: it rejects both the documented args object and the M27a writer_epoch/admission fields. The production agent requires the current writer epoch, so dropping that field cannot repair the contract. Version-1 result validation has the same field mismatch. A strict bounded typed parser must reconcile those documented request/result fields, retain unknown/duplicate/type refusal, enforce the selected writer epoch, and continue treating admission correlation as non-authoritative. That Root correction and new exact target proof are the next unfinished work. Session 05 used the existing QEMU image and has been stopped; no native effect or receipt was produced by this refused attempt.

The parser restoration is authorized under the reopened 27a / m27a-host-ticket-validation-replay, discovered by 27b / m27b-native-provider-discovery-and-actions. Root now uses strict typed version-1 request/result records, a duplicate-rejecting primitive argument map, structurally checked admission correlation and the generated writer fence. Nested argument values fail directly in a serde visitor without recursively allocating an untagged intermediate tree. The unrelated flat JSON grammars are unchanged. native-ticket-root-parser-tests-02.log records one focused PASS for nested argument acceptance, duplicate/type/null refusal and stale/missing writer rejection. The new exact target build is qemu-production-05; native integration and restoration closure are still pending.

Restoration closure: qemu-production-05/build.log compiled the corrected Root for the exact production QEMU profile, with canonical generated outputs restored. Its resolved manifest SHA-256 is b6c5494504b068c41ab95e9ccc23bca4580c691914b50b7adec62a1b2a6f3f88; the manifest and provider registry are byte-identical to QEMU build 04. The source-matched Merlin agent build is native-source-25.json / native-ticket-result-build-25.log; focused Mac lint is native-executor-result-clippy-01.log. This native build also compiles the snapshot publisher’s early unenrolled-provider refusal.

native-ticket-results-02.log and live-session-06/native-ticket-results-02/summary.json are PASS: Root admits systemd and Docker read-only native tickets with structured arguments and epoch 7; Merlin observes the actual APIs, retains private content-addressed observations, and publishes two succeeded results without writing legacy status projections. native-ticket-epoch-negative-01.log proves live Root refusal of missing and stale version-1 epochs before native execution. native-ticket-correlation-01.log proves admission correlation round-trip, including a state epoch distinct from the writer epoch. Correlation remains non-authoritative; its historical expiry is not used as a grant. The latter run uses a fresh agent journal and refuses replay of the two previously terminal records (failed=2, no repeated native operation), while the new read succeeds. This replay refusal is retained rather than relabeled as a new success.

The scoped 27a / m27a-host-ticket-validation-replay restoration is Complete. M27b’s native executor mirror correction is also verified for the read-only result path. Provider mutation postconditions retain their earlier native helper checks; this check does not claim newly verified mutation execution, executable Worker completion, signed producer authority or physical Pi behavior. Session 06 and its gateway/tunnel were stopped. The first refused attempt and earlier qualification artifacts remain unchanged. No full suite was run.

Enrolled native evidence producers (15 September 2026)

Title/ID: m27b-native-custody-producers Milestone: 27b / m27b-authoritative-receipt-and-evidence-core Goal: Extend an independently enrolled gateway admission witness with real native observations and a verified Root terminal readback, preserving phase custody and incomplete-chain refusal.

Changes: cohesix-evidence::producer adds private per-operation enrollment, separate gateway/native/Worker-witness custody, immutable CAS, locked durable prefix journals, exact binding/component checks and fixed expiry. The shared verifier’s terminal requirements are preserved; its internal prefix validator cannot produce a terminal projection. Gateway and ticket-agent signing flags refuse mock mode. The gateway signs a validated native v1 request append only after exact Root readback and manifest measurement. Native systemd, Docker and Kubernetes adapters carry observed native identity into their signed records. The native agent checks the entire grant prefix and exact request before I/O, then requires its observation hash in the exact Root terminal row. These are host custodian witnesses, with device attestation and Worker proof explicitly false. docs/CAUSAL_EVIDENCE.md defines the enrollment and operational contract.

Focused commands/checks:

• cargo test -p cohesix-evidence --test producer --test graph: out/m27b/evidence-producer-tests-03.log, 4 PASS. The added enrollment/profile, request semantic and fixed-expiry test brings producer coverage to 2 PASS in evidence-producer-enrollment-tests-04.log. The first producer test failed because the temporary directory lacked the required private permissions; only the fixture permissions were corrected, and that failure is retained.
• cargo test -p hive-gateway admission_witness_requires_exact_root_fields_and_one_record: evidence-gateway-tests-02.log, 1 PASS, 84 filtered. Exact fields, duplicate rows, changed epoch and changed native operands remain strict refusals.
• cargo clippy -p cohesix-evidence -p hive-gateway -p host-ticket-agent --all-targets -- -D warnings: evidence-producer-host-clippy-03.log, PASS.
• python3 out/scripts/m27b-build-evidence-mac-02.py builds release coh and gateway with the private QEMU profile, retains binary/provenance under evidence-producer-mac-02, and restores canonical generated outputs.
• python3 out/scripts/m27b-sync-native-26.py; on Merlin, cd /mnt/nvme/cohesix-dev/m27b-host-source-26 && CARGO_TARGET_DIR=/mnt/nvme/cohesix-dev/builds/m27b-host /home/wizard/.cargo/bin/cargo build --locked --release -p host-ticket-agent: native-evidence-build-26.log, PASS. Existing vendored FUSE warnings are retained without modifying vendor code.
• python3 out/scripts/m27b-live-session-07.py and python3 out/scripts/m27b-signed-native-live-01.py: signed-native-live-01.log, PASS. Exact QEMU build 05 accepts a read-only systemd request; Merlin reports seen=1 succeeded=1 failed=0. The shared installed coh evidence verify accepts eight phases under distinct gateway and native public keys. An exact gateway retry preserves all signatures and leaves one Root request row. A forged signature and a missing terminal are refused. No new target build or full suite was needed.

