Prospective native installation custody integration

Private read-only preparation by Olo/Moss, 2026-10-13. No tracked file changed; no import, test, build, guest, installation or native control ran. This plan is not admission or completion evidence. Root owns registration, execution and publishing; Pip branches and frozen artifact checkouts remain untouched.

Source authority inspected

Checkout	Exact clean head
DATA/scratch/installation-custody-witness (CW)	77d32ece01646f39d97e98b942fa7c776463a19c
DATA/scratch/installation-checker-repair (IC)	db5b9d86ff70795a4b7ecec046b60d07d8e4bb1a
DATA/scratch/service-acceptance-harness-01 (SA)	de77de7399710c5afd50ae0de981fda6e0b75f30
DATA/scratch/candidate-build-fresh-8fb6f413179b-01-a (F8)	package source frozen at 8fb6f413179b094288316e25845c137440ba23fa

DATA=/run/media/kmosoti/data/FabricO11y; META=DATA/results/candidate-build-fresh-8fb6f413179b-01. The three requested harness heads were read, not merged or modified. Actual native work requires a new clean merged harness pin after the prerequisite merges, including #66 and the custody lane. Neither mutable main nor these three different heads is an implicit final runtime authority.

CW custody_witness.py SHA256 is 2c500203cc26a474366d4b9daf13d63332fb6454fc94649a00f8dd43eb796ebf (417 production lines). The existing 417/+120 ceiling is exhausted; new caller and guest mechanisms need separately scoped owned paths and a line budget. This plan does not authorize an expansion or a modification of that reader.

The product contract requires durable identity/exact bytes before send, ACK after receiver sync, and atomic source-cursor movement with lines (CW contract:50). Accepted ADR-0013:13 distinguishes equal identity/equal bytes retries from conflicting bytes. Spindle architecture:19 also promises mandatory local diagnostic sources. The registered installation supplement retains historical L1/L2 and explicitly separates native admission, projected query equality and raw ACK evidence (protocol:168).

What actually exists on disk and in source

The focused inventory inspected results/installation-qemu, the immediate results namespaces and META's installation plans. It did not mount retained overlays or walk the full disk. No historical artifact becomes new-candidate acceptance.

• Historical results/installation-qemu/service-opening-{deb,rpm}-life-01 contains receipt, acceptance/journal/guest/bootstrap/serial/stderr text and frozen harness source copies. Both receipts record acceptance exit0, confirmed QEMU cleanup and removed scratch, bound to minimized source f23830d5..., DEB 54cddf54... / RPM 982ad692.... Their A11/L1/L2 text supports only that revision's finite lifecycle. Journals contain 93/124 matching ACK message lines respectively; they are plain journal text, without the complete new JSON PID/boot/window join. No allowed-log archive, raw Spool archive, raw server-state archive or lifecycle query JSON is present in those result directories.
• rel-deb-life-01 and release-fedora44-upgrade-03 record exit2 and retained stopped overlays. These remain failures; opaque overlay contents were not inspected and are not an exported custody receipt. Do not boot or remove them to prepare this new fixture.
• IC run-qemu.py:542 exports text plus receipt/source copies, then deletes successful owned guest scratch. Its transfers at411–449 contain packages, acceptance, lifecycle and optional A12 helper, but no custody producer or qualification dump helpers. Its lifecycle calls at492–519 have no host custody-reader/caller boundary.
• IC lifecycle.sh:44 saves three already-delivered rows, *.conf, account identity and UI hashes. It immediately installs/restarts, then compares the same rows after reboot. It does not create a pending predecessor Batch or hash explicit credential files, and its private guest query files are not exported.
• SA acceptance.sh:342 creates an outage line but drains it before lifecycle upgrade. The baseline config at223–236 selects both allowed and denied logs and a256MiB Spool. Denied-source gaps remain separately visible; they must not be hidden.
• The existing cross-family mechanisms show useful native capture patterns: Guest.install:109 transfers dump helpers; measure.py:169 stops units and captures journals, diagnostic Spool JSON, server replay, queries and independently decoded server groups. The raw server Faj files are read as base64 at209–225, but only decoded journal-groups.json is saved. This is source availability, not an observed run: its DATA/results/cross-family output namespace is absent in this focused inspection. It supplies neither installation guest archives nor new results.
• META/run-installation-with-process-witness.py exists, SHA256 bfec3efe426409e09a2a6b3a3fcb871abc7f6577c66a32fd273fa3d72b76ea81. Candidate/harness checks at48–100 and before/after checks at288–296 are a reusable admission pattern; its observer samples process removal only. META/process-witnesses is absent. It is not a custody producer/caller.

Consequential native-source mismatch

The frozen packaged CLI always creates spool/diagnostics/spindle.log, pins it as a source and emits startup/process/transition records (F8 fabric-node.rs:148). It writes an uncollected final stopping line at369–370, deliberately left for the next start. Diagnostics may rotate; the operational log bounds/ownership and name are defined at operational_log.rs:92.

