Complete Core source-admission native implementation blueprint (#1643)

Status: WHOLE architecture freeze, Development SOURCE ONLY. This proposal completes concrete boundaries beneath landed PR1634 (develop9e960a2879fbd83e57fd6962dd814ce9cdb4d6a5); it is not implementation authority, SOURCE GO, native admission, provisioning, qualification or release. Different fresh ENTIRE architecture review precedes implementation of the new protocol/trust/persistence/provider/proof boundaries. Governing contract remains source-safe-template-admission.md, ADR-source-admission-journal-v1.md, SPEC002 AC-4CF.1b / SPEC006 AC-6E.SA1, ALL CA01..CA08. Issues #1633/#1562/#1326 remain full delivery traceability. No empty adapters or a reduced delivery are selected.

Decision, existing source and alternatives

Actual Core src/server/index.ts already owns trusted middleware, resolved workspace, service permission/confirmation/lifecycle routes. Existing Audit store uses appendFile and returns an existing event ID without exact payload equality; existing command confirmations write independent stores. Neither provides this journal transaction or durable native Audit. Current discovery uses path-based interfaces and cannot assert held-handle exclusion/readback. Existing released registration and staged Windows ZIP/Linux TAR stay separate.

The outcome contract defines native durability but does not define provider ABI, key custody, journal binary schema, complete private nativeTemplate body or positive proof producer. Silently implementing a JS adapter over writeFile/rename/lstat or inventing a callback returning durable:true would create unreviewed authority. Selected proposal: a dedicated Core-owned native admission companion with narrowly confined capabilities, authenticated original Core process, provisioned persistent key provider, held trusted workspace/storage/root identities, versioned binary commands and independently admitted observer. It performs native storage/asset reads/materialization/discovery; Core alone authenticates API actors, validates canonical semantics and authorizes no-lifecycle requests. It is not CLI39's external host session broker, a privileged policy parser, generic shared event platform or arbitrary path executor. Owner provisioning is absent today and requires separate authorization; no new service is launched by this blueprint.

Pure in-process JS cannot establish no-follow atomic no-replace plus actual durable directory semantics on both hosts. A generic filesystem broker would widen authority unnecessarily. A per-request compiler/helper has mutable tool and child-custody gaps. The dedicated compiled matching native companion is selected; missing image/profile/key/native capability fails503 before stage allocation. Rollback disables admission and retains all original evidence/state; it never resets/migrates or falls back.

Whole implementation map

Prospective Core-owned files: src/runtime/service-source-admission/{catalog,transport,zip,canonical-policy,digests,controller,journal,native-channel,audit-adapter,recovery,proof-contract}.ts; src/server/routes/service-source-admission.ts; native/service-source-admission/{protocol,storage,assets,materializer,observer} source; scripts/prove-source-admission.mjs and scripts/verify-source-admission-proof.mjs. Route registration in src/server/index.ts preserves existing trusted actor/service:configure checks. API contracts add the existing normative closed projections only. No unrelated shared Audit or confirmation semantics are weakened. Companion packaging/provenance is integrated into existing Core packaging as a Core runtime dependency, not a fifth template public asset. Its exact source/image/provenance/host acceptance need separate admission.

Read-only native asset reader holds exactly service-template.tar.gz, template-candidate.json, template-contract.json, SHA256SUMS from independently source-selected immutable publication. The catalog fixes actual repository/commit/tag/version/kind, raw asset size/hash, semantic contract digest, current owner inventory/quotas and exact typed difference rules. Production catalog may remain empty pending pins but implemented readers/validators must support the full approved route. No fixture/caller/env entry grants authority. Complete current inventory includes owner policy self-member plus generated six-field provenance; no historical75/84 cap. New quotas exceeding any parser/frame/copy/native ceiling deny pending reviewed amendment. Policy/descriptor seven/eight keys and every nested shape are strict; original bytes/raw semantic digest and genuine TAR/PAX/checksum/directory/mode/gzip termination are independently validated as in landed native v3. Core transport remains SLTP-ZIP-1 plus exact SLTP-CATALOG-PATH-1; CLI native TAR is a different layer.

Provisioned native profile and persistent key provider

Proposed source-owned closed profile schema service-lasso.core-admission-profile.v1 with exact keys schema,platform,coreImage,companionImage,observerImage,workspaceIdentity,storageIdentity,endpoint,keyProvider,capabilities. Images each repository/full commit/sourceSha256/imageSha256/version; platform win32/linux only. Identities are actual admitted native root identity references, never public paths. endpoint kind named-pipe/unix-socket plus fixed source-owned name; no request/env URL. keyProvider exact providerId,providerImageSha256,keySetId,currentVersion,retainedVersions. Version strings1..64 ASCII safe identity; set/provider IDs1..128; retainedVersions unique sorted<=64, current included. No raw keys in profile or journal. Missing actual provider/image/authority remains UNKNOWN.

Windows proposed persistent provider: dedicated owner-provisioned native key service stores random256-bit key encrypted by machine/owner DPAPI in an exclusive protected owner-owned key object outside project/storage; its DACL admits the provisioned key-service identity only. Linux proposed provider: equivalent dedicated native key service owns an exclusive root-owned0600 random256-bit key object outside project/storage and authenticates companion Unix peer by actual uid/pidfd/held image. DPAPI is at-rest protection only; Linux0600 is access protection only, not encryption or nonexportable-key proof. Both providers explicitly permit trusted service memory to contain key bytes and never export them through the protocol. Host-admin/owner immutability is not claimed. These are proposed supported mechanisms, not existing grants. Provider signs HMAC over exactly SLTP-IDEMPOTENCY-1 NUL,u32 actor length,actor UTF8,u32 key length,ASCII key, scoped by admitted workspace/provider. It returns version+MAC only. Retained versions perform lookup; rotation is explicit separate reviewed transaction retaining mappings and old providers. An ephemeral/session/random replacement is forbidden. Native provider failure503 retains state. Provider setup, credentials and security policy need owner decision and direct original-boundary acceptance.

Mutual authentication binds original Core process/companion process via retained Windows HANDLE+birth+TokenUser+held image+named-pipe peer or Linux pidfd+SO_PEERCRED+held executable identity. PID alone cannot authenticate. Channel fresh32-byte nonce/capability established privately after these native checks, never argv/env/log/request, distinct from CLI primary/SEA/broker secrets. Only matching source-owned images/profile accepted.

Binary private companion protocol

Conventions U8/U32BE/U64BE, B32 raw32 bytes, S=U32 length+strictUTF8 bytes. Exact body header U8operation,U32sequence. Frame U32BE length,body,B32HMAC; preimage SLCORE-ADMISSION-1 NUL,direction byte,connection nonce32,U32sequence,U32length,body. Reject wrong phase/direction/sequence/MAC/version/trailing bytes before decode; validate expected operation cap BEFORE buffer growth. No JSON private native RPC or generic arbitrary blob pass-through.

Operations1 OPEN,2 READ_ASSETS,3 RESERVE_STAGE,4 WRITE_STAGE,5 PREFLIGHT_SEAL,6 PREACCEPT_INTENT,7 AUDIT_ENSURE,8 ACCEPT,9 WRITE_INTENT,10 MATERIALIZE,11 DISCOVER,12 OUTCOME_PENDING,13 AUDIT_ACK,14 READ_OPERATION,15 RECOVER,16 CLOSE,17 CAPSULE_CHUNK,18 CAPSULE_SEAL,19 RESOLVE_KEY,20 LOOKUP_STAGE,21 READ_STAGE,22 RELEASE_STAGE_READ,23 LOOKUP_PREFLIGHT. Corresponding result operation is request+128; status0 success or1 failure then closed U8 code. Codes1 unavailable,2 profile_mismatch,3 invalid_phase,4 capacity,5 corrupt,6 collision,7 denied,8 prewrite_failed,9 unknown,10 audit_unavailable,11 not_found,12 stage_expired,13 confirmation_expired,14 confirmation_used,15 idempotency_key_reused,16 idempotency_in_progress. Code11 is indistinguishable for malformed/missing/foreign references, qualified by the requested stage/preflight/operation role in Core's safe mapper. Codes12..14 require verified owning association. Core maps only normative stable errors; native detail never escapes API/Audit. Ordinary channel cannot INITIALIZE, ROTATE, MIGRATE, DELETE_TARGET or run lifecycle. Owner initialization is a separate provisioned native administrative action with its own exact authorized receipt.

OPEN has profileDigest B32 and workspaceIdentityDigest B32, returns persistent store generation U64 and keyVersion S<=64; cap1024. READ_ASSETS has source-selected catalogIdentity S<=256 only, returns four ordered enum/length/raw records with exact source ceilings archive262144,descriptor1024,policy32768,sums512 plus held read receipt B32; cap300000. No caller path selection. RESERVE_STAGE takes canonical actor/client IDs S<=256 each, opaque stageId S36, source catalogDigest B32, the complete DECLARED struct below and expiry U64; native fixed budgets derive from the independently selected catalog, never supplied allowances; cap2048. Native persists every declaration field in the same reserved generation before successful result/HTTP201. WRITE_STAGE carries stageID,offsetU32,chunk<=65536; only sequential exact declared body plus final native exact stage-byte EOF/readback, plus Core independently observed original HTTP EOF; separate authenticated completion command encoded zero chunk with final flag0/1, full rawSHA B32. Declared and observed archive hashes remain distinct and must equal; neither overwrites the other. This is internal streaming, public resumable upload stays forbidden. Entire compressed reservation remains charged. LOOKUP_STAGE/READ_STAGE/RELEASE_STAGE_READ provide actor-qualified metadata and original held bytes to later or restarted Core semantic validation; LOOKUP_PREFLIGHT restores the original owning stage/BINDING/confirmation state. RESOLVE_KEY alone accepts a transient raw ASCII key through the authenticated private channel and performs native-provider derivation plus retained lookup; its exact outcomes precede stage/confirmation expiry checks.

PREFLIGHT_SEAL carries original stageId/preflightId/confirmationId,expiry and canonical bounded private binding digest; companion retains exact strict schema bound to canonical Core validated full plan. CAPSULE_CHUNK transfers original preflightId,offsetU32,chunk<=65536 into exclusive held capsule under original reservation; CAPSULE_SEAL carries original preflightId,entryCountU32,complete frame digestB32 and no extra bytes. Capsule frame encodes full binding and all raw entries below; native verifies exact frame/HMAC/catalogue/retained stage correspondence, flushes/readbacks original capsule and returns opaque capsuleId plus full digest. No ACCEPT can refer to an unsealed or foreign capsule. PREACCEPT_INTENT carries original preflight identity, fixed event ID and canonical safe Audit bytes<=16384; cap32768. AUDIT_ENSURE carries fixedID and exact canonical bytes only; companion resolves own exact audit store, duplicate payload mismatch corruption. ACCEPT uses original preflight/confirmation,operationId,one-use native keyResolutionId,complete capsule digest and pending accepted fixedID/payload; cap65536. WRITE_INTENT binds operation+capsule+native target absence observation to next journal generation; no caller target path. MATERIALIZE original operation ID and capsule digest only; complete held capsule is native storage authority. DISCOVER original operation ID; native emits complete bounded inventory<=128 and all original held observation references. OUTCOME_PENDING and AUDIT_ACK bind original operation,eventID,payload digest and actual receipt generation; cap32768. READ_OPERATION actor qualification+operation ID; RECOVER accepts no request-selected root and traverses only exact verified journal members, no directory scan. CLOSE requires original session resource digest and returns closed/retained classification, never claims timeout means IO closure.

Core semantic plan is canonical exact ASCII paths/final modes/bytecounts/digests and exact raw bytes from validated original stage. Companion rechecks complete catalogue/capsule digest, limits and immutable source binding before write. Typed metadata is versioned closed, not a trusted caller boolean. All phase-dependent count/string/raw budgets checked preallocation; instance parser/stream copies use landed134217728 ceiling, capsules1073741824, raw167772160. Materializer handles stream raw entries directly from native capsule; no base64 JSON duplicate allowance. Limits are host acceptance predicates, not measured guarantees.

Journal v1 and capsule encoding

Dedicated held store under explicitly admitted trusted workspace native storage root. Owner initialization proves exact journal slots/selector/capsule directory/marker absent, owner/lock/profile/provider/key identity, creates/flushed/readbacks empty generation+marker once. Later missing/corrupt/partial/mismatched state503; no empty fallback.

Two native generation slots and selector; both slots count toward landed16777216 total journal ceiling including scratch/retained copies. Exact generation file frame U32payloadLength,strictUTF8 canonical compact sorted-key JSON+LF,B32HMAC. Domain SLCORE-JOURNAL-1 NUL,length,payload; selector U8version1,U8slot0/1,U64generation,B32payloadSHA256,B32HMAC domain SLCORE-SELECTOR-1 NUL preceding bytes. Payload closed keys schema,profileDigest,providerId,workspaceIdentityDigest,keySetId,keyVersions,generation,previousPayloadSha256,reservations,stages,preflights,operations,keyMappings,capsules,outbox,writeIntents. Decimal generations/counts/time ticks are canonical uint64 strings; public timestamps remain fixed RFC3339. Every nested record has closed schema/version, no unknown/duplicate keys or unsafe number coercion. Complete schema definitions are required in proof-contract/journal implementation and reviewed before use, never cast parsed JSON.

Reservations persist exact stageId/actor/client/catalogDigest/rawBytes/expandedAllowance/copyAllowance/historySlots/operationSlots/auditSlots/journalBytes/capsuleBytes/state/resourceRefs; state reserved/retained/released. Stage and preflight retain exact authenticated original associations/digests/expiry; confirmation only private binding+consumedBy original operation. Operation private storage combines safe projection with actor/provider/workspace, original preflight and immutable capsule digest, key mapping reference, write phase and evidence refs. Safe projection stays precisely normative API fields. Key mapping actor/keyVersion/HMAC/originalPreflight/fingerprint/materializationDigest/operationId; no raw key. Capsule record opaque id/digest/bytes/catalogDigest/ownerIdentityDigest/state; outbox fixedID/phase/operation/canonicalPayload/digest/bytes/pending-or-acknowledged/nativeReceipt. WriteIntent operationId/capsuleDigest/targetAbsenceReceipt/phase(never_written,write_intent,staged,rename_attempted,visible,verified)/nativeEvidenceRefs. Phases are persisted observations, never reconstructed from existence alone.