The live graph SHA-256 is 97b327e50f435a87e3578909224441d2e25c9967e05022d497f803bd1bcd2fd2. Its gateway binary is 28c616f68f2eda3cdcfac222647a8ea8e1c670989941c7f9bc866eb595ddeaea; its native agent binary is be172db092d6eb619a59e87f3125f32f08dc4a5b0c83fe8c5fd8477afbf7fffe. live-session-07/signed-native-01/summary.json, trust.json, the two private stores and verified.json retain source/manifest/component/phase provenance. The use-case binding fingerprints the generated host-integration dependency artifact containing its frozen use-case rows; this read does not qualify a production use case. Both temporary conformance private keys were deleted. The owned QEMU/gateway/tunnel session was stopped.

A subsequent recovery correction reads for an exact existing successful Root result before retrying a signed terminal append, so a lost result ACK cannot create a duplicate terminal row. This is narrower than native operation replay: the existing agent WAL still owns dispatch and never re-executes this operation. cargo test -p host-ticket-agent lost_terminal_ack_requires_exact_single_root_record_before_retry_is_suppressed is the focused independent predicate check; its logs are evidence-native-retry-tests-02.log and evidence-native-retry-clippy-02.log. The corresponding native profile check is native-evidence-retry-check-27.log against the exact source inventory native-source-27.json. This correction is not retroactively attributed to the earlier source-26 live run.

Compatibility review: existing unsigned operation-report and native observation schemas, transport result text and public control grammar remain unchanged. coh/Python evidence consumers and exporters share the unchanged terminal verification contract; cohsh, FUSE, sidecar snapshot publication, cas-tool, GPU IPC, REST read scopes and SwarmUI receive no new authority. Benchmark workloads and report fields require no change for this opt-in signing path. The remaining executable Worker witness, negative terminal-chain, generated workflow/deployment and broader conformance tasks remain open; no device, Worker, Pi, MIG or production-use-case acceptance is inferred from this run.

SIEM TLS acknowledgement recovery (15 September 2026)

Title/ID: m27b-siem-tls-durable-ack Milestone: 27b / m27b-observability-exporters Goal: Deliver a verifier-accepted graph over TLS and reconcile a lost receiver acknowledgement across both process restarts.

The generated SIEM policy now accepts an optional explicit CA-certificate path reference. The reference resolves to one bounded absolute PEM file, which must contain exactly one valid certificate. An invalid explicit source never falls back to system roots. The default policy omits this optional field and preserves the existing graph. Sender state requires an owned private directory, bounded regular files, no symlink/hardlink substitution or writable foreign files, and a retained WAL once the store has been initialized. Missing WAL is a refusal.

python3 out/scripts/m27b-siem-live.py built the private generated-policy release coh and restored every canonical generated output. The owned loopback TLS receiver committed an exact graph id, hash and payload using SQLite FULL synchronization before dropping its first response. After receiver restart, a fresh sender process obtained the exact acknowledgement; a third sender process read its durable acknowledged state without sending again. The result is three sender processes, two receiver process lifetimes, two HTTP requests and one unique durable acceptance. Temporary TLS private keys were deleted and the owned receiver stopped. out/m27b/siem-live-01/summary.json, the sender WAL/ACK, receiver database, source inventory and process logs retain the observations.

The proof class is live_receiver_delivery_of_historical_verified_native_graph. It uses graph 97b327e50f435a87e3578909224441d2e25c9967e05022d497f803bd1bcd2fd2, release binary cfd9cdad81309b05608b4569202027639ae32d8945add7e8caad409e05eca5da, and acknowledgement 0d24d565663de4bcd5b4f6962ccf9a17d75abc33ce3c4a20222883bd7c3b9b57. This proves delivery to the owned contract receiver; it does not claim a vendor SIEM installation, fresh native execution, device attestation or Worker proof.

Focused checks: siem-durable-tls-tests-03.log (two sender-state/CA tests), siem-tls-compiler-tests-01.log (one generated CA-reference test), siem-clippy-01.log (coh/coh-rtc all targets), and native-siem-check-28.log (Linux AArch64 coh) pass. The initial malformed-PEM fixture exposed lazy certificate parsing; the explicit bundle parse fixes the implementation, with the failure preserved in siem-durable-tls-tests-01.log. Two retained payload/ACK reads were subsequently switched to the bounded file reader and covered by the final focused checks; the earlier live binary is not relabelled as containing that later correction. Canonical regeneration 25 passes.

