# Cohesix Build Plan (ARM64, Pure Rust Userspace) This is the normative milestone scope and status ledger. Work follows declared dependencies and the release sequence below. Historical results retain their original source and target limits; current claims require the applicable milestone and [benchmark evidence](BENCHMARKS.md). Runtime contracts live in [ARCHITECTURE.md](ARCHITECTURE.md), [INTERFACES.md](INTERFACES.md), and the focused documents linked from `README.md`. Selected manifests, resolved outputs, and `coh-rtc` artifacts define as-built configuration. - **Host:** macOS 26 on Apple Silicon. - **Targets:** QEMU `aarch64/virt` with GICv3; Raspberry Pi 4 via firmware → U-Boot → seL4 binary image. - **Userspace:** pure Rust; Queen/Worker control uses bounded namespaces and console operations, with no ad-hoc host RPC authority. - **Reference AI host:** NVIDIA Jetson Orin Nano. AI runtimes and GPU tools run host-side, using configurable NVMe paths for models, data, caches and evidence. A **shard** is a manifest-derived Worker namespace bucket. Telemetry uses `/shard//worker//telemetry`; the legacy `/worker//telemetry` alias requires `sharding.legacy_worker_alias = true`. ## seL4 Reference Manual Alignment (v16.0.0) The [seL4 v16.0.0 manual](https://sel4.systems/Info/Docs/seL4-manual-16.0.0.pdf) governs kernel semantics. The selected external seL4 build, headers and metadata define enabled options, object layouts and APIs. Check each kernel interaction against both. Manual availability, configured support, implementation and target proof are distinct; Cohesix protocols, device behavior and build rules remain owned by their specific contracts. --- ## Milestones ## | Milestone | Description | Status | |----------|-------------|------| | [0](#0) | Repository Skeleton & Toolchain | Complete | | [1](#1) | Boot Banner, Timer, & First IPC | Complete | | [2](#2) | NineDoor Minimal 9P | Complete | | [3](#3) | Queen/Worker MVP with Roles | Complete | | [4](#4) | Bind & Mount Namespaces | Complete | | [5](#5) | Hardening & Test Automation (ongoing) | Complete | | [6](#6) | GPU Worker Integration | Complete | | [6a](#6a) | GPU Model Lifecycle & Telemetry Semantics (LoRA-ready) | Complete | | [7a](#7a) | Root-Task Event Pump & Authenticated Kernel Entry | Complete | | [7b](#7b) | Standalone Console & Networking (QEMU-first) | Complete | | [7c](#7c) | TCP transport parity while retaining existing flows | Complete | | [7d](#7d) | ACK/ERR broadcast is implemented across serial and TCP | Complete | | [7e](#7e) | TraceFS (JSONL Synthetic Filesystem) | Complete | | [8a](#8a) | Lightweight Hardware Abstraction Layer | Complete | | [8b](#8b) | Root-Task Compiler & Deterministic Profiles | Complete | | [8c](#8c) | Cache-Safe DMA via AArch64 VSpace Calls | Complete | | [8d](#8d) | In-Session `test` Command + Preinstalled `.coh` Regression Scripts | Complete | | [9](#9) | Secure9P Pipelining & Batching | Complete | | [10](#10) | Telemetry Rings & Cursor Resumption | Complete | | [11](#11) | Host Sidecar Bridge & /host Namespace (Ecosystem Coexistence) | Complete | | [12](#12) | PolicyFS & Approval Gates | Complete | | [13](#13) | AuditFS & ReplayFS | Complete | | [14](#14) | Sharded Namespaces & Provider Split | Complete | | [15](#15) | Client Concurrency & Session Pooling | Complete | | [16](#16) | Observability via Files (No New Protocols) | Complete | | [17](#17) | Content-Addressed Updates (CAS) — 9P-first | Complete | | [18](#18) | Field Bus & Low-Bandwidth Sidecars (Host/Worker Pattern) | Complete | | [19](#19) | `cohsh-core` Extraction (Shared Grammar & Transport) | Complete | | [20a](#20a) | `cohsh` as 9P Client Library | Complete | | [20b](#20b) | NineDoor UI Providers | Complete | | [20c](#20c) | SwarmUI Desktop (Tauri, Pure 9P/TCP) | Complete | | [20d](#20d) | SwarmUI Live Hive Rendering (PixiJS, GPU-First) | Complete | | [20e](#20e) | CLI/UI Convergence Tests | Complete | | [20f](#20f) | UI Security Hardening (Tickets & Quotas) | Complete | | [20f1](#20f1) | SwarmUI Host Tool Packaging + Tauri API Fix | Complete | | [20g](#20g) | Deterministic Snapshot & Replay (UI Testing) | Complete | | [20h](#20h) | Alpha Release Gate: As-Built Verification, Live Hive Demo, SwarmUI Replay, & Release Bundle | Complete | | [21a](#21a) | Telemetry Ingest with OS-Named Segments (Severely Limited Create) | Complete | | [21b](#21b) | Host Bridges (coh mount, coh gpu, coh telemetry pull) | Complete | | [21c](#21c) | SwarmUI Interactive cohsh Terminal (Full Prompt UX) | Complete | | [21d](#21d) | Deterministic Node Lifecycle & Operator Control | Complete | | [21e](#21e) | Rooted Authority, Cut Detection, Explicit Session Semantics, and Live Hive Visibility | Complete | | [22](#22) | Runtime Convenience (coh run) + GPU Job Breadcrumbs | Complete | | [23](#23) | PEFT/LoRA Lifecycle Glue (coh peft) | Complete | | [24](#24) | Python Client + Examples (cohesix) + Doctor + Release Cut | Complete | | [24b](#24b) | Live GPU Bridge Wiring + PEFT Live Flow + Live Hive Telemetry Text | Complete | | [24b1](#24b1) | Live Hive UX Patch: Performance, Labels, Clickability, Telemetry Harness | Complete | | [24c](#24c) | Authoritative Scheduling Grammar + REST Gateway + Scheduler/Lease Observability | Complete | | [24d](#24d) | Jetson CUDA Host Support (NVML Fallback + Doctor) | Complete | | [24e](#24e) | REST Multiplexer Transports + SwarmUI Gateway Mode | Complete | | [25](#25) | SMP Utilization via Task Isolation (Multicore without Multithreading) | Complete | | [25a](#25a) | REST Live Hive Performance (Parallel Polling + Batching) | Complete | | [25b](#25b) | Secure Scale Gateway (1k Worker Readiness + Due Diligence Closure) | Complete | | [25c](#25c) | Python Orchestration SDK (1k Fleet Playbooks + Host Integrations) | Complete | | [25d](#25d) | REST Request-Auth Parity Across Host Tools (Gateway Capability Max) | Complete | | [25e](#25e) | Evidence Packs + Integration Kits (Audit-First Adoption) | Complete | | [25f](#25f) | Gateway Broker Refactor + Large Telemetry Reference Manifests (No-Retry Reliability Gate) | Complete | | [25g](#25g) | Host Control Tickets via FUSE (GPU/PEFT + systemd/docker + K8s Coexistence) | Complete | | [25h](#25h) | Multi-Hive Federation via Ticket Relay (Single-Writer Preserved, 10x1k Fleet Pattern) | Complete | | [26](#26) | Official Pi 4 Bring-up (U-Boot + Binary Image) | Complete | | [26a](#26a) | Pi 4 Driver-Task Substrate + GENET/Serial/Display Isolation | Complete | | [26b](#26b) | Pi 4 USB/Wi-Fi Driver Tasks + DHCP/Benchmark Concurrency | Complete | | [26c](#26c) | Regression-Gated Refactor + Surface Audit (Zero-Regression) | Complete | | [26d](#26d) | seL4 16 Baseline Refresh + Reference/Performance Realignment | Complete | | [26e](#26e) | Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation | Complete | | [27](#27) | Operator Utilities: Inspect, Trace, Bundle, Diff, Attest | Complete — owner-approved evidence; 1.1.0-beta (Release A) | | [27a](#27a) | Authority Hardening: Delegated REST Identity, Fenced Failover, Idempotent Queen Intents | Next — 1.1.0-beta (Release A) authority floor | | [27b](#27b) | Host Integration Registry + Provider/Executor + Use-Case Conformance | Next — 1.1.0-beta (Release A) Jetson/Linux reference slice | | [27c](#27c) | Persistent Semantic Object Fabric + Context Capsules (Host-Side) | Next — 1.1.0-beta (Release A) capsule core; full graph conditional | | [27d](#27d) | Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT | Next — 1.1.0-beta (Release A) flagship workflow | | [27e](#27e) | Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) | Next — 1.1.0-beta (Release A) flagship boundary | | [27f](#27f) | SwarmUI Community Showcase: Spectrum Workbench + Live AI Hive | Next — 1.1.0-beta (Release A) flagship experience | | [28](#28) | Formal Verification Baseline + Proof-Carrying Manifests | Staged — core in 1.2.0-beta (Release B); extended proofs conditional | | [28a](#28a) | Machine-Checked Intent Admission + Decision-Bound Authority | 1.2.0-beta (Release B) — consequential actions | | [28b](#28b) | Production Worker Ticket/Lease Binding + Driver Inventory Projection + Structured Fault Lifecycle | 1.2.0-beta (Release B) — production assurance gate | | [28c](#28c) | MCP/A2A Gateway Projection: Read-Only First, Ticketed Writes Later | 1.2.0-beta (Release B) — MCP first; A2A demand-gated | | [29](#29) | Bounded VM-Local Persistence: Spool Stores + Settings | Conditional — 1.3.0-beta (Release C) edge-depth track | | [29a](#29a) | Core-Local Service-Turn Scheduling (SMP Hot-Path Optimization) | Conditional — activate only for an accepted SLO miss | | [29b](#29b) | Operator-Lane Scheduler + Multi-Surface Responsiveness | Conditional — activate only for an accepted responsiveness miss | | [30](#30) | Edge Local Status (Pi 4 Host Tool) | Conditional — shared core folds into 27 | | [30a](#30a) | Pi 4 Root-Shell Hardware Status (`hw-status`) | Deferred — field-demand gate | | [30b](#30b) | AI-Native Namespace Surfaces (Control-Plane Only) | Deferred — adoption-demand gate | | [31](#31) | AWS AMI (UEFI → Cohesix, ENA, Diskless 9door) | Parked — funded feasibility gate only | --- ## Post-26e Investment-Constrained Delivery Sequence Prioritize complete user journeys, a polished demonstration and reusable seL4 work within the maintainer budget. Milestone IDs stay fixed; the release slices below govern activation and blockers. Artifacts and release notes use `Cohesix--beta-`: **A = 1.1.0-beta**, **B = 1.2.0-beta**, **C = 1.3.0-beta**. These versions cannot be silently reassigned. ### Release 1.1.0-beta (A) — Show the Product Deliver one reproducible QEMU/Pi + Jetson journey, presented through SwarmUI: ```text install -> doctor -> connect -> infer -> observe/stream -> cancel or resume -> PEFT train/evaluate -> canary -> activate or rollback -> inspect -> evidence case -> replay in SwarmUI ``` Required slices: **27** operator evidence tools; **27a** delegated identity, idempotency, durable recovery, secrets, audit/replay and selected-profile single-writer safety; **27b** generated integration contracts and installable Jetson/Linux reference conformance; **27c core** immutable references, visibility/provenance, bounded spans, deterministic Context Capsules and render receipts; **27d/27e** inference and PEFT run/checkpoint/artifact lifecycles, including evaluate/scan/register/canary/activate/rollback and authoritative receipts; **27f showcase** Spectrum shell, truthful Live AI Hive, GPU/model/run views, evidence, replay and community demo assets. Use real external execution and configurable NVMe storage. Every VM claim needs accepted 26e evidence for its target. Other surfaces remain explicitly `unavailable`, `mock`, `dry_run` or `live`; host GPU work is never in-VM execution. Broad provider coverage, semantic AST/CFG/ownership/history graphs and unshipped HA/federation profiles do not block A. ### Release 1.2.0-beta (B) — Prove the Control Boundary Deliver **28 core** claim registers, generated witnesses, Secure9P bounds, HAL/resource checks and restricted policy IR; **28a** exact intent-to-authority admission for GPU leases, PEFT/model promotion or rollback and selected service controls; **28b** production Worker ticket/lease binding and deterministic fault/revoke/quarantine/replay evidence where claimed; **28c MCP phase 1** read-only resources and a small set of accepted ticketed tools; and the **27f** governed-workflow view. A2A requires a concrete use case that existing run/task and MCP surfaces cannot satisfy. ### Release 1.3.0-beta (C) — Deepen the Edge and Contribute Reusable seL4 Work Select only evidence-backed needs: **29** minimal profile-qualified persistence (Pi EMMC2 only for an enabled Pi profile); extended **28** verification tied to a named assurance claim; **29a/29b** for an accepted same-harness SLO miss that smaller fixes cannot close; and **30/30a** for a demonstrated field workflow. Extract reusable Rust, Microkit/sDDF-aligned driver, capability-witness, containment, restart and reproducible-evidence contributions from accepted work. ### Demand-Gated and Parked Work The full **27b** provider catalogue, **27c** semantic graph, A2A and enterprise **27f** desks require a named use case and maintainer budget. **30b** stays deferred until existing CLI/Python/OpenAI-compatible/MCP workflows demonstrate a need. **31** is outside committed releases: funded demand and written AWS Arm custom-OS supportability confirmation may authorize its feasibility gate only; ENA, TLS/HTTP, IMDS and AMI implementation wait for that gate. ### Release-Scope Rules Release A uses accepted 26e surfaces without waiting for 28 or conditional 29/29a/29b. Missing persistence, proof, scheduling, attestation and hardware evidence stay explicit. No schema, test, package, UI or document may turn an inactive milestone into a hidden prerequisite. Support only the provider, target and use-case rows needed by accepted walkthroughs; catalogue breadth alone is not progress. Keep replay, fixture, simulation, host, QEMU, Pi and live-provider evidence distinct in all tools and public materials. Passing a release gate authorizes only that release's reserved version. --- ## Milestone 0 — Repository Skeleton & Toolchain [Milestones](#Milestones) **Status:** Complete — the repository/workspace scaffolding, build scripts, size guard, bounded `m0-rust-1-97-1-security-refresh` task, bounded `m0-rust-current-stable-dependency-refresh` task, and bounded `m0-toml-1-1-4-maintenance` closure are complete. The exact Rust 1.97.1 host gate remains green; target-qualified later stages remain separately gated. **Deliverables** - Cargo workspace initialised with crates for `root-task`, `nine-door`, and `worker-heart` plus shared utility crates. - `toolchain/setup_macos_arm64.sh` script checking for Homebrew dependencies, rustup, and QEMU - and installing if absent. - `scripts/qemu-run.sh` that boots seL4 with externally built `elfloader`, `kernel.elf`, also creates and uses `rootfs.cpio`. - QEMU launchers auto-select host acceleration (`hvf` on macOS, `kvm` on Linux when `/dev/kvm` is accessible), with `COHESIX_QEMU_ACCEL`/`QEMU_ACCEL` overrides and fallback to `tcg`. - `scripts/ci/size_guard.sh` enforcing < 4 MiB CPIO payload. - Repository tree matches `docs/REPO_LAYOUT.md`, and architecture notes from `docs/ARCHITECTURE.md §1-§3` are captured in crate READMEs or module docs to prevent drift. **Checks** - `cargo check` succeeds for the workspace. - `qemu-system-aarch64 --version` reports the expected binary. - QEMU launchers log the selected accelerator and pass `-accel` with host-appropriate defaults or explicit overrides. - `scripts/ci/size_guard.sh out/rootfs.cpio` rejects oversized archives. ``` Title/ID: m0-rust-1-97-1-security-refresh Milestone: Milestone 0 — Repository Skeleton & Toolchain / Rust 1.97.1 security refresh Goal: Replace the superseded Rust 1.93.1 baseline with exact stable Rust 1.97.1 while preserving the existing host and `aarch64-unknown-none` build contracts. Inputs: rust-toolchain.toml, Cargo.toml, Cargo.lock, .github/workflows/ci.yml, toolchain/setup_macos_arm64.sh, toolchain/setup_linux_arm64.sh, scripts/ci/rust_risk_gate.sh, scripts/ci/test_rust_risk_gate.py, docs/TOOLCHAIN_MAC_ARM64.md, staged Test Plan gates. Changes: - rust-toolchain.toml + setup scripts + CI — select exact Rust 1.97.1 with deterministic minimal-profile installation plus the declared rustfmt, clippy, and aarch64-unknown-none closure. - scripts/ci/rust_risk_gate.sh + focused tests — bind risk scanning to the exact named Rust 1.97.1 toolchain and refreshed bootstrap-file digest. - docs/TOOLCHAIN_MAC_ARM64.md — describe the refreshed as-built Rust contract. Commands: - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo test --workspace -- --test-threads=1 - cargo test -p rust-risk-audit - python3 scripts/ci/test_rust_risk_gate.py - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml - cargo audit - cargo deny check advisories - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m0-rust-1-97-1-qemu - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m0-rust-1-97-1-pi4 - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m0-rust-1-97-1-pi4 Checks: the exact compiler, Cargo, rustfmt, Clippy, host standard library, and aarch64-unknown-none standard library resolve from Rust 1.97.1; all mandatory repository gates pass without product, protocol, authority, generated-artifact, or evidence-tier drift. Deliverables: synchronized exact toolchain pins and documentation plus host and bare-metal compile, lint, test, dependency, generated-artifact, risk-ratchet, and staged Test Plan evidence. ``` ``` Title/ID: m0-rust-current-stable-dependency-refresh Milestone: Milestone 0 — Repository Skeleton & Toolchain / Current stable Rust dependency refresh Goal: Move every crates.io dependency to its current stable, maintained release while preserving Cohesix protocol, authority, no_std, target, and evidence contracts. Inputs: Cargo.toml, Cargo.lock, all workspace Cargo.toml files, host and no_std Rust sources/tests, RustSec advisories, crates.io release metadata, and staged Test Plan gates. Changes: - Cargo manifests + Cargo.lock — refresh compatible dependencies, migrate direct breaking releases, and remove or replace unmaintained dependency lanes. - host and no_std Rust sources/tests — adapt only the APIs required by the dependency migrations without changing Cohesix behavior, protocol, authority, or generated interfaces. - docs/BUILD_PLAN.md + dependency-policy evidence — record exact scope, validation, intentional retained exceptions if any, and the final dependency frontier. Commands: - cargo update - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - cargo test --workspace -- --test-threads=1 - cargo audit - cargo deny check advisories - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m0-rust-current-stable-dependencies-qemu Checks: every direct crates.io dependency resolves to its current stable maintained release or has a documented target/contract blocker; the resolved graph has no unaddressed advisory regression; all mandatory repository gates pass without product, protocol, authority, no_std, generated-artifact, or evidence-tier drift. Deliverables: synchronized manifests and lockfile, required API migrations and tests, dependency/advisory evidence, generated-artifact verification, and staged Test Plan evidence. ``` ``` Title/ID: m0-toml-1-1-4-maintenance Milestone: Reopened Milestone 0 — Repository Skeleton & Toolchain / Current stable Rust dependency refresh Goal: Qualify the TOML 1.1.4 patch refresh and close the generated-policy hash embedding drift exposed by its focused regression run without changing Cohesix behavior. Inputs: Cargo.lock, the six direct TOML consumer manifests, exact Rust 1.97.1, coh-rtc generated policy/default artifacts, docs/USERLAND_AND_CLI.md, and dependency-policy checks. Changes: - Cargo manifests + Cargo.lock — advance the six direct TOML consumers from 1.1.3 to 1.1.4 and retain the resolver-selected compatible transitive graph. - docs/USERLAND_AND_CLI.md — restore the two embedded generated hashes to the authoritative coh-rtc snippets; do not change policy/default semantics. - docs/BUILD_PLAN.md — record the bounded maintenance scope, exact resolved graph, and validation evidence. Commands: - rustup show active-toolchain - cargo metadata --locked --no-deps --format-version 1 - cargo fmt --all -- --check - cargo check --locked -p coh -p cohsh -p swarmui -p coh-rtc -p rust-risk-audit -p security-nist - cargo test --locked -p coh -p cohsh -p swarmui -p coh-rtc -p rust-risk-audit -p security-nist - cargo clippy --locked -p coh -p cohsh -p swarmui -p coh-rtc -p rust-risk-audit -p security-nist --all-targets -- -D warnings - python3 scripts/ci/check_swarmui_dependencies.py - cargo audit - cargo deny check advisories - scripts/check-generated.sh Checks: all six affected packages compile and test under exact Rust 1.97.1; dependency/advisory policy remains green; generated artifacts and their embedded documentation blocks agree byte-for-byte. Deliverables: synchronized manifests, lockfile, generated-doc embedding, and bounded validation evidence with Milestone 0 returned to Complete. ``` ``` Title/ID: m0-host-setup-parity-repair Milestone: Reopened Milestone 0 — Repository