Capsule binary: domain SLCORE-CAPSULE-1 NUL,version1,source catalogIdentity S<=256,tuple canonical fields,operationId,fingerprintB32,materializationB32,U32entryCount,ordered entries S<=240 path,U8mode0=0644/1=0755,U32length,B32SHA,raw bytes; terminal B32 frameHMAC under persistent capsule key version. Entire frame count/digests/semantic policy independently checked against catalogue before write. Native holds generation/capsule handles; no pathname reopen. Capsule encryption where provider supports it must use separately admitted actual envelope scheme; absence is explicit provider limitation, never fake encryption. Uncertain/corrupt remains retained.

Transaction under native workspace/service cross-process lock: pre-reserve both generation/temp/transition capacities; write inactive slot exclusively, flush, full held readback/HMAC; flush directory; write/flush/readback selector temp, atomic replace selector and flush directory, reopen held selector readback. Old selected generation retained until new commit verified. Crash before selector retains old generation; contradictory selector/frame blocks instead of picking newest. Native Windows flush/atomic replace/lock and Linux fsync/rename/lock must be directly qualified on admitted host; unsupported guarantees deny.

API/controller ordering and complete durable effects

All five routes exact landed bodies/responses. Trusted auth then service:configure precedes private parser detail; malformed/missing/foreign references same404. Owner stage409 expiry; confirmation409 expiry. Strict decoded duplicate-aware UTF8 JSON body65536/depth16/string4096 and exact header duplication/framing enforced. No request path/token/URL/inline manifest. Upload validates full local/central ZIP/count/offset/CRC/deflate/EOF/no-extract quotas and raw archive SHA; complete catalog path namespace validated once including dot/case/@ only exact approved paths. Preflight validates current immutable tuple, whole owner inventory, all locked nested fields and modes, typed differences/config/six-field provenance, canonical manifest/raw digest and complete staged/materialization/fingerprint. Confirmation nested inside preflight and consumed by accepted generation only.

Commit bounded syntax -> RESOLVE_KEY native-provider derivation and actor-qualified replay across ALL retained versions before expiry/use lookup. Exact original preflight/fingerprint/materialization mapping returns stored200 even accepted/unknown/expired public ref; changed association409. No mapping -> LOOKUP_PREFLIGHT and held owning stage read, stage/preflight expiry, confirmation syntax/existence/actor/bindings/expiry/single-use checks, current full validation, native persistent key/provider ready, premutation durable intent+Audit ENSURE. Native capsule full flush/readback precedes ACCEPT. ACCEPT independently repeats full retained-version lookup under native lock using its one-use key-resolution handle; it never trusts caller-supplied MAC/version. One accepted generation atomically binds consumed confirmation,key mapping,operation,capsule,reservations,pending accepted event. A concurrent exact winner returns stored replay without second acceptance or effect; a changed winner returns409. No target write until accepted and accepted fixed event durable acknowledgement. Before response uncertainty503 safe stored unknown if available; after202 worker changes durable GET only.

Before MATERIALIZE write intent is durable. Companion held root/segments reject reparse/links/substitution, creates private same-volume staging exclusive, writes each capsule entry via held no-follow handles, hashes/bytes/mode/flush readback then complete held directory enumeration. Native exclusive no-replace rename target direct child serviceId only, never merge/overwrite. Linux native mode exact0644/0755; Windows mode must use separately reviewed exact output DACL profile distinguishing execute allowance (coordinate CLI39 proposed owner execute-deny versus allow), not requested enum asserted as mode. Native actual root/directory/file handle identity and full discovery bind all entries; original generic path discovery may project result only after held verification and full service schema validation. No install/setup/start/secret/shell effect.

Outcome pending same generation as full result evidence, then fixedID Audit ENSURE and later durable ACK before completed is externally readable. Duplicate event ID exact canonical sorted-key compactJSON+LF equality mandatory, raw native readback/flush receipt binds durable generation. Existing appendAuditEvent cannot be called then described as durable; adapter adds native admission-specific stream integrated with existing Audit read/query projection without weakening its chain/history. Existing store corruption remains retained503. Journal outbox survives every outage/crash; ACK never precedes actual native receipt. Attempt/denial/replay events use same safe sink, outage503 no accepted mutation.

Recovery validates exact selector/schema/HMAC/key/provider/profile/catalog/capsule/all resource reservations before work. Flush SAME pendingID/SAMEpayload, verify original event bytes then ACK. Only proven never-written target plus intact capsule may resume original accepted operation. Any rename/write uncertainty, absent uncertain target, partial/extra/different target, lost catalogue/key/capsule becomes retained unknown; never repeat mutation/cleanup. Unknown can reconcile to completed only with same original full native discovery+outcome Audit evidence. No accepted mapping/history/capsule/outbox eviction. Cleanup only actual exclusive contained completed capsule after durable outcome, no unknown target/evidence deletion. Actual IO closure releases charge; logical deadline never does.

Exact private Core proof and coordinated wrapper

Proposed private body schema service-lasso.core-source-admission-native-proof.v1, closed outer keys schema,source,scope,run,platform,tools,template,catalogSource,assets,provider,journey,operations,journal,audit,discovery,lifecycle,closure,gates,negativeCases,rawEvidence,outcome. Body<=1048576/depth16/tokens65536/members4096; no arbitrary nativeTemplate pass-through. source repository/commit/ref/tree; scope canonical owner policy reference, run original provider runID/attempt/workflowSHA/jobID; platform win32/linux. tools Core/companion/observer/keyProvider each actual source/image/version identity. template tuple exact original publication repository/commit/version/tag/kind/semanticDigest; assets four ordered name/size/rawSHA/nativeObjectRef. catalogSource exact coordinated T1 object and independently admitted Core catalogue commit/blob/rawSHA, not caller asserted success.

provider exact profileSHA,providerId,keySetId,currentVersion,retainedVersions,workspaceIdentityRef,storageIdentityRef,initializationReceiptRef; no raw keys/path. journey stageRef,uploadRef,preflightRef,confirmationRef,commitRef,pollRefs,cliProofRef: refs resolve ORIGINAL private request/response captures with redacted public counterparts; sensitive capture custody independently admitted. cliProofRef consumes CLI39 service-lasso.cli-template-native-proof.v1 original body plus actual source/run/asset identities, not reserialize/digest assertion. It proves TC12 independently; Core producer cannot invent CLI success. operations<=64 original safe projections plus originalPreflightRef,keyMappingRef,acceptedGenerationRef,writeIntentRef,capsuleRef,outcomeRef. journal initial/final generation+selector/full frames+native lock/flush/replace/readback refs. audit rows fixed eventId,payloadSHA,byteCount,phase,nativeReceiptRef,ackGenerationRef; original exact bytes independently compared for repeated IDs. discovery complete sorted path/mode/bytes/SHA/nativeObjectRef plus root/discovery/readback refs, full dynamic inventory equality. lifecycle separate authorizedConfirmationRef,setup/install/start/health/process/stop refs; source admission itself zero lifecycle and cannot synthesize these.

Closure binds original process birth/token-or-uid/image/exit/binary stdoutEOF/stderrEOF, native stream/handle/IO close or retained refs and final reservations. Same eleven-key native primitive rows and platform/API enum proposed in CLI39 blueprint are shared observation vocabulary only; Core-specific journal/key/selector operations add closed prefixes core.journal_write/readback/selector_commit/selector_readback,win32.dpapi_key_hmac,linux.key_provider_hmac,core.audit_flush/readback,capsule.write/readback. Core additions require separate architecture review and actual observer source. Rows alone do not establish custody. Source owner observer independently binds raw kernel API result to original held objects, full raw evidence manifest and original provider artifact.

gates exactly ordered CA01..CA08 with outcome success/failure/blocked and nonempty original proofRefs for success. negativeCases fixed IDs below with original inputRef,expectedCode,actualCode,noEffectObservationRef,closureRef,outcome. rawEvidence sorted closed basenames1..240 ASCII/no path/control, size and SHA; every ref subset exists and full bytes/size independently verified. Missing bindings failure/null under existing R3 failure union; no third consumer/new public template asset. Public consumer wrapper only projects existing admitted register/R3 fields; private body stays private90days. Source-owned producer/verifier must validate original body/schema/ref/gate/actual provider identity and raw ZIP artifact equality, not hash arbitrary JSON. Gate caps may require separately reviewed wrapper private-evidence limit amendment; do not silently exceed existing consumer ceiling.

Positive, negative and crash matrix

Whole fixtures authored later UNEXECUTED: owning genuine complete current tuple/project, baseline and every typed difference/id/name/config, all immutable0755, dynamic newer inventory, full API nested shape/no lifecycle; foreign malformed/missing identical404, owner expired409; exact accepted/terminal/unknown replay, expired stage/confirmation/publicGET replay, changed association and concurrent commit. Actual native callee fixtures exercise every protocol operation and hostile frame before growth; no fake durable adapter can stand as acceptance.

Fixed negatives: auth-absent,permission-denied,foreign-stage,foreign-preflight,foreign-operation,malformed-ref,stage-expired,confirmation-expired,confirmation-used,binding-actor,binding-service,binding-template,binding-staged,binding-materialization,binding-fingerprint,replay-changed-preflight,duplicate-json,invalid-utf8,unknown-json,deep-json,header-duplicate,length-invalid,length-mismatch,chunked,content-coding,trailer,extra-body,early-eof,zip-method,zip-flag,zip64,zip-offset,zip-overlap,zip-crc,zip-local-central,zip-extra,zip-comment,zip-path-alias,zip-ancestor,zip-case,zip-mode,zip-missing,zip-extra-member,zip-quota,zip-ratio,unadmitted-tuple,asset-size,asset-hash,policy-shape,policy-digest,locked-property,provenance-shape,config-forbidden,unknown-path,provider-missing,key-version-lost,journal-missing,journal-corrupt,journal-partial,marker-mismatch,capacity-stalled,capacity-outbox,frame-mac,frame-sequence,frame-size,frame-tail,native-peer,image-mismatch,target-existing,target-reparse,target-extra,target-readback-mode,target-readback-hash,audit-duplicate-payload,audit-unavailable,recovery-uncertain-absence,unknown-no-retry,lifecycle-unconfirmed. Each binds original no-effect/retained evidence and safe error; tests cannot weaken protected gates/deadlines.

Crash injection at each native write/flush/readback/selector replacement, capsule creation, premutation Audit append/flush/readback, accepted generation, accepted Audit ACK, write intent, per-file write/flush, staging discovery, no-replace rename before/after, full target discovery, outcome pending, Audit append/flush/readback, ACK and cleanup. Observe durable original generation, no loss of fixed IDs/payload, no second effect, retained quota/key mapping, correct before503/after202/GET semantics. Actual process kill/ACL/native injection prohibited until separate input admission and explicit authorized fixture ownership.

Direct production success route and unresolved gates

Template owner publishes original four assets first under protected controls and immutable raw readback. Different pins-only reviews independently admit complete CLI/Core catalogues. Core matching companion/profile/provider/observer initialized separately with real owner custody; complete final source different ENTIRE GO and NEW complete-input ROOT permit executed gates. Build once exact frozen source, naturalCI observed read-only; existing packaging includes same tool/companion bytes/provenance. Original Windows ZIP/Linux TAR packaging and staged release transfer remain mandatory.

Actual released external CLI on Windows/Linux performs native v3 TC01..12, faithful complete source ZIP, remote authenticated Core stage/upload/preflight/operator confirmation/commit/poll/full held native discovery, then separately authorized setup/install/start/running/health/original process/lifecycle and original stop/maintenance gates. Fresh packaged Core consumes identical released CLI/TUI bytes; original five TUI actions remain separate. Proof producer collects original provider API metadata and bounded original artifact ZIP, validates fixed workflow/source/attempt/policy/terminal success; retains all original consumed bodies byte-for-byte, not extraction/serialization alone. Existing #1640/F7 native fixture source and actual provider custody are absent/UNKNOWN, not accepted prerequisites. Scope is Windows/Linux; Darwin deferred never PASS. No workflow rerun/dispatch/settings/publication/deployment here.

Review decision needed on WHOLE companion trust, native profile/key provider, journal/capsule binary schema, native exact Windows mode profile, Audit reader integration, private proof vocabulary/body and complete producer success route. After approved architecture/governed landing, sole author implements ALL CA source and meaningful unexecuted fixtures; another fresh ENTIRE final source review plus NEW complete-input ROOT before every executable check. No architecture decision enables endpoints without actual immutable pins/provider/native qualification. This freeze preserves full implementation obligation and reports real activation gaps; it does not deliver a partial EMPTY product.

Exact command and stored binding appendix

BINDING payload is exact tuple S(templateId<=128),S(templateCommit40),S(templateVersion<=64),B32contractDigest; then S(serviceId<=63),S(version<=64),B32archiveSHA,B32stagedDigest,B32manifestSHA,B32materializationDigest,B32fingerprint,U32inventoryCount,U64expandedBytes. All string patterns/equalities are normative. PREFLIGHT_SEAL payload S(stageId36),S(preflightId36),S(confirmationId36),S(actorId<=256),S(clientId<=256),U64preflightExpiryUnixMilliseconds,U64confirmationExpiryUnixMilliseconds,B32declarationDigest,B32stageReadReceiptDigest,BINDING. Result S(preflightId),B32bindingDigest,U64generation. bindingDigest=SHA256(SLCORE-BINDING-1 NUL || exact BINDING bytes). WRITE_STAGE payload S(stageId),U32offset,U8final,U32chunkLength,chunk and when final1 B32archiveSHA; final0 requires nonzero chunk, final1 requires zero chunk and exact accumulated declared bytes. cap66000. Core owns HTTP EOF/framing check before final1; native owns stage-object EOF/hash independently. No native assertion substitutes for HTTP observation.