CW reader at260–262 admits only the committed Spool root members, not a nested diagnostics directory; at316–324 every decoded cursor needs its real archive. conserve at346 requires identical entire source archives, at376–377 admits only old3+pending+unread log rows, and at378–389 tiles every passed cursor path using those five rows. Therefore a direct full-native snapshot is incompatible with this finite interface: candidate diagnostics add paths/bytes/rows and can leave a legitimate uncollected suffix. Disabling diagnostics or replacing the packaged node with an embedded collector would evade the shipped contract. The historical predecessor's diagnostic behavior was not inferred from F8.

Preferred prospective amendment: distinguish complete raw custody capture from the explicit allowed-log fixture witness. Retain every raw root member, all source payloads/hashes, every cursor and its real archived source, and separate diagnostic directory inventory/bytes. Strictly decode all committed frames, using the existing limited metrics/traces semantics. Admit only the registered /var/log/fabric-accept/allowed.log path for the five-row/tiling comparison; select by path/interval, never by an expected body allowlist. Keep unexpected allowed-path rows as failures. Define a controlled fixture view whose log-row/cursor/archive projection is explicit, while original payload, hash, source sequence and complete raw snapshots remain authoritative for all pending Batch ACKs. Preserve/compare the entire stopped native tree before and after install separately; distinguish allowed-file immutability from diagnostic append/rotation after candidate start. Report genuine collection gaps and diagnostic tails outside the narrow fixture claim.

This is a trust-boundary amendment, not already permitted behavior. Register positive native-shaped diagnostic fixtures and missing/changed/extra allowed line controls before implementing any view. Do not silently filter snapshots or declare five selected bodies to be global source completeness. Alternative: generalize conservation to all source histories and lifecycle-produced diagnostics; this is larger, requires independent expected history/rotation semantics, and is unnecessary for the finite #41 obligation.

Small separately reviewable cards

1. Prospective protocol and literal controls only. Register explicit raw whole-tree/source capture, allowed-path view, expected admission tuple, guest/host ownership distinction, journal clock/PID join, preservation order and failure classification. Keep every current test/oracle/gate. Commit body starts Trust-boundary update:. Root records named absence/binding reds; fixture mechanism absence is not a product regression.
2. Guest producer (proposed install/custody_guest.py, with narrow lifecycle call sites). Capture raw operation exits/monotonic times/boot, unit states, MainPID/control groups and companion identities; query errors are not absence. Freeze original config/account and explicit credential metadata+hashes (server.key, admin-token, node-token, CA/certificate), never secret bytes. Record actual guest owner/mode policy separately from host-copy metadata. Record baseline raw query pages and journal cursor; stop server; append a unique pending newline; allow the registered20s collection; stop node; confirm complete stop; append a distinct unread newline. Never manufacture a Batch, sequence, source identity or ACK in this native fixture.
3. Host receipt admission and transfer/reader bridge (proposed install/custody_upgrade.py, reusing existing admission primitives where ownership permits). Before guest creation, require the owner-pinned #40 expected tuple, not merely well-formed/equal supplied tuples. Reuse SA inputs.validate_inputs:13–60 for linked DEB/RPM/source/helper checks, adding owner-frozen original_head, epoch, receipt/helper manifest hashes, clean merged harness SHA/file hashes and native-image/predecessor hashes. Freeze and recheck transferred producer, helper and package bytes; compare installed binary/UI payload inventory to the admitted package before candidate start. In exclusive DATA scratch, transfer a no-follow bounded source inventory and regular raw files with guest dev/inode/optional Btrfs identity. Hold guest quiescence; re-observe stop and source hashes after capture/transfer. Supply CW stopped_snapshot a truthful committed-root archive view, retaining separate complete native-tree evidence. Both diagnostic helpers are read-only corroboration, not raw frame/hash authority.
4. Lifecycle caller/orchestration (small lifecycle.sh/run-qemu.py changes plus the bridge). Split the current upgrade at the actual stop/install/start boundary. Require predecessor pending raw sentinel at sequence>ACK and the exact absent unread suffix before install. Install while both roles remain stopped; verify unchanged whole-tree/config/credential/account state before launch. Observe actual candidate node unit/PID, executable identity and /proc start identity within guest monotonic brackets. Preserve JSON journal _SYSTEMD_UNIT, _PID, _BOOT_ID, monotonic timestamp and message, converting units explicitly; reject old sender/window records. After bounded drain, stop both units again and capture final raw state plus durable ACK. Call the explicitly admitted fixture-view conservation against complete raw queries; reject missing pages, incomplete answers, extra allowed rows or any pending Batch without its original-payload exact-byte candidate ACK. Restart, actually reboot, require distinct boot and exact post-reboot rows/config/ credential/account identity, then perform existing removal/reset gates. Export evidence before removal or successful QEMU scratch deletion.

Retain native body/query evidence; the oracle's projected row contract is node label/ID, sequence/index, observed time, string body and string attributes, not every raw OTLP field. spool_dump.rs:35 reencodes parsed Batches; it cannot establish original bytes. Candidate ACK text is emitted before local ACK persistence (fabric-node.rs:316); require both exact-byte message evidence and the final stopped FAK1 cursor. Raw server reread is optional corroboration beyond the existing registered node-ACK commitment claim. If included, save bounded original server Faj bytes and independently decoded groups before cleanup; shared server_dump alone must not become an independent oracle or a stronger advertised storage claim.