Compatibility review: the acknowledgement and exporter payload schemas, shared Rust/Python terminal verifier, gateway/console/FUSE scopes, GPU executor, sidecar snapshots, CAS and SwarmUI authority remain unchanged. Optional CA selection is documented in HOST_TOOLS and SECURITY; other host tools do not deliver SIEM payloads. Provider/exporter performance remains a distinct later task.

Federation, matrix and provider overhead (15 September 2026)

Title/ID: m27b-federation-matrix-overhead Milestones: 27b / m27b-federation-conformance, m27b-ecosystem-conformance-matrix, m27b-provider-exporter-performance Goal: Recover the exact native terminal across two actual hives after a lost forward acknowledgement, expose focused canonical contract selection, and measure the changed host paths without a full performance suite.

The scoped compiler change replaces M27a’s unconditional production-federation activation ban with M27b’s implemented host relay. The existing production strict-intent, audit/replay, writer epoch, WAL, raw-debug and secret-reference requirements remain mandatory; the Release A profile generator still defaults federation off. federation-compiler-test-01.log records one passing positive and floor-refusal contract test. This is selection, not a use-case promotion.

Two disposable provisioned profiles explicitly enable federation. Exact builds qemu-federation-a-09 and qemu-federation-b-10 pass and restore all canonical generated outputs. native-federation-b-build-30.log records the matching Linux AArch64 release agent build, with its inventory in native-source-30.json. The first attempts are retained: run 01 encountered the launcher’s fixed diagnostic-port collision; run 02 passed those new arguments incorrectly to the gateway; run 03 selected an intentionally disabled federation profile; builds 07/08 then identified the obsolete unconditional compiler ban. The launcher now accepts bounded explicit UDP-echo and TCP-smoke ports, while preserving guest ports/image identity and the default smoke fallback. An explicit smoke port never silently falls back. The independent port-range check passes in matrix-port-tests-01.log (four selected tests total).

python3 out/scripts/m27b-federation-live-04.py runs the canonical scripts/ci/provider_federation.py against both actual QEMU hives and a native Merlin agent. The runner refuses nonempty ticket streams, checks both measured Root manifest hashes and uses separate source/peer delegation. It submits one read-only systemd.status-check for ssh.service; the target executes it once. The owned proxy drops the first HTTP 200 forward reply. Source process one retains a pending WAL entry; process two restarts, retries forwarding and returns the target terminal exactly; process three sends nothing further. The retained native observation hash matches the target result. All owned hives, gateways, tunnel and native agent were stopped; the final remote process check finds zero owned agents. No account, network service or native unit was changed.

out/m27b/federation-live-04/conformance/summary.json, three source logs and WAL snapshots, both identical terminal records, proxy events, the native observation object and owner-summary.json bind the result. Terminal SHA-256 is 97c0473b5d2f4aeaa932c3840bd31b037050c9ba3b93426793f58bf51972c558. Source agent SHA-256 is b6131ad71458af4657976768f3110744ff1c86028c13dea96f6d2644d538e34f; target native agent is b9ec7b589a1db9727d6d5feb8f55ac13557bee3b09d59002ab4724c724aaa0a9. The source/target Root images are respectively 958c0b24a803d8b0b24e9d75a50bd1b445937abd44c71f759d893d4e683f878a and 1b4260fa4ecee1f589a3be36c7f337e5956ba7d1983a7bb4fa70973efb63d5e1. This is observed correlated native terminal return, with signed-graph, Worker, Pi and production-use-case proof explicitly false. Earlier pure WAL/queue, correlation and deadline checks retain their separate scope.

The new configs/provider_conformance.toml inherits exact versions, lifecycle, authentication and evidence requirements from the generated registry rather than defining another action catalog. provider_matrix.py validates bounded case/profile/provider identity, scoped cargo/pytest selection, all seven lifecycle phases and separate proof lanes. It records source files, commands, output hashes, counts, duration and generated availability, stops on the first failed selected contract, refuses zero-test success and does not promote generated availability. --validate-only emits NOT_RUN rows; the selection record is provider-matrix-selection-01. Five focused matrix/terminal/endpoint tests pass in matrix-federation-tests-03.log; the prior port test is retained. No full matrix or full suite was run. HOST_TOOLS and TEST_PLAN document these entry points, including explicit live federation enrollment and proof limits.

.venv/bin/python scripts/ci/provider_conformance_run.py --perf-only --state-dir out/m27b/provider-overhead-01 passes the opt-in release host probe. It records ten warmups and 100 samples per operation over a 12,527-byte, eight-node signed fixture and 168,338-byte registry. p95 is 2.500 microseconds for registry lookup, 2.625 for target validation/refusal, 5.084 for local identity mapping, 602.584 for signed graph verification and 13.625 for receipt rendering. Exporter p95 is 0.334 microseconds for Prometheus, 118.167 for OpenTelemetry, 37.375 for CloudEvents, 37.083 for in-toto and 26.334 for SIEM. Output sizes range from 380 to 7,406 bytes. performance.json retains every sample, artifact size and proof limit; provider-overhead-clippy-01.log passes the exact test-target Clippy check. There is no comparable prior baseline, native execution, network/disk cost, or target throughput claim. BENCHMARKS owns the methodology.

