Separate simulator helper preparation, 2026-10-15

Preparation only: no Rust compilation, new helper execution, package rebuild, product refreeze or acceptance result.

The exact 108 historically recorded Debian package versions were installed in a private rootless store from immutable Debian base sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587. The fingerprint script checks those pins, preserves complete installed-package/archive records and inventories the sysroot. Altered historical pins were independently rejected before any container command in the negative control below.

Preparation tightened the launcher to actual 7/8 GiB high/max, zero swap, with 1800-second outer deadline and 9 GiB full reservation. Five-second owned-growth and thirty-second full-tree admission monitoring ran; no other project workload ran concurrently. The controller and exact plan remain under results/candidate-build-fresh-8fb6f413179b-01 on DATA. Container removal and sampler stop were confirmed. Private store cleanup follows in a separate retained receipt; the immutable OCI archive remains a build input.

Prepared OCI SHA-256: eaf3e44ac1ee1e544f8cf702219260cc5ead7eaa299d93c93455837ad0a9df34. Image ID: 3d2067dbc9e4867194dc450f8ee3c10fec1ae3dbe168c5f4035992726ee91bfc. Sysroot summary SHA-256: 39c360e023cd296b08a4d58b9f59218a03eb0ebc21d0fe1b7dd82d103059d0ac.

The new source freeze at af3f40c5bda62fe8454917077dae4960cb56d406 compared all compilation input paths/bytes with the canonical candidate manifest. Only examples/spindle_sim.rs differs. Frozen source commit 1a923e70bed65b899382c7aad06590ae11d46855, tree 5b49e6b9502c53adddf0d1ec6fef797266d67a30, manifest SHA-256 0398b2b7220990ece3812167508054897949b18b89c6fc73d81a581ceefd232a, bundle SHA-256 4c2e8be5b1495be3c02ac9ba5dfd3ffb5ca3ca4d1c7487e0b8bdefb3c0c8a3da. Complete toolchain tree fingerprint: fcb07970ad99acfe964448e221eab95376eb86ea9dfe2975aa4c76b499933559.

The separate helper build admission draft pins these actual inputs and the exact offline cold-build command. Its preflight URL is deliberately absent pending authorization to post the coordination message; the builder refuses that incomplete authority. Native witness controls, atomic publication observer/fault controls and full true exposure remain unrun. Existing frozen packages and canonical helpers are unchanged.

simulator-preparation-pin-control-01

Revision af3f40c5bda62fe8454917077dae4960cb56d406. Exit 0. Outer stop confirmed: True.

python3 -B -c import os,runpy; from pathlib import Path; from unittest.mock import patch; p=Path(os.environ["TMPDIR"])/"bad-pins.md"; p.write_text("altered input\n"); ns=runpy.run_path("/run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/prepare-simulator-sysroot-01.py"); fn=ns["main"]; fn.__globals__["PINS"]=p; fn.__globals__["sys"].argv=["prepare","control"]
with patch("subprocess.run",side_effect=AssertionError("container command must not run")):
 try: fn()
 except RuntimeError as e:
  assert str(e)=="historical package pins"; print("altered pin rejected before any subprocess")
 else: raise AssertionError("altered pin accepted")

Executed inside python3 -B tools/resource_group.py -- ..., admitted by the pinned run-step driver. Full raw command/receipt: /run/media/kmosoti/data/FabricO11y/results/service-opening-candidate/simulator-preparation-pin-control-01.json. Log SHA-256 a9878de66f593f5fb7d4f5590b5678eaa14b70ec76db7eefc78dd7d45f062cb5.

simulator-sysroot-preparation-01

Revision af3f40c5bda62fe8454917077dae4960cb56d406. Exit 0. Outer stop confirmed: True.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/prepare-simulator-sysroot-01.py prepare-01

Executed inside python3 -B tools/resource_group.py -- ..., admitted by the pinned run-step driver. Full raw command/receipt: /run/media/kmosoti/data/FabricO11y/results/service-opening-candidate/simulator-sysroot-preparation-01.json. Log SHA-256 36087344c96e833f58457c413b98c33182c4e106f78f81a07d0cb1d179a30679.

simulator-source-freeze-01

Revision af3f40c5bda62fe8454917077dae4960cb56d406. Exit 0. Outer stop confirmed: True.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/freeze-simulator-source-01.py

Executed inside python3 -B tools/resource_group.py -- ..., admitted by the pinned run-step driver. Full raw command/receipt: /run/media/kmosoti/data/FabricO11y/results/service-opening-candidate/simulator-source-freeze-01.json. Log SHA-256 aa465f21e5a318effebfed5cae8792df1be1ffac267a13eac9fef2540df8935a.

Documentation command bun tools/docs/check.mjs, through the resource launcher: exit 0 at 6bd5250a6223fe3663b254c25627ce4ff2b4c9e0; outer stop confirmed. Raw receipt /run/media/kmosoti/data/FabricO11y/results/service-opening-candidate/simulator-helper-preparation-docs-01.json.

Temporary-store cleanup

The preparation container was already stopped and removed. Three cleanup attempts were retained: simulator-sysroot-cleanup-01 exit 1 (rootless mount enumeration needed its namespace), -02 exit 1 (the private overlay bind mount prevented directory removal after files were removed), -03 exit 125 (census store uses vfs, not overlay; configuration mismatch refused before the command). Corrected -04 used the existing pinned vfs census namespace, checked only the exact owned subtree and removed it: exit 0, outer stop confirmed. No broad/lazy unmount was used. Complete image and preparation logs survive under results/spindle-sysroot-prepare-01; cleanup-receipt-04.json records owned-directory absence. Every failed log and resource receipt remains in results/service-opening-candidate.