Concrete prospective controls and native sequence

Register literal source controls for the four cards before each correction: wrong owner-expected frozen/package/harness/helper tuple despite self-consistent receipts; changed transfer bytes; live/error/missing unit or companion; archive symlink/path/link/mount/stat drift; malformed journal metadata/clock units or PID reuse; incomplete query pages; credential metadata/hash drift; capture or grade failure followed by attempted purge. Each refusal must precede native start, reader use or destructive cleanup as appropriate and preserve input bytes. Tests may fake effects, but record that limitation.

After merged-harness source checks/preflight, use unique serial cells:

Cell	Real operation/evidence	Required outcome
Debian/Fedora positive custody lifecycle	Historical predecessor creates pending source; exact candidate native install, drain, stopped archive, changed boot	All existing installation gates plus narrow custody witness; actual raw evidence and confirmed stop
Pending-not-produced guest control	Stop predecessor node before the first append; archive genuinely lacks committed pending sentinel	Preparation refusal before candidate install/start; body presence in source is insufficient
Live-writer stop control	Collect stop receipt while the real disposable node remains active, with a bounded parent cleanup	Producer refusal before copying/decoding; actual MainPID/cgroup observation, not just a fixture JSON flag
Native-artifact mutation controls	Clone only a fresh stopped positive evidence bundle; delete pending frame, change payload with repaired CRC, lose an allowed leading line with rebuilt CRC/ACK, or substitute old/wrong-PID journal events	Exact named custody/admission refusal; original immutable positive/raw failures untouched
Credential preservation control	In a separately registered disposable fixture, alter one credential file after stopped install with config unchanged	Native metadata/hash join fails before launch; only hashes exported

The last two are artifact mutation / deliberate guest fixture controls, respectively; they are not unmodified candidate acceptance or physical-loss tests. Root must prospectively admit their exact commands and effects. Stop and archive failed guests before cleanup. Never replace a failed cell with a passing subset, or replay copied messages as a real sender witness.

Bounds, exact candidate and remaining uncertainty

No new native command is admitted by this plan. Existing shape remains run-qemu.py --family FAMILY --package EXACT_PACKAGE --source-commit 73ff77867d10ef521ca985b094e1d177f7786b77 --run-id NEW_ID --memory-stressor parallel --upgrade-from EXACT_PREDECESSOR; the new bridge/producer arguments and source files do not exist yet. Root must freeze the final command rather than run this old shape and infer custody.

Keep1800s outer,180s lifecycle phases,2vCPU/6144MiB/8GiB guest and actual host 7GiB high/8GiB max/no swap. Reserve full9GiB; admission census must be <=85,336,323,584 bytes before each guest,95GB stop/100GB ceiling unchanged. One upgrade deadline begins before first stop; every SSH/helper/copy/query uses the lesser of its bound and remaining time, with checks before/after dispatch and no reset. IC's bootstrap reservation at462–470 is not a continuous whole lifecycle deadline. Save pre and final raw Spool archives; post-install can rehash the live stopped tree rather than duplicate it. Two maximum Spools alone consume about512MiB; measure helpers/source/log/receipt growth within the existing1GiB overhead before admission. Raw server copies are not free capacity. Unknown time/space fit is an incomplete admission, not permission to omit evidence or extend limits. Guest fixture process lifetimes must be finite even if an SSH peer times out; whole QEMU stop remains the final cleanup boundary.

The metadata inspected, without a new artifact verification run, records F8, epoch1791841113, minimized source 73ff77867d10ef521ca985b094e1d177f7786b77, DEB A 8edfc7709f4b5dc3da01c00a1d8c442470298e96f8c8e502cfb14e8c9e713e92, RPM A a54f55e7bf1b2230e026b49d6b86023778a9648ae49b11c6bcb0d558db34a840 and canonical helper manifest at results/installation-package-build/fresh-8fb6f413179b-01-deb-a/qualification-helpers/manifest.json. Revalidate actual #40 receipts/provenance/helper bytes at admission; preserve the canonical manifest and do not compile replacements. Historical predecessor hashes are 27a733e1...0e85c3 DEB and 3c0a64a1...ad469a3 constructed historical-binary RPM, not a claimed previously shipped Fedora package.

Unresolved until actual execution: predecessor cursor/schema compatibility, native pending creation within20s, diagnostics archive/rotation coverage, helper compatibility, full180s upgrade/time/space fit, actual sender JSON journal availability and stop evidence, guest ownership/SELinux/audit and cleanup. Fedora remains enforcing; no broad allow policy. The finite UTF-8 newline fixture excludes oversized/invalid-UTF8 intentional skips and torn tails; keep CW's refusal/ownership/raw-storage limitations explicit. Issue41's closed historical checklist is not evidence for these new candidate cells.

Original read-only local plan SHA-256 978f438d5ac49b0d2a1d8a32109edb1bdad13ef608be794c74301e71ffa1fc28; the wiki rendition changes only source links to immutable GitHub blob/line links and adds this note. No native admission is granted by this proposal.