Compatibility review: the complete host-tool suite, Python verifier/projection, REST/OpenAPI, FUSE, CAS, GPU IPC, snapshot publication and SwarmUI retain their existing authority and wire formats. The added launcher ports are host-only. The existing hardware benchmark scripts require no workload/schema change; provider overhead is a separate opt-in report. The conformance scripts are invoked by the canonical documented runner and are excluded from live packages unless a generated deployment profile explicitly selects them. M27b remains In Progress for its remaining provider, workflow, deployment and evidence tasks.

Native MIG implementation and Orin regression (15 September 2026)

Title/ID: m27b-gpu-workload-and-mig-executor. The native helper now discovers bounded NVML parent/GI/CI UUIDs, profiles, memory and placements. A selected nvidia-mig-cuda13 executor requires independent enrollment of the complete native topology digest and exact CI. Fresh NVML checks fence topology changes; the isolated CUDA child has one visible MIG UUID and checks the unique native CI UUID through the versioned CUDA driver API. Discovery and execution share cancellation/deadline bounds. The unchanged local GPU transport requires the existing ticket/lease/epoch/TTL/resource/request/helper bindings. GI memory may be shared by sibling CIs; no independent CI memory isolation is claimed.

Focused command evidence:

• cargo test --locked -p gpu-bridge-host --lib mig::: out/m27b/mig-tests-01.log, two passing tests covering UUID/placement/profile, whole-generation changes, duplicate native identities, unavailable state and canonical ordering.
• cargo test --locked -p cohesix-authority --lib gpu::tests::mig_profile and cargo test --locked -p coh-rtc --lib provider_registry::tests::mig_executor: one passing contract test each; changing profile cannot weaken ABI bounds.
• cargo clippy --locked -p gpu-bridge-host --all-targets -- -D warnings: out/m27b/mig-clippy-02.log passes. The first initializer-style finding is retained in mig-clippy-01.log.
• Native source copies 31 and 32 compile the CUDA 13.2.2 Orin helper and release bridge with --features cuda,nvml,rest. Source 32 additionally compiles the compute-80 PTX MIG variant with -DCOH_REFERENCE_MIG=1; this is compilation evidence, not execution on a MIG-capable host.
• out/scripts/m27b-native-mig-orin-01.py exercises actual Orin vadd, matmul, wrong-device, over-budget, stale-inventory, timeout and cancellation through the canonical CUDA reference runner. All seven pass. Source 31 initially reports MIG unavailable because this host’s parent UUID does not have the datacenter UUID format.
• Source 32 checks MIG mode before parsing a parent UUID. The fresh out/scripts/m27b-native-mig-orin-02.py query returns exactly not_supported, NVML error 3, with no instances. The corrected helper does not change physical CUDA execution. The diagnostic records and source/build hashes are retained in out/m27b/mig-native-evidence/ and the corresponding native-mig-*.log files.

Source 32 bridge SHA-256 is caddc11d738179240e1b23288a8b745773e64fb510f04131bdb51d18afc7f581; physical helper is c46203b46f5f5f6f2f8411ae2ec3c92c8527ce3bd659f913a0ffe888b0c2e3b7; compile-only MIG variant is 03f4bf186919079c914d54cc6f645354232d78ef578b0597b1162bbbd2efdd48. The unchanged registry graph is cc91ca1fd9f74bdb0f39a153ee1dd489f6a432109cbd4a8c06c5ba58786e7ed6. No MIG-capable device is available here. Native MIG execution/isolation remains unqualified; Orin, Worker, Pi and use-case proof classes stay distinct.

Compatibility review: the generated optional executor profile preserves all transport/resource defaults. Existing physical configuration omits the new optional MIG enrollment. coh, cohsh, host-ticket-agent, Python and benchmark workloads continue to use the existing admitted device/topology/request ABI; only gpu-bridge-host owns native MIG selection. The matrix adds the focused identity/refusal case. Build manifests retain schema v1 and now bind the helper header as well as its translation unit and executable. Package builders consume the measured helper binary; rebuilding final packages remains part of closure.