CAPSULE_CHUNK payload S(preflightId),U32offset,U32chunkLength,rawChunk<=65536; CAPSULE_SEAL S(preflightId),U32count,B32frameSHA. Private raw capsule frame carries BINDING and per-entry data. PREACCEPT_INTENT S(preflightId),S(capsuleId36),S(eventId36),U32payloadLength,canonical safe bytes. AUDIT_ENSURE S(eventId36),U32payloadLength,canonical safe bytes; success U64auditGeneration,B32payloadSHA,U32payloadLength,B32nativeReceiptDigest. Fixed admission Audit IDs sae_ plus32 lowercasehex are private, never opaque confirmation/operation syntax. ACCEPT S(preflightId),S(confirmationId),S(operationId36),B32keyResolutionId,S(capsuleId),B32capsuleSHA,S(eventId),U32payloadLength,payload; native resolves actor/client/BINDING/reservations from original preflight and matching private key-resolution handle, not acceptance caller substitution. Success U8disposition(0newAccepted,1exactConcurrentReplay),U64generation,B32generationPayloadSHA,U32projectionLength,canonical safe projection<=8192; exact replay ignores prospective operation/event/capsule identities as new effect authority and returns the stored original operation. WRITE_INTENT S(operationId),B32capsuleSHA; native observes absent target and returns U64generation,B32absenceReceipt. MATERIALIZE S(operationId),B32capsuleSHA returns U8knownState(0neverWritten,1collision,2visible,3unknown),B32nativeEvidenceDigest; no success enum by itself completes operation. DISCOVER S(operationId) returns U32count,ordered(Spath,U8observedMode,U32bytes,B32fileSHA,B32nativeObjectDigest),B32discoveryDigest. cap65536. OUTCOME_PENDING S(operationId),U8result(0completedCandidate,1conflict,2denied,3failed,4unknown),S(errorCode<=64 or empty for completedCandidate),S(eventId),U32payloadLength,payload,B32evidenceDigest; completedCandidate remains externally accepted until ACK. AUDIT_ACK S(operationId),S(eventId),U64auditGeneration,B32payloadSHA,U32payloadLength,B32receiptDigest returns U64journalGeneration and safe projection. READ_OPERATION S(actorId),S(operationId), returns closed safe projection encoded bounded canonicalJSON<=8192; native returns only stored original actor projection. RECOVER empty returns U32originalRecordCount,U32pendingEventCount,U32unknownCount,U64generation; no paths. CLOSE B32resourceDigest returns U8state0closed/1retained,B32actualClosureDigest. Other result caps65536 except READ_ASSETS300000 and READ_STAGE65664; actual stricter operation caps apply, failure result<=256. Every response begins operation+128/sequence/status; success fields exact as above, no unknown/trailing. No method can fabricate keyMAC: companion asks admitted provider and compares current/retained versions.

Closed storage structs (all fields mandatory; null only explicitly marked): stage {id,actorId,clientId,catalogDigest,declared,bindingDigest,expiresAt,state,reservationId,stageObjectRef}; declared exact serviceId,version,archiveSha256,archiveBytes,archiveEntries,manifestSha256. state reserved/uploading/written/sealed/expired/retained; bindingDigest and stageObjectRef null before written. preflight {id,stageId,actorId,clientId,confirmationId,expiresAt,confirmationExpiresAt,binding,bindingDigest,consumedBy}; consumedBy null or original operation ID. binding exact BINDING named fields. reservation uses listed exact fields, resourceRefs ordered opaque identity/digest/size/state records, actual state owned/closed/retained. capsule uses listed fields with state building/sealed/retained/disposed, disposition requires native proof. keyVersions rows {version,providerIdentityDigest,state}; state current/retained. generation schemas exact version service-lasso.source-admission-journal.v1. Operations {projection,actorId,clientId,providerId,workspaceIdentityDigest,preflightId,capsuleId,capsuleDigest,keyMappingId,writePhase,evidenceRefs,candidateOutcome}; candidateOutcome null or closed status/error/evidence binding until durable outcome ACK. keyMappings {id,actorId,keyVersion,keyHMAC,preflightId,admissionFingerprint,materializationDigest,operationId}. outbox {eventId,phase,operationId,canonicalPayload,payloadSha256,bytes,state,nativeReceipt}; operationId null only premutation/attempt, nativeReceipt null pending otherwise exact eventId/payloadSha256/byteCount/auditGeneration/nativeReceiptDigest. phase premutation/accepted/outcome/reconciliation/attempt. writeIntents exact listed fields and evidenceRefs sorted refs. All opaque refs are name/digest/size closed objects resolving retained native files, no API path authority; no discretionary extra payload.

Audit native stream is admission-specific and query-visible through explicit shared Audit read integration. Frame U32canonicalPayloadLength,S(eventId36),canonical safe bytes,B32previousFrameDigest,B32HMAC; domain SLCORE-AUDIT-1 NUL preceding bytes. Independently held index maps fixedID to exact frame offset/digest; index and frame update use native journal-style selected generation transaction. Duplicate fixedID payload mismatch returns corrupt, never existing-event success. Native frame contains actor-safe payload only; Core read integration revalidates native frame chain/identity and maps into existing Audit projection without rewriting historical Audit JSONL or manufacturing its old chain. Missing/corrupt stream/index503 retained; shared readers explicitly distinguish this admission frame source in chain status. This introduces a new Audit read representation requiring separate architecture review, not an unnoticed store adapter.

Owner administrative initialization receipt exact schema service-lasso.core-admission-initialization.v1,profileSha256,workspaceIdentityRef,storageIdentityRef,keyProviderIdentityRef,keySetId,currentVersion,absenceObservationRefs,lockObservationRef,initialJournalGenerationRef,markerRef,flushReadbackRefs,outcome; original source-owned authorization/custody required. Missing receipt cannot be repaired by an endpoint. Native object refs and raw capture schemas require independently reviewed actual observer source before positive proof; no opaque receipt digest alone can establish native success.

Cryptographic frame completion: every journal/capsule/Audit/selector authenticated frame prefixes S(keyVersion<=64) after its fixed domain/version and before its length/remaining fields; the prefix is included in MAC preimage. Key provider resolves only independently admitted current/retained version; unknown denies, no trial with ephemeral replacement. Provider operation is exact {domain enum,idempotency/journal/selector/capsule/audit,version,bytesLength,original bounded bytes}, returns version+MAC; domain is independently reinserted by provider, not caller arbitrary prefix. Native computes frame MAC after original bytes verification; Core-supplied CAPSULE_CHUNK excludes final HMAC, CAPSULE_SEAL appends actual provider HMAC after validation and includes exact BINDING, original prospective operationId and selected keyVersion. Initial preflight capsule becomes operation-bound only under the same original preaccept lineage; changed operation association cannot reuse it. Complete capsuleDigest hashes full native sealed frame, distinct from materializationDigest. No raw key enters any frame. Proposal does not claim actual DPAPI/provider/native image exists.

Profile capabilities are exactly ordered native_no_follow,native_exclusive_create,native_same_volume,native_no_replace,native_file_flush,native_directory_durability,native_atomic_selector,native_cross_process_lock,native_complete_discovery,native_original_lifetime,native_private_observer. Each row {name,qualificationRef}; no boolean grants capability. qualificationRef resolves independently admitted original host-native evidence with actual filesystem/provider/source/image. Absent/mismatched/unqualified row denies endpoints; fixture receipts cannot populate production profile. workspace/storage identities and initialization receipt remain actual private custody evidence, never source-selected guessed identities.

Complete native key resolution and persisted-stage read contract (F1/F2)

This section selects the exact missing private operations for the ENTIRE seven-document architecture correction. It refines the command appendix above; public five-route grammar, source-selected catalog, trusted middleware actor/client/workspace and ALL CA01..CA08 remain unchanged. Proposed native source owners protocol/storage plus Core native-channel/controller own these complete interfaces. Native peer authentication proves the original Core callee, not an API actor: only Core trusted middleware supplies actor/client; no public request may set these fields. Every request includes admitted providerId S<=128 and workspaceIdentityDigest B32 where noted; native requires byte equality with its independently provisioned OPEN profile. Provider/workspace IDs scope every retained key mapping and stage/preflight association. A supplied matching string is never itself a profile grant.

DECLARED is S(serviceId<=63),S(version<=64),B32archiveSha256,U32archiveBytes,U32archiveEntries,B32manifestSha256. RESERVE_STAGE exact request S(actorId<=256),S(clientId<=256),S(stageId36),B32catalogDigest,DECLARED,U64expiryUnixMilliseconds; result S(stageId36),U64expiry,U32maxBytes,U32maxEntries,U64generation,B32declarationDigest. declarationDigest=SHA256(SLCORE-DECLARED-1 NUL || exact DECLARED bytes). Native checks all normative service/version/string grammar, 1..10485760 bytes/1..512 entries and narrower selected owner ceilings, exact catalog association and server-owned expiry before reservation. Complete strict declaration persists with actor/client/provider/workspace/catalog/reservation before201; WRITE_STAGE final independently checks observed complete byte count/hash/EOF against this immutable declaration. Native malformed declaration denies before growth; Core independently validates HTTP body and semantic manifest/service/version/hash later. CatalogDigest resolves exactly one selected immutable tuple; caller cannot switch tuples by reusing a stage.

RESOLVE_KEY request S(actorId<=256),S(clientId<=256),S(providerId<=128),B32workspaceIdentityDigest,S(preflightId36),S(rawKey8..128); cap1024 including header. Core supplies only the bounded authenticated API original actor and exact unnormalized ASCII key matching the landed grammar. No fingerprint supplied by the caller becomes authority: companion resolves the retained original preflight/BINDING internally. Companion authenticates the provisioned provider with native lifetime/image/peer profile and sends exactly actor+rawKey+provider/workspace domain binding for each admitted current/retained version (<=64). Provider rejects foreign workspace/provider/version and reconstructs the landed SLTP-IDEMPOTENCY-1 HMAC preimage itself. ProviderId/workspace are authenticated scope, not additions to that fixed preimage. It never exports key bytes; only version/MAC results return privately. Raw API key exists only during bounded request/provider derivation, is zeroed from native buffers after all MACs are obtained, and is excluded from persistence, Audit, public proof, native observation rows and raw capture logs. Core's private journey capture redacts key/auth/confirmation values; exact original body proof is limited to nonsecret proof bodies, never authorization/key request bytes. Native key buffers/copies are bounded, charged and actually closed; timeout does not erase unresolved IO by assertion.

Native verifies selected journal/provider/workspace and searches ALL retained version MACs under native workspace lock. A missing/corrupt/lost required version or multiple contradictory mappings returns503 retained, never MISS or a fresh version replacement. Mapping identity includes actorId/providerId/workspaceIdentityDigest/keyVersion/keyHMAC; clientId belongs to original admission binding but is not an extra idempotency-key scope. Same trusted actor through another authenticated client still replays its original mapping; new client cannot replace stored original client. Mapping retains original preflightId plus exact fingerprint/materialization/BINDING identity independently of public GET/stage expiry. Match on the original preflight requires equality with that retained original binding; a supplied different or malformed original reference fails bounded syntax/not-found as applicable before any lookup disclosure, and a well-formed different preflight for the same actor/key yields code15 idempotency_key_reused even if expired/missing. Foreign actors derive distinct mappings and learn none. No stage/confirmation expiry, consumption, public GET expiry or parser can mask an exact retained replay.

RESOLVE_KEY success U8outcome: 0MISS -> B32keyResolutionId,S(currentVersion<=64),U64observedGeneration; 1IN_PROGRESS or 2REPLAYED -> U32projectionLength,canonical original safe projection<=8192,U64selectedGeneration. IN_PROGRESS means stored status accepted, including durable worker/outbox pending; REPLAYED includes every stored terminal status including unknown. Both map HTTP200/replayed:true, never a second worker/202. If the native lock owner is presently selecting the same actor/provider/workspace/MAC original acceptance and no durable accepted generation is yet readable, an independently synchronized native in-flight association permits code16/HTTP409 idempotency_in_progress; it is transient lock-owner evidence only, never an accepted claim or startup-reconstructed state. Generic lock contention cannot manufacture that code. Native may instead wait within original bounded lock/deadline and then replay the readable generation; uncertain lock ownership stays unavailable/retained. REUSED returns failure code15 and no projection/handle. Missing mapping alone returns MISS before owning expiry lookup; it is not permission to accept. The unpredictable32-byte keyResolutionId refers only to this original authenticated connection, actor/provider/workspace/preflight, all derived version/MAC pairs, original provider/profile/version-set digest and native observation generation; no raw key is retained in it. At most4 outstanding handles per connection, charge bounded bytes before allocation, lifetime<=remaining original40s commit deadline, one ACCEPT use, no renewal. CLOSE releases only actually closed handles; late result/connection loss invalidates acceptance capability and retains unresolved IO/capacity. Reconnect/restart reissues RESOLVE_KEY and independently reads persistent mappings; no session handle is durable authority.

ACCEPT validates keyResolutionId belongs to this original connection/actor/preflight/profile/provider/workspace, and repeats the full current/retained MAC search under the SAME native lock as confirmation consumption and accepted generation selection. Provider/profile/version-set drift invalidates the handle503 without effects; it must resolve anew before expiry checks. An exact concurrent winner returns disposition1/stored projection200 before confirmation-used/expiry; changed winner returns code15. Only absence under that lock permits owning stage/preflight/confirmation checks, native full capsule/catalog/fingerprint/materialization validation, original premutation intent+same-ID exact Audit durable receipt validation and atomic generation. A one-use handle is consumed on ACCEPT success or terminal rejection, never accepts a caller MAC/version. No in-progress resolution itself persists a key claim or consumes confirmation. Conflicting prospective capsules/intents remain charged orphan evidence until separately verified disposition; no cleanup/effect grant follows from replay.

LOOKUP_STAGE request S(actorId<=256),S(clientId<=256),S(providerId<=128),B32workspaceIdentityDigest,S(stageId36); cap1024. Trusted actor owns visibility; stored client is original metadata, never replaced by current request client. Result S(stageId),S(originalActor),S(originalClient),B32catalogDigest,DECLARED,B32declarationDigest,U64expiry,U8state(0reserved,1uploading,2written,3sealed,4retained),U64generation,U8hasReadHandle; when hasReadHandle1 append B32readHandle,U32observedBytes,B32observedArchiveSHA,B32nativeObjectDigest. Result<=2048. Owning reserved/uploading state may return metadata but cannot yield readHandle or authorize preflight. Owning written/sealed stage yields handle only after final original stage EOF/hash/flush/readback and full declared equality; retained unknown/corrupt cannot yield bytes as valid stage. Foreign/missing/malformed all code11 with identical failure body/no timing detail projection; owning expired stage code12 unless already resolved exact commit replay. No stored state4 bypasses expiry. Stage lookup never extends expiry or frees reservation.

Native holds the original regular nonreparse stage object and verified parent closure, not a Core pathname. LOOKUP_STAGE opens/anchors only journal-resolved exact native object refs under its trusted store; actual held identity must match original stageObjectRef and original digest/size/owner/profile. A restarted companion recovers these original journal-authorized refs with actual native no-follow held reopen+full readback; any replacement/ambiguous closure denies retained503. Core never receives stage path or arbitrary read capability. At most1 active reader per stage, within16 stage/instance and existing copy budgets, a separate exclusive reader cannot race upload/cleanup. Handle32 is connection-scoped CSPRNG, bound actor/provider/workspace/stage/generation/native object/declared equality. Preflight10s includes lookup/read/parser; accepted commit original40s includes reread/revalidation; independently timed IO keeps actual ownership/reservation until closed. Stage remains fully charged throughout, including disconnect/restart/unresolved reads.