Skeleton & Toolchain / macOS and Ubuntu ARM64 host setup parity repair Goal: Make one canonical setup command provision each supported host-build lane and a shared repository Python environment without overstating Linux target acceptance. Inputs: toolchain/setup_macos_arm64.sh, toolchain/setup_linux_arm64.sh, scripts/setup_environment.sh, configs/test-plan-python-requirements.lock, tools/cohesix-py/pyproject.toml, README.md, docs/QUICKSTART.md, docs/TOOLCHAIN_MAC_ARM64.md, docs/PYTHON_SUPPORT.md, release inventory, and host setup tests. Changes: - toolchain/setup_macos_arm64.sh — enforce macOS 26+, Apple Silicon, Xcode Command Line Tools, ripgrep, and HVF prerequisites before completing the existing pinned seL4 host setup. - toolchain/setup_linux_arm64.sh — enforce Ubuntu 22.04/24.04/26.04 ARM64, install the correct QEMU ARM system package and complete host-tool build dependencies, select Python 3.11+ per LTS, and verify diagnostic TCG. - toolchain/setup_repo_venv.sh — create the non-symlinked repository `.venv` from the hash-locked host-test closure and install `tools/cohesix-py` editable without optional integration or ML dependencies. - scripts/setup_environment.sh — keep the release-bundle path runtime-only, correct Ubuntu QEMU/GTK package selection, support the three ARM64 LTS releases, enable Universe only when installation is needed, fail closed on incompatible hosts, verify HVF or TCG, and install the exact bundled Python wheel into a protected `.venv` without conflating runtime readiness with target acceptance. - README.md + docs/QUICKSTART.md + docs/TOOLCHAIN_MAC_ARM64.md + docs/PYTHON_SUPPORT.md — project one-command setup for each OS and retain the distinct macOS construction, Linux diagnostic-QEMU, and target-acceptance boundaries. - tests/test_toolchain_setup.py + scripts/ci/check_test_plan.sh — guard platform, package, Python, documentation, and shell-syntax contracts. The complete host-tool suite, `tools/cohesix-py`, and performance benchmark scripts were reviewed; only Python environment installation is affected, with no protocol, benchmark workload, or report-schema change. Commands: - bash -n toolchain/setup_macos_arm64.sh toolchain/setup_linux_arm64.sh toolchain/setup_repo_venv.sh - scripts/setup_environment.sh --check - .venv/bin/python -m pytest -q tests/test_toolchain_setup.py - scripts/check-generated.sh - scripts/ci/check_test_plan.sh Checks: both installers reject hosts outside their exact support envelope before mutation, expose help without platform preflight, install the shared locked `.venv` by default, and preserve separate full-construction, diagnostic-QEMU, and acceptance claims; focused tests and repository consistency gates pass. Deliverables: corrected canonical host installers, a shared repository Python bootstrap, simplified macOS/Linux quickstart documentation, and deterministic regression coverage with Milestone 0 returned to Complete. ``` **M0 dependency-refresh evidence (2026-07-28)** - All 47 direct crates.io dependencies resolve to their current stable releases. Required breaking migrations cover AES, Axum, Base64, CBOR, Ed25519/signature, FUSE, libloading, NVML, Rand, SHA-2, smoltcp, spin, syn, Tauri, TOML, and ureq. - `cargo update --dry-run -v` reports no further resolvable updates. Five transitive packages remain intentionally constrained by the current direct parents: `generic-array 0.14.7` through Tauri's SHA-2 0.10 graph, `matchit 0.8.4` through Axum 0.8.9, and `toml 0.8.2`, `toml_datetime 0.6.3`, and `toml_edit 0.20.2` through Tauri's GTK3 build graph. Forcing the advertised newer versions fails the upstream exact-version requirements; no local patch or duplicate authority lane is introduced. - `cargo audit` reports no vulnerability failure. Its 17 allowed warnings are the existing unmaintained/unsound GTK3 and `urlpattern` transitive graph retained by current Tauri; `cargo deny check advisories` passes. The obsolete serde_cbor and FUSE advisory exceptions are removed. - Formatting, workspace Clippy with warnings denied, workspace/all-target compilation, FUSE/NVML/Tauri optional compilation, QEMU root-task compilation, the `aarch64-unknown-none` Pi runtime compilation, generated artifact checks, 706 Pi runtime tests, and every dependency-migration test pass. - `cargo test --workspace --no-fail-fast` passes under exact Rust 1.97.1. The stale serial-flood fairness assertion now matches the already-established independent serial/local-seat partial-line contract; no runtime behavior or operator grammar changed. - The QEMU release-feature library matrix also passes under Rust 1.97.1 after its fixtures were aligned with the single-attempt supervisor, bounded diagnostic output, independent physical-input scheduling, and current diagnostic-precedence contracts. These are test-harness corrections only; target runtime behavior and operator grammar are unchanged. **M0 TOML maintenance evidence (2026-07-29)** - The six direct host consumers now resolve TOML `1.1.4`. The lockfile also advances `displaydoc` to `0.2.7` and `tao-macros` to `0.1.4`; Tauri utilities retain their independently compatible existing TOML `0.9.12` edge. A `cargo update --dry-run -v` reports zero additional compatible updates and preserves the five already documented parent-constrained exceptions. - The patch refresh changes no source API, protocol, authority, manifest, or target behavior. `coh-rtc` output remains byte-identical. The focused test run exposed two stale generated-policy hashes embedded in `docs/USERLAND_AND_CLI.md` by the earlier `5e50c5c62` manifest regeneration; those two embedded values now match the authoritative standalone snippets without changing policy/default semantics. - Exact Rust/Cargo `1.97.1`, locked metadata, formatting, strict Clippy for all affected targets, affected-package compilation and tests, SwarmUI dependency policy, generated-artifact/test-plan/NIST guards, and diff checks pass. `cargo audit` retains the same 17 allowed Tauri GTK3/urlpattern warnings with no vulnerability failure, and `cargo deny check advisories` passes. ## Milestone 1 — Boot Banner, Timer, & First IPC [Milestones](#Milestones) **Status:** Complete — boot banner, timer tick, and initial IPC appear in current boot logs; retain existing log ordering. **Deliverables** - Root task prints a banner and configures a periodic timer tick. - Root task spawns a secondary user component via seL4 endpoints. - Demonstrate one ping/pong IPC exchange and timer-driven logging. - Added runtime CSpace-path assert for all retypes. - Scaffold `cohsh` CLI prototype (command parsing + mocked transport) per `docs/USERLAND_AND_CLI.md §2-§4` so operators can observe logs via `tail` and exercise attach/login flows defined in `docs/INTERFACES.md §7`. **Checks** - QEMU serial shows boot banner and periodic `tick` line. - QEMU serial logs `PING 1` / `PONG 1` sequence exactly once per boot. - No panics; QEMU terminates cleanly via monitor command. **M1 → M2 Transition Note** - Retype now targets the init root CNode using the canonical tuple `(root=seL4_CapInitThreadCNode, node_index=0, node_depth=bootinfo.initThreadCNodeSizeBits, slot)` and validates capacity via `initThreadCNodeSizeBits`. ## Milestone 2 — NineDoor Minimal 9P [Milestones](#Milestones) **Status:** Complete — Secure9P codec, fid/session handling, and the synthetic namespace are active; follow-up limited to ongoing fuzz coverage. **Deliverables** - Secure9P codec + fid/session table implementing `version`, `attach`, `walk`, `open`, `read`, `write`, `clunk`. - Synthetic namespace publishing: - `/proc/boot` (read-only text) - `/log/queen.log` (append-only) - `/queen/ctl` (append-only command sink) - `/worker//telemetry` (append-only, created on spawn) - In-VM transport (shared ring or seL4 endpoint wrapper). No TCP inside the VM. - `cohsh` CLI upgraded to speak the live NineDoor transport (mock removed) while preserving operator workflows. - Implementation satisfies the defences and layering requirements from `docs/SECURE9P.md §2-§5` and strictly adheres to `docs/INTERFACES.md §1-§6` for operation coverage, ticket validation, and error semantics. - These flows are defined for one Queen orchestrating many workers within a hive; host tools (CLI or GUI) drive them via `cohsh`. **Checks** - Integration test attaches, walks, reads `/proc/boot`, and appends to `/queen/ctl`. - Attempting to write to `/proc/boot` fails with `Permission`. - Decoder corpus covers malformed frames (length mismatch, fid reuse). ## Milestone 3 — Queen/Worker MVP with Roles [Milestones](#Milestones) **Status:** Complete for the Queen/Worker session model — roles, budgets, and `/queen/ctl` JSON handling are live in root/host model state; this milestone did not prove a separate Worker target task. **Deliverables** - Role-aware access policy implementing `Queen` and `WorkerHeartbeat` roles. - `/queen/ctl` accepts JSON commands: - `{"spawn":"heartbeat","ticks":100}` - `{"kill":""}` - `{"budget":{"ttl_s":120,"ops":1000}}` (optional fields) - The root/host Worker-heart model appends `"heartbeat "` lines to the selected Worker telemetry path. - Budget enforcement (ttl/ticks/ops) with automatic revocation. - Access policy follows `docs/ROLES_AND_SCHEDULING.md §1-§5` and the queen control schema in `docs/INTERFACES.md §3-§4`; all JSON handling must reject unknown formats as defined in the error table (`docs/INTERFACES.md §8`). - These queen/worker flows assume one Queen orchestrating many workers within a hive, exercised through `cohsh` or clients speaking its protocol. **Checks** - Writing spawn command creates bounded Worker model state and its telemetry stream. - Writing kill removes worker directory and closes telemetry file. - Role isolation tests deny cross-role reads/writes. ## Milestone 4 — Bind & Mount Namespaces [Milestones](#Milestones) **Status:** Complete — Per-session mount tables are implemented; future changes must preserve established bind/mount semantics from `SECURE9P.md`. **Deliverables** - Per-session mount table with `bind(from, to)` and `mount(service, at)` operations scoped to a single path. - Queen-only commands for namespace manipulation exposed via `/queen/ctl`. - Namespace operations mirror the behaviour defined in `docs/INTERFACES.md §3` and respect mount expectations in `docs/ARCHITECTURE.md §4`. - Mount and namespace flows remain scoped to one Queen orchestrating many workers inside a hive, driven by `cohsh` (and future GUI clients that speak its protocol). **Checks** - Queen remaps `/queen` to a subdirectory without affecting other sessions. - Attempted bind by a worker fails with `Permission`. ## Milestone 5 — Hardening & Test Automation (ongoing) [Milestones](#Milestones) **Status:** Complete — Unit/fuzz/integration coverage exists; maintain regression packs as features evolve. **Deliverables** - Unit tests for codec, fid lifecycle, and access policy negative paths. - Fuzz harness covering length-prefix mutations and random tail bytes for the decoder. - Integration test: spawn heartbeat → emit telemetry → kill → verify revocation logs. - Cohsh regression scripts (per `docs/USERLAND_AND_CLI.md §6-§7`) execute against mock and QEMU targets, ensuring CLI and Secure9P behaviours stay aligned. **Checks** - `cargo test` passes in CI. - Fuzz harness runs N iterations (configurable) without panic. ## Milestone 6 — GPU Worker Integration [Milestones](#Milestones) **Status:** Complete for the host-side bridge, simulation, schema, and Worker-role model. No executable VM Worker task was completed here; that remains conditional on a later profile with target-created task objects and matching capability, lifecycle, scheduling, fault, and revocation evidence. **Deliverables** - Define `WorkerGpu` role and extend `/queen/ctl` schema with GPU lease requests. - Host-side `gpu-bridge-host` tool implementing NVML-based discovery (feature-gated) and `--mock` namespace mirroring for `/gpu//*`. - Job submission protocol (JSON) supporting vector add and matrix multiply kernels with SHA-256 payload validation, optional inline payloads, and status fan-out to `/gpu//status` and `/worker//telemetry`. - Implementation must align with `docs/GPU_NODES.md §2-§7`, uphold the command schemas in `docs/INTERFACES.md §3-§5`, and keep VM-side responsibilities within the boundaries in `docs/ARCHITECTURE.md §7-§8`. - The shipped host bridge and simulation paths are production-grade within their documented bounds. Host simulation and a Worker-role model do not establish an executable target Worker or a fully implemented GPU stack. **Checks** - Queen creates a bounded GPU Worker model record and receives logical Worker telemetry; host simulation does not launch a target Worker task. - Lease expiry revokes Worker-model/session access and closes the host-simulation `/gpu//job` handle. - Host integration tests run in `--mock` mode when GPUs are absent. > **Rule of Engagement:** Advance milestones sequentially, treat documentation as canonical, and keep code/tests aligned after every milestone increment. > **Future Note:** A host-side WASM GUI is expected as a hive dashboard layered on the `cohsh` protocol; it does not alter kernel/userspace boundaries or introduce new in-VM services. ## Milestone 6a — GPU Model Lifecycle & Telemetry Semantics (LoRA-ready) [Milestones](#Milestones) **Status:** Complete — host bridge and documentation now define model lifecycle surfaces, schema-tagged telemetry, and export guarantees without altering in-VM capabilities. **Why this exists (context)** Milestone 6 proved the **GPU lease boundary and host bridge mechanics** using kernel-style job submission. That validated the architecture, but it does not yet express **model lifecycle state** or **learning-oriented telemetry semantics**, which are required for PEFT / LoRA feedback loops at scale. Milestone 6a adds **no new execution capabilities** and **no new control channels**. It introduces only **file-level conventions and minimal host-bridge extensions** so Cohesix can orchestrate *model state* and *learning telemetry* without becoming an ML runtime. This milestone is intentionally boring. --- ### Goal Extend the existing `gpu-bridge-host` and GPU namespace with: 1. **Model lifecycle surfaces** (selection + activation, not execution) 2. **Well-defined telemetry semantics** suitable for LoRA / PEFT pipelines while preserving: - CUDA/NVML strictly outside the VM - Secure9P as the only control plane - WorkerGpu as a namespace-only role - Deterministic memory and rate bounds --- ### Deliverables #### 1. GPU Model Lifecycle Namespace (Host-side only) Extend the mirrored GPU namespace with a **model lifecycle view**: /gpu/models/ available/ / manifest.toml active -> Properties: - `available/` is read-only to VM roles - `active` is a writable symlink-like pointer (atomic swap) - Model artifacts live on the host filesystem; Cohesix sees references only - Activation semantics are host-defined (reload / restart / hot-swap) **Non-goals** - No model uploads via 9P - No artifact streaming - No training or conversion logic --- #### 2. Telemetry Schema for Learning Loops Define and document a **versioned telemetry schema** for GPU learning feedback. Required fields (minimum): - `schema_version` - `device_id` - `model_id` - `lora_id` (optional) - `time_window` - `token_count` - `latency_histogram` Optional fields: - confidence / entropy - drift indicators - operator feedback flags Telemetry continues to flow through existing paths: /gpu/telemetry/* /worker//telemetry Constraints: - Size-bounded records - Append-only semantics - Explicit windowing (no unbounded streams) --- #### 3. Worker Behavior (No New Roles) WorkerGpu behavior remains minimal: - Observe `/gpu/models/active` - Include `model_id` / `lora_id` in forwarded telemetry - Enforce existing rate and size limits No new worker types or privileges are introduced. --- #### 4. Queen Export Compatibility (No Training Logic) Ensure telemetry emitted under the new schema can be **exported unchanged** via: /queen/telemetry/* /queen/export/lora_jobs/* Milestone 6a does **not** implement training, scheduling, or PEFT tooling. It only guarantees that exported telemetry is: - Structured - Bounded - Policy-checkable - ML-pipeline friendly --- ### Files & Components Touched - `gpu-bridge-host` - Add model lifecycle surfaces - Implement atomic model activation - Emit telemetry records with schema tags - `docs/GPU_NODES.md` - Document `/gpu/models/*` - Clarify separation between job execution vs model state - `docs/INTERFACES.md` - Telemetry schema definition - Explicit size and rate limits - `docs/USE_CASES.md` - Reference LoRA / PEFT edge feedback loop (informational) No changes to: - seL4 kernel usage - Secure9P protocol - NineDoor access policy logic - Worker role definitions --- ### Checks (Definition of Done) - Existing Milestone 6 GPU kernel tests still pass unchanged - Switching `/gpu/models/active` causes host-side model reload - Telemetry records include valid schema headers - Oversized or malformed telemetry is rejected - Worker cannot upload models or bypass leases - No new in-VM dependencies introduced --- ### Outcome After Milestone 6a: - Cohesix can safely coordinate **model evolution at the edge** - PEFT / LoRA pipelines can consume telemetry without bespoke glue - GPU execution remains host-owned - The control plane remains deterministic, auditable, and small Milestone 6 stays about **capability**. Milestone 6a is about **intent**. ## Milestone 7a — Root-Task Event Pump & Authenticated Kernel Entry [Milestones](#Milestones) **Status:** Complete — Event pump replaces the spin loop; authenticated console flow and serial integration are live. Preserve PL011 logging and audit ordering during follow-up changes. **Deliverables** - **Deprecate legacy spin loop** - Replace the placeholder busy loop in `kernel_start` with a cooperative event pump that cycles serial RX/TX, timer ticks, networking polls, and IPC dispatch without relying on `std` primitives. - Capture wake ordering and preemption notes in module docs so subsequent milestones can extend the pump without regressing determinism. - Instrument the transition with structured audit logs showing when the pump initialises each subsystem. - **Serial event integration (no-std)** - Introduce a `root-task` `serial` module built atop OSS crates such as `embedded-io` and `nb` for trait scaffolding while maintaining zero-allocation semantics using `heapless` buffers. - Provide interrupt-safe reader/writer abstractions that feed the event pump, expose per-source back-pressure counters via `portable-atomic`, and enforce UTF-8 sanitisation before lines reach the command parser. - Add conformance tests that replay captured QEMU traces to guarantee debounced input (backspace, control sequences) behaves identically across boots. - **Networking substrate bootstrapping** - Integrate the virtio-net PHY and `smoltcp` device glue behind a feature gate, seeding deterministic RX/TX queues using `heapless::{Vec, spsc::Queue}` and documenting memory bounds in `docs/SECURITY.md`. - Ensure the event pump owns the poll cadence for `smoltcp`, handles link up/down notifications, and publishes metrics to `/proc/boot` for observability. - Provide fault-injection tests that exhaust descriptors, validate checksum handling, and assert the pump survives transient PHY resets. - **Authenticated command loop** - Embed a shared command parser (serial + TCP) constructed with `heapless::String` and finite-state validation to enforce maximum line length, reject unsupported control characters, and throttle repeated failures with exponential back-off. - Hook authentication into the root-task capability validator so privileged verbs (`attach`, `spawn`, `kill`, `log`) require valid tickets, emitting audit lines to `/log/queen.log` on denial. - Add integration tests that execute scripted login attempts, verify rate limiting, and confirm the event pump resumes servicing timers and networking during authentication stress. - **Documentation updates** - Update `docs/ARCHITECTURE.md` and `docs/SECURITY.md` with the new event pump topology, serial/network memory budgets, and authenticated console flow diagrams. - Document migration steps for developers moving from the spin loop to the event pump, including feature flags and testing guidance in `docs/REPO_LAYOUT.md` or relevant READMEs. **Checks** - Root task boots under QEMU, initialises the event pump, and logs subsystem activation without reintroducing the legacy busy loop. - Serial RX/TX, networking polls, and command handling execute deterministically without heap allocations; fuzz/property tests cover parser and queue saturation paths. - Authenticated sessions enforce capability checks, rate limit failures, and keep timer/NineDoor services responsive during sustained input. ### Task Breakdown ``` Title/ID: m7a-event-pump-core Goal: Replace the kernel_start spin loop with a cooperative no-std event pump. Inputs: docs/ARCHITECTURE.md §§2,4; docs/SECURITY.md §§3-4; existing root-task entrypoint. Changes: - crates/root-task/src/kernel.rs — remove spin loop, initialise serial/net/timer pollers, and document scheduling guarantees. - crates/root-task/src/event/mod.rs — new event pump coordinator orchestrating serial, timer, IPC, and networking tasks with explicit tick budgeting. - crates/root-task/tests/event_pump.rs — unit tests covering scheduling fairness, back-pressure propagation, and panic-free shutdown paths. Commands: cd crates/root-task && cargo test event_pump && cargo check --features net && cargo clippy --features net --tests Checks: Event pump drives serial, timer, and networking tasks deterministically; tests cover starvation and shutdown. Deliverables: Root-task event pump replacing legacy loop with documented guarantees and regression tests. ``` ``` Title/ID: m7a-serial-auth Goal: Provide authenticated serial command handling with rate limiting and audit trails. Inputs: docs/INTERFACES.md §§3,7-8; docs/SECURITY.md §5; embedded-io 0.4; heapless 0.8. Changes: - crates/root-task/src/console/mod.rs — integrate heapless line editor, authentication state machine, and audit logging. - crates/root-task/src/console/serial.rs — implement no-std serial driver traits, UTF-8 sanitisation, and per-byte throttling metrics. - crates/root-task/tests/console_auth.rs — tests for login success/failure, rate limiting, control sequence rejection, and audit log outputs. Commands: cd crates/root-task && cargo test console_auth && cargo check --features net && cargo clippy --features net --tests Checks: Serial console authenticates commands, enforces throttling, and keeps event pump responsive under stress. Deliverables: Hardened serial console with authentication, audit coverage, and passing tests. ``` ``` Title/ID: m7a-net-loop Goal: Embed the smoltcp-backed networking poller into the event pump with deterministic buffers. Inputs: docs/ARCHITECTURE.md §§4,7; docs/SECURITY.md §4; smoltcp 0.11; heapless 0.8; portable-atomic 1.6. Changes: - crates/root-task/src/net/mod.rs — finalise virtio-net PHY, smoltcp integration, and bounded queues with instrumentation. - crates/root-task/src/event/net.rs — event pump adapter scheduling smoltcp polls, handling link state, and surfacing metrics. - crates/root-task/tests/net_pump.rs — property tests for descriptor exhaustion, checksum validation, and PHY reset recovery. Commands: cd crates/root-task && cargo test --features net net_pump && cargo check --features net && cargo clippy --features net --tests Checks: Networking poller integrates with event pump, survives fault injection, and maintains deterministic buffer usage. Deliverables: Networking subsystem integrated with event pump, documented, and guarded by targeted tests. ``` ``` Title/ID: m7a-docs-migration Goal: Update documentation for the event pump, authenticated console, and networking integration. Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, existing milestone notes. Changes: - docs/ARCHITECTURE.md — describe event pump topology, serial/net modules, and removal of spin loop. - docs/SECURITY.md — record authenticated console threat model, rate limiting strategy, and memory quotas. - docs/REPO_LAYOUT.md & crate READMEs — outline developer workflows, feature flags, and testing commands for the new pump. Commands: cargo doc -p root-task --document-private-items && mdbook build docs (if configured) Checks: Documentation builds cleanly, reflects new architecture, and guides developers through migration. Deliverables: Synchronized documentation explaining event pump adoption, security posture, and developer workflows. ``` ## Milestone 7b — Standalone Console & Networking (QEMU-first) [Milestones](#Milestones) **Status:** Complete — PL011 root console and TCP console co-exist; networking stack is feature-gated and non-blocking. Virtio-console is not used; PL011 remains the root console (see `ARCHITECTURE.md` for dual-console expectations). **Deliverables** - **Serial console integration** - Implement a bidirectional serial driver for QEMU (`virtio-console` preferred, PL011 fallback) that supports blocking RX/TX (no heap, no `std`) and exposes an interrupt-safe API so the event pump can integrate timer and network wake-ups. - Replace the `kernel_start` spin loop with an event pump that polls serial input, dispatches parsed commands, services outgoing buffers, and yields to networking/timer tasks without starving the scheduler. - Enforce ticket and role checks before privileged verbs execute; log denied attempts to `/log/queen.log`, apply exponential back-off when credentials are wrong, and drop connections that exceed retry quotas. - **Networking substrate** - Add `smoltcp` (Rust, BSD-2) to the root-task crate under a new `net` module with explicit feature gating so baseline builds stay minimal. - Implement a virtio-net MMIO PHY for QEMU, encapsulate the device behind a trait that abstracts descriptor management, and document the register layout alongside reset/feature negotiation flows. - Use `heapless::{Vec, spsc::Queue}` for RX/TX buffers to keep allocations deterministic; document memory envelopes in `docs/SECURITY.md` and prove queue saturation behaviour with tests. - **Command loop** - Build a minimal serial + TCP line editor using `heapless::String` and a finite-state parser for commands (`help`, `attach`, `tail`, `log`, `quit`, plus `spawn`/`kill` stubs that forward JSON to NineDoor) with shared code paths so behaviours remain identical across transports. - Integrate the loop into the root-task main event pump alongside timer ticks, networking polls, and IPC dispatch while enforcing capability checks before invoking root-task RPCs. - Rate-limit failed logins, enforce maximum line length, reject control characters outside the supported set, and record audit events whenever a session hits throttling. **Checks** - QEMU boot brings up the root task, configures smoltcp, accepts serial commands, and listens for TCP attachments on the configured port. - `cohsh --transport tcp` can attach, tail logs, and quit cleanly; regression scripts cover serial-only mode. - Fuzz or property-based tests exercise the new parser and networking queues without panics. ### Task Breakdown ``` Title/ID: m7b-serial-rx Goal: Provide bidirectional serial I/O for the root-task console in QEMU. Inputs: docs/ARCHITECTURE.md §2; docs/INTERFACES.md §7; seL4 virtio-console/PL011 specs; `embedded-io` 0.4 (optional traits). Changes: - crates/root-task/src/console/serial.rs — MMIO-backed RX/TX driver exposing `read_byte`/`write_byte` without heap allocation, plus interrupt acknowledgement helpers and a shared rate-limiter primitive for reuse by the console loop. - crates/root-task/src/kernel.rs — initialise the serial driver, hook it into the event pump, remove the legacy busy loop, and document the wake-up ordering for timer/net/serial sources. - crates/root-task/tests/serial_stub.rs — host-side stub verifying backspace/line termination handling, throttle escalation, and the audit log entries emitted by repeated authentication failures. Commands: cd crates/root-task && cargo test serial_stub && cargo check --features net && cargo clippy --features net --tests Checks: Serial RX consumes interactive input without panics; console loop handles backspace/newline, rate limiting, and audit logging in QEMU. Deliverables: Root-task serial driver initialised during boot with regression tests for RX edge cases and throttling safeguards. ``` ``` Title/ID: m7b-net-substrate Goal: Wire up a deterministic networking stack for the root task. Inputs: docs/ARCHITECTURE.md §§4,7; docs/INTERFACES.md §§1,3,6; docs/SECURITY.md §4; smoltcp 0.11; heapless 0.8; portable-atomic 1.6. Changes: - crates/root-task/Cargo.toml — add `smoltcp`, `heapless`, and `portable-atomic` dependencies behind a `net` feature along with feature docs explaining footprint impact. - crates/root-task/src/net/mod.rs — introduce PHY trait, virtio-net implementation (descriptor rings, IRQ handler), smoltcp device glue, bounded queues, and defensive checks for descriptor exhaustion. - crates/root-task/src/main.rs — initialise networking, register poller within the root-task event loop, and expose metrics hooks so audit logs can capture link bring-up status. - docs/SECURITY.md — document memory envelopes, networking threat considerations, and mitigations for RX flooding or malformed descriptors. Commands: cd crates/root-task && cargo check --features net && cargo test --features net net::tests && cargo clippy --features net --tests Checks: Smoltcp interface boots in QEMU with deterministic heap usage; unit tests cover RX/TX queue saturation, link bring-up, error paths, and descriptor validation. Deliverables: Root-task networking module with virtio-net backend, updated security documentation, and passing feature-gated tests reinforced by lint coverage. ``` ``` Title/ID: m7b-console-loop Goal: Provide an authenticated serial/TCP command shell bound to capability checks. Inputs: docs/INTERFACES.md §§3-5,8; docs/SECURITY.md §5; existing root-task timer/IPC code; heapless 0.8. Changes: - crates/root-task/src/console/mod.rs — add finite-state parser, rate limiter, shared line editor for serial/TCP sources, and an authentication/session manager that reuses ticket validation helpers. - crates/root-task/src/main.rs — integrate console loop with networking poller and ticket validator while ensuring timer/NineDoor tasks retain service guarantees. - crates/root-task/tests/console_parser.rs — unit tests for verbs, overlong lines, login throttling, Unicode/control character handling, and audit log integration. Commands: cd crates/root-task && cargo test --features net console_parser && cargo clippy --features net --tests Checks: Parser rejects invalid verbs, enforces max length, rate limits failed logins, normalises newline sequences, and verifies capability enforcement via mocks. Deliverables: Hardened console loop with comprehensive parser tests integrated into root-task and lint-clean CI coverage. ``` ## Milestone 7c — TCP transport parity while retaining existing flows [Milestones](#Milestones) **Status:** Complete — TCP transport, documentation updates, and integration tests are in tree; keep host build scripts and console fixtures in sync when toggling transport flags. **Deliverables** - **Remote transport** - Extend `cohsh` with a TCP transport that speaks to the new in-VM listener while keeping the existing mock/QEMU flows; expose reconnect/back-off behaviour and certificate-less ticket validation for the prototype environment. - Reuse the current NineDoor command surface so scripting and tests stay aligned, document the new `--transport tcp` flag with examples, and ensure help text highlights transport fallbacks when networking is unavailable. - **Documentation & tests** - Update `docs/ARCHITECTURE.md`, `docs/INTERFACES.md`, and `docs/SECURITY.md` with the networking/console design, threat model, and TCB impact including memory budgeting tables for serial/net buffers. - Provide QEMU integration instructions (`docs/USERLAND_AND_CLI.md`) showing serial console usage, remote `cohsh` attachment, and recommended port-forwarding commands for macOS host tooling. - Add unit tests for the command parser (invalid verbs, overlong lines), virtio queue wrappers, and integration tests that boot QEMU, connect via TCP, run scripted sessions, and verify audit log outputs. - Record the TCP console toggle in `configs/root_task.toml` once the manifest compiler lands (Milestone 8b) so docs and fixtures remain in sync. ### Task Breakdown ``` Title/ID: m7c-cohsh-tcp Goal: Extend cohsh CLI with TCP transport parity while retaining existing flows. Inputs: docs/USERLAND_AND_CLI.md §§2,6; docs/INTERFACES.md §§3,7; existing cohsh mock/QEMU transport code. Changes: - apps/cohsh/Cargo.toml — gate TCP transport feature and dependencies, annotate default-off status, and document cross-compilation requirements for macOS hosts. - apps/cohsh/src/transport/tcp.rs — implement TCP client with ticket authentication, reconnect handling, heartbeats, and telemetry logging for CLI operators. - apps/cohsh/src/main.rs — add `--transport tcp` flag and configuration plumbing, including environment overrides and validation for mutually exclusive serial parameters. - docs/USERLAND_AND_CLI.md — document CLI usage, examples, regression scripts covering serial and TCP paths, and troubleshooting steps for QEMU port forwarding. Commands: cd apps/cohsh && cargo test --features tcp && cargo clippy --features tcp --tests && cargo fmt --check Checks: CLI attaches via TCP to QEMU instance, tails logs, forwards NineDoor commands, retains existing regression flow for serial transport, and recovers gracefully from simulated disconnects. Deliverables: Feature-complete TCP transport with documentation, tests validating CLI behaviour, and formatting/lint coverage. ``` ``` Title/ID: m7c-docs-integration-tests Goal: Finalise documentation updates and cross-stack integration tests for networking milestone. Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, docs/USERLAND_AND_CLI.md; existing integration harness scripts. Changes: - docs/ARCHITECTURE.md — describe networking module, console loop, PHY abstraction, and update diagrams to illustrate serial/net event pump interactions. - docs/INTERFACES.md — specify TCP listener protocol, authentication handshake, console commands, and error codes for throttling or malformed frames. - docs/SECURITY.md — extend threat model with networking attack surfaces, mitigations, audit expectations, and documented memory bounds. - tests/integration/qemu_tcp_console.rs — scripted boot + TCP session exercising help/attach/tail/log/quit verbs, plus negative tests for failed logins and overlong lines. - scripts/qemu-run.sh — accept networking flags, expose forwarded TCP port, document usage, and emit helpful diagnostics when host prerequisites (tap/tuntap) are missing. Commands: ./scripts/qemu-run.sh --net tap --console tcp --exit-after 120 && cargo test -p tests --test qemu_tcp_console && cargo clippy -p tests --tests Checks: Automated QEMU run brings up TCP console reachable from host; integration test passes end-to-end; documentation reviewed for consistency and security sign-off. Deliverables: Updated documentation set, automation scripts, and passing QEMU TCP console integration test with lint coverage. ``` ## Milestone 7d — ACK/ERR broadcast is implemented across serial and TCP [Milestones](#Milestones) **Status:** Complete — ACK/ERR broadcast is implemented across serial and TCP with shared fixtures, reconnection semantics, and documentation in place. **Deliverables** - Ensure the PL011 root console remains active alongside the TCP listener; TCP handling must stay non-blocking so serial recovery remains deterministic (see `ARCHITECTURE.md`). - Attachments must respect the current NineDoor handshake and ticket validation; acknowledgements should reuse the parser grammar from `USERLAND_AND_CLI.md`. - **Console acknowledgements** - Enable the root-task TCP listener to emit `OK`/`ERR` responses for `ATTACH`, heartbeat probes, and command verbs so remote operators receive immediate feedback. - Surface execution outcomes (success, denial, or validation failure) through the shared serial/TCP output path with structured debug strings suitable for regression tests. - **Client alignment** - Ensure `cohsh` reuses the acknowledgement surface for telemetry, surfacing attach/session state changes and command failures consistently across transports. - **Documentation & tests** - Update protocol documentation to describe the acknowledgement lifecycle, including reconnection semantics and error payloads. - Extend automated coverage so both serial and TCP transports assert the presence of acknowledgements during scripted sessions. **Checks (DoD)** - Adding ACK/ERR output MUST NOT change line prefixes, newline behaviour, or attach handshake timing established in Milestone 7c. The Regression Pack must pass without modifying any fixture. ### Task Breakdown ``` Title/ID: m7d-console-ack Goal: Implement bidirectional console responses covering attach handshakes and command execution outcomes. Inputs: docs/INTERFACES.md §7; docs/USERLAND_AND_CLI.md §6; apps/root-task/src/event/mod.rs; apps/root-task/src/net/virtio.rs; apps/cohsh/src/transport/tcp.rs. Changes: - apps/root-task/src/event/mod.rs — introduce an acknowledgement dispatcher that emits success/error lines for each validated command, wiring into both serial and TCP paths. - apps/root-task/src/net/virtio.rs & apps/root-task/src/net/queue.rs — plumb outbound console buffers so TCP clients receive the acknowledgement lines generated by the event pump without blocking polling guarantees. - apps/cohsh/src/transport/tcp.rs — consume acknowledgement lines for attach/command verbs, surfacing them in CLI output and telemetry, and hardening reconnect flows when acknowledgements are missing. - docs/INTERFACES.md & docs/USERLAND_AND_CLI.md — document the acknowledgement grammar, heartbeat expectations, and troubleshooting guidance for mismatched responses. Commands: (cd apps/root-task && cargo test --features net && cargo clippy --features net --tests && cargo fmt --check) && (cd apps/cohsh && cargo test --features tcp && cargo clippy --features tcp --tests && cargo fmt --check) Checks: TCP console responds with acknowledgements for attach/log/tail commands; serial harness mirrors the same output; regression suite covers success and failure cases with deterministic logs. Deliverables: Bidirectional console acknowledgements spanning serial and TCP transports, updated protocol documentation, and passing unit/integration tests with lint/format coverage. ``` **Foundation Allowlist (for dependency reviews / Web Codex fetches)** - `https://crates.io/crates/smoltcp` - `https://crates.io/crates/heapless` - `https://crates.io/crates/portable-atomic` (for lock-free counters) - `https://crates.io/crates/embassy-executor` and `https://crates.io/crates/embassy-net` (future async extension, optional) - `https://crates.io/crates/log` / `defmt` (optional structured logging while developing the stack) - `https://crates.io/crates/embedded-io` (serial/TCP trait adapters) - `https://crates.io/crates/nb` (non-blocking IO helpers) - `https://crates.io/crates/spin` (lock primitives for bounded queues) ## Milestone 7e — TraceFS (JSONL Synthetic Filesystem) [Milestones](#Milestones) **Status:** Complete — TraceFS provider backs `/trace/*` and worker traces; control-plane filters and CLI coverage are wired without regressing existing mounts (see `SECURE9P.md`). **Purpose** Add a minimal synthetic 9P provider (`tracefs`) exposing JSONL-based tracing and diagnostic streams. Enable root-task and userspace components to log, filter, and stream events via append-only 9P files, following the Plan 9 “everything is a file” model. **Deliverables** - New `nine-door` provider `/trace/ctl`, `/trace/events`, `/kmesg`, and per-task `/proc//trace`. - Root-task `Trace` facade with zero-allocation ring buffer and `trace!()` macro. - Category/level filters controllable by writing JSON commands to `/trace/ctl`. - Persistent, append-only JSONL event format shared across roles. - CLI (`cohsh`) integration for `tail`/`echo` commands against `/trace/*`. - Optional host-side mirroring via a bridge mount. **Commands (Mac ARM64)** ```bash SEL4_BUILD_DIR=$HOME/seL4/build \ ./scripts/cohesix-build-run.sh \ --sel4-build "$HOME/seL4/build" \ --out-dir out/cohesix \ --profile release \ --root-task-features kernel,bootstrap-trace,serial-console \ --cargo-target aarch64-unknown-none \ --transport qemu \ --raw-qemu cohsh> echo '{"set":{"level":"debug","cats":["boot","ninep"]}}' > /trace/ctl cohsh> tail /trace/events ``` **Checks** * `/trace/events` streams JSONL trace lines after boot. * `/trace/ctl` accepts JSON control messages without panic. * Per-task `/proc//trace` returns filtered events. * Host build passes `cargo test -p nine-door` and integration test `tests/cli/tracefs_script.sh`. **Definition of Done** * Boot completes and serial console shows `[Cohesix] Root console ready.