Field-bus codec, spool and independent DNP3 work (in progress)

Scope: reopened m18-live-modbus-dnp3-sidecars, discovered under the production surface audit and implemented for m27b-industry-sidecar-contracts. cohesix-authority::bus owns exact bounded endpoint/point maps; coh-rtc validates the optional field-bus registry extension. The new native sidecar-bus feature implements MODBUS RTU/TCP and the documented single-fragment DNP3 subset, native deadline-bound TCP/serial ownership, exact protocol response checks and a private atomic spool. The old model always queues; native adapter names no longer alias the in-memory model.

fieldbus-protocol-tests-02.log records three passing codec tests; fieldbus-map-tests-02.log records the exact-range/control-map test; fieldbus-wal-tests-01.log records three passing lost-ACK/restart/corruption tests; fieldbus-model-test-01.log verifies the online model cannot report delivery. The missing no_std test macro import is retained in fieldbus-map-tests-01.log. fieldbus-clippy-04.log passes the focused native crate check after correcting style findings. A later DNP3 public decoder guard for invalid operation bounds is covered by fieldbus-protocol-tests-02.log; it is not retroactively attributed to the earlier reference binary.

out/scripts/m27b-fieldbus-profile-build.py generates a private exact endpoint profile, compiles the native release client and restores canonical generated files. out/m27b/fieldbus-native-01/interop-02/summary.json records a real TCP exchange with separately built OpenDNP3 3.1.2 at commit c1dc7165a79cc08edbf4b55d2ff4162efb176f92. The client refuses a remote restart indication, reads analog 42 with ONLINE quality after explicit reference-fixture setup, and returns the identical durable result without a second wire read on process restart. Client SHA-256 is e8a5560979ddc7ac7cea1e64ecb7a5676ee3d208a8c4f9059bdaacb703063242; reference outstation SHA-256 is 177863aebfcf6720fe5c581289a890e06f9fe5f3609b9ed18251631f148513c8. The initial reference attempt, including its additional need-time IIN bit, is retained in interop-01; fixture time setup is explicit in the second attempt. The released client does not set time or clear restart indications. Both owned reference outstations exited after the runs.

This is native host interoperability with a named software reference, not physical field-device, Worker or production-use-case acceptance. MODBUS native interoperability, endpoint/action registry wiring, authenticated TTL publication, control admission integration, Linux compilation, packaging and canonical conformance routing remain to be completed for this task.

Field-bus integration and native references (15 September 2026)

M18 m18-live-modbus-dnp3-sidecars and M27b m27b-industry-sidecar-contracts now include compiler-validated endpoint/point maps, v1 read/control ticket dispatch, signed control grants, exact map/graph fences, read-only bounded retry, and freshness-preserving snapshot projection. Schema 1.24 adds the four ticket actions without adding in-VM protocol I/O. The SDK validates the same compiled maps. Native package profiles include sidecar-bus and FIELD_BUS.md; service rendering requires signed enrollment for bus tickets and grants only exact configured serial devices.

Focused evidence: fieldbus-authority-test-01, fieldbus-snapshot-test-01, fieldbus-agent-test-01 and fieldbus-compiler-test-01 each pass their selected contract test. fieldbus-services-test-01 passes three rendering tests. fieldbus-matrix-03 passes codec and WAL tests; its SDK failure was an inline import shadowing the global validator, corrected and passed in fieldbus-matrix-sdk-04. fieldbus-matrix-parser-test-01 passes three tests. The earlier comma-filter and missing-pytest failures remain in runs 01/02. sidecar-library-test-01 and fieldbus-integrated-clippy-04 pass after removing superseded library publication paths and adding the compiled mount fence. The initial error conversion compile finding remains in Clippy run 03.

The canonical scripts/ci/field_bus_conformance.py owns independent PyModbus 3.11.4 and OpenDNP3 3.1.2 references. fieldbus-canonical-macos-01 passes native TCP/RTU-PTY/DNP3 reads, exception/restart refusal, signed controls and exact ACK replay. fieldbus-canonical-linux-05 passes those cases plus ACK-time-preserving DNP3 snapshot projection on Linux AArch64. Linux source 38 client SHA-256 is 412306a8ee22ee95d24a2c05644f2678a6962b270a9f0e6f1229ba518d4dd2e8; OpenDNP3 outstation is da12e0a1caade1850be34cfb2b02bf281424ffaf1479b19bfae9dd175a961cc6. Both bind the independently checked OpenDNP3 commit c1dc7165a79cc08edbf4b55d2ff4162efb176f92, private generated maps, source inventory, wire bytes and durable records. Ephemeral fixture signing keys are deleted; owned references exit. Linux attempts 01–04 stopped before wire I/O for incomplete Gitless source/index/release inputs; the final runner verifies a complete source manifest and supplies a temporary Git index solely for compiler inventory. No synthetic commit is created. Selected licence/release support files are preserved unchanged in the native archive.

These records establish host interoperability, not physical UART/device, Worker or production use-case proof. Final exact Root integration, package rebuilding and milestone closure are still pending. The sidecar library now shares the CLI publisher, removing stale legacy status writes and typed-unavailable Jetson/net branches superseded by actual native observations. Complete suite review found no change required to coh/cohsh, gateway, FUSE, SwarmUI or hardware benchmark wire formats for this library migration. SDK field-bus validation and generated registry/snapshot contracts were updated together; final suite-wide review remains part of M27b closure.