READ_STAGE request B32readHandle,U32offset,U32maxBytes; cap64; maxBytes1..65536, offset must equal next consumed offset, no seek, rewind, filename or caller digest. Result U32offset,U32chunkLength,original raw bytes,U8eof; when eof1 append U32totalBytes,B32fullArchiveSHA,B32nativeReadReceiptDigest. Result cap65664 before allocation including header; exact raw transfer<=declared archiveBytes<=10485760 and existing copy ceiling. Native reads at most maxBytes, requires positive chunk until EOF, and probes held object's actual end independently (zero-length final only when needed). Final eof1 requires exactly declared bytes, exact declared and prior observed rawSHA, current held identity/parent closure and original native EOF observation; unexpected/trailing/truncated/replaced bytes deny503 and invalidate handle. Core independently incremental-hashes/counts original received bytes, verifies offsets/frame MAC/no tail, final EOF/total/hash equality and then performs the COMPLETE original SLTP-ZIP-1/strict JSON/catalog/manifest/provenance/modes/differences semantic validation. A native receipt never substitutes for those parser checks. No full archive allocation/new base64 allowance; original parser copies are charged. No PREFLIGHT_SEAL/capsule authority from partial transfer, timeout or failed final receipt.

RELEASE_STAGE_READ request B32readHandle; result U8state(0closed,1retained),B32closureDigest; cap128. Only closed after native reader IO/handle buffers actually close. retained invalidates further use and preserves reservations/native unknown evidence. Core calls after original transfer/parser completion or failure; disconnect/CLOSE invokes same actual closure boundary. Actual stage expiry or concurrent state/generation changes are rechecked before PREFLIGHT_SEAL/ACCEPT, not inferred from the earlier lookup. First valid stage preflight stores a native read receipt reference and original declarationDigest in its private binding lineage; PREFLIGHT_SEAL must independently match final read receipt/BINDING/current complete semantic assertion from the original authenticated Core and atomically enforce one stage/candidate preflight. Core semantic validation remains its selected trust authority, never a native parser-success boolean.

LOOKUP_PREFLIGHT request S(actorId<=256),S(clientId<=256),S(providerId<=128),B32workspaceIdentityDigest,S(preflightId36); cap1024. Result S(preflightId),S(stageId),S(originalActor),S(originalClient),S(confirmationId),U64preflightExpiry,U64confirmationExpiry,BINDING,B32bindingDigest,B32declarationDigest,B32stageReadReceiptDigest,U8consumed,U8hasOperation; consumed0 has no consumed field, consumed1 appends S(originalOperationId); hasOperation1 appends original safe projection length+bytes<=8192; U64generation ends response; cap12288. Native resolves exact persisted actor/provider/workspace/stage/BINDING/confirmation associations; no raw confirmation or key. Foreign/missing/malformed all code11. Owning expired confirmation/preflight follows landed confirmation_expired409; owner stage expiry code12; owning consumed confirmation code14 only AFTER exact retained key lookup MISS, never before replay. This lookup is metadata only and cannot substitute for held stage revalidation on new acceptance. Native retains exact original associations after Controller restart; expired preaccepted state cannot be renewed by replaying seal.

Stored stage adds mandatory providerId/workspaceIdentityDigest/declarationDigest/observedArchiveSha256/nativeWriteReceiptRef; latter two null until written, independently retained from declared.archiveSha256. Stored preflight adds providerId/workspaceIdentityDigest/declarationDigest/stageReadReceiptRef; all nonnull at seal, retains separate preflight and confirmation expiry (confirmationExpiresAt). KeyMappings add providerId/workspaceIdentityDigest/bindingDigest; same original binding remains retained for exact replay when public references expire. Reader/key handles are transient native resource rows only, never restart persistence or public paths. Journal/capsule/private native proof source schemas include original declaration/read/provider/retained lookup/lock observations with secret-redacted refs; no raw key or keyResolutionId may enter Audit/public proof.

Required direct authored later UNEXECUTED callee/controller cases: all six declared fields persisted before201 and recovered after Core+companion restart; reserved/uploading/expired/foreign/malformed/missing identical ownership outcomes; actual original held streaming after later request/restart, exact frame/copy/EOF/hash caps, zero/truncated/trailing/replaced/same-size-substituted stages, mid-read disconnect/expiry/generation change, closure-retained charging and complete semantic positives/negatives. Actual provider key MISS/new acceptance/current+retained rotation replay after consumed/expired stage+confirmation/publicGET, accepted/terminal/unknown projections, changed preflight/fingerprint/materialization, missing/corrupt version, forged MAC/handle/actor/provider/workspace, new client same actor, original native-lock simultaneous exact and changed commits, reconnect/restart replay with no second mutation/confirmation/Audit ID. Every operation19..23 gets natural positive, hostile frame-before-growth and no-effect/retained native observation proof, including original provider HMAC boundary. Full journal/capsule/Audit no-loss/crash/resource/CA01..CA08/protected/native Windows+Linux/released CLI/TUI gates remain required; these proposed commands prove no actual capability or acceptance.

Coordinated landed CLI39 complete shared reader binding (2026-10-04)

The primary shared architecture identity is CLI PR40 original reviewed head f2cccec6e4725d7e67512fb6fd2f52fc77500957/tree76d592b73ae5196a28b05ae26f93fd59e359ed80, basec073495b620cb0759738eba6098a8af893792319, normally landed CLI develop7e2ab67141965bac67b29af841195488aee14436 at2026-10-03T22:40:07Z. Full docs/decisions/BLUEPRINT-003-complete-native-v3-host-admission.md blob2b7110456bc7ba7130f033c2c4547d29ab97e921/rawSHA256e6ca678cd2bd046e27eae4081267eab64c9947ab2cad5734947c89d0cc659f87 is the exact187-line accepted architecture source. The distinct entire CLI review reports WHOLE ARCHITECTURE GO; this is architecture identity only, never product/native/catalog admission. Original Core entire21a362 key/stage architecture review remains preserved; this entire coordinated alignment requires a DIFFERENT fresh ENTIRE architecture review before implementation. Historical76bd/tree453670a8/blob40fb7f22/raw70dcbcd8 pin remains historical evidence and grants no coverage of this final contract.

Core consumes service-lasso.cli-template-native-proof.v1 ORIGINAL body/ZIP/member bytes against the entire landed CLI blueprint, with exact outer/nested keys, duplicate/unknown/type/null/caps/reference validation. All source/template/catalog/admission/assets/session/plan/readback/closure/gates/negative/raw evidence rules remain required; a shared reference alone grants no source or observer authority. Core own private journal/provider/key/Audit/native body remains distinct, as do native commands19..23 and all CA01..CA08. CLI host profile/protocol/ledger v2 does not initialize or qualify Core store/key/source budget. All retained-version replay-before-expiry, immutable six-field DECLARED stage, original held stream/parser/copy/closure, capsule/materialization/private proof and fixed-ID exact-payload durable Audit semantics above remain unchanged.

The following complete shared launch/input-route and proof clauses are selected verbatim from that exact architecture source for Core's closed reader. Historical correction/review status sentences in the source describe its pre-landing checkpoints; the verified landed identity and current coordinated review boundary above govern this alignment. This selection does not alter the native v3 READ/PLAN/CLOSE wire grammar, HMAC domains, caps, optional id/name relationship or deadlines.

HA5: complete production launcher and public result lifetime

Selected production owner is the same provisioned source-owned native host service, extended with an authenticated launch endpoint separate from the primary admission endpoint. The public service-lassoctl executable becomes a source-owned native facade with no authoring or profile authority; service launches the approved original native primary image (which launches its matching SEA/writer under ADR), not the facade PID. Host installation separately provisions both exact images and observer/library transport source in the independently admitted profile. This proposed executable split requires future coherent packaging/installation/public-command adaptation; current executable is not asserted compatible. Portable library authoring requires the same installed authenticated facade/host capability; no ambient PATH, caller executable, profile or Node compiler fallback. Missing installation denies authoring, not a fabricated successful empty bundle. Legacy non-authoring CLI commands retain their ordinary existing runtime route.

The facade authenticates service using HA1 original server object/image/owner; service authenticates facade using original peer object/image/owner and admitted facade source, never process-name/PID/root alone. A Node library uses a package-source-owned absolute installed facade binding verified against its source-owned admitted transport contract; facade uses an inherited private local channel authenticated by fresh capability and actual parent Node image/package-source custody. That caller authentication grants invocation permission only, never template admission. Unverifiable package/source/caller custody denies library authoring. Qualification uses this exact public facade/library route; its outer harness observes independently but never supplies/enrolls/replaces the mandatory production observer or original primary.

Service reserves one of16 control bindings, all128-reference capacity and finite retention/capture/forwarding space before creating anything. Pending launch also provisionally charges one of16 host and4 actual-user session slots; spawn failure remains charged until every created original object physically closes. Service launches one approved external observer as its own child and authenticates its exact original process/source using a fresh private inherited control capability. Observer never descends from original primary. Service creates original primary stdout/stderr pipes, gives primary only their writer ends and service collector their sole read ends; observer receives original identity duplicates/capture readback custody, never a competing pipe reader. Service starts the approved primary in a native gated state: Windows create suspended with held image/source and processHANDLE; Linux approved held executable via execveat with an inherited private start barrier and original pidfd acquired/correlated before release. Any unavailable original-object/source/launch guarantee fails closed. No unsupported universal Linux suspend claim. Source-owned primary does no asset IO or RESERVE until authenticated start release.

Service creates fresh random run identity itself, binds actual user, profile, exact launcher/observer/primary/SEA source identities and selected independently admitted catalog tuple (or truthful no-tuple denial) in a retained native launch record. Caller request source hash is never authority. Service authenticates observer channel, transfers original primary and actual original pipe read duplicates, independently validates OBSERVER_BIND and native source/run binding, and durably reads back binding before releasing primary start barrier. Original primary then authenticates service and sends empty RESERVE. Its provisional charge becomes the same reservation, never a second session or a released gap. New RESERVE not matching exactly one service-created live launch/binding denies. Unused/failed provisional launch follows retained closure/recovery rules; caller cannot enroll an independently launched arbitrary primary. Service cannot parse/admit policy or synthesize template trust: original primary/SEA independently authenticate the complete source-owned catalog and raw admitted tuple.

Facade request is closed operation materialize or library-load; fixed version, invocation nonce, optional id/name, destination intent, immutable private inputRoot routing and source-owned catalog selector are encoded before bounded native transport. Full async preview follows library-load then CLOSE; materialize follows one READ/derive/PLAN. Existing ADR validation and native caps precede any allocation or launch. Destination is ordinary caller intent, never authority for a profile/image/tuple. Service passes bounded request bytes on inherited private channel to original primary, which performs all semantic validation. Library loader returns only an immutable inspection plus opaque local WeakMap token bound to this original live remote session; this is pending inspection, not authoring/qualification success. Materialize or fullpreview consumes the token once on the same original channel; cloned, caller-supplied, replaced, reused tokens deny. Explicit dispose requests CLOSE. Abandonment or missing consumer by original absolute40s retains/denies and rejects any later use, no idle extension/reconnect. No successful authoring result can be returned by load alone.

Service collector copies every actual original stream byte into pre-reserved capture, records original EOF including empty streams and forwards finite framed data to facade on separate control channel. Capture/forwarding buffers and unresolved sends are charged service control/retention, writer ends are original session resources. Source-owned per-stream/aggregate byte bounds are fixed by independently admitted launch profile and must fit the finite retention record plus1MiB service-control budget; no unbounded queue or disk spill. Overflow, lost caller, backpressure not completed by original deadline, missing EOF or uncertain IO retains/blocks without truncation-as-success. CLI output is finite original bytes, ordered per stream; no cross-stream ordering claim. Facade/library expose pending output as such, never a success marker before disposition.

Two-stage CLOSE_INTENT/ACK→original naturalzero/EOF/channel/all-resource closure→FREE remains exact HA3. Observer archives original captures/launch/intent/terminal/ledger evidence before TERMINAL_ACK. Service independently reads back ACK/archive association, then sends exactly one authenticated public terminal result on already admitted facade control channel. Public success requires FREE, verified archive ACK, complete original result bytes and deadline; service sends no success while primary is alive or terminal cell unacknowledged. Materialize returns complete owner-verified project/result; fullpreview returns complete immutable inspection with no writer; CLI exits zero only after validating this terminal result. Library promise resolves only there. Denial, RETAINED/QUARANTINED, missing terminal result, loss, nonzero facade or deadline produces bounded typed failure with no authoring success; a produced project may exist and must be reported as retained/unqualified without deleting it. No re-send/poll/retry. Public result delivery and facade/observer exit are control-resource obligations, never omitted primary resources. Control binding is released only after original facade/observer/channel/forwarding closure; loss retains charged binding even if resource slot FREE. Service crash quarantines provisional/used slots and retains outstanding control cells, never recreates launch handles or success.

HA5 original four-asset input route (CLI39-HA5-INPUT)

Selected F3 correction is the bounded private caller-root route, rather than a new catalog filesystem map. loadAcceptedTemplateBundle(templateRoot, admissions) retains its signature: source-owned library transport captures the original caller cwd and resolves templateRoot once lexically, before LAUNCH, without reading any asset, resolving symlinks, probing ancestors or selecting an ambient default. Relative roots therefore keep the existing caller-cwd relationship; resolution does not establish safety or authority. createServiceScaffold(options) forwards options.templateRoot through that loader; full async dryRun does likewise. Ordinary CLI forwards its explicit local template-root intent through the same source-owned facade encoding. Missing root denies before authoring, not cwd/PATH/environment/catalog fallback. Synchronous informational preview stays zeroIO/zero authored files and never creates LAUNCH. No library signature, opaque bundle association or original id/name rule changes.

LAUNCH sequence0 binds S inputRoot exactly once immediately after invocationNonce and before catalogSelector, in both materialize and library-load modes. S is U32BE byte length followed by strict UTF8 bytes, length1..4096, no NUL, unpaired surrogate, malformed/overlong UTF8 or trailing bytes. No Unicode normalization, case folding, environment expansion, URI conversion, shell expansion or silent shortening. Native primary validates supported absolute local path grammar before assetIO; Windows/POSIX paths need not be ASCII. Structural length/frame caps are checked before variable allocation; full LAUNCH still fits the independently admitted maximumRequestBytes<=16384, otherwise rejects without launch/assetIO. catalogSelector remains lookup-only and root never supplies a catalog/profile/image/source hash or authority. A root outside the separately admitted immutable tuple, even if structurally safe, cannot pass four raw lengths/hashes plus complete SEA semantic validation.