` * Writing to `/trace/ctl` dynamically changes categories/levels. * Reading `/trace/events` shows bounded ring output with sequence continuity. * No TCP or external logging inside the VM. * Code aligned with `secure9p-*` layering; passes `cargo clippy -- -D warnings`. * TCP console must remain non-blocking and PL011 stays active as the fallback root console (see `ARCHITECTURE.md`). ## Milestone 8a — Lightweight Hardware Abstraction Layer [Milestones](#Milestones) **Why now (context):** Kernel bring-up now relies on multiple MMIO peripherals (PL011 UART, virtio-net). Tight coupling to `KernelEnv` spread driver responsibilities across modules, making future platform work and compiler integration harder to reason about. **Goal** Carve out a lightweight Hardware Abstraction Layer so early boot and drivers consume a focused interface for mapping device pages and provisioning DMA buffers. **Deliverables** - `apps/root-task/src/hal/mod.rs` introducing `KernelHal` and the `Hardware` trait that wrap device/DMA allocation, coverage queries, and allocator snapshots. - `apps/root-task/src/kernel.rs` switched to the HAL for PL011 bring-up and diagnostics, keeping boot logging unchanged. - `apps/root-task/src/drivers/{rtl8139.rs,virtio/net.rs}` and `apps/root-task/src/net/stack.rs` updated to rely on the HAL rather than touching `KernelEnv` directly, simplifying future platform support and keeping NICs behind a shared `NetDevice` trait. - Documentation updates in this build plan describing the milestone and entry criteria. **Status:** Complete — Kernel HAL now owns device mapping, diagnostics, and NIC bring-up (RTL8139 by default on `dev-virt`, virtio-net behind the feature gate) while keeping console output stable. **Commands** - `cargo check -p root-task --features "kernel,net-console"` **Checks (DoD)** - Root task still boots with PL011 logging and default RTL8139 initialisation via the HAL, with virtio-net available behind the feature gate for experiments. - HAL error propagation surfaces seL4 error codes for diagnostics (no regression in boot failure logs). - Workspace `cargo check` succeeds with the kernel and net-console features enabled. - Run the Regression Pack (see “Docs-as-Built Alignment”) to confirm console behaviour, networking event pump cadence, and NineDoor flows are unchanged despite the new HAL. Any change in ACK/ERR or `/proc/boot` output must be documented and justified. - HAL introduction MUST NOT alter device MMIO layout, IRQ numbering, or virtio feature-negotiation visible in QEMU logs. Any change requires a manifest schema bump and doc update. - **Milestone 8a scope exception (authorized):** A narrow TCP/virtio-net stability effort is permitted to unblock console bring-up, limited to: - Minimal, feature-gated debug instrumentation in `apps/root-task/src/drivers/virtio/net.rs` and queue helpers. - TX/RX publish ordering + cache visibility fixes, without protocol or console grammar changes. - A host repro harness that drives the existing QEMU TCP console and cohsh smoke flow. The original standalone helper was later retired when `scripts/cohsh/run_regression_batch.sh` and `scripts/qemu_tcp_response_matrix.py` became the canonical bounded paths. - No refactors, no new in-VM services, and no manifest/schema changes. - **Scope note (authorized):** Feature-flag consolidation for root-task bring-up (`cleanup-1-feature-flags-consolidation`) is permitted, limited to adding a single public `cohesix-dev` umbrella, removing dead flags, and updating scripts/docs without changing default behavior or console grammar. - **Scope note (authorized):** Instrumentation noise reduction (`cleanup-2-instrumentation-noise-reduction`) is permitted, limited to heapless rate-limited counters and demoting/rate-limiting net/event pump spam without changing console protocol lines, ordering, or CLI/ACK semantics. --- ## Milestone 8b — Root-Task Compiler & Deterministic Profiles [Milestones](#Milestones) **Why now (context):** The event pump, HAL, and authenticated console now run end-to-end, but the configuration that wires tickets, namespaces, and capability budgets together still lives in hand-written Rust. A manifest-driven compiler lets us regenerate bootstrap code, docs, and CLI fixtures from one artefact so deployments stay auditable and reproducible. **Goal** Introduce the `coh-rtc` compiler that ingests `configs/root_task.toml` and emits deterministic artefacts consumed by the root task, docs, and regression suites. **Deliverables** - `configs/root_task.toml` capturing schema version, platform profile, event-pump cadence, ticket inventory, namespace mounts, Secure9P limits, and feature toggles (e.g., `net-console`). - Workspace binary crate `tools/coh-rtc/` with modules: - `src/ir.rs` defining IR v1.0 with serde validation, red-line enforcement (walk depth ≤ 8, `msize ≤ 8192`, no `..` components), and feature gating that refuses `std`-only options when `profile.kernel = true`. - `src/codegen/` emitting `#![no_std]` Rust for `apps/root-task/src/generated/{mod.rs,bootstrap.rs}` plus JSON/CLI artefacts. - Integration tests under `tools/coh-rtc/tests/` that round-trip sample manifests and assert deterministic hashes. - `apps/root-task/src/lib.rs` and `apps/root-task/src/kernel.rs` updated to include the generated module (behind `#[path = "generated/mod.rs"]`) and to use manifest-derived tables for ticket registration, namespace wiring, and initial audit lines. - `apps/root-task/build.rs` gains a check that fails the build if generated files are missing or stale relative to `configs/root_task.toml`. - Generated artefacts: - `apps/root-task/src/generated/bootstrap.rs` — init graph, ticket table, namespace descriptors with compile-time hashes. - `configs/generated/root_task_resolved.json` — serialised IR with SHA-256 fingerprint stored alongside. - `scripts/cohsh/boot_v0.coh` — baseline CLI script derived from the manifest to exercise attach/log/quit flows. - Manifest IR gains optional `ecosystem.*` section (schema-validated, defaults to noop): - `ecosystem.host.enable` (bool) - `ecosystem.host.providers[]` (enum: `systemd`, `k8s`, `nvidia`, `jetson`, `net`) - `ecosystem.host.mount_at` (default `/host`) - `ecosystem.audit.enable` (bool) - `ecosystem.policy.enable` (bool) - `ecosystem.models.enable` (bool; future CAS hook) - Generated doc snippets call out that these nodes appear only when enabled. - Documentation updates: - `docs/ARCHITECTURE.md §11` expanded with the manifest schema and regeneration workflow. - `docs/BUILD_PLAN.md` (this file) references the manifest in earlier milestones. - `docs/REPO_LAYOUT.md` lists the new `configs/` and `tools/coh-rtc/` trees with regeneration commands. **Status:** Complete — local aarch64/QEMU validation and regression pack confirm the DoD checks. **Commands** - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json --cli-script scripts/cohsh/boot_v0.coh` - `cargo check -p root-task --no-default-features --features kernel,net-console` - `cargo test -p root-task` - `cargo test -p tools/coh-rtc` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh` **Checks (DoD)** - Regeneration is deterministic: two consecutive runs of `cargo run -p coh-rtc …` produce identical Rust, JSON, and CLI artefacts (verified via hash comparison recorded in `configs/generated/root_task_resolved.json.sha256`). - Root task boots under QEMU using generated bootstrap tables; serial log shows manifest fingerprint and ticket registration sourced from generated code. - Compiler validation rejects manifests that violate red lines (e.g., invalid walk depth, enabling `gpu` while `profile.kernel` omits the feature gate) and exits with non-zero status. - Run the Regression Pack and reject any drift in `scripts/cohsh/boot_v0.coh` output or manifest fingerprints unless the docs and schema version are updated in the same change. - Generated modules MUST NOT introduce new global state or reorder initialisation in a way that changes serial boot ordering or `/proc/boot` output. - Compiler rejects manifests that set `ecosystem.host.enable = true` when memory budgets or Secure9P red lines (msize, walk depth, role isolation) would be exceeded; enabling the ecosystem section MUST NOT relax prior limits. - Docs-as-built guard extends to the new schema nodes so generated snippets and rendered docs agree on the resolved manifest. **Compiler touchpoints** - Introduces `root_task.schema = "1.0"`; schema mismatches abort generation and instruct operators to upgrade docs. - Adds `cargo xtask` style CI guard (or Makefile target) invoked by `scripts/check-generated.sh` that runs the compiler, compares hashes, and fails CI when committed artefacts drift. - Exports doc snippets (e.g., namespace tables) as Markdown fragments consumed by `docs/ARCHITECTURE.md` to guarantee docs stay in lockstep with the manifest. --- ## Milestone 8c — Cache-Safe DMA via AArch64 VSpace Calls [Milestones](#Milestones) **Why now (context):** DMA regions shared with host-side GPUs, telemetry rings, and future sidecars cross NineDoor and HAL boundaries, but our cache maintenance is still implicit. Section 10.9.2 of the seL4 manual exposes the AArch64-only `seL4_ARM_VSpace_{Clean, CleanInvalidate, Invalidate, Unify}_Data` invocations; wrapping them in Rust lets us publish deterministic cache semantics instead of trusting ad-hoc CPU flushes. **Goal** Wrap the AArch64-specific VSpace cache operations in the HAL, wire them into manifest-driven DMA contracts, and call them whenever pages are pinned for host DMA so shared buffers remain coherent and auditable. **Deliverables** - `apps/root-task/src/hal/cache.rs` (new module) defining `CacheMaintenance` helpers around `seL4_ARM_VSpace_Clean_Data`, `CleanInvalidate_Data`, `Invalidate_Data`, and `Unify_Instruction` plus error/trace plumbing so callers can treat range, alignment, and domain failures deterministically. - HAL integration updates (telemetry rings, GPU windows, future sidecar buffers) that execute the helpers immediately before handing memory to host-side actors and right after reclaiming pins, ensuring caches flush/invalidates happen in lockstep with page sharing. - `tools/coh-rtc` schema additions (`cache.dma_clean`, `cache.dma_invalidate`, `cache.unify_instructions`) plus generated bootstrap tables and docs (`docs/ARCHITECTURE.md §11`, `docs/SECURE9P.md`) describing why AArch64 cache ops are necessary for deterministic DMA. The manifest rejects configurations that omit `cache.kernel_ops = true` while requesting DMA cache maintenance, preventing bizarreness. - `apps/root-task/tests/cache_maintenance.rs` (QEMU/host shim) covering success/error paths of the helpers and asserting audit logs for flushed ranges before the shared region becomes available to NineDoor clients. **Status:** Complete — cache maintenance helpers and DMA audit traces verified; coh-rtc rejects missing `cache.kernel_ops`; tests pass. **Commands** - `cd apps/root-task && cargo test cache_maintenance --features cache-maintenance` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json --cli-script scripts/cohsh/boot_v0.coh` - `cargo test -p coh-rtc` **Checks (DoD)** - Cache helpers succeed for valid, aligned ranges and surface `seL4_RangeError`/`seL4_InvalidArgument` in logs when misaligned. - Serial logs around NineDoor/DMA transitions mention cache flush/invalidate audit lines, proving the helpers run before sharing buffers. - `coh-rtc` refuses to emit bootstrap tables for DMA cache maintenance when `cache.kernel_ops` is disabled, keeping docs/code aligned with the manual’s capability requirements. --- ## Milestone 8d — In-Session `test` Command + Preinstalled `.coh` Regression Scripts [Milestones](#Milestones) **Why now (context):** The TCP console is now viable, but operators and CI need a deterministic, single-command proof that `cohsh` protocol semantics and server-side Secure9P/NineDoor behaviours remain intact. An in-session `coh> test` that exercises client↔server flows via preinstalled scripts ensures regressions surface immediately, including namespace side effects and negative paths. **Goal** Provide `coh> test` that runs a bounded suite validating the `cohsh` control-plane contract end-to-end (client + server), returning deterministic PASS/FAIL plus optional machine-readable JSON suitable for CI. Following the .coh script format as documented in docs/USERLAND_AND_CLI.md "## coh scripts" section. **Deliverables** - Interactive command surface - `coh> test` defaults to a bounded “quick” suite; `--mode quick|full` switches coverage depth. - Flags: `--json` (stable output schema), `--timeout ` (hard upper bound to prevent hangs), and optional safety `--no-mutate` (skips spawn/kill when operators prohibit mutation). Mutation is otherwise permitted for “full” coverage. - Assumes session is already AUTH’d and ATTACH’d but revalidates both up front and fails fast if either is missing. - Preinstalled `.coh` regression scripts on the server filesystem (rootfs-installed by the build script, never fetched at runtime) - Canonical path: `/proc/tests/` within the mounted namespace; scripts are installed into the CPIO rootfs during packaging. - Versioned artefacts (names fixed): - `selftest_quick.coh` — validates session state (AUTH/ATTACH), ping/ack grammar, bounded request/response round-trips. - `selftest_full.coh` — validates Secure9P/NineDoor semantics and performs one disposable Worker-model lifecycle (spawn → observe namespace/telemetry evidence → kill) to prove mutation paths. - `selftest_negative.coh` — validates deterministic ERR paths (forbidden role action, `..` traversal rejection, bounded walk depth, oversized request vs `msize`, and no unintended mutation). - Script execution model - `coh> test` executes the server-hosted `.coh` scripts (e.g., internally equivalent to `coh> run /proc/tests/selftest_full.coh` if the verb exists) so real client↔server control flow and namespace semantics are exercised; no client-embedded shortcuts. - Output contract - Human output: checklist-style PASS/FAIL with the first failing step and a concise reason. - JSON (`--json`): `{ ok, mode, elapsed_ms, checks:[{name, ok, detail, transcript_excerpt?}], version }` (versioned for compatibility). **Status:** Complete — `coh> test` runs against preinstalled `/proc/tests` scripts, emits PASS/FAIL plus JSON, and rerun guidance is documented for operators. **Test coverage (what “full” must prove)** - AUTH/ATTACH validation with deterministic failure when missing. - Protocol grammar: deterministic OK/ERR acknowledgements, bounded retries, no silent failures. - Role enforcement: queen-only actions rejected when attached as a non-queen role (or simulated negative in the script when role switching is unavailable). - Secure9P correctness: walk/open/read/write/clunk flows, rejection of `..`, bounded walk depth, `msize`/frame bounds, read-only vs append-only semantics. - Disposable Worker-model lifecycle: create a short-lived model record, observe namespace/telemetry evidence, remove the record, and verify cleanup. **Commands** - `coh> test` - `coh> test --mode full` - `coh> test --mode full --json` - `coh> test --mode full --timeout 10` - `coh> test --mode full --no-mutate` - Example referencing the installed scripts: `coh> run /proc/tests/selftest_full.coh` (only if the existing verb is available; otherwise the `test` command drives the same execution path internally). **Checks (DoD)** - From an active interactive session, `coh> test --mode quick` completes within the default timeout and reports PASS on a healthy system. - `coh> test --mode full` completes within the default timeout and exercises: AUTH/ATTACH validation, at least one read-only read from `/proc/*`, at least one permitted control write (append-only where applicable), disposable Worker-model spawn → observe → kill, and at least one negative test producing deterministic ERR output. - `--json` output matches the documented schema and remains stable for CI consumption (include `version`). - `.coh` scripts exist at `/proc/tests/`, are installed into the rootfs by the build process, and remain the single source of truth for the suite (rerun whenever console, Secure9P, namespace layout, or access policy changes). - Regression command reruns are documented: operators must execute this suite whenever console handling, Secure9P transport, namespace structure, or access policies change. --- ## Milestone 9 — Secure9P Pipelining & Batching [Milestones](#Milestones) (Clarification) Milestones 9–15 intentionally build on the full 7d acknowledgement grammar. Do NOT attempt to pull 9P batching/pipelining earlier than 7d; doing so breaks test surfaces. **Why now (compiler):** Host NineDoor already handles baseline 9P flows, but upcoming use cases demand concurrent telemetry and command streams. Enabling multiple in-flight tags and batched writes requires new core structures and manifest knobs so deployments tune throughput without compromising determinism and Regression Pack guarantees. **Goal** Refactor Secure9P into codec/core crates with bounded pipelining and manifest-controlled batching. **Deliverables** - Split `crates/secure9p-codec` / `secure9p-core` / `secure9p-transport` into: - `crates/secure9p-codec` — frame encode/decode, batch iterators, fuzz corpus harnesses (still `std` for now). - `crates/secure9p-core` — session manager, fid table, tag window enforcement, and `no_std + alloc` compatibility. Existing consumers (`apps/nine-door`, `apps/cohsh`) migrate to the new crates. - `apps/nine-door/src/host/` updated to process batched frames and expose back-pressure metrics; new module `pipeline.rs` encapsulates short-write handling and queue depth accounting surfaced via `/proc/9p/*` later. - `apps/nine-door/tests/pipelining.rs` integration test spinning four concurrent sessions, verifying out-of-order responses and bounded retries when queues fill. - CLI regression `scripts/cohsh/9p_batch.coh` executing scripted batched writes and verifying acknowledgement ordering. - `scripts/cohsh/9p_batch.coh` includes batching/overflow assertions and participates in the regression pack DoD. - `configs/root_task.toml` gains IR v1.1 fields: `secure9p.tags_per_session`, `secure9p.batch_frames`, `secure9p.short_write.policy`. Validation ensures `tags_per_session >= 1` and total batched payload stays ≤ negotiated `msize`. - Docs: `docs/SECURE9P.md` updated to describe the new layering and concurrency knobs; `docs/INTERFACES.md` documents acknowledgement semantics for batched operations. - Explicit queue depth limits and retry back-off parameters documented; negative path covers tag overflow and back-pressure refusal. **Status:** Complete — pipelining tests cover synthetic load, batching toggles, and back-pressure; `9p_batch.coh` regression (including overflow) passes with the full regression pack. **Commands** - `cargo test -p secure9p-codec` - `cargo test -p secure9p-core` - `cargo test -p nine-door` - `cargo test -p coh-rtc` (regenerates manifest snippets with new fields) - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/9p_batch.coh` **Checks (DoD)** - Synthetic load (10k interleaved operations across four sessions) completes without tag reuse violations or starvation; metrics expose queue depth and retry counts. - Batched frames round-trip within negotiated `msize`; when the manifest disables batching the same tests pass with single-frame semantics. - Short-write retry policies (e.g., exponential back-off) are enforced according to manifest configuration and verified by CLI regression output. - Abuse case: exceeding configured `tags_per_session` or queue depth yields deterministic `ERR` and audit lines without panics; regression script asserts failure ordering. - Re-run the Regression Pack to ensure pipelining and batching do not alter existing single-request semantics (tags, errors, or short-write handling) as exercised by