Worker v2 producer wiring (19 September 2026; live closure pending)

Scope: m27b-authoritative-receipt-and-evidence-core and m27b-gpu-workload-and-mig-executor. The shared evidence crate now owns exact caller-versus-Root v2 normalization, correlation-path encoding and independently enrolled Worker binding checks. The gateway signs only the exact resolved snapshot, retains a pending Worker sequence, and captures bounded GPU/lease facts. Retries preserve original facts and grants. The agent validates the exact signed grant before I/O, checks distinct gateway/native/Worker public keys, and requires a separate Worker witness enrollment. Native publication is persisted before witness attempts; cursor/compaction waits for exact Root completion. Signed retained Worker phases can finish after restart without changing bytes.

GPU native results retain their original durable terminal time and immutable job identity. Actual failure/cancel/revoke/interruption observations enter verification with the corresponding outcome; missing native evidence remains incomplete. Control/observe receipts retain their own postcondition and leave the original submit outcome unchanged. The service renderer supplies the separate enrollment option without embedding keys. CAUSAL_EVIDENCE, HOST_TOOLS and packaging guidance document the non-attested Root witness and independently enrolled image hash.

Focused commands/evidence:

• cargo test --locked -p cohesix-evidence --lib ticket::: worker-evidence-ticket-test-01.log, one passing normalization/refusal test.
• cargo test --locked -p cohesix-evidence --test producer: worker-evidence-producer-test-02.log, three tests pass, including independent Worker custody for success/failure/cancel/expiry, missing phases and forged generation. The initial test-only Event clone compile error is retained in 01.
• cargo test --locked -p hive-gateway --bin hive-gateway evidence::tests: worker-evidence-gateway-test-01.log, two exact admission/refusal tests pass.
• cargo test --locked -p host-ticket-agent --lib causal::tests: worker-evidence-agent-test-01.log, two tests pass for lost result ACKs and pinned/new/completed Worker receipts across success/failure/expiry.
• cargo clippy --locked -p cohesix-evidence -p hive-gateway -p host-ticket-agent --all-targets -- -D warnings: worker-evidence-clippy-03.log passes. Run 01’s style finding was corrected; run 02 also passed before the final producer test addition.
• .venv/bin/python -m pytest -q tests/test_host_services.py -k worker_witness: worker-evidence-service-test-01.log, one focused rendering test passes.

The canonical matrix routes these evidence contracts. No full suite ran. These are host contract results, not a claim that the new signed Worker chain has yet passed its combined QEMU/native-CUDA lane. Exact target/native rebuild, live success and negative chains, final package validation and M27b closure remain. The shared verifier already owns Rust/Python/REST/UI/export projections; no new wire schema or parallel receipt validator was introduced. Hardware benchmark workloads/schemas remain unchanged. Source and package inventories need their final regeneration after remaining provider/workflow tasks.

Signed CUDA-to-Worker live chain (19 September 2026)

The exact QEMU image in out/m27b/qemu-worker-evidence-11/artifact and native Merlin source archive 39 passed separately enrolled gateway, CUDA-agent and Worker-witness signing for vector addition and matrix multiplication. Retained evidence is out/m27b/live-session-09/signed-worker-02/summary.json, with all nine graph phases, exact image/component hashes, CAS artifacts, trust inputs, verification outputs and deterministic missing/forged Worker refusals. The Worker receipt/completion sequences were respectively 2/2 and 3/3 with no outstanding control. The vector-add graph is 77e06fd55f3955c8f66970d9cf02686371523b542c3c70b841c5c2f3f5d1735c; matrix multiplication is 72546bf967d2ace5df6d589f2bd0d31b37115003a16496a3e2ea23e9ffbbf99e.

The first diagnostic correctly refused to sign while the Worker completion was pending (live-session-08/signed-worker-01). The second waited for Root’s terminal observation, restarted the agent, and completed from its durable native result without redispatch. Further agent and gateway retries left graph bytes unchanged. All private signing keys were removed and owned native/QEMU processes stopped. This proves authenticated Root witness custody with an independently enrolled Worker image; it is not device attestation, a Pi result, or qualification of an entire production use case. Lease setup used the unsigned native path and is explicitly excluded from the signed chain claim.

The GPU control reconciliation envelope now has an explicit read-only control_status operation. It preserves the admitted cancel/observe binding, cannot dispatch cancel, and checks the same Worker/resource generations. Cancellation dispatch happens once, followed by read-only completion checks. cargo test -p gpu-bridge-host --lib workload::tests -- --nocapture passed three focused tests in out/m27b/worker-evidence-control-test-01.log; the new regression checks unchanged WAL bytes, no WAL file creation, and changed-generation refusal. Exact Linux release compilation passed in out/m27b/worker-evidence-native-build-01.log with CUDA/NVML/REST features. QEMU compile/restoration evidence is qemu-worker-evidence-11/source.json. No full suite ran. The remaining macOS/provider, packaging and workflow tasks still prevent marking M27b Complete.

Native launchd lifecycle (19 September 2026)

Scope: m27b-native-provider-discovery-and-actions and the associated registry, SDK and conformance surfaces. Manifest schema 1.25 adds optional compiler-owned launchd target maps and selectable lifecycle actions. The Rust agent requires one exact target id; the SDK follows the same generated argument map. Discovery uses these configured targets instead of environment label lists. An empty map remains unavailable and the default Root allowlist is not expanded.