After authenticated LAUNCH and before start release/RESERVE, service retains the exact authenticated body and its inputRoot byte slice in the existing private immutable run record, correlated to client/source/profile/catalog/run/original primary. Service checks only bounded transport shape and does not inspect root assets or parse/admit policy/TAR. The service-to-primary inherited private launch channel uses the identical complete LAUNCH body, length-framed and MAC-bound under a distinct fresh32-byte service-to-primary launch capability/domain SLCLI-PRIMARY-LAUNCH-2 NUL, runIdentity, U32BE body length and original body; capability is delivered only through admitted inherited private transport, never argv/env/output. Original primary authenticates this one request against the service-created run/start binding before releasing its semantic work. No new caller enrollment, public service request or source authority is introduced. The same original inherited channel later carries the existing one LIBRARY_ACTION bound to run/token; no action may add/replace a root, and phase/trailing-byte checks reject attempts.

Primary sends the exact retained root bytes once to its matching SEA through an authenticated one-use inherited private start record, correlated with the existing candidate/greeting identity: U32BE payload length, B32 runIdentity, S inputRoot, B32 HMAC under a distinct fresh32-byte primary-to-SEA start capability over SLCLI-SEA-INPUT-3 NUL || runIdentity || S inputRoot. Total start payload<=4164 (32+4+4096+32); length prefix is excluded from payload but checked before allocation. Capability is confined to this inherited private transport, distinct from service/facade/observer/native-v3 capabilities and never forwarded to writer. SEA consumes exactly one start record after authenticated native greeting and before READ, verifies run/candidate/channel association and sends native v3 READ S inputRoot byte-for-byte equal to this retained value. Primary independently compares original READ root bytes to its launch binding before opening any leaf; mismatch is native invalid_phase and terminal consumption, never a second root/read. Native v3 READ wire codes/caps/HMAC/deadlines stay unchanged. Root delivery is not a new semantic policy parser in service/primary: matching SEA validates full original assets after original primary read.

Original primary performs exactly four ADR fixed-name held no-follow reads at the selected root; ancestor/regular-file/identity/EOF/size/raw binding checks remain mandatory. It never reads a supplied provenance substitute or extracted tree. Service/facade/library do not pre-read assets. All raw tuple admission remains source-owned and independent from root choice; caller admissions arrays deny before transport under the existing reference-equality rule. Inputs/root are never cleanup targets, reopened to prove identity, modified or recursively scanned; output overlap/unsafe destinations deny under original rules. PLAN/writer get no root, root bytes, input handles or start/service capabilities. Complete materialize/async preview/dispose uses the original one-use session; library-load may return only pending inspection and its final action cannot change inputRoot. Fullpreview has no writer and reaches external FREE/archive ACK before terminal success.

Root/source/capability ownership is fully charged: facade/library request encoding/copies and inherited transport are finite client/control obligations; service immutable LAUNCH copy, start transport and private route evidence are service-control/retention obligations; primary launch/root/start copies and SEA start/root/READ buffers are session obligations. Reserve growth before allocation and include actual native/JS encoding overhead in independently measured existing 1MiB aggregate service-control, 8388608/session and admitted retention caps. Each component retains at most one original LAUNCH root slice plus one bounded outbound encoding per edge; complete request copies, MAC/start buffers, active IO and observer evidence are separately counted, never assumed free aliases. Ended buffers/closed original IO only release charge; unresolved copies/IO retain under HA4. Root source routing adds no durable global root map, no ledger root field, no increased128-reference/16binding/4-user16-host limit. Original10/10/10/20s and40s or stricter protected deadlines include launch transfer and pending library action, never restart at READ. Malformed root may reject pre-spawn; any later failure truthfully retains/physically closes already-created resources under F1/F2.

Privacy: raw root and full LAUNCH/start/READ bodies remain private admitted90-day evidence only, with finite pre-reserved sink/copy capacity. Never echo a root, raw body, root digest, capability, OS exception or private reference in public stdout/stderr/PUBLIC_RESULT/T1/T2/R3, HTTP/Audit or writer input. The caller's existing local result.directory remains local API data under ADR and cannot be repurposed as public proof. No process argv/environment root transport is selected. Product diagnostics use existing closed safe codes; root validation failure maps to input_unsafe (or input_quota for exceeded size) at native READ, and pre-primary structural denial uses fixed host invalid_resource, never reflects caller bytes.

Prospective closure.launch.inputRouteRef resolves a closed private route record with exact keys runIdentity,requestRef,serviceForwardRef,primaryStartRef,seaStartRef,readRequestRef,assetsRef,catalogSourceRef,ownershipRef,outcome. All eight Ref fields resolve original rawEvidence names; successful route has all bindings nonnull; failed/unobserved fields null with every key retained. requestRef is the authenticated original facade LAUNCH body, serviceForwardRef its original authenticated service-to-primary frame, primaryStartRef original primary accepted launch/native start-release correlation, seaStartRef the exact authenticated SEA start record, readRequestRef original native v3 READ body/MAC/phase, assetsRef original four held-read observations and raw record receipt, catalogSourceRef independently admitted catalog/raw tuple plus SEA semantic outcome, ownershipRef actual charged copy/IO/closure inventory. Source-admitted independent observer/private collector custody correlates every frame and native object to one original client/run/reservation/profile/catalog/source; decoding must prove exact S-byte equality across LAUNCH/service/start/READ. Hashes or caller assertions alone cannot prove route. No new observer kernel-operation enum is needed: source-owned authenticated-channel raw captures plus original existing read/identity/closure primitives prove routing. This row enters the original archive generation before terminal ACK, while result/control closure remains the separate final record; no self/future-digest. Complete private proof binds both archive generations. Shared reader must consume this closed row/raw refs and exact LAUNCH order; old Core1644 76bd pin grants no coverage. Parent relays before freeze, final pin alignment follows architecture GO.

Required direct Windows/Linux positives use the same released route: ordinary CLI materialize; exported library load→acceptedTemplateFiles independent copies→materialize with baseline and explicit id/name; createServiceScaffold; full async preview/no writer; explicit dispose; absolute roots including spaces/non-ASCII and valid relative caller roots. Two different local directories containing the identical independently admitted original four bytes must preserve the requested route and each achieve complete raw/semantic/owner/readback/closure proof; no hidden catalog path substitution. Qualification captures original full requests/start/READ/four assets and custody, complete TC01..TC12 and unchanged publication/Core/operator gates, never substitutes a test-only route.

Required denials: missing/empty/oversize/NUL/invalidUTF8/unpaired surrogate/nonabsolute or unsupported root; forged caller admissions; root field on LIBRARY_ACTION/extra trailing/duplicate request/replaced start/READ root; wrong run/candidate/source/MAC/capability; root symlink/reparse/unsafe ancestor/nonregular or changed original leaf/partial read; safe root with wrong raw tuple, policy/descriptor/sums/TAR semantic defect or missing four asset; no installed facade/profile/catalog, unavailable/private retention/control/session capacity, input/output overlap, launch/action timeout/abandonment, control/capture loss/service crash. Each expected closed code, no unauthorized asset IO/write/input modification, actual original closure or truthful retained resources and private/public separation must be independently proved. No root denial or missing capability is blocked-as-PASS; original positive deadlines/gates are protected. This is architecture/spec proposal only, not authored/executed tests.

HA4: ownership, memory and cleanup

Exact private TC proof body proposal

New private schema service-lasso.cli-template-native-proof.v1, supplementing unchanged host-acceptance1/legacy phase receipts. Exact outer keys schema,source,scope,run,platform,tools,template,catalogSource,admission,assets,session,plan,readback,closure,gates,negativeCases,rawEvidence,outcome. Duplicate/unknown/trailing denies; body<=1MiB/depth16/tokens65536/members4096. Failure same shape with null unobserved bindings/blocked or failure gates; success no null except deliberately omitted name. No arbitrary object/string blob or caller boolean proves execution.

source repository,commit,ref,tree; scope exactSPEC008R1; run exactR3 id,attempt,workflowSha; platformwin32/linux. tools primary,sea,writer,observer each sourceCommit,sourceDigest,imageSha256,version. template repository,commit,version,tag,archiveSha256,contractSha256,contractDigest. catalogSource exactT1; catalogIdentity exact separately admitted entry under admission. assets four ordered name,sha256,size,nativeObjectRef. Every name refers actual retained raw evidence, not public path.

admission exact profileSha256,serviceSourceCommit,serviceImageSha256,hostEpoch,reservationId,slotId,ownerIdentityRef,catalogIdentity,initialGeneration,finalGeneration,initialLedgerRef,finalLedgerRef,providerJobId. Native service/observer independently records original identity/ledger4-user16-host proof; hashing clientJSON never grants observer authority. session nonceSha256,readReceipt,planDigest,readbackDigest,peakBytes,phaseObservations,retainedResources. phaseObservations<=8 rows phase,startTick,endTick,absoluteDeadlineTick,nativeObservationRef; ticks observed monotonicu64 decimalstrings. retainedResources<=128 rows kind,identityRef,state,bytes,observationRef; kindprocess/stream/channel/input-handle/io/buffer/candidate; stateowned/closed/retained/quarantined. All private references resolve actual raw bytes.

plan destinationIdentityRef,id,name,entryCount,totalBytes,entries,ownerVerificationRef; entries<=128 exactASCII order path,mode,bytes,sha256; actual owner verifier over produced project independent of held plan. readback entryCount,totalBytes,entries,discoveryRef; entries same plus nativeObjectRef; all equal complete plan. Native raw observations/complete discovery required, no aggregate-only digest.

closure exact keys primary,sea,writer,channels,inputs,io,ledger,closeIntent,finalization,launch. Process row nativeIdentityRef,birthRef,exitRef,stdoutRef,stderrRef,outcome(natural/failed/unresolved); streamrefs bind actual bytes/digest/EOF, including empty captured streams. channels/inputs/io<=128 ordered nativeObjectRef,closeObservationRef,outcome. ledger exact retainedSlots,retainedBytes,terminalGeneration,readbackRef (retainedSlots/retainedBytes are this reservation, not unrelated host sessions). closeIntent exact reservationId,observerBindingDigest,finalSnapshotDigest,intentDigest,generation,acceptedTick,absoluteDeadlineTick,requestRef,ackRef,pendingLedgerRef,outcome; outcome accepted/failed/unresolved. finalization exact observerBindingDigest,observerChannelRef,primaryClosureRef,resourceClosureRef,terminalReceiptRef,terminalAckRef,terminalLedgerRef,terminalGeneration,completedTick,disposition,outcome; disposition FREE/RETAINED/QUARANTINED; outcome success/failure/blocked. Generations/ticks decimal u64 strings; digests lowercase64; reservationId lowercase64; refs rawEvidence names. Failure shape retains all keys with null unobserved values; accepted intent alone cannot set finalization success. Success requires nonnull actual original request/ACK, CLOSE_PENDING ledger, independently captured primary naturalzero/streamsEOF/channel closure, complete closed-resource snapshot and committed FREE+terminal-cell raw ledger, exact original terminal receipt delivery and archived-before-ACK evidence. Terminal generation strictly exceeds intent generation; acceptedTick<=completedTick<=unchanged absoluteDeadlineTick. Body remains prospective service-lasso.cli-template-native-proof.v1 with these exact keys; Core #1644 must align its selected closed reader through parent relay before later implementation. No unconstrained extension body. CLOSE/fullpreview may have writer null and cannot claim materialization qualification. Timeout cannot pass.

gates orderedTC01..TC12 id,outcome,proofRefs; nonempty original proof on success. negativeCases fixed source-owned IDs below, rows id,inputRef,expectedCode,actualCode,noWriteObservationRef,closureRef,outcome. rawEvidence sortedASCII closed name,sha256,size refs, no duplicates/unknowns. Original providerZIP plus original consumed proof bodies separately retained/compared outside body; reencodedJSON/extracted-only equality insufficient. Fixed API independently proves job/run/source/attempt/policy/terminal outcome; native observer is a separately admitted image/source/custody input requiring NEW ROOT, not fabricated by author.

Exact amendment appendix for architecture review

This appendix proposes concrete choices, not permission to create the service/store or add catalog authority. Core policy source is full commit a0384e676c1b2dbf66b915563ea70c176c09d598, path .governance/project/ga-platform-scope.json, blob e694c3e314c1bf11e03dc4656730a96467a765b8. Raw SHA256 must be computed from those ORIGINAL Git blob bytes in the freeze, never a reserialized object. Actual Template full policy/owner verifier bytes at2b9 are read-only input evidence and no admission.

Profile exact closed keys schema,platform,serviceSource,endpoint,owner,store,clientImages,control,retention,launch. schema service-lasso.cli-host-profile.v2; platform win32/linux; serviceSource repository,commit,imageSha256,sourceSha256; endpoint kind,name (kind unix-socket/named-pipe matching platform); owner nativeId; store provider,rootIdentity,keyVersion,maximumBytes (4194304); clientImages exactly primarySha256,observerSha256,launcherSha256,libraryFacadeSourceSha256. control exact maximumBindings16,maximumReferencesPerBinding128,maximumServiceBytes1048576. retention exact provider,rootIdentity,maximumBytes,maximumRecordBytes,minimumDays90; positive safe integer source-owned finite byte limits independently admitted, no runtime supplied value. Observer peak/capture quota resides in separately admitted observer source and must fit retention reserved record capacity before binding; no invented numerical allowance grants admission. All hashes lowercase64/commitslowercase40; nativeId actual uid decimal/SID; names fixed source-owned absolute endpoint, no env expansion/URL; each profile independently admitted, no guessed values. Ordinary caller may neither supply profile nor initialize store. Service executes no policy/TAR parser or writer.

Binary conventions: U8/U32BE/U64BE; B32 exact32raw bytes; S u32 strictUTF8 length+bytes, cap4096/noNUL; H native handle transferred out-of-band with fixed index into at most128 handles; no portable raw handle integer authority. Body header U8operation,U32sequence. RESERVE payload empty; peer identity supplies owner/primary and service finds prebound observer by original primary identity. RESERVE_RESULT U8status then success0 B32reservation,U8slotId,U64generation,B32observerBindingDigest,U64absoluteDeadlineTick; failure1 U8code. OBSERVE payload B32reservation,U8phase,U32snapshotLength,snapshot; OBSERVE_RESULT status then success U64generation,B32snapshotDigest or failure U8code. CLOSE_INTENT payload B32reservation,B32finalSnapshotDigest,B32observerBindingDigest,U8expectedExit0,U64absoluteDeadlineTick. CLOSE_INTENT_ACK U8status then success0 U64intentGeneration,B32intentDigest,U64acceptedTick; failure1 U8code. No ACK claims FREE. CLOSE_INTENT digest SHA256(domain SLCLI-HOST-CLOSE-INTENT-2 NUL || reservation || authenticatedPrimaryIdentityDigest || observerBindingDigest || exact CLOSE_INTENT body). Native primary source exits zero only after validating this exact ACK and original deadline; service does not infer ACK receipt merely from a socket write.