earlier CLI scripts. - Tag scheduling MUST remain deterministic: single-request scripts from milestones ≤7 MUST still produce byte-identical ACK/ERR sequences. **Compiler touchpoints** - `coh-rtc` emits concurrency defaults into generated Rust tables and CLI fixtures; docs snippets pull from the manifest rather than hard-coded prose. - CI regeneration guard ensures manifest-driven tests fail if concurrency knobs drift between docs and code. **Task Breakdown** ``` Title/ID: m09-codec-core-split Goal: Extract codec/core crates with bounded tag windows and batch iterators. Inputs: crates/secure9p-codec, crates/secure9p-core, crates/secure9p-transport, configs/root_task.toml (new IR fields), docs/SECURE9P.md excerpts. Changes: - crates/secure9p-codec/lib.rs — move frame encode/decode + batch iterators; add fuzz corpus harness. - crates/secure9p-core/lib.rs — session manager with tag window enforcement and queue depth accounting. - apps/nine-door/src/host/pipeline.rs — enforce queue limits and short-write retry back-off. Commands: - cargo test -p secure9p-codec - cargo test -p secure9p-core Checks: - Tag overflow attempt (tags_per_session + 1) returns deterministic ERR and audit line. Deliverables: - Updated crate split, manifest IR additions, and queue depth limits documented in docs/SECURE9P.md. Title/ID: m09-batched-io-regression Goal: Prove batched write ordering and back-pressure across CLI + Regression Pack. Inputs: scripts/cohsh/9p_batch.coh, apps/nine-door/tests/pipelining.rs. Changes: - apps/nine-door/tests/pipelining.rs — four-session interleave with induced short writes. - scripts/cohsh/9p_batch.coh — add overflow case asserting ERR on batch > msize. Commands: - cargo test -p nine-door --test pipelining - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/9p_batch.coh Checks: - Out-of-order responses preserved; batch larger than msize is rejected with logged ERR. Deliverables: - Regression outputs archived; docs/INTERFACES.md snippet refreshed from manifest. ``` --- ## Milestone 10 — Telemetry Rings & Cursor Resumption [Milestones](#Milestones) **Why now (compiler):** Persistent telemetry is currently mock-only. Operators need bounded append-only logs with resumable cursors, generated from the manifest so memory ceilings and schemas stay auditable. **Goal** Implement ring-backed telemetry providers with manifest-governed sizes and CBOR frame schemas. **Deliverables** - `apps/nine-door/src/host/telemetry/` (new module) housing ring buffer implementation (`ring.rs`) and cursor state machine (`cursor.rs`), integrated into `namespace.rs` and `control.rs` so workers emit telemetry via append-only files. - `crates/secure9p-core` gains append-only helpers enforcing offset semantics and short-write signalling consumed by the ring provider. - CBOR Frame v1 schema defined in `tools/coh-rtc/src/codegen/cbor.rs`, exported as Markdown to `docs/INTERFACES.md` and validated by serde-derived tests. - CLI regression `scripts/cohsh/telemetry_ring.coh` exercising wraparound, cursor resume, and offline replay via `cohsh --features tcp`. - Manifest IR v1.2 fields: `telemetry.ring_bytes_per_worker`, `telemetry.frame_schema`, `telemetry.cursor.retain_on_boot`. Validation ensures aggregate ring usage fits within the event-pump budget declared in `docs/ARCHITECTURE.md`. - `apps/root-task/src/generated/bootstrap.rs` extended to publish ring quotas and file descriptors consumed by the event pump. **Status:** Complete — ring-backed telemetry and cursor retention are validated by tests and the regression pack, with latency metrics recorded in `docs/SECURITY.md`. **Commands** - `cargo test -p nine-door` - `cargo test -p secure9p-core` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh` **Checks (DoD)** - Rings wrap without data loss; on reboot the cursor manifest regenerates identical ring state and CLI replay resumes exactly where it left off. - Latency metrics (P50/P95) captured during tests and recorded in `docs/SECURITY.md`, sourced from automated output instead of manual measurements. - Attempts to exceed manifest-declared ring quotas are rejected and logged; CI asserts the rejection path. - Abuse case: late reader requesting stale cursor receives deterministic ERR and bounded rewind log; overflow write attempts drop frames with explicit audit. - Re-run the Regression Pack to confirm that adding ring-backed telemetry does not change console grammar or existing `/worker//telemetry` semantics outside the new CBOR frames. - Introduction of CBOR telemetry MUST NOT alter legacy plain-text worker telemetry unless explicitly gated by manifest field `telemetry.frame_schema`. **Compiler touchpoints** - Codegen emits ring metadata for `/proc/boot` so operators can inspect per-worker quotas; docs pull from the generated JSON to avoid drift. - Regeneration guard verifies that CBOR schema excerpts in docs match compiler output. **Task Breakdown** ``` Title/ID: m10-ring-impl Goal: Implement bounded append-only rings with cursor state machine. Inputs: apps/nine-door/src/host/telemetry/, configs/root_task.toml telemetry fields. Changes: - apps/nine-door/src/host/telemetry/{ring.rs,cursor.rs} — ring write/read, cursor resume, wraparound handling. - crates/secure9p-core/lib.rs — append-only helpers for offsets and short-write signalling. Commands: - cargo test -p nine-door --test telemetry_ring - cargo test -p secure9p-core Checks: - Write past ring_bytes_per_worker rejects with ERR and audit entry; cursor resume returns deterministic frame ordering. Deliverables: - Ring implementation and manifest-aligned quotas documented in docs/INTERFACES.md. Title/ID: m10-cbor-schema-regen Goal: Define CBOR frame schema and regenerate bootstrap/fixtures. Inputs: tools/coh-rtc/src/codegen/cbor.rs, apps/root-task/src/generated/bootstrap.rs. Changes: - tools/coh-rtc/src/codegen/cbor.rs — schema + Markdown export. - apps/root-task/src/generated/bootstrap.rs — emit ring quotas and cursor retention flags. Commands: - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh Checks: - CLI script proves wraparound and stale cursor rejection; regenerated schema matches docs snippet. Deliverables: - Updated manifest IR, CBOR schema excerpts in docs/INTERFACES.md. ``` --- ## Milestone 11 — Host Sidecar Bridge & /host Namespace (Ecosystem Coexistence) [Milestones](#Milestones) **Why now (compiler):** Cohesix needs to govern existing fleets (systemd units, Kubernetes nodes, GPUs) without moving those systems into the VM. Mirroring host controls into `/host` via Secure9P keeps determinism and the tiny TCB while exposing file-driven levers. **Flagship narrative:** Cohesix acts as a governance layer over existing ecosystems: external orchestrators, device managers, and schedulers are surfaced as files and policies so queens and workers can coordinate without new protocols or in-VM servers. **Goal** Provide a host-only sidecar bridge that projects external ecosystem controls into a manifest-scoped `/host` namespace with strict policy/audit boundaries and no new in-VM transports. **Deliverables** - New host tool crate `apps/host-sidecar-bridge/` (name can adjust) that connects to NineDoor from the host using existing transports, publishes a provider-driven synthetic tree under `/host`, and supports `--mock` mode for CI. - Namespace layout (v1, minimal, file-only and append-only for controls): - `/host/systemd//{status,restart}` (mocked) - `/host/k8s/node//{cordon,drain}` (mocked) - `/host/nvidia/gpu//{status,power_cap,thermal}` (mocked; honours GPU-outside-VM stance) - Access policy: - Queen role can write control nodes; workers are read-only or denied based on manifest policy. - Control writes are append-only command files (no random writes); audit lines are appended for every write using existing logging/telemetry mechanisms (no new logging protocol). - Host-only transport enforcement: no new in-VM TCP listeners; the sidecar uses the existing authenticated console/NineDoor boundaries from the host side only. - CLI harness and commands (documented): - `cargo test -p host-sidecar-bridge` - `cargo run -p host-sidecar-bridge -- --mock --mount /host` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/host_absent.coh` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/host_sidecar_mock.coh` - Manifest/IR alignment: `/host` tree appears only when `ecosystem.host.enable = true` with providers declared under `ecosystem.host.providers[]` and mount point defaulting to `/host`. - Docs include policy and TCB notes emphasising that the bridge mirrors host controls without expanding the in-VM attack surface. **Status:** Complete — host-sidecar bridge and manifest-gated `/host` namespace are verified via host tool tests, `host_sidecar_policy`, and regression scripts covering `/host` role enforcement. **Checks (DoD)** - `/host/*` tree mounts only when enabled by the manifest; omitted otherwise. - Writes to control nodes are rejected for non-queen roles and result in append-only audit lines; mock mode exercises this path in CI. - No new in-VM TCP services are introduced; all transports remain host-side per Secure9P. - Abuse case: denied write to `/host/systemd/*/restart` returns deterministic ERR and logged audit; disablement removes namespace entirely and unit/integration tests assert absence. **Compiler touchpoints** - `coh-rtc` validation ensures enabling `ecosystem.host` respects existing Secure9P red lines (msize, walk depth, role isolation) and memory budgets. - Codegen emits doc/CLI snippets advertising `/host` only when enabled; docs-as-built guard pulls from the resolved manifest. **Task Breakdown** ``` Title/ID: m11-sidecar-skeleton Goal: Create host sidecar bridge and manifest-gated /host namespace. Inputs: apps/host-sidecar-bridge/, configs/root_task.toml (ecosystem.host.*). Changes: - apps/host-sidecar-bridge/src/main.rs — provider mounts, append-only control writers, mock mode. - apps/nine-door/src/host/namespace.rs — conditional mount for /host based on manifest. Commands: - cargo test -p host-sidecar-bridge - cargo run -p host-sidecar-bridge -- --mock --mount /host Checks: - Disabled manifest omits /host entirely; enabling exposes mocked controls without TCP listeners inside VM. Deliverables: - Host bridge crate and manifest toggles documented in docs/ARCHITECTURE.md. Title/ID: m11-policy-roles Goal: Enforce role-based append-only controls with audit. Inputs: docs/INTERFACES.md control grammar, scripts/cohsh/host_sidecar_mock.coh. Changes: - apps/nine-door/src/host/control.rs — queen-only write enforcement and append-only audit logging. - scripts/cohsh/host_sidecar_mock.coh — denied-write then approved-write flow. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/host_sidecar_mock.coh - cargo test -p nine-door --test host_sidecar_policy Checks: - Non-queen write returns ERR EPERM; audit line includes ticket and path; approved write succeeds deterministically. Deliverables: - CLI regression outputs captured; docs/SECURITY.md mentions audit expectations. ``` --- ## Milestone 12 — PolicyFS & Approval Gates [Milestones](#Milestones) **Why now (compiler):** Host mirroring introduces higher-risk controls. Converting approvals into manifest-driven files keeps operations human-auditable without new protocols. **Flagship narrative:** Governance is file-native: risky actions become append-only requests, policy gates decide via files, and the hive stays deterministic across transports. **Goal** Add a PolicyFS surface that captures human-legible approvals for sensitive operations before they reach `/queen/ctl` or `/host` controls. **Deliverables** - Namespace nodes (provider may live in NineDoor or host; keep consistent with existing architecture): - `/policy/ctl` (append-only JSONL commands for policy changes) - `/policy/rules` (read-only snapshot emitted from manifest) - `/actions/queue` (append-only requests) - `/actions//status` (read-only) - Enforcement: selected control writes (e.g., `/queen/ctl`, `/host/*/restart`) require a policy gate when enabled; denials/approvals append to the audit log using existing telemetry logging. - CLI regression demonstrating a denied action followed by an approved action under policy gating. - `scripts/cohsh/policy_gate.coh` is part of the regression pack and must remain deterministic. Its live target lane gates a session-local `/queen/ctl` bind; seeded `/host` nodes remain fixture-only. - Manifest flag (e.g., `ecosystem.policy.enable`) toggles the gate and publishes rules; the current default manifest enables the gate and disabling it reverts to prior control semantics. **Status:** Complete — PolicyFS surfaces and gating are manifest-driven, approval consumption is enforced, and the policy gate regression passes deterministically. **Commands** - `cargo test -p nine-door` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/policy_gate.coh` **Checks (DoD)** - Policy gate enablement is manifest-driven; disabling it reverts to prior control semantics without hidden defaults. - Deterministic results: identical scripts produce identical ACK/ERR sequences and audit lines for denied vs. approved actions. - Sensitive control writes are refused when gates are active and no approval exists; acceptance path appends deterministic audit lines. - Abuse case: replaying an already-consumed approval yields ERR and does not double-apply actions; CLI script asserts refusal. **Compiler touchpoints** - `coh-rtc` emits policy/rule snapshots into generated docs and CLI fixtures; validation enforces append-only semantics and bounded queue sizes consistent with Secure9P limits. - Docs-as-built guard ensures policy nodes and examples match the resolved manifest. **Task Breakdown** ``` Title/ID: m12-policyfs-provider Goal: Implement PolicyFS nodes and append-only gating for risky controls. Inputs: apps/nine-door/src/host/{policy.rs,namespace.rs}, configs/root_task.toml (ecosystem.policy.*). Changes: - apps/nine-door/src/host/policy.rs — providers for /policy/ctl, /policy/rules, /actions/*. - apps/nine-door/src/host/control.rs — enforcement hook requiring approvals before queen/host writes. Commands: - cargo test -p nine-door --test policyfs - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json Checks: - Missing approval produces ERR EPERM with audit; enabling flag publishes /policy tree; disabling removes it. Deliverables: - PolicyFS provider code and manifest schema updates referenced in docs/INTERFACES.md. Title/ID: m12-approval-regression Goal: Demonstrate denied→approved flow and replay refusal. Inputs: scripts/cohsh/policy_gate.coh. Changes: - scripts/cohsh/policy_gate.coh — stepwise denied action, approval append, approved retry, replay attempt. - docs/SECURITY.md appendix note on approval replay limits (snippet refreshed from manifest). Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/policy_gate.coh Checks: - Replay attempt after approval consumption returns ERR and no duplicate action; ACK/ERR sequence deterministic. Deliverables: - CLI transcript stored; manifest hash recorded for regression comparison. ``` --- ## Milestone 13 — AuditFS & ReplayFS [Milestones](#Milestones) **Why now (compiler):** With host mirroring and policy gates, operators need deterministic replay for investigations without expanding the TCB. Bounded audit/replay surfaces make Cohesix operations repeatable and inspectable. **Flagship narrative:** Cohesix treats control as data: every action and decision is recorded as append-only files that can be replayed deterministically to prove governance over external ecosystems. **Goal** Provide append-only audit logs and a bounded replay surface that re-applies Cohesix-issued control actions deterministically. **Deliverables** - `/audit/` subtree: - `/audit/journal` (append-only CBOR or JSONL aligned with existing telemetry choices) - `/audit/decisions` (policy approvals/denials) - `/audit/export` (read-only snapshot trigger) - `/replay/` subtree: - `/replay/ctl` (append-only commands like “start replay from cursor X”) - `/replay/status` (read-only) - Replay semantics: - Only replays Cohesix-issued control-plane actions (no arbitrary host scans) and respects bounded log windows. - Deterministic execution: same inputs → same ACK/ERR + audit lines regardless of transport (serial/TCP). - CLI regression exercising record then replay of a scripted sequence with byte-identical acknowledgements. - `scripts/cohsh/replay_journal.coh` is part of the regression pack. Its live target actions are approved session-local `/queen/ctl` binds, so replay coverage does not invent host-provider state. - Audit logging integrates with telemetry rings without adding new protocols; storage remains bounded per manifest budget. **Status:** Complete — AuditFS/ReplayFS surfaces, manifest gating, tests, and regression scripts are in place and pass deterministically. **Commands** - `cargo test -p nine-door` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/replay_journal.coh` **Checks (DoD)** - Scripted actions can be replayed to yield byte-identical ACK/ERR sequences for Cohesix control operations. - Audit entries are emitted for all transports; replay refuses to exceed bounded windows or to replay non-Cohesix host state. - Append-only semantics enforced for journal/control files; attempts at random-write are rejected and audited. - Abuse case: request to replay beyond bounded window or disabled replay flag returns ERR and leaves system unchanged; CLI script asserts refusal. **Compiler touchpoints** - Manifest fields (e.g., `ecosystem.audit.enable`) gate audit/replay surfaces; validation enforces bounded storage and adherence to Secure9P limits. - Generated docs reference audit/replay schemas derived from the resolved manifest; CI guard ensures snippets stay in sync. **Task Breakdown** ``` Title/ID: m13-auditfs-journal Goal: Add append-only audit journal and decision logs with bounded storage. Inputs: apps/nine-door/src/host/audit.rs, configs/root_task.toml (ecosystem.audit.*). Changes: - apps/nine-door/src/host/audit.rs — /audit/journal and /audit/decisions providers, append-only enforcement. - apps/nine-door/src/host/telemetry/mod.rs — hook to emit audit lines into telemetry ring. Commands: - cargo test -p nine-door --test auditfs Checks: - Random-write attempts to journal rejected with ERR; storage cap enforced with deterministic truncation policy. Deliverables: - Audit schema documented in docs/INTERFACES.md via compiler snippet. Title/ID: m13-replayfs-determinism Goal: Implement bounded replay control with deterministic ACK/ERR. Inputs: apps/nine-door/src/host/replay.rs, scripts/cohsh/replay_journal.coh. Changes: - apps/nine-door/src/host/replay.rs — /replay/ctl, /replay/status, cursor handling within bounded window. - scripts/cohsh/replay_journal.coh — record then replay sequence plus over-window abuse case. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/replay_journal.coh - cargo test -p nine-door --test replayfs Checks: - Replay beyond window or when disabled returns ERR; successful replay reproduces byte-identical ACK/ERR. Deliverables: - Replay semantics and bounds captured in docs/SECURITY.md and docs/INTERFACES.md. ``` --- ## Milestone 14 — Sharded Namespaces & Provider Split [Milestones](#Milestones) **Why now (compiler):** Scaling beyond hundreds of workers will otherwise bottleneck on single-directory namespaces. Deterministic sharding keeps walk depth bounded and aligns provider routing with manifest entries. **Goal** Introduce manifest-driven namespace sharding with optional legacy aliases. **Deliverables** - Namespace layout `/shard/<00..ff>/worker//…` generated from manifest fields. `apps/nine-door/src/host/namespace.rs` grows a `ShardLayout` helper that maps worker IDs to providers using manifest-supplied shard count and alias flags. - `apps/nine-door/tests/shard_scale.rs` spins 1k worker directories, measuring attach latency and ensuring aliasing (when enabled) doesn't exceed walk depth (≤ 8 components). - `crates/secure9p-core` exposes a sharded fid table ensuring per-shard locking and eliminating global mutex contention. - Manifest IR v1.2 additions: `sharding.enabled`, `sharding.shard_bits`, `sharding.legacy_worker_alias`. Validation enforces `shard_bits ≤ 8` and forbids aliases when depth would exceed limits. - Docs updates in `docs/ROLES_AND_SCHEDULING.md` describing shard hashing (`sha256(worker_id)[0..