The native adapter binds plist label/content, selected executable bytes, launchd invocation counts and a measured Swift libproc helper’s PID/uid/birth identity. Lifecycle postconditions require real process state, including native absence after stop. Separate root/native custody and the version-1 durable non-replay journal remain authoritative. No new unsafe Rust, raw commands, native paths in ticket inputs, or in-VM dependency is introduced.

Focused evidence:

• launchd-map-test-03.log: one exact map/refusal test passes. Initial isolated compilation exposed missing alloc imports and missing explicit serde std features; both were fixed, preserving the target no_std feature closure.
• launchd-native-contract-test-01.log: one native incarnation/postcondition contract test passes; an unused import was removed afterward.
• launchd-clippy-01.log: scoped sidecar, ticket-agent and compiler Clippy passes.
• launchd-no-std-01.log: authority without std compiles.
• native-launchd-03/summary.json: canonical --provider launchd --live-reference PASS for pre-dispatch executable mismatch refusal and start/restart/stop of one owned /bin/sleep job. The measured helper, exact plist/executable hashes, selected SDK, native process observations and successful job removal are retained. This is host-native reference proof, not Root/Worker/package qualification.
• native-launchd-01 retains the initial negative-test deadline failure after successful lifecycle observations. The negative was moved before dispatch, where the real executable hash now refuses it without starting another job.
• launchd-generate-04.log: canonical source generation passes. The concurrent operator-manual integration temporarily restored base files during compilation; earlier logs retain its transient missing API error. Restored source timestamps were refreshed before rebuilding. Current main includes 49b61ca4c and the upstream operator-guide commits; those changes remain intact.

No full suite ran. The native runner is now tracked, routed through the canonical matrix entry point and documented in MACOS_PROVIDERS. Package helper wiring, exact Root integration, macOS release/endpoint actions and generated workflows remain active M27b work.

Retained macOS and workflow foundation (19 September 2026)

Main 1383c9630 narrows 27b to the Executable Host Foundation. The work below was implemented under the earlier broad activation and is preserved under the 27c/28a owners recorded in BUILD_PLAN. Historical evidence and task ids above retain their original identity; they are not upgraded by this ownership change.

Schema 1.26 adds optional exact macOS release/endpoint target maps. Source tree and artifact hashing, private native attempts, Xcode structured result checks, certificate-bound signing checks, correlated Apple job/upload/checksum checks, and fixed endpoint observations are implemented. Empty maps stay unavailable. The native reference at out/m27b/native-macos-release-01/summary.json passes Xcode build, one executed test and archive, plus duplicate attempt refusal. Apple credentialed signing/notarization/upload and Root/package qualification remain unexecuted. macos-sdk-matrix-02.log records five passing SDK/map cases; macos-clippy-02.log records scoped compiler/agent/sidecar Clippy. Public native summaries subsequently redact device/test/path details; raw xcresult artifacts remain hash-bound. No cloud qualification or endpoint certification is claimed.

Generated workflow IR retains all nine previously specified DAGs, finite stage order, exact actions/topology and explicit external dependencies. coh and the SDK provide plan/apply/watch/explain/verify/recover foundations. Every advance requires exact request equality inside an independently signed graph; missing terminal data stays pending. Recovery has separately enrolled current authority and an original terminal link. Current workflows needing undeployed external applications refuse apply. Legacy live control-model execution now requires an explicit rehearsal flag. These are retained implementation foundations, not complete recipes or domain-use-case proof.

Focused evidence under out/m27b:

• workflow-ir-test-01.log: canonical DAGs and missing-stage, unknown-action, orphan-topology and implicit-recovery refusals pass.
• workflow-evidence-test-01.log: signed completion, forged request refusal and missing-terminal pending contract pass.
• workflow-sdk-test-01.log: ten generated/rehearsal/credential boundary cases pass.
• workflow-clippy-01.log: scoped coh, compiler, agent and sidecar Clippy passes.
• cuda-safe-oom-01.log: isolated deterministic CUDA OOM fault mapping passes without allocating shared GPU RAM; another CUDA error cannot impersonate OOM.
• cuda-enforcement-01.log: selected finite cgroup controls and unsupported unlimited/oversized controls pass. The explicit local lane stays unqualified.
• foundation-service-test-01.log: exact CUDA device policy and selected process limits pass without activating any service.

Compatibility review covers coh/cohsh, swarmui’s generated inputs, gateway, REST/OpenAPI, GPU bridge, ticket agent, native sidecar/bus, CAS/evidence tools, Python library/CLI and performance harnesses. All share regenerated schema and provider/evidence contracts; CLI workflow and provider changes have public usage documentation. SwarmUI rendering and benchmark workload/report schemas need no change for these host-only operations. No hardware benchmark or Pi acceptance is inferred. The SDK remains target-neutral; native references, QEMU integration and earlier package checks retain their separate source ids.

Selected executable foundation closure (19 September 2026)

Complete. Scope is the five current 27b tasks in BUILD_PLAN at main 1383c9630, with the owner’s CUDA 13.2.2 selection and focused-testing instruction. The former broader activation’s working implementation is preserved and mapped to its current later owners. No recipe, UI, credentialed Apple release, capable MIG host or broad deployment/package qualification is implied by this closure.