Observer channel sequence0: OBSERVER_BIND payload B32primaryIdentityDigest,B32runIdentityDigest,U32primaryHandleIndex,U32stdoutHandleIndex,U32stderrHandleIndex,B32retentionReservationDigest; native out-of-band primary duplicate must match original birth/image/user and admitted run/source, distinct stream indexes actual original capture pipes. OBSERVER_BIND_ACK U8status then success0 B32observerBindingDigest or failure1 U8code. Binding digest SHA256(domain SLCLI-HOST-OBSERVER-BIND-2 NUL || original observerIdentityDigest || exact binding body). Observer sequence1: service sends once TERMINAL_RECEIPT payload B32reservation,U8slotId,B32observerBindingDigest,B32intentDigest,U64terminalGeneration,B32closureEvidenceDigest,B32terminalLedgerDigest,U64completedTick,U8disposition (0FREE,1RETAINED,2QUARANTINED). IntentDigest allzero only when no accepted intent, forbidden for FREE. Observer sends TERMINAL_ACK sequence1 B32reservation,U64terminalGeneration,B32terminalReceiptDigest,B32archiveReadbackDigest. terminalReceiptDigest SHA256(domain SLCLI-HOST-TERMINAL-2 NUL || exact original receipt body). Archive digest binds admitted retention sink original raw receipt and complete private evidence manifest, not reencodedJSON. Service records ACK only after independently admitted archive readback correlation; forged ACK/digest cannot clear terminal cell. No extra ACK_RESULT, observer requests, unsolicited arbitrary body or sequence2. Failure codes1..8 in listed order; unknown status/enum/trailing bytes denies. Expected operation body cap16384 for OBSERVE,256 for every other frame; MAC uses body sequence also in envelope preimage. No service greeting transports authority prior to native peer checks.

Snapshot binary exact U8version1,U8phase,U32resourceCount followed by sorted resource IDs: U32id,U8kind,U8state,U64chargedBytes,B32identityDigest,U32handleIndex,B32observationDigest. kind0primary,1sea,2writer,3channel,4stream,5inputHandle,6io,7buffer,8candidate; state0owned,1closed,2retained,3quarantined; handleIndex0xffffffff only for buffers or already-closed objects accompanied by previously admitted observation. Count<=128, each IDunique/orderstrict, charged bytes sum<=8388608, no unknown/trailing. Phases0reserved,1greeting,2read,3derive,4plan,5writer,6readback,7close. Service checks every live native resource via its original duplicate; native observation bytes are separately retained before ACK and closed proof refs bind them. The canonical digest hashes domain SLCLI-HOST-SNAPSHOT-1 NUL,reservationId,exact snapshot bytes. Service cannot independently measure all JS allocator physical overhead from a counter: the independently admitted primary/SEA allocator accounting plus actual native peak-memory observations are required, and missing measurement blocks positive qualification.

Ledger encoding fixed: generation payload UTF8 canonical compact JSON+LF, strict duplicate/closed validation and deterministic field order, raw cap262144 each slotfile; two files generation-a/generation-b plus selector. Payload exact keys schema,hostIdentity,hostEpoch,profileSha256,keyVersion,generation,slots,observations,terminalCells,previousPayloadSha256; schema service-lasso.cli-host-ledger.v2. slots exact16 HA2 records; observations exact sorted nonfree slotId,sha256,size. terminalCells exact16 rows slotId,reservationId,intentDigest,closureEvidenceDigest,terminalGeneration,closureLedgerRef,terminalReceiptDigest,terminalReceiptRef,disposition,ackDigest; empty cells have all fields except slotId null; occupied cells have complete fields except ackDigest null until verified ACK, terminalReceiptDigest/terminalReceiptRef null in committed closure seed, closureLedgerRef null only until the subsequent receipt-ready transaction, intentDigest null only failed/no-intent disposition. FREE+closure seed is one committed generation: crash cannot select FREE without matching closure evidence/cell. After this commit service retains that exact closure-generation raw payload, derives its SHA256 as terminalLedgerDigest, builds the original receipt body and flushes/readbacks its binary file, then commits a receipt-ready generation binding closureLedgerRef and terminalReceiptDigest/terminalReceiptRef before sending once. terminalGeneration remains the original closure generation, not the receipt-ready or ACK generation. This removes self-digest circularity: closure payload never contains its own hash or final receipt digest. Both exact generations are retained under4MiB until archive ACK. Crash between closure and receipt-ready leaves safe FREE plus an undelivered occupied cell, never inferred terminal delivery or automatic replay. Selector exact binary U8version2,U8slot0or1,U64generation,B32payloadSha256,B32HMAC; HMAC domain SLCLI-HOST-SELECTOR-2 NUL then preceding exact selector bytes. Each generation file U32payloadLength,rawpayload,B32HMAC with domain SLCLI-HOST-LEDGER-2 NUL,length,payload. Initial previousPayloadSha256 null, later actual previous generation raw payload digest. FREE resource fields null/retainedBytes0; used fields follow HA2 null rules. generation positiveU64 decimal string, no unsafe JSONnumber. Observation files are bound by manifestsha/size; total store4MiB includes both generations/selector/observations/temporarycopies/terminal cells. No store path is an input candidate or user project.

Commit transaction: reserve temporarycopy capacity first, native exclusive write next inactive generation, flush file, held readback complete raw frame/HMAC; flush containing held directory where supported; exclusively write/flush/readback new selector temporary then native atomic replace selector and flush directory; current selector/frame readback independently matches generation. Original older generation preserved until new selector committed. Crash before selector keeps old generation; contradictory/missing/invalid selected generation blocks, never guess empty/newest. Complete ledger lock held through this bounded storage transaction but NOT any client input/IO/writer operation; unresolved storage consumes service capacity and denies new admission. Owner initialization/rotation have separate exact native receipts and no implicit retry. Actual Windows/POSIX storage guarantees require host evidence; unsupported provider fails closed.

Windows output mode selection for review: original leaf created read/write/READ_CONTROL with held no-write-delete-sharing, protected owner DACL. Final0644 exact D:P(A;;0x001f01df;;;OW) (FILE_ALL_ACCESS excluding FILE_EXECUTE); final0755 exact D:P(A;;FA;;;OW). No inheritable/extraACE, readonly attribute off, regular nonreparse disk object, same native fileID/volume before-after; exact held GetSecurityInfo protected DACL plus actual access test for owner execute denial/allow establishes this Windows projection, not a claim of POSIX permission semantics. Parent/project directory protected ownerFA. Writer readback maps enum ONLY from independently observed exact descriptor/profile and allnative checks; never from request. Owner retains WRITE_DAC and can change later; no immutable-to-owner claim. Existing writer allFA does NOT qualify0644 projection. Destination is private candidate with complete readback/discovery then held native no-replace rename; existing direct final-directory creation must be adapted coherently, not described as atomic. Input DACLs untouched.

Proof primitives exact constraints: SHA256lowercase64,commit/tree/bloblowercase40,size positive safe integer<=sourcecap,ref refs/heads/develop,platform enum, version owning candidate grammar1..64ASCII. Evidence names ASCII basename1..240,no dot/dotdot/backslash/colon/control; private files may be separate qualified directories but refs never paths. Manifest-mode enum0644/0755; bytes nonnegative safe<=owner/phase cap; entrycount1..128; null allowed only fixed failure/unobserved fields and omittedname/fullpreviewwriter. Gate outcome success/failure/blocked; top outcome same; negative actual/expected code closed ADRcode or protocol_rejected for unauthenticated malformed frame. Success needs allsource-owned fixed cases with actual outcome success on each platform; gate refs exact subset of retained manifest names, all refs consumed/hash/size verified. Native raw body schemas for kernel birth/EOF/identity/flush/readback observations must be frozen with actual observer source; this blueprint's observer primitive fields are kind,platform,objectIdentityDigest,monotonicTick,operation,outcome,bytesSha256,byteCount,mode,relatedIdentityDigest,sourceImageSha256. kind birth/identity/read/eof/write/flush/discovery/exit/close/ledger, operation fixed source-owned native API enum; outcome success/failure/unresolved; null only inapplicable fields with kind-specific exact validator. An unconstrained operation string or opaque blob cannot establish positive proof. Complete observer-source review/native input admission remains mandatory; no implementation in this freeze.

Observer operation enum is closed to linux.execveat, linux.pidfd_open, linux.pidfd_poll, linux.so_peercred, linux.fstat, linux.openat_read, linux.read, linux.write, linux.fsync, linux.getdents, linux.rename_noreplace, linux.close, linux.waitid, win32.create_process, win32.process_birth, win32.process_wait, win32.token_user, win32.pipe_peer, win32.nt_open_read, win32.file_identity, win32.read, win32.write, win32.flush, win32.directory_query, win32.rename_noreplace, win32.close, win32.security_info, ledger.generation_write, ledger.generation_readback, ledger.selector_commit, ledger.selector_readback. A row's platform must match its operation prefix; ledger operations additionally require the admitted platform-specific native storage receipt. Operations cannot silently widen to arbitrary commands.

Every primitive has all eleven keys listed above. Identity digest, tick and sourceImageSha256 always nonnull. birth and identity require relatedIdentityDigest and null byte/hash/mode fields; birth binds original parent, identity binds previous held observation. read/write require byteCount and bytesSha256, null mode, relatedIdentityDigest binding the same original held object; eof requires byteCount0 and hash of empty bytes, related stream identity. flush/close/exit require null byte/hash/mode and related original identity; exit outcome success means original natural zero exit under separate original wait observation, never a caller status. discovery requires complete canonical inventory byte count/digest and related held directory identity, null mode; its retained inventory contains every observed object. Mode observation is identity kind with win32.security_info or linux.fstat and nonnull0644/0755, related original file identity and null byte/hash. ledger requires full exact frame byte count/hash, related generation identity and null mode. Any other null/non-null combination denies. Each success must be independently correlated with admitted observer's original kernel object and retained raw capture; rows alone remain assertions until that custody and actual original provider artifact body are proved. Failure/unresolved rows cannot prove successful closure.

Historical review and current correction status

Exact production launch amendment appendix (HA5)

Profile launch exact keys endpoint,primaryImageBinding,observerImageBinding,launcherImageBinding,libraryTransportBinding,maximumRequestBytes,maximumResultBytes,maximumStdoutBytes,maximumStderrBytes,maximumAggregateCaptureBytes. endpoint same HA1 native kind/name rules, distinct fixed endpoint; imageBinding exact repository,commit,blob,rawSha256,imageSha256 and held native installed object identity, independently admitted before enablement; libraryTransportBinding exact repository,commit,blob,rawSha256,nodeImageSha256,packageSourceSha256,inheritedChannelKind. Installed object identity is a separately retained native primitive reference, never a guessed path/PID. Byte bounds positive safe integers source-owned and independently measured/admitted; request<=16384, result<=16384, each stream<=aggregate, aggregate plus worst-case complete private evidence<=retention.maximumRecordBytes; all outstanding forwarding/control allocations across16 bindings<=1048576. Unsupported source/native/library parent custody or peak/capture budget denies. No new image or package is automatically trusted because profile names it.

Separate public launch channel after native mutual authentication uses fresh32-byte nonce/capability and same capped framing but HMAC domain SLCLI-HOST-LAUNCH-2 NUL; direction0 facade→service,1 service→facade. Exact binary header U8operation,U32sequence. Codes1LAUNCH,2LAUNCH_PENDING,3LIBRARY_ACTION,4OUTPUT,5PUBLIC_RESULT. LAUNCH sequence0 payload U8mode(0materialize,1library-load),B32invocationNonce,S inputRoot,S catalogSelector,S destination,U8hasId,[S id],U8hasName,[S name]; all fields schema/cap/semantic validated by approved primary, id/name retain ADR optional rules, destination empty only library-load pending materialization/fullpreview, catalogSelector source-owned lookup only. LAUNCH_PENDING success B32runIdentity,B32remoteToken,B32inspectionDigest,U32inspectionLength,inspection bytes; failure U8closed host code. Pending inspection is available only after original READ validation, bounded by native ADR inspection cap and maximumResultBytes; it grants no terminal success. Materialize does not require caller action. library-load accepts exactly one LIBRARY_ACTION sequence1 B32runIdentity,B32remoteToken,U8action(0materialize,1fullpreview,2dispose),S destination,U8hasId,[S id],U8hasName,[S name]. Native primary enforces remote token/session/deadline and exact output request validation. No further caller request, reconnect or reuse. OUTPUT service sequence1..1024 monotonic is U8stream(0stdout,1stderr),U32chunkLength,original bytes, bounded before allocation by remaining profile stream/control budget. Service responses have independent sequence space; LAUNCH_PENDING first sequence0, OUTPUT next, PUBLIC_RESULT final at most1026. Output unavailable/no pending data uses no frame, never fabricated empty EOF; original EOF lives in capture evidence. PUBLIC_RESULT exact U8status(0success,1failure),B32runIdentity,U8disposition(0FREE,1RETAINED,2QUARANTINED),B32terminalReceiptDigest,B32archiveReadbackDigest,U32resultLength,result bytes,U8failureCode; success failureCode0 and nonnull digest fields, failure result is bounded diagnostic with no credentials/paths/private receipts and allzero digests only where unobserved. Source-owned result exact compact closed JSON+LF keys operation,id,name,entryCount,totalBytes,inspectionDigest,ownerVerificationDigest; nonapplicable id/name/ownerVerificationDigest null only fullpreview/dispose, result fields independently match original primary immutable result/complete readback; no service invented owner verification. Failure codes use HA3 closed enum1..8. No frame exceeds16384 or admitted request/result caps; no arbitrary JSON/command extension. Pending inspection output/result propagation cap must be proved for actual full tuple; incompatible larger tuple denies pending operation before partial return. Ordinary load passes no caller-provided admissions.