=shard_bits)`), alias behaviour, and operational guidance. - `scripts/cohsh/shard_1k.coh` added to the regression pack DoD. **Status:** Complete — sharded layouts, fid tables, manifest validation, CLI/regression coverage, and docs are aligned; regression pack is green. **Commands** - `cargo test -p nine-door` - `cargo test -p secure9p-core` - `cargo test -p tests --test shard_1k` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` **Checks (DoD)** - 1k worker sessions attach concurrently without starvation; metrics exported via `/proc/9p/sessions` demonstrate shard distribution. - Enabling legacy aliases preserves `/worker/` paths for backwards compatibility; disabling them causes the compiler to reject manifests that still reference legacy paths. - Re-run the Regression Pack and compare paths: legacy `/worker/` scripts must either continue to pass when aliases are enabled or fail deterministically when aliasing is disabled, with matching docs and manifest examples. - Walk-depth MUST remain ≤8 at all times; CI must emit a hard error if shard/alias combinations ever generate deeper paths. - Abuse case: deliberate alias + shard over-depth request fails manifest validation and produces deterministic compiler error recorded in docs. **Compiler touchpoints** - Generated bootstrap code publishes shard tables for the event pump and NineDoor bridge; docs consume the same tables. - Manifest regeneration updates CLI fixtures so scripted tests reference shard-aware paths automatically. **Task Breakdown** ``` Title/ID: m14-shard-mapping Goal: Implement shard layout helper and sharded fid table. Inputs: apps/nine-door/src/host/namespace.rs, crates/secure9p-core fid table. Changes: - apps/nine-door/src/host/namespace.rs — ShardLayout mapping with alias toggle. - crates/secure9p-core/lib.rs — per-shard fid tables and lock partitioning. Commands: - cargo test -p nine-door --test shard_scale - cargo test -p secure9p-core Checks: - Over-depth shard+alias combination rejected by manifest validation; 1k worker attach latency within documented bounds. Deliverables: - Shard tables emitted to generated bootstrap and referenced in docs/ROLES_AND_SCHEDULING.md. Title/ID: m14-shard-regression Goal: Validate legacy alias compatibility and sharded CLI flows. Inputs: scripts/cohsh/shard_1k.coh (new), tests/integration shard_1k harness. Changes: - scripts/cohsh/shard_1k.coh — attaches to shard and legacy alias paths; includes disabled-alias negative case. - docs/INTERFACES.md snippet showing shard path grammar generated from manifest. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/shard_1k.coh Checks: - Legacy path fails deterministically when alias disabled; succeeds when enabled with identical ACK ordering. Deliverables: - Regression transcript captured; manifest hash recorded for docs. ``` --- ## Milestone 15 — Client Concurrency & Session Pooling [Milestones](#Milestones) **Why now (compiler):** Server-side pipelining is useless unless the CLI and automation harness can take advantage of it safely. Manifest-driven client policy keeps retries and pooling deterministic across deployments. **Goal** Add pooled sessions and retry policies to `cohsh`, governed by compiler-exported policy files. **Deliverables** - `apps/cohsh/src/lib.rs` extends `Shell` with a session pool (default manifest value: two control, twenty-four telemetry) and batched Twrite helper. `apps/cohsh/src/transport/tcp.rs` gains retry scheduling based on manifest policy. - `apps/cohsh/tests/pooling.rs` verifies pooled throughput and idempotent retry behaviour. - Manifest IR v1.3: `client_policies.cohsh.pool`, `client_policies.retry`, `client_policies.heartbeat`. Compiler emits `configs/generated/cohsh_policy.toml` consumed at runtime (CLI loads it on start, failing if missing/out-of-sync). - CLI regression `scripts/cohsh/session_pool.coh` demonstrating increased throughput under load and safe recovery from injected failures. - Docs (`docs/USERLAND_AND_CLI.md`) describe new CLI flags/env overrides, referencing manifest-derived defaults. **Status:** Complete — session pooling, retry policies, policy hashing, CLI regression coverage, and docs updates are in place; regression pack is green. **Commands** - `cargo test -p cohsh` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` **Checks (DoD)** - Throughput benchmark (documented in test output) demonstrates improvement relative to single-session baseline without exceeding `msize` or server tag limits. - Retry logic proves idempotent: injected short-write failures eventually succeed without duplicating telemetry or exhausting tickets. - CLI refuses to start when the manifest policy hash mismatches the compiled defaults. - Re-run the Regression Pack and assert that pooled sessions preserve ACK/ERR ordering and idempotent retries for all existing CLI scripts. - Pooled sessions MUST NOT reorder ACKs across operations that were previously strictly ordered (attach/log/tail/quit baseline). - Abuse case: pool exhaustion and forced retry after connection drop yields bounded retries and no duplicate commands; script asserts final counts. **Compiler touchpoints** - `coh-rtc` emits policy TOML plus hash recorded in docs/tests; regeneration guard compares CLI-consumed hash with manifest fingerprint. - Docs embed CLI defaults via compiler-generated snippets to avoid drift. **Task Breakdown** ``` Title/ID: m15-session-pool Goal: Add pooled sessions and retry policies to cohsh. Inputs: apps/cohsh/src/lib.rs, configs/root_task.toml client_policies.*. Changes: - apps/cohsh/src/lib.rs — session pool, batched Twrite helper, policy hash enforcement. - apps/cohsh/src/transport/tcp.rs — retry scheduling and reconnect handling. Commands: - cargo test -p cohsh --tests - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh Checks: - Connection drop triggers retries without duplicate telemetry; pool exhaustion returns deterministic ERR and audit. Deliverables: - Updated client policy TOML emitted by compiler and referenced in docs/USERLAND_AND_CLI.md. Title/ID: m15-throughput-benchmark Goal: Measure throughput improvements and ensure ordering stability. Inputs: apps/cohsh/tests/pooling.rs, scripts/cohsh/session_pool.coh outputs. Changes: - apps/cohsh/tests/pooling.rs — throughput benchmark comparing single vs pooled sessions with injected short writes. - docs/SECURITY.md — note on ordering/idempotency with snippet from manifest. Commands: - cargo test -p cohsh --test pooling - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh Checks: - ACK/ERR ordering unchanged from baseline; retries logged once per failure; benchmark shows expected throughput gain. Deliverables: - Benchmark data archived; manifest hash updated in docs. ``` --- ## Milestone 16 — Observability via Files (No New Protocols) [Milestones](#Milestones) **Why now (compiler):** Operators need structured observability without adding new protocols inside the VM. Manifest-defined `/proc` endpoints ensure metrics stay aligned with runtime behaviour. **Goal** Expose audit-friendly observability nodes under `/proc` generated from the manifest. **Deliverables** - `apps/nine-door/src/host/observe.rs` (new module) providing read-only providers for `/proc/9p/{sessions,outstanding,short_writes}` and `/proc/ingest/{p50_ms,p95_ms,backpressure,dropped,queued}` plus append-only `/proc/ingest/watch` snapshots. - Event pump updates (`apps/root-task/src/event/mod.rs`) to update ingest metrics without heap allocation; telemetry forwarded through generated providers. - Unit tests covering metric counters and ensuring no allocations on hot paths; CLI regression `scripts/cohsh/observe_watch.coh` tails `/proc/ingest/watch` verifying stable grammar. - Manifest IR v1.3 fields: `observability.proc_9p` and `observability.proc_ingest` enabling individual nodes and documenting retention policies. Validation enforces bounded buffer sizes. - Docs: `docs/SECURITY.md` gains monitoring appendix sourced from manifest snippets; `docs/INTERFACES.md` documents output grammar. **Status:** Complete — /proc observability providers, ingest metrics hooks, CLI regressions, doc snippets, and regression pack coverage are aligned and green. **Commands** - `cargo test -p nine-door` - `cargo test -p root-task` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/observe_watch.coh` **Checks (DoD)** - Stress harness records accurate counters; metrics exported via `/proc` match expected values within tolerance. - CLI tail output remains parseable and line-oriented; regression test asserts exact output grammar. - Compiler rejects manifests that attempt to enable observability nodes without allocating sufficient buffers. - Re-run the Regression Pack to ensure `/proc` additions are strictly additive and do not change existing node sizes, EOF behaviour, or latency characteristics beyond documented tolerances. - `/proc` nodes MUST NOT change default units, JSON keys, or column spacing without a manifest schema revision and updated golden outputs. - Abuse case: rapid poll of `/proc/ingest/watch` under back-pressure does not allocate or drop counters; deterministic throttling logged. **Compiler touchpoints** - Generated code provides `/proc` descriptors; docs embed them via compiler output. - As-built guard compares manifest-declared observability nodes with committed docs and fails CI if mismatched. **Task Breakdown** ``` Title/ID: m16-proc-providers Goal: Implement observability providers without new protocols. Inputs: apps/nine-door/src/host/observe.rs, apps/root-task/src/event/mod.rs. Changes: - apps/nine-door/src/host/observe.rs — providers for /proc/9p/* and /proc/ingest/* with bounded buffers. - apps/root-task/src/event/mod.rs — metrics update hooks without heap allocation. Commands: - cargo test -p nine-door --test observe - cargo test -p root-task Checks: - Under stress, metrics remain accurate; abuse case polling watch node throttles without allocations. Deliverables: - Observability nodes documented in docs/INTERFACES.md and docs/SECURITY.md via compiler snippets. Title/ID: m16-cli-regressions Goal: Validate CLI grammar and negative cases for observability nodes. Inputs: scripts/cohsh/observe_watch.coh. Changes: - scripts/cohsh/observe_watch.coh — tail watch node, induce back-pressure, request unsupported node to assert ERR. - docs/SECURITY.md — capture latency/metric tolerances. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/observe_watch.coh Checks: - Unsupported node returns deterministic ERR; watch grammar matches golden; back-pressure logs recorded. Deliverables: - Regression transcript stored; manifest hash noted in docs. ``` --- ## Milestone 17 — Content-Addressed Updates (CAS) — 9P-first [Milestones](#Milestones) **Why now (compiler):** Upcoming edge deployments need resumable, verifiable updates without bloating the VM with new protocols. Manifest-governed CAS ensures integrity rules and storage budgets remain enforceable. **Goal** Provide CAS-backed update distribution via NineDoor with compiler-enforced integrity policies. **Deliverables** - `apps/nine-door/src/host/cas.rs` implementing a CAS provider exposing `/updates//{manifest.cbor,chunks/}` with optional delta packs. Provider enforces SHA-256 chunk integrity and optional Ed25519 signatures when manifest enables `cas.signing`. - Host tooling `apps/cas-tool/` (new crate) packaging update bundles, generating manifests, and uploading via Secure9P. - CLI regression `scripts/cohsh/cas_roundtrip.coh` verifying download resume, signature enforcement, and delta replay. - Models as CAS (registry semantics via files, no new service): expose `/models//{weights,schema,signature}` backed by the same CAS provider; include doc example binding a model into a worker namespace via mount/bind. - CLI regression `scripts/cohsh/model_cas_bind.coh` uploads a dummy model bundle, verifies hash, and binds it into a worker namespace. - Manifest CAS fields are `cas.enable`, `cas.store.chunk_bytes`, `cas.delta.enable`, and `cas.signing.verification_key_path`. Validation ensures chunk size ≤ negotiated `msize` and a valid public Ed25519 verification key is present when signatures are required; target code never embeds the private signing key. - Docs: `docs/INTERFACES.md` describes CAS grammar, delta rules, and operational runbooks sourced from compiler output; `docs/SECURITY.md` records threat model. **Status:** Complete — CAS provider, cas-tool, model bindings, compiler v1.4 CAS fields, doc snippets, and regression coverage are aligned and green. **Commands** - `cargo test -p nine-door` - `cargo test -p cas-tool` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/cas_roundtrip.coh` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/model_cas_bind.coh` **Checks (DoD)** - Resume logic validated via regression script; delta application is idempotent and verified by hashing installed payloads before/after. - Signing path tested with fixture keys; unsigned mode explicitly documented and requires manifest acknowledgement (e.g., `cas.signing.required = false`). - Compiler rejects manifests where CAS storage exceeds event-pump memory budgets or chunk sizes exceed `msize`. - Re-run the Regression Pack and verify that enabling CAS does not change baseline NineDoor error codes or 9P limits (e.g., `msize`, walk depth) enforced by earlier milestones. - CAS fetch paths MUST NOT alter 9P latency or error codes for non-CAS workloads; regression pack MUST prove no change in baseline attach/log/tail flows. - Model binding test proves `/models/` mounts remain read-only and integrate with worker namespaces without introducing new services; manifest gating (e.g., `ecosystem.models.enable`) controls exposure. - Abuse case: hash mismatch or signature verification failure rejects chunk and leaves partial downloads quarantined with deterministic audit. **Compiler touchpoints** - Codegen emits CAS provider tables and host-tool manifest templates; docs ingest the same JSON to prevent drift. - Regeneration guard checks CAS manifest fingerprints against committed artefacts. - Manifest validation ties CAS model exposure to `ecosystem.models.enable` and ensures model artefact sizes respect existing Secure9P `msize` and walk-depth limits. **Task Breakdown** ``` Title/ID: m17-cas-provider Goal: Implement CAS provider and manifest validation for updates/models. Inputs: apps/nine-door/src/host/cas.rs, configs/root_task.toml cas.* fields. Changes: - apps/nine-door/src/host/cas.rs — chunk integrity checks, delta packs, signature enforcement. - tools/coh-rtc/src/codegen/cas.rs — emit IR v1.4 fields and templates. Commands: - cargo test -p nine-door --test cas_provider - cargo test -p tools/coh-rtc Checks: - Hash mismatch causes ERR and quarantine; chunk_size > msize rejected at compile time. Deliverables: - CAS grammar documented in docs/INTERFACES.md with compiler snippets. Title/ID: m17-cas-regressions Goal: Validate end-to-end CAS roundtrip and model binding. Inputs: scripts/cohsh/cas_roundtrip.coh, scripts/cohsh/model_cas_bind.coh, apps/cas-tool/. Changes: - apps/cas-tool/src/main.rs — bundle creation, manifest generation, upload helper. - scripts/cohsh/cas_roundtrip.coh — resume + signature paths including negative signature case. - scripts/cohsh/model_cas_bind.coh — bind model into worker namespace and assert read-only. Commands: - cargo test -p cas-tool - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/cas_roundtrip.coh - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/model_cas_bind.coh Checks: - Replay after interruption resumes without duplication; signature failure returns deterministic ERR and audit. Deliverables: - Regression outputs stored; docs/SECURITY.md updated with CAS threat model references. ``` --- ## Milestone 18 — Field Bus & Low-Bandwidth Sidecars (Host/Worker Pattern) [Milestones](#Milestones) **Status:** Reopened — the bounded `m18-remove-hallucinated-lora-radio` defect correction, discovered during the Milestone 26c documentation audit, closed on 2026-07-15, but the later production-surface audit found that the claimed live MODBUS/DNP3 delivery path is still only an in-memory model. `BusAdapter` returns `Delivered` while online without performing protocol I/O, and the MODBUS and DNP3 types are aliases over that queue. The compiler-declared namespace and bounded-spool model remain useful, but they are not live protocol integration evidence. This reopened scope is limited to completing the original host-side MODBUS/DNP3 promise; `worker-bus` remains the one intentionally model/session- only Worker role. Historical references that attached a radio subsystem to lowercase `lora` identifiers are invalid: Cohesix does not implement or target that subsystem. `LoRA`, `worker-lora`, and lowercase `lora` identifiers refer only to the AI adapter/model lifecycle. ```text Title/ID: m18-remove-hallucinated-lora-radio Milestone: Milestone 18 — Field Bus & Low-Bandwidth Sidecars / reopened defect discovered by Milestone 26c README-linked documentation remediation Goal: Remove the fabricated radio subsystem attached to lora identifiers while preserving the declared bounded MODBUS/DNP3 sidecar model for the separately reopened live-delivery task and the root-owned AI LoRA receipt model. Inputs: tools/coh-rtc/src/{ir.rs,codegen}, configs/root_task*.toml, apps/{sidecar-bus,worker-lora,nine-door,root-task}, scripts/cohsh/sidecar_integration.coh, README.md, docs/{GLOSSARY,INTERFACES,SECURITY,ROLES_AND_SCHEDULING,USE_CASES}.md, generated artifacts, current tests, immutable release snapshots. Changes: - tools/coh-rtc, source manifests, and generated artifacts — remove sidecars.lora, the /lora radio namespace, regional-band, transmit, duty-cycle, payload, and radio-tamper schema and outputs; retain AI LoRA worker-role and PEFT schema. - apps/sidecar-bus, apps/worker-lora, apps/nine-door, and apps/root-task — remove radio-only APIs and namespace handlers; keep WorkerLora as a bounded AI lifecycle-receipt Worker with no training, inference, model loading, or GPU access in the VM. - scripts/cohsh and tests — remove radio assertions and add regressions that reject the retired manifest surface and preserve AI LoRA receipt behavior. - README.md and canonical docs — define LoRA once as low-rank adaptation, remove all current radio claims, and cross-reference the Queen export and host PEFT lifecycle contracts. - releases/ — leave published snapshots immutable; record the false historical radio claims as superseded current-documentation errata and exclude them from current as-built truth. Commands: - cargo fmt --all -- --check - cargo test -p coh-rtc - cargo test -p worker-lora - cargo test -p sidecar-bus --features modbus,dnp3 - cargo test -p nine-door - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib ninedoor::tests - cargo test -p cohsh --test script_catalog - cargo check -p worker-lora --target aarch64-unknown-none - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo test --workspace -- --test-threads=1 - SEL4_BUILD_DIR=seL4/SMP_build cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-qemu - SEL4_BUILD_DIR=seL4/build_UBOOT cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4 - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --sel4-kernel-source-dir "$HOME/seL4_16" - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --list - cargo audit - cargo deny check advisories Checks: - Current source, manifests, generated artifacts, tests, scripts, and canonical docs contain no radio-specific region, transmission, duty-cycle, or radio-tamper behavior or claim under lora identifiers. - sidecars.lora is rejected as an unknown manifest field; the MODBUS/DNP3 model still passes its bounded-spool and authority tests without those tests being labelled live protocol evidence. - The root-owned WorkerLora receipt model remains available without claiming an executable target role, and /queen/export/lora_jobs plus host PEFT policy remain unchanged. - Generated-artifact drift, focused tests, workspace checks, local links, Markdown structure, and GitHub Mermaid validation pass. Deliverables: Corrected compiler/runtime/docs suite, regenerated default-profile artifacts, regression evidence, and a release erratum without mutating historical release bundles. ``` **Closure evidence (2026-07-15):** The task commands pass. Compiler schema v1.6 rejects `sidecars.lora`; the