Milestone 27 completion — 2026-09-14

Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest is Complete by explicit owner approval on the evidence below. This record closes m27-owner-review-closure and m27-audit-ledger-refresh in the Build Plan, including the disclosed remaining Pi evidence gaps. It does not establish full physical Pi qualification.

Owner decision and scope

After receiving the remaining Pi checks and successful QEMU results, Lukas Bower instructed:

I approve the milestone being marked completed on this basis. Please update the build plan and status, commit and push to main.

The approval accepts the final-image Pi boot, live operator checks and Pi Stages 03–05 as unexecuted for M27 completion. Those checks retain their original status; no stage marker, target result or evidence source is changed. The earlier failed physical attempts remain failures. Future physical claims still require the applicable Test Plan evidence. This decision neither activates downstream milestones nor grants a general waiver for later source, target, release or audit acceptance.

The earlier instruction, “Consider DD30 and Rust review signed off”, remains bound separately by DD30_M27_APPROVAL.toml. DD30 remains P1 / ACCEPTED_RISK; dynamic fault/wake remains UNEXECUTED; expiry remains 2026-10-13. That approval binds the reviewed implementation at 7c3b82abbaf938f82f958dc40886d24fcf1c9f01. This completion record does not amend the protected hashes, original release waiver or finding disposition.

The owner’s earlier stock-Pi exclusion applies to positive signed-device acceptance. Optional measurement-only mode remains non-attested, and required device-bound authority fails closed when no issuer is available. Shared TPM2 signature verification passes independently signed offline fixtures; neither those fixtures nor QEMU results prove a live signed hardware identity. Actual isolated TPM/DICE issuance and sealed/derived ticket admission remain the conditional reopened M26 device task in the Build Plan.

Tested source and target identities

• Tested source: b54bdd2fcff97fe35c5e3a61faa4d5a761b2a1ac.
• Source inventory digest: 5c8a7b623078baee766d214a15771ea86e37b89b6535cb8cba9f1e8c65fa0fea.
• QEMU base artifact ID: bca8377a892fa0522dc2ab832aad2f6f4aa4449952f3d941a9a14ae87fd0836b.
• QEMU gated artifact ID: 72319d68c405d284b40389388ef7582fb48a69bc57b3c9e1a6250c2ca7b3a8b7.
• Pi image ID: d484710a6dd358ea7c1540c166cbfb4d59e227f17e6b3881540bd9773ef57255.
• Pi raw image SHA-256: ec621af1f477f94f39a3f4e66e20badf40aa722d07339e47e79bbbe54c60d245.

The Pi image was built and bound to its selected manifest but never booted. The subsequent completion commit changes documentation and its generated inventory metadata only; it does not rebind these tested artifacts or stage records to a new source identity. Artifact paths below are retained local evidence under ignored out/, not files distributed by a clean Git checkout.

Qualification results

The unexecuted Pi sequence comprises a fresh exact-image boot and settling record; live TCP/REST M27 capture and offline composition; the complete 17-script Stage 03 matrix across four independently booted groups; Stage 04’s four REST scripts and Python smoke; then Stage 05 against that exact Pi chain. No full throughput rerun was required for the read-only M27 utility scope.

The complete host-tool suite, tools/cohesix-py, generated contracts and performance consumers were reviewed during implementation. Applicable changes and fixtures landed together; target/runtime interfaces and throughput workloads remain unchanged by the final collection repairs. This closure changes only documentation, milestone disposition and generated metadata for the new documentation inventory entry.

Retained evidence index

The local summary is out/m27-attestation/M27_STATUS.json; the append-only command history is out/m27-attestation/task-record.md. The table binds the completed stage and operator records by path and SHA-256. QEMU Stage 01 reuses the common result in the Pi state directory.

Additional evidence under out/m27-attestation/:

• host-implementation-continuity-b54b.json, linux-arm64-build-9a5e.json and linux-operator-9a5e/result.json: native host evidence and exact production continuity. The later Rust change is the test catalog’s script hash only.
• pi-serial-owner-release.json, pib54b-boot1/, pib54b-boot2/, pib54b-boot3/ and pi-proven-direct/serial.log: failed serial handoffs and the user-directed REBOOT.md retry. No visible serial holders remained; the direct attach received no ACK, so no reboot was issued. Ports were released.
• pi-common-b54b.log, pi-target-build-b54b.log, qemu-common-b54b.log, qemu-target-build-b54b.log, qemu-tcp-b54b.log, qemu-rest-b54b.log, qemu-governance-b54b.log and qemu-operator-b54b.log: completed command logs.

Completion-change validation

Only the required documentation checks run for this closure:

• cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json: regenerate the documentation inventory and its dependent graph digest for this new record. Runtime manifests, generated code and policies remain identical.
• scripts/check-generated.sh, including scripts/ci/check_test_plan.sh: generated outputs, canonical test catalog, documentation projection and runner integrity.
• git diff --check and scoped link/header checks for the edited documents.
• Read-only SHA-256 verification of the retained evidence records above.

Completed common, QEMU and native suites are reused; no new Pi or full Rust suite is run for this documentation-only approval record. The final command results are retained in out/m27-attestation/completion-checks/.

Result: PASS. Generated consistency and its Test Plan checks pass after the documentation inventory refresh; 13 added local links/anchors, six document headers and eight retained evidence hashes/statuses/source bindings pass. The generated delta is exactly one non-production documentation entry and its dependent graph digest. The initial missing-inventory failure remains retained alongside the successful rerun.