Fresh host observation is out/m27b/foundation-host-versions-02.log: Ubuntu 24.04.5 LTS, AArch64 kernel 6.8.12-1021-tegra, JetPack 7.2.1-b49, L4T 39.2.1-20260806224157, CUDA toolkit 13.2.2-1, nvcc 13.2.86-1 and NVIDIA container toolkit 1.19.1-1. Both native results report CUDA driver/runtime 13020 and device UUID 8cc9c4072cc0587a8d93b7e2754559cb. Jetson is the tested reference for the portable Linux AArch64 contract; no new platform was introduced.

The selected QEMU image is out/m27b/qemu-worker-evidence-12/artifact, built from source digest e4f48b785f0e25078fca94faef958ee9f4bec260e86ff8b2e0ddbbbd19bd32d9. Its provisioned input manifest SHA-256 is 302600a95502694d479186d11060b1fc1075b3d07793dadbaaf87544160fba90; resolved target manifest is d502977c8b61c5ecb273d5bbcaced92e1b4b631d60e47641e98bb950d0d20de9. Native archive 40 compiles those same selected generated contracts. Source archive records and each graph bind Root, Worker image, gateway, agent, bridge, helper and generated graphs independently. Later documentation/catalogue classification repairs are not relabelled as changes to this executed image.

Container image digest is sha256:f98584bf0500d678d58ee89a693fee30c8f7305ea1bdd9177332183be90ffee1. Each directory’s native-correlation.json independently checks signed CAS artifacts against manager identity, exact device, verified output and kernel controls: 1 GiB memory, 200000/100000 microsecond CPU quota, 64 tasks and NoNewPrivs. One CUDA context enforces concurrency; child kill/reap enforces the finite deadline/current grant. Requested allocations and actual allocation/free memory remain separate from cgroup controls. The 2 GiB reserved OS headroom and soft CUDA allocation budget are not hardware GPU partitioning. Docker is unprivileged, read-only, without network or added capabilities. Owned services and containers were stopped and private signing keys removed.

Both lanes pass gateway and agent retries without changing the verified graph, plus forged/missing Worker refusal. Systemd graph hashes are 2c2a23c6e64e3cd53c0497ae14911706964b0fe832dabe18793c6f0cb4279239 (vadd) and 8e1ac65cd9dd920e05901dc02ad07091b8ce9b4237ed8a9178ab56d8c0907f2b (matmul). Docker hashes are afa38887cbc972f401c66b81d5db315d4a7cb81468935c624967947d3d020fc7 (vadd) and 57c42ad7689c51acf81436988c46557c52311bf61354c4753cee7773ac66657d (matmul). An initial second-lane attempt reused the first target’s ticket history with a fresh agent and correctly refused an old Worker identity; its FAIL diagnostic remains in live-session-10/signed-docker-01. The passing Docker run uses a fresh QEMU session with the same immutable image, not relaxed identity checks.

Minimum focused verification reuses the original physical reference negatives in mig-native-evidence (wrong device, stale inventory, oversize, deadline and cancel), admitted post-first-kernel cancellation in live-session-02, and lost-result-ACK/restart/custody tests and live delayed Worker reconciliation in live-session-09. They retain their earlier component hashes and proof layers. New finite-cgroup tests and isolated deterministic OOM mapping cover the added controls without exhausting shared RAM. No full workspace suite or staged release campaign was run; no stage markers or Pi evidence were synthesized. Admission remains operator_approved; machine-checked admission is unavailable. Host recovery is not Queen reboot persistence or production ticket-to-bundle proof.

Final focused commands and results under out/m27b:

• foundation-qemu-build-01.log / qemu-worker-evidence-12/build.log: exact release-qemu Root/driver/Worker and complete macOS host-tool build PASS.
• foundation-native-build-01.log: Linux AArch64 release agent, sidecar and GPU bridge with CUDA/NVML/REST PASS.
• foundation-systemd-live-01.log, foundation-docker-live-02.log: both admitted native workload pairs and signed graph verification PASS.
• foundation-format-01.log: cargo fmt --all -- --check PASS.
• foundation-clippy-01.log: GPU bridge scoped Clippy with warnings denied PASS.
• foundation-matrix-test-01.log: three canonical matrix routing tests PASS.
• foundation-inventory-test-01.log: SDK source test classification regression PASS.
• foundation-generated-check-03.log: scripts/check-generated.sh --update-pi4-test-profile PASS, including surface catalogue, host integration, Test Plan and NIST evidence consistency. Earlier logs retain catalogue drift and a stale security-nist build-cache path; classification was repaired and that one package rebuilt. No check was weakened.
• foundation-test-plan-02.log: scripts/ci/check_test_plan.sh PASS after refreshing manifest fingerprints from generated outputs.

The complete host-tool/SDK/benchmark compatibility review is recorded directly above. Broader preserved implementation is source-available with explicit unqualified modes; all five selected foundation tasks are complete.