Launch proof row exact requestRef,inputRouteRef,clientIdentityRef,sourceTupleRef,observerBirthRef,primaryBirthRef,streamBindingRef,prebindRef,resultDeliveryRef,outcome. All refs are rawEvidence names, outcome success/failure/blocked. Failed/unobserved refs null with every key retained; success all nonnull and independently bound to same run/reservation/profile/catalog/source and original native objects. requestRef actual authenticated original LAUNCH body; inputRouteRef exact private route record defined below; clientIdentityRef actual facade and library parent custody where applicable; sourceTupleRef complete admitted source/profile/catalog tuple; observerBirthRef external service-parent birth and original image; primaryBirthRef service-parent original gated birth/image; streamBindingRef actual two distinct original stdout/stderr pipes/writer ends/sole collector; prebindRef actual original OBSERVER_BIND/ACK durable readback before start release and RESERVE; resultDeliveryRef exact original PUBLIC_RESULT received by original facade plus archived-before-ACK receipt correlation. The initial archive ACK covers launch/prebind/primary closure/terminal receipt evidence only, never future public result bytes. Result delivery and facade/control closure are retained in a separately pre-reserved final control record after delivery; the complete private proof manifest binds both archive generations before qualification reports success. PUBLIC_RESULT never hashes itself or its future control record. A lost final control record blocks qualification even if the already delivered product result was successful; it cannot erase retained earlier evidence. Success primitive launch operation linux.execveat/win32.create_process uses birth kind (related original service parent identity, null bytes/hash/mode), followed by existing original birth/identity observations and held image raw digest/source association; kernel operation alone never proves source authority. Library fullpreview/materialize and ordinary CLI need their own actual same-route proof; qualification-only observations cannot substitute.

Coordinated whole implementation and review boundary

The selected production service authenticates facade/library parent, starts its admitted external observer and original gated primary, binds original streams/run/source and durably prebinds BEFORE start release/RESERVE. Qualification never supplies a replacement observer. Selected root routing is private immutable caller intent, independently source-admitted raw tuple and full SEA semantics remain authority. No new catalog filesystem map or public root transport exists. Two-stage charged CLOSE_PENDING/primary natural-zero→FREE/terminal archive ACK→public result and separate final control records are required on ordinary CLI and all library/scaffold/fullpreview/dispose routes. Core consumes every original raw ref with matching run/source/catalog/native object custody; raw hash equality alone cannot prove routing or source authority.

Complete shared proof mode/type/null/tick/generation, manifest inventory, same-ABI native observations and raw provider ZIP/body equality remain required. Native launch primitives linux.execveat/win32.create_process require original birth/service-parent/held image/source custody, never a PID/path assertion. Missing installation/profile/provider/key/observer/catalog/immutable pins/resources/current F7 remains absent UNKNOWN, not a new criterion or grant. All source admission CA01..CA08, original Core staged-service/outer Windows ZIP, CLI native TAR, TUI five actions, identical published CLI/TUI bytes and original released running-service/operator proof remain UNMET. Darwin remains deferred, never PASS.

This entire source-only architecture alignment is not implementation or execution authority. Different fresh ENTIRE cumulative/current-base/shared-boundary architecture review and governed develop landing precede whole product implementation; then different ENTIRE product SOURCE GO and NEW complete-input ROOT precede ANY executable check. No source imports/parsers/compiler/build/npm/tests/native/service/provider/ACL/lifecycle/dispatch/rerun/settings/publication/deployment/cleanup is authorized by this document. Parent owns coordinated review and PR landing; review branch/evidence is intentionally retained under #1643/PR1644.

#1643 complete F4 original-library-data architecture selection

Development SOURCE ONLY prospective ENTIRE architecture amendment under SPEC002 AC-4CF.1b / SPEC006 AC-6E.SA1 and all CA01..CA08. Primary shared amendment is CLI PR41 original prospective architecture head d15f703fcd809f7cceeb6626d0efb7a611e2144d/tree d9e7d2713972a46f59b857a7b9e2fcadc88972b4/base7e2ab67141965bac67b29af841195488aee14436, full blueprint blob62d359d8406c1b2fbb4043140e716eb4f5fb785e/rawSHA256d2ca5338ab29eb50963b1a5b3eb372e31c56e40fbff3112bd5269f44bf299b23/100822bytes. Original landed CLI40 f2cc/tree76d592 remains retained history; prior GO does not transfer to this new proposal. DIFFERENT fresh ENTIRE coordinated architecture review and governed develop landing precede product implementation; later DIFFERENT ENTIRE product SOURCE GO and NEW complete-input ROOT precede execution.

The complete Core blueprint selects original authenticated four-hop SEA→primary→service→facade/library BEGIN/CHUNK/END with exact complete baseline file record; unchanged original native READ/PLAN/CLOSE v3 and admission/ledger v2, new launch/profile v3, each frame16384 and chunk16307 maximum, total768000 record ceiling and every tighter independently admitted complete dynamic owner quota. No inline whole LAUNCH_PENDING payload, metadata-only Buffers, OUTPUT tunnel, path reread, truncated inventory or new writer/capability authority can satisfy the library route. Source/run/launchNonce/original READ/four raw tuple/catalog custody, all raw records and complete semantic equality are independently required. Actual source evidence policy18891bytes exceeds the prior16384 entire frame; it grants no immutable publication or catalog pin.

Original CLI proof outer18 keys/closure10 keys remain; launch becomes exact11 keys with inspectionRouteRef, whose exact13-key private row binds full original transfer, source-private snapshot/copy sets and ownership. Null inspectionRouteRef applies only independently decoded non-library/no-transfer or failure; successful library route requires full nonnull records and actual source custody. Client-copy quota8388608 per binding/128 copy sets/16 host bindings reserves each complete source-owned allocation before growth; returned mutable Buffer copies remain conservatively charged until authenticated original Node-parent actual exit. Original service aggregate1048576/session8388608/128references/4-user16-host/control/storage/retention/deadlines remain. Initial terminal archive before ACK cannot hash future public result/client exit; full proof binds subsequent final control/client closure generation or remains blocked.

Core operations1..23/retained-version MAC replay-before-expiry/native-lock ACCEPT/original six-field DECLARED/held stage stream and full ZIP/JSON/catalog/provenance/modes/differences/native materialization/discovery/two-generation journal/capsule/fixed-ID exact-payload durable Audit no-loss outbox remain unchanged. Full CA01..CA08/TC01..TC12/positive-negative-crash/raw provider ZIP/source/operator journey remain required. Missing profiles/keys/images/providers/catalog/immutable pins/F7 are activation gaps, never fake grants or success. Native1640 D1/D4/D8 separate NO-GO remains unwaived. Original Windows/Linux released route/TUI/same published bytes/protected publication/lifecycle acceptance and Darwin deferred remain distinct/unmet.

Whole-blueprint literal angle/brace expressions receive code-span markup only to resolve the actual natural b47 docs111314171608 MDX21:680 error; exact normative literal bytes/values are preserved. Image parser guard/packages/workflow remain unchanged. Source-only byte/integrity/markup analysis is not a docs build, implementation SOURCE GO, native admission or acceptance.

Coordinated COMPLETE F4 shared reader selection (#1643)

CLI PR41 original prospective architecture head d15f703fcd809f7cceeb6626d0efb7a611e2144d/tree d9e7d2713972a46f59b857a7b9e2fcadc88972b4/base7e2ab67141965bac67b29af841195488aee14436, full blueprint blob62d359d8406c1b2fbb4043140e716eb4f5fb785e/rawSHA256d2ca5338ab29eb50963b1a5b3eb372e31c56e40fbff3112bd5269f44bf299b23/100822bytes is the exact prospective complete source binding. This supersedes only the original inline LAUNCH_PENDING shared transport, launch/profile version and conditional launch proof shape. Original Core-specific143-line architecture plus F1/F2 commands19..23 remain fully required. Prior landed CLI40/current Core1644 architecture is history; new different whole review/governed landing must cover this complete proposal before any product authorship. Actual profiles/catalogues/providers/keys/immutable assets/native resources remain unprovisioned.

Core consumes the following WHOLE original F4 amendment with complete original authenticated records/native object/source custody, exact full original raw record equality and complete immutable owner semantics. The shared reader enforces original18-field outer proof and10-field closure, exact11-field launch and13-field inspectionRoute conditional schemas; it cannot accept a missing inspection route on successful library invocation. All six private transfer/copy/ownership refs resolve original raw evidence and both actual archive generations. Returned client data remain charged until independently observed original Node-parent exit; earlier delivered native result is separate from full final control qualification. No new field/opcode, abbreviated proof, source/hash assertion, public private-data tunnel or writer authority is invented.

The whole original Core rules remain: retained MAC replay before stage/confirmation expiry/use, same native-lock winner recheck, complete immutable six-field DECLARED before201, restart-authorized original held stage chunks and full original ZIP/JSON/catalog/provenance/mode/difference validation, no-follow/no-replace complete materialization/discovery, native journal/capsule/selector durability, fixed-ID exact-payload durable Audit/outbox/recovery and ALL CA01..CA08 source/proof/crash/production cases. Native1640 separate NO-GO is unwaived. This is architecture selection/source metadata only, requiring DIFFERENT fresh ENTIRE review before implementation.

The selected full amendment follows verbatim before markup; historical status text is preserved, while this exact prospective pin and required next review govern the new proposal. Literal MDX-safe backticks preserve every original normative byte/value.

F4: complete original library data route amendment (CLI39-HA5-INSPECTION)

Status: complete prospective amendment to the ENTIRE HA1..HA5/native v3/TC01..TC12/scoped publication architecture. Different ENTIRE architecture review and governed landing are required before product authorship. It does not transfer the prior architecture GO to these bytes, provision a host, grant a catalog tuple or qualify a native input. The preceding187-line architecture remains fully required except the exact superseding selections below. F1/F2/F3, original source preservation, complete owner semantics, every publication/Core/operator gate and original failures remain retained.

Confirmed source feasibility gap and scope

Original Template repository service-lasso/service-template, full source commit2b9aa7cd88e83df41a5453a48844f6abe5078492, path template-contract.json, blob51c449dc37ed73c04fb7ad21e127c74522a2131c, raw18891 bytes/SHA256ee2d0f0696c8022d1cc5bca76eec8751acbe3e4fd60415cbb366f4d85eddf69f. Genuine Git blob framing and raw bytes were checked; this is unadmitted source evidence. Its83 inventory rows state381008 content bytes. Complete baseline content is therefore at least399899 bytes including unchanged raw policy, before generated provenance and framing. Neither83 nor this arithmetic is a permanent inventory cap or actual immutable publication identity. Even raw policy alone exceeds the existing16384-byte LAUNCH_PENDING frame. Current src/template.ts declares AcceptedTemplateBundle.files Buffer data and acceptedTemplateFiles returns independent Buffer.from copies; actual scaffold source consumes these copies, and tests/scaffold.test.js directly reads accepted.files bytes. ADR-002 preserves those data APIs. The host proposal's only data response is capped pending inspection; OUTPUT is actual primary stdout/stderr and PUBLIC_RESULT is seven-key metadata. Complete file data cannot arrive through those selected operations. Fail-closed larger-tuple denial is valid failure behavior but cannot satisfy the original complete positive library route.

This amendment selects a private inspection-data transport. It is neither an extra native v3 READ nor a filesystem/path reader in library, facade or service. The original primary still reads exactly the original four held fixed-name assets, verifies independent raw catalog bindings and gives the original SEA those exact copied bytes. SEA alone performs the complete canonical semantic derivation and emits the complete baseline inspection file record. A new frame's digest never supplies tuple/source authority. No output file, catalog fallback, compiler, proxy-primary or qualification observer is introduced.

Protocol/source version and complete four-hop ownership

Host admission protocol/ledger v2 and native primary/SEA READ/PLAN/CLOSE v3 remain unchanged. The launch protocol becomes service-lasso.cli-host-launch.v3, HMAC domain SLCLI-HOST-LAUNCH-3 NUL and profile schema service-lasso.cli-host-profile.v3. The exact previous profile keys remain; launch adds clientCopies with exact maximumBytes8388608,maximumCopySets128,release original-parent-exit. These values are newly selected prospective client policy quotas, not existing native facts or a promise every host can support them. Unsupported source/version/profile rejects before launch, no implicit v2/v3 downgrade. Actual install/source/provider/control/client allocator compatibility and native inputs need a new review/admission; no deployed migration is claimed.

The production service creates and authenticates the original native objects and private inherited inspection endpoints before original primary start release. The matching original primary supplies the SEA endpoint through the already admitted inherited private start transport. This adds a separately authenticated, one-way inspection subchannel on that original inherited transport after its one-use root start record; it does not alter the native v3 greeting/frame/root grammar. SEA-to-primary domain is SLCLI-INSPECTION-SEA-1 NUL, primary-to-service domain SLCLI-INSPECTION-PRIMARY-1 NUL. Both have distinct fresh32-byte capability and32-byte connection nonce delivered only through original admitted inherited handles, with original run/candidate/source/parent/image/peer custody. Neither capability is the host, start, native-v3, observer or writer capability. Service-to-facade data uses the admitted v3 launch channel; facade-to-library uses the original admitted private library-parent transport with distinct domain SLCLI-INSPECTION-LIBRARY-1 NUL/fresh nonce/capability. Library parent custody remains the actual original Node process and admitted package source, not a process name, path or caller hash. Ordinary CLI materialize has no inspection-data transfer. Qualification uses the same production library route.

At each edge a frame is U32BE bodyLength, exact body, B32 HMAC. bodyLength<=16384 checked before body allocation. On the inherited inspection subchannels preimage is that edge's literal domain, direction byte0 producer to consumer, connection nonce32, U32 sequence, U32 bodyLength, original body. Body is U8 operation,U32 sequence plus exact payload. Each inherited inspection subchannel sequence is independent and starts0. Service-to-facade uses direction1 and the existing launch-channel sequence after pending, under SLCLI-HOST-LAUNCH-3; never reuse a capability/nonce or accept a second transfer/reconnect. The service collector is sole owner of the service-side inspection read/forward handles. The original external observer receives classified original object/capture custody and bounded raw private frame readbacks, never a competing reader or substituted source. New handles/IO/references fit the original128-reference binding limit or deny before creating them.

Exact inspection record and frame grammar

Uncompressed complete record is U8 format1,B32 runIdentity,B32 launchNonce,B32 readReceipt,B32 catalogTupleDigest,U32 entryCount followed by ASCII-sorted complete entries (S path,U8 finalMode,U32 byteCount,raw bytes). S is the existing strictUTF8 framing; catalog portable ASCII path grammar/depth/count quotas apply. finalMode is existing0=0644,1=0755. entryCount1..128 is the independently admitted complete dynamic inventory plus unchanged raw policy self-member and generated exact six-field provenance; no fixed75/84 cap. Record length<=768000 and the owning tuple's tighter plan/content/config/manifest/provenance limits are checked before encoding/growth. No archive/descriptor/sums/root/private capability/native handles enter the authored-file record. raw policy remains a project member. Baseline manifest id/name are unchanged; later materialize id/name are independently re-derived from the original native session and cannot be obtained from mutated inspection files. No compression, arbitrary JSON bag, implicit extension or encoding normalization is selected.

catalogTupleDigest is SHA256(SLCLI-INSPECTION-CATALOG-1 NUL || S exact source-owned catalogIdentity || the four ordered native READ record names/U32 lengths/B32 independently admitted raw SHA256 digests). The primary checks this against its original catalog/four raw assets/readReceipt; the library checks against its own independently source-owned catalog entry, not a tuple supplied by BEGIN. inspectionDigest is SHA256(SLCLI-INSPECTION-RECORD-1 NUL || exact entire record). A digest authenticates transported bytes only after the original channels/source/native custody and semantic checks; it is never an admission grant or owner proof substitute.

