Patched native witness build and source admission

This is the separately admitted simulator helper on patched product e078ba23; it does not relabel the old c492... ELF or refreeze package bytes. Native exposure/publication qualification and S1/FULL remain pending. The controller uses clean, already merged 313d2b3, independently from pending PR72 runtime; the helper worktree forks exactly e078 with the sole registered examples/spindle_sim.rs bytes SHA1073e32336f04959ac9f78ac9f5ac97d02860c605037c98dcc1f2f8fbce045e4. Every other complete compilation input matched canonical DEBA.

Retained authority

{
  "binary_sha256": "5d0555dfc38cd001d0ecca0f488d309eb0be02cdf0cf295b3e07cbb3c79eee24",
  "source_commit": "fddfdd1c213fc4ac668774780db5bff307331b2d",
  "source_tree": "d8459d39a83ea40728859235b62b199253e770ea",
  "source_manifest_sha256": "38bf397f321328e34a708f354f5a008e8fe4af514f91b266d78fd0da344a80a8",
  "source_bundle_sha256": "5a461d41e97a68c11ffdd39e5ba4a594d900a314b26c4f0ebba88c900b8d26f5",
  "build_receipt_sha256": "7078950bc99832e85c3b9d33005354087a5a7cd28732d2b377949ab9ac84efa2",
  "canonical_helper_manifest_sha256": "e23a9b50599e2330b89335d1abbb8fe8789f2757936fdc1f0450aba699903c4d"
}

New ELF /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/build-patched-witness-02/spindle_sim; raw build receipt SHA7078950bc99832e85c3b9d33005354087a5a7cd28732d2b377949ab9ac84efa2. Pure normalized receipt is separately hashed b51feaac4bbe06ace61698e869c1077a25ad1703973c0759f6f62a145b58c129, expected record 8f831ccb0b51583e5b1cfe71bffa49fae82234982c964b155f11ee0731546546. Empty feature/rustflags arrays mean no explicit CLI overrides; default feature behavior remains bound by complete manifests/lock. No self-referential receipt hash was invented.

The cold builder used the retained OCI/sysroot/Rust1.99 authorities, offline/locked release command and empty owned target. Complete registry440507566bytes/digestfd58a6e824dbb308da096065b8b60f16d99cb8349c55949e65db473eec780cc5 matched before/after source and copy; links/special files/unexpected content refused. Actual memory peak4297691136bytes,7/8GiB high/max, swap0, all OOM counters0; inner1500s/default1800s outer, fresh9GiB reserve, DATA-only strict95GB census.

Commands and stops

• simulator-patched-preparation-01: exit0, finished2026-10-16T03:11:07.985022+00:00, resourceSHA 92b760b4a41f7ae6a59925b7c35daabb2b4c006db573a854e93c76e6ccc42203, stoppedTrue.

python3 -B /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/prepare-main-controller.py /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/actual-input.json d13a9f2fd509249f05d9394ababf7dc5acfa016f1e95ae5c46376108957e2a1e

• simulator-patched-cold-build-01: exit2, finished2026-10-16T03:11:59.803458+00:00, resourceSHA e2576f1c74e686a58dc69b69600122d81183ea29022f03027ca1163ff38cae0d, stoppedTrue.

python3 -B /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/build.py --id patched-witness-01 --admission /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/build-admission.json --admission-sha256 cbd1fcbc262b6dd19d4093cb6e83ce5448abc5829fd3fae7e7e9eef92cc3dff4

• simulator-patched-registry-json-red-01: exit1, finished2026-10-16T03:13:30.730907+00:00, resourceSHA 2a4a77ed8c816d0a4fd9c2470d9a2849141441cbd50c277786672e2a58c5c62f, stoppedTrue.

env PYTHONPATH=/run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/retry-02 python3 -B -m unittest -v test_registry_serialization

• simulator-patched-registry-json-green-02: exit0, finished2026-10-16T03:14:22.751059+00:00, resourceSHA d5a03027fd5b81561b3de7b6440a589723e694a0d002df1545aca71cae6b363f, stoppedTrue.

env PYTHONPATH=/run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/retry-02 python3 -B -m unittest -v test_registry_inventory test_registry_serialization

• simulator-patched-cold-build-02: exit0, finished2026-10-16T03:16:58.235948+00:00, resourceSHA 4f67ef04d0278a13466d1e5e38f8218c1eda7c300e17cc3e877154be5f38f40e, stoppedTrue.

python3 -B /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/build-02.py --id patched-witness-02 --admission /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/build-admission-02.json --admission-sha256 52c5dc6454e5ac9598203835d5171bdc240ec8e7b43213c7a73dfa4d226a420c

• simulator-patched-projection-02: exit0, finished2026-10-16T03:19:31.032050+00:00, resourceSHA b5d5a6eaf240e920181d8c1111dd6a873ee64c7455ca236e0e1e1e037485c899, stoppedTrue.

python3 -B /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/normalize-02.py

• simulator-patched-owned-cleanup-02: exit0, finished2026-10-16T03:19:43.744156+00:00, resourceSHA fedf57b8490a0dee38aa0d76948b2958c783411c112f840144798765af0fc15e, stoppedTrue.

python3 -B /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/cleanup-helper-02.py

• simulator-patched-identity-source-docs-01: exit0, finished2026-10-16T03:22:38.547077+00:00, resourceSHA 2d7b08b50a5b8e8e19a14d673a8a0527f1bc29de6501c04367fd025cb7f28e6f, stoppedTrue.

env PYTHONPATH=tools/qualification:tools bash -euc 'python3 -B -m unittest -v test_simulator_exposure test_simulator_native_controls test_simulator_native_trace
python3 -B /run/media/kmosoti/data/FabricO11y/results/browser-responses-source-01/check-deps.py
python3 -B /run/media/kmosoti/data/FabricO11y/results/browser-responses-source-01/check-links.py
python3 -B /run/media/kmosoti/data/FabricO11y/results/browser-responses-source-01/check-checker.py
python3 -B /run/media/kmosoti/data/FabricO11y/results/browser-responses-source-01/check-hooks.py
'

• simulator-patched-source-build-admission-02: exit0, finished2026-10-16T03:24:53.209433+00:00, resourceSHA c1a6ec4c1f42c9f52ab94604960f2beaa4a5a9619531facc73302022a3503ac4, stoppedTrue.

env PYTHONPATH=tools/qualification:tools python3 -B /run/media/kmosoti/data/FabricO11y/results/simulator-patched-witness-preparation-01/validate-source-build-02.py

Counterexample and limits

Build01 stopped before compilation with a complete-inventory mismatch. The same canonical JSON digest/bytes matched, but the checker returned tuples in memory and the persisted authority decoded lists. A literal JSON roundtrip positive reproduced the failure (one test/one error). Retry02 changes only the row representation to lists, preserving canonical JSON/digests and all whole-inventory/link/FIFO/content/copy assertions. Five controls then exited0, including serialized authority and content-drift refusal. Original module/build/admission/normalizer/inventory/test authority is preserved byte-for-byte under failed-01-authority with SHA inventory; failed01 raw/owned state remains retained.

Separate identity-only revision 2a8e11e explicitly binds patched candidate and canonical seven fields. Its existing35 simulator source controls and all3 documentation checks exited0. The retained artifact validator then rehashed actual prebuild admission/raw receipt/ELF/source manifest+bundle/canonical helpers/normalized files, authenticated actual image/environment/compiler configuration and cloned/checked every source path and byte before invoking the unchanged source/build join. This is source/build admission, not native publication certification.

Cleanup02 independently required stopped raw build, retained output/log hashes, exact owned marker, no active containers and explicit owned-mount checks. It removed only owned02 build/store scratch; owned path absent, no mounts remained, output ELF/raw/logs and authorities retained. All outer services stopped. The 16 original native TLS/publication/fault controls are separately registered for this actual new helper; no pending result is called passed.