On the inherited SEA/primary/service/private-library subchannels codes1 BEGIN,2 CHUNK,3 END. BEGIN sequence0 payload B32 runIdentity,B32 launchNonce,B32 readReceipt,B32 catalogTupleDigest,B32 inspectionDigest,U32 recordBytes,U32 entryCount,U32 totalContentBytes. CHUNK sequence1..1024 payload B32 runIdentity,B32 inspectionDigest,U32 offset,U32 chunkBytes,exact chunk bytes. Each chunk is nonempty<=16307 (16384-5-32-32-4-4), offset exactly the next consumed byte, no gap/repeat/overlap/out-of-order, total remaining checked before allocation/copy. END sequence N+1 payload B32 runIdentity,B32 inspectionDigest,U32 recordBytes,U32 entryCount,U32 totalContentBytes. No data after END, early EOF or unknown/trailing bytes. END is available only after producer has authenticated/consumed the complete prior original record, not a digest assertion. One BEGIN/END and N<=1024 chunks; the768000 record bound requires at most48 full chunks, not a requirement to use full chunks. Intermediate hop may repartition original record bytes under its own authenticated frames; complete record byte equality, ordered offsets, source/run/read/catalog binding and full private original frames are independently checked. No parse/reserialize equality substitutes for original record equality.

The v3 launch channel retains operation1 LAUNCH,2 LAUNCH_PENDING,3 LIBRARY_ACTION,4 OUTPUT,5 PUBLIC_RESULT and adds6 INSPECTION_BEGIN,7 INSPECTION_CHUNK,8 INSPECTION_END with these exact payloads. Every frame still<=16384 and every admitted profile maximum applies. LAUNCH_PENDING sequence0 success is B32 runIdentity,B32 remoteToken,B32 inspectionDigest,U32 recordBytes,U32 entryCount,U32 totalContentBytes, with NO inline inspection bytes; failure remains closed host code. Pending binds the announced stream but is not a returned loader object or terminal success. INSPECTION_BEGIN is next sequence, its matching run/digest must equal pending; all inspection chunks/END precede any OUTPUT and use the service's one monotonic sequence space. OUTPUT still contains only actual original stdout/stderr, never file records, roots, raw proof, capabilities or an inspection tunnel. PUBLIC_RESULT remains the exact seven-key compact metadata/status grammar and occurs only after the original final action and F1 FREE/archive-before-ACK. Total service response frames after pending, including BEGIN/chunks/END and OUTPUT,<=1024; PUBLIC_RESULT is final sequence<=1025. Each inherited edge has its own separate<=1024 chunk cap. Nothing silently widens native v3 codes/caps, host observation limits or original stricter deadlines.

Original API, local copy accounting and actual closure

Keep exact existing loader/acceptedTemplateFiles/materialize signatures and mutable Buffer data compatibility. load is async; it returns only after complete END, original record/hash/count/mode/source equality and full held semantic validation. It returns a bounded immutable metadata inspection with independent mutable Buffer data plus private WeakMap association to the same live remote session; its files cannot grant authority. acceptedTemplateFiles remains Promise<Array<{path,bytes:Buffer,mode:number}>> and obtains complete independent copies from a source-owned private verified local snapshot, never caller-mutated bundle.files. Its copying is local; no new request/async IPC/filesystem fallback is added to this API. Current source has no cloneFiles export/function; a future internal synchronous copy helper must use the same source-owned budget reservation BEFORE Buffer allocation, never introduce a new public signature or fake native receipt. Clones/deserialization/foreign loader objects reject with invalid_template_bundle. Mutating public inspection cannot alter retained bytes/remote materialization. acceptedTemplateFiles calls do not consume the action token, but expired/used/closed/child-exited sessions reject template_session_unavailable; previously returned independent Buffers remain ordinary data and are not erased on CLOSE. Dispose/fullpreview/materialize consumes the same token once. Invalid id/name/destination and native safe error identities retain ADR mappings; capacity exhausted copy returns template_session_unavailable, consumes the association and takes the normal safe cancellation/retention path. No new outward code or raw diagnostic is invented.

An explicit new client-copy reservation of8388608 bytes per library binding, at most16 host bindings, covers all source-owned library/facade record assembly, immutable verified snapshot, public bundle Buffer copies, EACH repeated acceptedTemplateFiles copy set, paths/metadata/token tables/framing/UTF8/allocator overhead. Reserve the worst-case client quota before launch against finite independently admitted client capacity; client total reservation<=16*8388608, and actual source-owned cumulative allocation cannot exceed the individual quota. Copy-set count<=128 includes initial public bundle.files and every exported/internal data-copy set. Source-owned local synchronous allocator reserves complete prospective bytes+measured overhead before any allocation; multi-entry reserve is all-or-deny. No runtime flag/caller number/digest/GC event approves allocation or releases charge. Original source/package-instance and original authenticated Node-parent association must be checked; repeated package instances/new bindings still consume host control/client capacity. Instrumentation records each actual complete copy set, cumulative bytes and source membership in bounded private client records; independent original process/source/peak observations remain required before positive qualification. Client records/counters alone do not establish native custody or allocator sufficiency.

The8388608 value is a policy selection: existing record ceiling768000 plus several complete<=468462 content copies and framed metadata leaves headroom for the currently evidenced complete tuple, but that arithmetic does not prove JS/native overhead. At least private snapshot+public bundle data+first acceptedTemplateFiles copy must fit, and all forwarding/serialization copies count at their actual owning component. Independently measured source-owned worst-case physical overhead and process peak must meet the selected quota; otherwise deny/unqualified before allocation. Larger tuples/repeated copies may exhaust early without truncation or partial return. Ended private scratch may release only with actual source/native ended ownership proof; already returned client Buffers are conservatively charged until the authenticated original Node parent actually exits. Caller promises, dereference, finalizers or GC do not prove absence of another Buffer reference. The initial client reservation remains until that original exit even after native session FREE. This is a bounded availability tradeoff, not a promise that every arbitrary caller heap is governed. Unrelated user allocations/copies outside the source-owned API are not authoring capabilities or falsely claimed controlled memory.

Primary/SEA copies, record construction and active IO remain within their existing8388608/session cap and tighter768000/owner limits. Service only streams bounded frames: at most one inbound plus one outbound16384-byte body per active library binding, plus bounded existing MAC/request/control records, charged before growth against the unchanged aggregate1048576 service-control ceiling. It never assembles/semantically parses the full record. Facade/library memory belongs to the explicit client reservation, not hidden service memory or released native allowance. Each original frame raw capture and full record/private source/copy evidence consumes separately pre-reserved retention capacity before launch; no unbounded spill, alias-as-free-copy or capture truncation. Host4-user16-session/16-control/128-reference/store4194304/90-day retention remain unchanged;128MiB client-reservation maximum does not mean service/control/retention can accept sixteen maximal transfers at once. Exhaustion denies before creating resources. Original deadlines10/10/10/20 and absolute40s or stricter include all hops/derivation/pending consumer; no reset at BEGIN/READ/action and no retries.

Native CLOSE_INTENT/FREE requires actual closure of original primary/SEA/native inspection IO/private native buffers and writer if born, independent natural-zero/streamEOF, exactly as F1. Returned library-owned data is classified external client-control memory; it is not omitted live primary memory or writer authority. Client Node parent original process observation and copy reservation remain in charged control records after successful PUBLIC_RESULT/facade exit/native FREE. Complete final control closure/qualification requires actual original Node-parent exit and complete client/transport/control evidence; a live Node parent cannot be labelled closed because the facade exited or method returned. Original returned Buffers may be used after materialization as ordinary data; never invalidated/zeroed/deleted to fake closure. Lost parent/collector/EOF/raw copy record/service restart retains the original binding/client reservation; restart cannot reconstruct handles or infer ended memory. Native success delivered earlier remains a product result, while complete qualification remains blocked until final control closure record is retained. This extends the already selected separate final control/archive generation; no PUBLIC_RESULT/future-record self digest or dead-primary reply.

Exact closed shared proof and whole source reader reconciliation

Native proof outer18 keys and closure10 keys remain unchanged. closure.launch exact keys become requestRef,inputRouteRef,inspectionRouteRef,clientIdentityRef,sourceTupleRef,observerBirthRef,primaryBirthRef,streamBindingRef,prebindRef,resultDeliveryRef,outcome. inspectionRouteRef is null only non-library invocations or unobserved failure. Library success requires nonnull full original route; materialize-only/no-transfer success requires null with the independently decoded original LAUNCH mode proving applicability. All other launch success refs remain required. Core must implement this exact conditional closed shape and verify applicability from original frames, never accept absence on a library route or an arbitrary extension.

inspectionRouteRef resolves exact closed private keys runIdentity,readReceipt,catalogIdentity,recordDigest,entryCount,totalBytes,seaRecordRef,primaryForwardRef,serviceForwardRef,facadeReceiveRef,libraryCopiesRef,ownershipRef,outcome. Types: runIdentity/readReceipt/recordDigest lowercase64; catalogIdentity exact independently admitted source side data<=256 UTF8/no controls; entryCount1..128,totalBytes nonnegative safe integer within source/owner quotas; six Ref keys resolve original rawEvidence names; outcome success/failure/blocked. Same shape with null unobserved fields on failure, never missing keys. Success requires all values nonnull, every original source/run/catalog/READ/record count/total/entry/path/mode/content binding, original raw four-asset observations and full immutable owner semantics. seaRecordRef includes original authenticated source-SEA BEGIN/chunks/END and exact complete record; primaryForwardRef/serviceForwardRef/facadeReceiveRef include each original authenticated channel frame and original object custody; libraryCopiesRef binds complete actual bounded source-owned copy-set records and private local snapshot byte/hash/mode equality, never caller assertion. ownershipRef binds pre-growth quota reservation, all original handles/buffers/copies/IO/control/retention and actual closure or truthful retained original Node-parent observation. No new kernel observer operation enum is introduced; existing original identity/read/write/EOF/close/exit/source-native observations plus independently admitted source allocator/peak accounting are required.

Initial observer archive before terminal ACK includes immutable original inspection transfer/source/raw assets/native closure and copy reservations/issued-copy records through consumed final action. Later original client parent exit and complete final control disposition are retained in the separately pre-reserved final control record; ownershipRef binds both exact original generations via the complete final proof manifest. Initial archive cannot contain/hash future exit/result bytes. A missing final record blocks full proof even if prior PUBLIC_RESULT success was delivered. The complete manifest/provider original ZIP/consumed proof bodies retain original bytes and exact source/attempt/policy bindings. No inspection record/root/record digest/client identity/copy evidence enters public T1/T2/R3/HTTP/Audit/OUTPUT or writer input. The writer still receives the original complete final PLAN entries under native v3, without inspection/control authority. Returned inspection files are authenticated local API data only.

This author changes CLI docs only. Parent relays the complete amended launch/inspection reader grammar and eventual full source commit/blob/raw SHA to a separately owned Core entire amendment. Current Core1644/CLI40 architecture remains preserved history. Different ENTIRE coordinated architecture review/normal develop landing must precede product source; later different ENTIRE product review plus NEW complete-input ROOT must precede any product execution. No guessed source/image/profile/catalog/provider grants or narrower proof route.

Complete positives, denial/crash and retained independent gates

Original full Windows/Linux positive ordinary materialize, exported loader→actual accepted.files and multiple acceptedTemplateFiles copies→materialize, baseline/explicit id/name, scaffold/fullpreview/dispose, original absolute/nonASCII/spaced/relative roots and two original four-byte-identical input directories remain required. Add full original policy>16KiB and full dynamic inventory transfer, one file spanning multiple chunks, zero-length entry, both final modes and all generated/unchanged members, mutation of public Buffer data while source-private copy/materialization remain faithful, repeated copy quota reservation, and use of returned data after native CLOSE while control correctly remains charged until original parent exit. All TC01..TC12 continue to require owner-shaped real original published tuple/native production route, not repacked/short fixture positives. Current source tuple is not admitted.

Add fixed negative IDs inspection-missing-begin,inspection-duplicate-begin,inspection-sequence,inspection-offset,inspection-empty-chunk,inspection-chunk-cap,inspection-total-cap,inspection-count,inspection-end-missing,inspection-early-eof,inspection-trailing,inspection-record-digest,inspection-read-receipt,inspection-catalog-source,inspection-source-peer,inspection-run,inspection-mode,inspection-member-hash,inspection-inventory,inspection-source-changed,inspection-client-copy-quota,inspection-client-copy-partial,inspection-parent-exit,inspection-parent-unobserved,inspection-copy-record-missing,inspection-control-capacity,inspection-retention-capacity,inspection-timeout,inspection-cancel,inspection-channel-loss,inspection-service-crash,inspection-private-leak. These append to every original fixed negative ID; none replaces/weakens it. Authenticated malformed data closes with existing confined_writer_invalid_plan or protocol_rejected for unauthenticated grammar; host capacity/IO failures retain closed HA3 codes, local expired/copy-capacity association uses existing template_session_unavailable. Absent source admission remains template_identity_unavailable; wrong raw/semantic tuple remains invalid_template_bundle under the existing boundary, never transport granted. Each case must independently prove no unauthorized write/input change, original source custody, complete channel/copy/IO/parent closure or retained charges, no partial returned bundle/copy set, privacy, original deadlines and no retry/new primary. Crash between frames/native CLOSE/archive ACK/PUBLIC_RESULT/client exit/final control archive keeps original evidence/capacity and cannot relabel failure or recreate objects. Inspection transfer creates no writer; later final one-use action is original native semantic path.

All original native1640 D1/D4/D8 fixture NO-GO, original Core CA01..CA08/F7/released compatible pin, source-owned producer/catalog, Template first immutable four-asset publication, scoped protected2/portable2 Windows/Linux native TAR6/7/8/source/protection/original-provider-ZIP checks, legacy Darwin retention, Core staged-service/outer Windows ZIP, TUI five actions/same published bytes and separately authorised runtime/operator acceptance remain independent/unmet. F4 proposal neither repairs nor substitutes those gates. Whole delivery remains incomplete.