canonical resolved-manifest SHA-256 is `376f09a49cdb37c07ae8ef007d4d4c715df4b4f949d4d6c1546002108d495599`. The QEMU package and stage-only Pi build regenerated their rootservers and elfloader images; the retired radio paths and identifiers are absent from those artifacts. Current source and canonical documentation scans contain only the AI LoRA meaning, intentional negative tests, and this correction record. Historical release snapshots remain unchanged and are explicitly superseded by `docs/audit/M26C_DOC_DRIFT_LEDGER.md` entry `M26C-DOC-019`. **Separate repository gate at that checkpoint:** On 2026-07-15, the regenerated `seL4/build_UBOOT/elfloader/archive.archive.o.cpio` was 5,001,728 bytes against the mandatory 4 MiB limit; the preceding checked-in artifact was 5,005,824 bytes. The correction therefore reduced the archive by 4 KiB and did not introduce the breach. Later Milestone 26d repository-gate work restored the invariant; the current tracked seL4 16 archive is 3,237,888 bytes. The historical figures remain evidence for that checkpoint, not a current blocker or capacity available for in-place rootserver replacement. **Why now (context):** Remaining edge use cases depend on deterministic adapters for industrial buses. Implementing them as sidecars preserves the lean `no_std` core while meeting operational demands. **Goal** Deliver host-side adapters that bridge MODBUS and DNP3 into NineDoor namespaces, driven by compiler-declared mounts and capability policies. **Deliverables** - Host-side sidecar framework (`apps/sidecar-bus`) offering async runtimes on macOS/Linux with feature gates to keep VM artefacts `no_std`. Sidecars communicate via Secure9P transports or serial overlays without embedding TCP servers in the VM. - A recognized `worker-bus` template and generated `/bus/*` control/telemetry contract. Current selected profiles still mark the target Worker role as not implemented; the host-side provider remains the as-built integration path. - Compiler schema v1.6 fields `sidecars.modbus` and `sidecars.dnp3` describing mounts, baud/link settings, and capability scopes; validation keeps resources within the event-pump budget. - Documentation updates (`docs/ARCHITECTURE.md §12`, `docs/INTERFACES.md`) illustrating the sidecar pattern, security boundaries, and testing strategy. - `scripts/cohsh/sidecar_integration.coh` integrated into the regression pack DoD. **Historical completion boundary:** The MODBUS/DNP3 host-side framework, compiler-declared `/bus` contract, CLI regression coverage, and documentation remain accepted only as a contract/model baseline. They do not prove serial or TCP protocol delivery, remote acknowledgement, restart-safe replay, or live interoperability. Milestone 17 boundary remains `3e6faa33410af58ed8d1942ce58ab701a276b882`. The invalid radio-specific `lora` surface described above has been removed; that radio-only defect is closed, while the live MODBUS/DNP3 delivery defect remains reopened as scoped above. ```text Title/ID: m18-live-modbus-dnp3-sidecars Milestone: Milestone 18 — Field Bus & Low-Bandwidth Sidecars / reopened live-delivery defect discovered by the Milestone 28b1 production-surface audit Goal: Replace the in-memory online-delivery model with real bounded host-side MODBUS RTU/TCP and DNP3 client adapters while keeping WorkerBus model/session-only. Inputs: apps/sidecar-bus/**, apps/host-sidecar-bridge/**, tools/coh-rtc/src/**, configs/root_task*.toml, scripts/cohsh/sidecar_integration.coh, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, docs/TEST_PLAN.md, and the 28b1 provider/integration registry contract. Changes: - tools/coh-rtc/src/** + configs/root_task*.toml — generate exact MODBUS unit/register/coil maps and DNP3 outstation/object/variation maps, serial/TCP endpoint bounds, polling/deadline/reconnect policy, read actions, separately approved write/control allowlists, capability scopes, spool durability, and evidence requirements; reject free-form addresses, functions, objects, or control payloads. - apps/sidecar-bus/** — add a host executable and real bounded MODBUS RTU/TCP and DNP3 client codecs/transports. `Delivered` is emitted only after the remote protocol acknowledgement; exception/status codes, timeout, disconnect, partial frame, duplicate, and reconnect map to typed Cohesix outcomes. No protocol stack or TCP listener enters the VM. - apps/sidecar-bus/** — replace drain-before-ack with a crash-safe bounded WAL/spool carrying sequence, target, operation fingerprint, attempt state, acknowledgement, and deadletter status. Restart resumes unacknowledged entries without silently dropping or duplicating a write. - apps/host-sidecar-bridge/** + NineDoor host projection — publish authenticated, versioned, TTL-bound read snapshots and approved terminal action receipts over the existing Secure9P/host-ticket surfaces; stale or absent links withdraw state instead of returning success. - interoperability and packaging — add deterministic protocol simulators plus at least one live RTU/TCP and DNP3 interoperability transcript per supported host profile, negative safety/refusal cases, exact package manifests, hardened service definitions, and evidence-pack reconstruction. - canonical docs and historical errata — describe the contract/model baseline separately from live provider acceptance and correct prior claims without mutating historical release snapshots. Commands: - cargo test -p sidecar-bus --features modbus,dnp3 - cargo test -p host-sidecar-bridge - cargo test -p coh-rtc - scripts/ci/provider_conformance_run.sh --provider modbus --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m18-modbus - scripts/ci/provider_conformance_run.sh --provider dnp3 --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m18-dnp3 - scripts/cohsh/run_regression_batch.sh - scripts/check-generated.sh Checks: online delivery performs real protocol I/O and requires the matching remote acknowledgement; serial/TCP framing, exception/status mapping, reconnect, duplicate suppression, WAL recovery, bounds, authorization, read-only defaults, separately approved controls, namespace publication, and package manifests pass; absent or stale providers are typed unavailable; no mock, simulator, queue-only result, or WorkerBus model state can satisfy live provider or production use-case evidence. Deliverables: Real host-only MODBUS/DNP3 integrations, durable acknowledgement-aware delivery, exact live conformance evidence, and an explicitly model-only WorkerBus boundary. ``` **Use-case alignment** - Industrial IoT gateways (Edge §1) gain MODBUS integration without bloating the VM. - Energy substations (Edge §2) receive DNP3 scheduling and signed config updates. **Commands** - `cargo test -p worker-bus` - `cargo test -p sidecar-bus --features modbus,dnp3` - `cohsh --script scripts/cohsh/sidecar_integration.coh` **Checks (DoD)** - Sidecars operate within declared capability scopes; attempts to access undeclared mounts are rejected and logged. - Offline telemetry spooling validated for MODBUS/DNP3 adapters with manifest-driven limits. - For this milestone, run the full Regression Pack both under QEMU and (where applicable) on the target hardware profile, and treat any divergence between the two as a bug unless explicitly documented. - Sidecar mounts MUST NOT introduce new `/bus` names that collide with legacy namespaces; compiler must hash-prefix automatically if conflicts appear. - Abuse case: unauthorized write into a sidecar mount returns `ERR` and an audit record. **Compiler touchpoints** - IR v1.6 ensures mounts, roles, and quotas for sidecars, generating documentation tables and manifest fragments consumed by host tooling. - Validation prevents enabling sidecars without corresponding host dependencies or event-pump capacity. **Task Breakdown** ``` Title/ID: m19-sidecar-framework Goal: Build the host sidecar framework and bounded bus template. Inputs: apps/sidecar-bus/, apps/worker-bus/, configs/root_task.toml sidecars.modbus and sidecars.dnp3. Changes: - apps/sidecar-bus/src/lib.rs — capability-scoped adapters with feature gates for modbus/dnp3. Commands: - cargo test -p sidecar-bus --features modbus,dnp3 - cargo test -p worker-bus Checks: - Unauthorized mount access returns ERR; bounded spool behavior is verified in tests. Deliverables: - Sidecar patterns documented in docs/ARCHITECTURE.md and docs/INTERFACES.md. Title/ID: m19-cli-regressions Goal: Validate manifest-gated mounts and offline spooling behaviour. Inputs: scripts/cohsh/sidecar_integration.coh, Regression Pack. Changes: - scripts/cohsh/sidecar_integration.coh — mount enable/disable checks, offline spool replay, unauthorized write attempt. - docs/SECURITY.md — note on namespace collision avoidance via hash-prefix. Commands: - cohsh --script scripts/cohsh/sidecar_integration.coh Checks: - Disabled manifest hides mounts; offline spool flushes deterministically; unauthorized write produces ERR and audit. Deliverables: - CLI transcript stored; manifest hash updated in docs. ``` --- ## Milestone 19 — `cohsh-core` Extraction (Shared Grammar & Transport) [Milestones](#Milestones) **Why now (compiler):** UI and automation consumers need a shared grammar without duplicating console logic. Extracting a core library keeps ACK/ERR stability while enabling multiple frontends. **Goal** Publish a reusable `cohsh-core` crate with shared verb grammar and transports that mirror console semantics. cohsh-core is a grammar + transport library only; it adds no new verbs or semantics. **Deliverables** - New crate `crates/cohsh-core/` encapsulating verb grammar (`attach`, `tail`, `spawn`, `kill`, `quit`), ACK/ERR/END model, login throttling, and ticket checks. Supports `no_std + alloc` with optional smoltcp TCP transport feature. - Golden transcript fixtures covering serial, TCP, and in-process transports to prove byte-identical ACK/ERR sequences. - CLI harness using `cohsh-core` to ensure parity with existing `cohsh` commands; docs reference the shared grammar. **Status:** Complete — cohsh-core grammar/ACK models are shared by console and CLI, transcript parity is enforced across transports, and coh-rtc emits guarded grammar/policy snippets. **Commands** - `cargo test -p cohsh-core` - `cargo test -p cohsh --tests` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh` **Checks (DoD)** - Console serial/TCP and `cohsh-core` transport fixtures remain byte-identical; focused `cohsh` tests bind the CLI projection to the shared grammar. - Heapless build passes; no unbounded allocations and no POSIX dependencies. - Abuse case: invalid ticket or throttled login returns deterministic ERR without advancing state; fixture captures denial. - UI/CLI/console equivalence MUST be preserved: ACK/ERR/END sequences must remain byte-stable relative to the 7c baseline. **Compiler touchpoints** - `coh-rtc` emits grammar snippets and ticket policies into docs/USERLAND_AND_CLI.md; regeneration guard ensures hash alignment with `cohsh-core` fixtures. **Task Breakdown** ``` Title/ID: m19-core-crate Goal: Extract shared verb grammar and transports into cohsh-core. Inputs: apps/cohsh/src/lib.rs existing grammar, scripts/cohsh/boot_v0.coh fixtures. Changes: - crates/cohsh-core/lib.rs — verb parser, ACK/ERR model, smoltcp TCP transport feature. - apps/cohsh/src/lib.rs — refactor to consume cohsh-core. Commands: - cargo test -p cohsh-core - cargo test -p cohsh --tests Checks: - Invalid ticket returns deterministic ERR; heapless build passes without allocations beyond bounded buffers. Deliverables: - Shared crate and regenerated grammar snippets in docs/USERLAND_AND_CLI.md. Title/ID: m19-transcript-harness Goal: Ensure transcript parity across console/TCP/core transports. Inputs: scripts/cohsh/boot_v0.coh, new tests in crates/cohsh-core/tests/transcripts.rs. Changes: - crates/cohsh-core/tests/transcripts.rs — compare serial vs TCP vs in-process transcripts. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh - cargo test -p cohsh-core --test transcripts Checks: - Transcript diff produces zero-byte delta; abuse case with throttled login emits ERR and matches across transports. Deliverables: - Stored golden fixtures owned by the focused transcript test. ``` --- ## Milestone 20a — `cohsh` as 9P Client Library [Milestones](#Milestones) **Why now (compiler):** Automation and UI need a library-level 9P client that reuses grammar without console coupling. A first-class client library keeps ordering/idempotency intact. **Goal** Refactor `cohsh` into a reusable 9P client library with helpers for control verbs and streaming tails. **Deliverables** - `CohClient` exposing `open/read/write/clunk` plus `tail()` streaming helper built atop `cohsh-core` 9P transport. - Convenience helpers for `/queen/ctl` JSON (`spawn`, `kill`, `budget`) with manifest-derived defaults. - Script harness replaying sessions via 9P (not console) to validate identical semantics; golden fixtures maintained. **Commands** - `cargo test -p cohsh --test client_lib` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh` **Checks (DoD)** - `tail()` stream over 9P matches console stream identically; diff harness reports zero variance. - `spawn/kill` via file writes produce identical ACK/ERR semantics; clients may retry explicitly; operations are designed to be idempotent where applicable. - Abuse case: attempt to walk `..` or access disabled namespace returns deterministic ERR without affecting state. - UI/CLI/console equivalence MUST be preserved: ACK/ERR/END sequences must remain byte-stable relative to the 7c baseline. **Compiler touchpoints** - Manifest-derived paths and defaults emitted by `coh-rtc` into client templates; docs updated via snippets. **Task Breakdown** ``` Title/ID: m20a-client-api Goal: Build CohClient library with tail and control helpers. Inputs: apps/cohsh/src/lib.rs, crates/cohsh-core transport. Changes: - apps/cohsh/src/client.rs — CohClient struct with open/read/write/clunk and tail helper. - apps/cohsh/src/queen.rs — spawn/kill/budget helpers wrapping JSON writes. Commands: - cargo test -p cohsh --test client_lib - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/boot_v0.coh Checks: - Walking `..` or disabled namespace returns ERR; tail stream matches console transcript. Deliverables: - Client API docs in docs/USERLAND_AND_CLI.md via compiler snippet. Title/ID: m20a-replay-harness Goal: Replay sessions over 9P and compare to console baselines. Inputs: scripts/cohsh/session_pool.coh, new regression harness for 9P replay. Changes: - scripts/cohsh/session_pool.coh — add 9P-only replay path and abuse case for forbidden walk. - apps/cohsh/tests/client_lib.rs — compares ACK/ERR across transports without a one-line repository wrapper. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh Checks: - Replay harness shows zero diff between 9P and console outputs; abuse case logs ERR without side effects. Deliverables: - Updated regression pack metadata and manifest hashes. ``` **Status:** Complete — CohClient API and queen helpers are in tree, client defaults are compiler-emitted, and the 9P replay harness matches console transcripts with regression coverage. --- ## Milestone 20b — NineDoor UI Providers [Milestones](#Milestones) **Why now (compiler):** UI surfaces need read-only summaries without adding protocols. Providers must reuse existing `/proc` mechanics and stay bounded. **Goal** Expose UI-friendly read-only providers under NineDoor with cursor-resume semantics and CBOR/text variants. **Deliverables** - Providers for `/proc/9p/{sessions,outstanding,short_writes}`, `/proc/ingest/{p50_ms,p95_ms,backpressure}`, `/policy/preflight/{req,diff}`, `/updates//{manifest.cbor,status}` with deterministic EOF and 32 KiB read bounds. - CBOR and text outputs aligned with manifest schemas; cursor resume for long reads. - UI fixtures documenting provider outputs for SwarmUI and CLI parity. **Commands** - `cargo test -p nine-door --test ui_providers` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/observe_watch.coh` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/cas_roundtrip.coh` **Checks (DoD)** - Each provider ≤ 8192 bytes per 9P read; larger outputs must be cursor-resumed over multiple reads with deterministic EOF; fuzzed frames don’t panic or allocate unboundedly. - Abuse case: request for disabled provider or oversized read returns deterministic ERR and audit line. - UI/CLI/console equivalence MUST be preserved: ACK/ERR/END sequences must remain byte-stable relative to the 7c baseline. **Compiler touchpoints** - Manifest toggles for UI providers emitted via `coh-rtc` and referenced in docs/INTERFACES.md and docs/ARCHITECTURE.md. **Task Breakdown** ``` Title/ID: m20b-provider-impl Goal: Implement bounded UI providers with CBOR/text outputs. Inputs: apps/nine-door/src/host/{observe.rs,policy.rs,updates.rs}, manifest toggles. Changes: - apps/nine-door/src/host/observe.rs — add text + CBOR variants with cursor resume. - apps/nine-door/src/host/policy.rs — /policy/preflight providers with diff output. Commands: - cargo test -p nine-door --test ui_providers - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/observe_watch.coh Checks: - Disabled provider returns ERR; read beyond 32 KiB rejected; fuzz harness passes without panics. Deliverables: - Provider docs and CBOR schemas refreshed in docs/INTERFACES.md. Title/ID: m20b-updates-status Goal: Surface update status for UI consumption via NineDoor. Inputs: apps/nine-door/src/host/cas.rs status hooks, scripts/cohsh/cas_roundtrip.coh. Changes: - apps/nine-door/src/host/cas.rs — expose /updates//{manifest.cbor,status} read-only nodes. - scripts/cohsh/cas_roundtrip.coh — add status fetch and disabled-provider abuse case. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/cas_roundtrip.coh Checks: - Status node respects cursor resume; disabled updates return ERR without touching CAS store. Deliverables: - UI fixture outputs stored; docs reference status grammar. ``` **Status:** Complete — UI providers are manifest-gated with bounded cursor-resume semantics, CBOR/text parity, and audit-deny paths; tests and regression pack are green. --- ## Milestone 20c — SwarmUI Desktop (Tauri, Pure 9P/TCP) [Milestones](#Milestones) **Why now (compiler):** Desktop operators need a UI that *reflects the namespace* and reuses the existing 9P grammar without introducing new transports or control semantics. SwarmUI must prove strict parity with CLI behavior and respect ticket-scoped authority. **Goal** Deliver a SwarmUI desktop (Tauri) that speaks 9P via `cohsh-core`, renders namespace-derived telemetry and fleet views, and supports deterministic offline inspection via cached CBOR snapshots. SwarmUI adds **no new verbs** and **no in-VM services**. SwarmUI is a thin presentation layer only: all protocol semantics, state machines, parsing, and policy live in Rust (cohsh-core); any WASM or frontend code is rendering-only and must not implement verbs, retries, background polling, caching policy, or independent state. **Deliverables** - `apps/swarmui/` Tauri app with Rust backend linked to `cohsh-core`; **host-only**, no HTTP/REST dependencies. - Namespace-driven panels: - **Telemetry Rings** (tail `/worker/*/telemetry`). - **Fleet Map** (read `/proc/ingest/*` + worker directories). - Optional **Namespace Browser** (read-only tree over `/proc`, `/queen`, `/worker`, `/log`, `/gpu`, indicating read/append-only paths). - Offline inspection via bounded CBOR cache under `$DATA_DIR/snapshots/` (opt-in; read-only when offline). - Ticket/lease auth identical to CLI; **per-ticket session views** supported; role-scoped interactions enforced client-side. **Commands** - `cargo test -p cohsh-core` - `cargo test -p swarmui` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh` **Checks (DoD)** - UI renders telemetry with exact `OK …` then stream and terminates with `END`; transcript matches CLI byte-for-byte. - Build proves no HTTP/REST dependencies (static link audit or cargo deny). - Abuse case: expired or unauthorized ticket returns `ERR` surfaced verbatim in UI and logs audit; offline mode uses cached CBOR without network or retries. - UI/CLI/console equivalence MUST be preserved: ACK/ERR/END sequences remain byte-stable relative to the 7c baseline. - SwarmUI performs no background polling outside an active user view/session; no hidden watchers when idle. **Compiler touchpoints** - UI defaults (paths, cache size, ticket scope) emitted by `coh-rtc` for SwarmUI config; `docs/USERLAND_AND_CLI.md` references the same sources of truth. **Task Breakdown** ``` Title/ID: m20c-ui-backend Goal: Wire SwarmUI backend to cohsh-core with 9P-only transport and per-ticket sessions. Inputs: apps/swarmui/src-tauri/, crates/cohsh-core, scripts/cohsh/telemetry_ring.coh. Changes: - apps/swarmui/src-tauri/main.rs — session management (per ticket), ticket auth, telemetry tail via cohsh-core. - apps/swarmui/Cargo.toml — ensure no HTTP/REST deps; enable bounded offline cache feature. Commands: - cargo test -p swarmui - cargo run -p cohsh –-features tcp – –transport tcp –script scripts/cohsh/telemetry_ring.coh Checks: - Unauthorized ticket returns ERR surfaced verbatim in UI; offline mode reads CBOR snapshot only. Deliverables: - UI backend notes and cache path documented in docs/USERLAND_AND_CLI.md. Title/ID: m20c-ui-fixtures Goal: Capture UI/CLI transcript parity and namespace-derived fleet rendering. Inputs: UI snapshot fixtures, /proc/ingest providers. Changes: - apps/swarmui/tests/transcript.rs — compare UI-captured ACK/ERR/END to CLI golden. - apps/swarmui/src/cache.rs — snapshot write/read with strict size bounds and expiry handling. Commands: - cargo test -p swarmui –test transcript - cargo test -p cohsh-core Checks: - Transcript diff zero; cache bounded to documented size; expired cache rejected gracefully. Deliverables: - Updated docs/INTERFACES.md with SwarmUI consumption guidance and non-goals. ``` **Status:** Complete — SwarmUI desktop is wired to cohsh-core with ticket-scoped sessions, transcript parity tests, bounded offline cache, and no-HTTP dependency enforcement; regression pack remains green. --- ## Milestone 20d — SwarmUI Live Hive Rendering (PixiJS, GPU-First) [Milestones](#Milestones) **Why now (SwarmUI):** Milestone 20d proves SwarmUI can act as a strict, ticket-scoped presentation layer over the 9P namespace with byte-stable CLI parity. The remaining risk is visual overload or architectural drift (SVG/D3 DOM graphs, UI-invented state, per-event rendering). This extension locks in a **single, elegant, GPU-first “Live Hive” renderer** that is visually compelling while remaining protocol-faithful, deterministic, and bounded. **Goal** Extend SwarmUI with a PixiJS-backed “Live Hive” view that renders agents, work, and flow as a continuous simulation derived solely from existing telemetry and event streams. The renderer introduces **no new verbs**, **no new transports**, and **no UI-owned control logic**. All authority, parsing, and semantics remain in Rust (`cohsh-core`). SwarmUI remains a thin presentation layer: frontend code renders only. All protocol behavior, retries, caching policy, and state machines live in Rust. Any frontend logic must be strictly lossy, bounded, and discardable. ### Deliverables - **Live Hive Canvas** - PixiJS (WebGL) scene embedded in SwarmUI. - Visual primitives: - **Agents (“bees”)** — sprites with subtle motion and state-based glow. - **Work/messages (“pollen”)** — short-lived particles flowing between agents. - **Load/health** — aura intensity or soft heat field derived from telemetry. - **Errors** — transient pulse/shockwave effects surfaced from `ERR` events. - **Namespaces/groups** — faint, collapsible cluster hulls mapped from namespace paths. - SVG permitted **only** for labels and selection overlays; never for core rendering. - **Simulation Model (Frontend)** - Lightweight, ephemeral world model decoupled from the render loop: - agent positions/velocities/state flags - ephemeral flows/messages - optional low-resolution heat grid - Fixed or semi-fixed update step; render capped (30–60fps). - Explicit level-of-detail rules: - Zoomed out → clusters + aggregate flow intensity. - Zoomed in → individual agents + per-message particles. - Under load → degrade to edge intensity; never drop frames. - **Event Ingestion Contract** - Consume the same event streams used by telemetry panels (`tail` over namespace paths). - Event → simulation diff mapping only; no per-event draw guarantees. - No UI-specific protocol extensions. - **Replay & Demo Mode** - Live Hive can be driven entirely from: - recorded transcripts - cached CBOR snapshots - Deterministic playback for demos, regression tests, and offline inspection. ### Non-Goals - No SVG/D3 graph as the primary renderer. - No Web-only (WASM-only) SwarmUI target yet. - No UI-invented orchestration, scheduling, or heuristics. - No attempt to visualise every raw event individually. ### Commands - `cargo test -p cohsh-core` - `cargo test -p swarmui` - `cargo run -p swarmui -- --replay $DATA_DIR/snapshots/demo.cbor` ### Checks (DoD) - Live Hive renders identically when driven by: 1) a live Cohesix node 2) a recorded transcript - UI actions emit byte-identical `ACK/ERR/END` sequences to CLI for equivalent verbs. - Sustained high event rates do not reduce UI responsiveness or violate frame caps. - No HTTP/REST dependencies introduced; no background polling outside active views. - Renderer remains discardable: restarting the UI reconstructs state solely from streams/snapshots. ### Compiler Touchpoints - UI defaults (hive LOD thresholds, frame caps, snapshot limits) emitted by `coh-rtc`. - `docs/INTERFACES.md` updated to describe Live Hive as a **rendering view only**, not a control surface. ### Task Breakdown ``` Title/ID: m20d-hive-renderer Goal: Add GPU-first Live Hive renderer without altering protocol semantics. Inputs: apps/swarmui/, crates/cohsh-core, telemetry streams, CBOR snapshots. Changes: - apps/swarmui/frontend/hive/ — PixiJS scene, simulation model, LOD rules. - apps/swarmui/frontend/events.js — event → simulation diff mapping. - apps/swarmui/src-tauri/ — replay mode wiring (no new verbs). Commands: - cargo test -p swarmui - cargo run -p swarmui – –replay demo.cbor Checks: - Frame rate bounded; transcript parity preserved; no new deps. Deliverables: - Live Hive view documented as non-authoritative renderer in docs/INTERFACES.md. Title/ID: m20d-hive-fixtures Goal: Prove deterministic rendering and replay stability. Inputs: golden transcripts, CBOR snapshots. Changes: - apps/swarmui/tests/replay.rs — snapshot-driven render smoke tests. - docs/INTERFACES.md — Live Hive non-goals and degradation rules. Commands: - cargo test -p swarmui –test replay Checks: - Replay produces stable visual state; expired snapshots rejected cleanly. Deliverables: - Golden demo snapshots committed for CI and demos. Title/ID: m20d-design-fonts Goal: Establish a cross-platform, UI-safe font system aligned with Tauri and PixiJS best practices. Inputs: apps/swarmui/, design guidelines, Tauri asset bundling. Changes: - apps/swarmui/frontend/assets/fonts/ — bundle Inter and JetBrains Mono font files (limited weights only). - apps/swarmui/frontend/styles/fonts.css — define canonical font stacks and defaults. - apps/swarmui/frontend/styles/tokens.css — expose font tokens (`--font-ui`, `--font-mono`, sizes, line-heights). - Disable ligatures by default for monospace; expose opt-in toggle. Commands: - cargo test -p swarmui Checks: - Fonts load from local assets only (no system or network dependency). - Text renders consistently across macOS, Windows, and Linux. Deliverables: - Documented font policy and usage rules in docs/INTERFACES.md. Title/ID: m20d-design-colors Goal: Define a minimal, dark-first color system shared by HTML UI and PixiJS hive renderer. Inputs: SwarmUI frontend, PixiJS renderer. Changes: - apps/swarmui/frontend/styles/colors.css — base palette, semantic colors, opacity rules. - apps/swarmui/frontend/styles/tokens.css — color tokens shared by UI and canvas overlays. - apps/swarmui/frontend/hive/palette.js — PixiJS color constants derived from tokens. Commands: - cargo test -p swarmui Checks: - No hard-coded colors outside token files. - Semantic colors (ACK/ERR/flow/load) map consistently between UI and hive. Deliverables: - Color token table and usage notes added to docs/INTERFACES.md. Title/ID: m20d-design-layout Goal: Lock down layout, spacing, and panel rules for a dense operator UI. Inputs: SwarmUI frontend panels. Changes: - apps/swarmui/frontend/styles/layout.css — spacing scale (4/8/12/16/24/32), panel rules. - Remove shadows; enforce separation via tone and spacing only. - Standardise panel chrome (headers, dividers, empty states). Commands: - cargo test -p swarmui Checks: - No arbitrary spacing values outside the defined scale. - Panels render consistently across platforms and DPI settings. Deliverables: - Layout and spacing rules documented for contributors. Title/ID: m20d-design-icons Goal: Standardise iconography for SwarmUI controls and panels. Inputs: SwarmUI frontend. Changes: - apps/swarmui/frontend/assets/icons/ — bundle Phosphor Icons SVG subset. - apps/swarmui/frontend/components/icon.js — single icon wrapper enforcing size/weight. - Replace mixed or ad-hoc icons with Phosphor set. Commands: - cargo test -p swarmui Checks: - Single icon set used everywhere. - Icon weights consistent for default vs active states. Deliverables: - Icon usage guidelines added to docs/INTERFACES.md. Title/ID: m20d-hive-visual-language Goal: Define and enforce the visual language for the Live Hive renderer. Inputs: PixiJS hive renderer. Changes: - apps/swarmui/frontend/hive/style.js — shape, motion, glow, and blending constants. - Enforce circle/soft-blob primitives only; no sharp geometry. - Define motion easing and pulse rules for normal vs error states. Commands: - cargo test -p swarmui Checks: - Hive visuals conform to documented motion and shape rules. - Error pulses are single-shot and bounded. Deliverables: - Live Hive visual language documented as non-authoritative rendering rules. Title/ID: m20d-design-tokens Goal: Centralise all design constants into a single token system. Inputs: SwarmUI frontend, PixiJS renderer. Changes: - apps/swarmui/frontend/styles/tokens.css — fonts, colors, spacing, motion. - apps/swarmui/frontend/hive/tokens.js — generated or mirrored constants for PixiJS. - Remove duplicated constants across UI and renderer. Commands: - cargo test -p swarmui Checks: - No duplicated magic numbers in UI or hive renderer. - Token changes propagate consistently. Deliverables: - Single source-of-truth design tokens referenced in docs/INTERFACES.md. ``` **Status:** Complete — Live Hive PixiJS rendering is wired with deterministic replay fixtures, compiler-emitted hive defaults, and documented design tokens; regression pack is green. --- ## Milestone 20e — CLI/UI Convergence Tests [Milestones](#Milestones) **Status:** Complete — the original convergence work established shared grammar and per-frontend transcript fixtures. After the canonical worker namespace became shard-qualified, SwarmUI and coh-status intentionally stopped sharing a zero-byte worker-path fixture with the legacy-alias console/cohsh lane; `docs/TEST_PLAN.md` records their distinct hashes. The obsolete aggregate shell harness was retired in the 2026-08-24 script audit. Current protection is the four focused tests below, not a cross-frontend zero-byte or timing claim. **Why now (compiler):** After UI/CLI/library convergence, each frontend needs deterministic fixture ownership against the shared grammar. **Goal** Establish deterministic transcript-fixture coverage for console, `cohsh`, `cohsh-core`, SwarmUI, and coh-status while keeping each frontend bound to the shared grammar and its current canonical namespace projection. **Deliverables** - Focused golden transcript tests for console, `cohsh`, `cohsh-core`, SwarmUI, and coh-status. - Deterministic failure on unreviewed byte-level fixture drift within each frontend contract. - Frontend-specific transcript fixtures stored in `tests/fixtures/transcripts/` with hashes recorded by TEST_PLAN. **Commands** - `cargo test -p cohsh-core --test transcripts` - `cargo test -p cohsh --test transcripts` - `cargo test -p swarmui --test transcript` - `cargo test -p coh-status --test transcript` **Checks (DoD)** - Each frontend matches its own bound fixture and shared ACK/ERR/END grammar. - Abuse case: an intentionally corrupted fixture triggers a deterministic failure. - Namespace-path differences are limited to the canonical shard path versus an explicitly enabled legacy alias; they are not normalized into a false zero-byte cross-frontend claim. **Compiler touchpoints** - Manifest fingerprints and transcript hashes recorded in docs/TEST_PLAN.md; regeneration guard verifies alignment. **Task Breakdown** ``` Title/ID: m20e-transcript-suite Goal: Build shared transcript fixtures and comparison harness. Inputs: tests/fixtures/transcripts/, console + TCP outputs. Changes: - crates/cohsh-core/tests/transcripts.rs — own serial, TCP, and core fixture parity. - apps/cohsh/tests/transcripts.rs + apps/swarmui/tests/transcript.rs + apps/coh-status/tests/transcript.rs — own each frontend's current namespace projection and fixture. Commands: - cargo test -p cohsh-core --test transcripts - cargo test -p cohsh --test transcripts Checks: - Corrupted fixtures fail deterministically; each focused frontend transcript matches its TEST_PLAN-bound fixture. Deliverables: - Transcript fixtures stored; docs/TEST_PLAN.md references their distinct hashes. Title/ID: m20e-ui-cli-sync Goal: Integrate SwarmUI/coh-status into convergence CI. Inputs: apps/swarmui/tests/transcript.rs, apps/coh-status/tests/transcript.rs. Changes: - apps/swarmui/tests/transcript.rs — capture UI transcript and feed into shared fixtures. - apps/coh-status/tests/transcript.rs — same for status tool. Commands: - cargo test -p swarmui --test transcript - cargo test -p coh-status --test transcript Checks: - UI/CLI/console retain shared ACK/ERR/END grammar while each current namespace projection matches its bound fixture. Deliverables: - CI job definition referencing convergence tests; docs updated with expected tolerances. ``` --- ## Milestone 20f — UI Security Hardening (Tickets & Quotas) [Milestones](#Milestones) **Status:** Complete — Ticket scopes/quotas are enforced; multi-worker cohsh parity, command surface checks, and deterministic regression batching validated; host ticket mint one-shots shipped. **Why now (compiler):** With UI parity established, enforce least privilege and quotas to protect interactive sessions. **Goal** Lock UI/CLI security quotas and console grammar parity while proving cohsh works cleanly with multiple workers and a deterministic regression batch. **Deliverables** - Ticket scopes `{path, verb, rate}` with per-ticket bandwidth and cursor quotas enforced in NineDoor and consumed by UI/CLI. - `PumpMetrics` adds `ui_reads`, `ui_denies`; audit lines emitted for denials with manifest-driven limits. - CLI/UI regression scripts prove permission denials and quota breaches across transports. - Cohsh multi-worker regression coverage exercises spawn/tail/kill across multiple worker telemetry paths without ID drift. - `scripts/cohsh/run_regression_batch.sh` is a reliable manual compliance pack for this milestone (base + gated, deterministic worker-id scripts). - SwarmUI/CLI transcripts retain the shared ACK/ERR/END grammar; each namespace projection remains byte-stable against its own TEST_PLAN-bound fixture. - Cohsh and SwarmUI add host-only ticket mint one-shots that do not alter console grammar. **Commands** - `cargo test -p nine-door --test ui_security` - `cargo test -p cohsh-core` - `cargo test -p cohsh --test transcripts` - `cargo test -p cohsh --test script_catalog` - `cargo test -p swarmui --test security` - `cargo test -p coh-status --test transcript` - `cargo test -p cohsh --test client_lib` - `cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh` - `scripts/cohsh/run_regression_batch.sh` **Checks (DoD)** - Write with read-only ticket → `ERR EPERM` across all transports; denial audited. - Quota breach → `ERR ELIMIT`; audit lines consistent and deterministic; no duplicate frames. - Abuse case: replayed ticket beyond expiry refuses access with deterministic ERR without consuming additional quota. - Multi-worker regression: spawn two workers, tail each telemetry path, kill both, and observe no path errors. - Cohsh command surface checklist passes for queen + worker sessions without console disconnects. - SwarmUI console transport passes transcript/security tests with no grammar drift. - Regression batch passes base + gated with deterministic worker-id scripts and archived logs. - UI/CLI/console equivalence preserved: ACK/ERR/END sequences remain byte-stable relative to the 7c baseline. - Cohsh `--mint-ticket` prints a worker/queen token; SwarmUI "Mint Ticket" button and `--mint-ticket` return the same token format and enforce worker subject requirements. **Compiler touchpoints** - `coh-rtc` emits ticket quota tables and hashes referenced by docs/SECURITY.md and docs/USERLAND_AND_CLI.md; regeneration guard enforces consistency. **Task Breakdown** ``` Title/ID: m20f-ticket-quotas Goal: Enforce per-ticket path/verb/rate quotas with audit metrics. Inputs: apps/nine-door/src/host/security.rs, PumpMetrics. Changes: - apps/nine-door/src/host/security.rs — quota checks, ui_denies/ui_reads metrics. - apps/nine-door/src/host/telemetry/mod.rs — audit lines for denials. Commands: - cargo test -p nine-door --test ui_security Checks: - Quota breach triggers ERR ELIMIT and increments metrics; replayed ticket denied deterministically. Deliverables: - Quota tables documented via compiler output in docs/SECURITY.md. Title/ID: m20f-cli-ui-regressions Goal: Validate quota enforcement and multi-worker parity across CLI and UI clients. Inputs: scripts/cohsh/telemetry_ring.coh, scripts/cohsh/shard_1k.coh, apps/cohsh/tests/script_catalog.rs, apps/swarmui/tests/security.rs. Changes: - scripts/cohsh/telemetry_ring.coh — ensure read-only ticket write attempt and quota exhaustion loop remain deterministic. - scripts/cohsh/shard_1k.coh — add multi-worker coverage (second distinct-role spawn + telemetry checks). - apps/cohsh/tests/script_catalog.rs — refresh script hashes to include updated regression scripts. - apps/swarmui/tests/security.rs — mirror quota abuse from UI. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/telemetry_ring.coh - cargo test -p cohsh --test script_catalog - cargo test -p swarmui --test security Checks: - ERR EPERM/ELIMIT identical across transports; metrics observed in /proc/ingest/watch. - Multi-worker telemetry paths pass `tail` without invalid path errors. Deliverables: - Regression outputs captured; manifest hash noted in docs/USERLAND_AND_CLI.md. Title/ID: m20f-regression-batch-determinism Goal: Make the regression batch deterministic for worker-id dependent scripts and document it in the test plan. Inputs: scripts/cohsh/run_regression_batch.sh, docs/TEST_PLAN.md, resources/proc_tests/selftest_full.coh. Changes: - scripts/cohsh/run_regression_batch.sh — isolate worker-id scripts into dedicated boots and archive logs per script. - resources/proc_tests/selftest_full.coh — align worker ids with deterministic spawn ordering. - docs/TEST_PLAN.md — add regression batch requirements and ordering. Commands: - scripts/cohsh/run_regression_batch.sh Checks: - Regression batch passes with no worker-id drift across scripts. Deliverables: - Updated test plan documenting the manual regression pack. Title/ID: m20f-cohsh-tcp-pool-safety Goal: Stabilize cohsh TCP pooling against the single-console connection while preserving pool bench semantics. Inputs: apps/cohsh/src/transport/tcp.rs, apps/cohsh/src/main.rs, scripts/cohsh/session_pool.coh. Changes: - apps/cohsh/src/transport/tcp.rs — add pooled TCP wrapper that avoids extra ATTACH/QUIT on shared connections. - apps/cohsh/src/main.rs — use pooled TCP wrapper for session pool factory. - apps/cohsh/src/lib.rs — adjust pool bench TCP expectations, payload limits, and skip CAT readback on console transports. - docs/USERLAND_AND_CLI.md — document TCP console pool bench expectations. Commands: - cargo run -p cohsh --features tcp -- --transport tcp --script scripts/cohsh/session_pool.coh Checks: - cohsh interactive commands do not drop the console connection; pool bench reports OK. Deliverables: - Regression logs covering session_pool.coh. Title/ID: m20f-swarmui-console-alignment Goal: Align SwarmUI with the TCP console transport and add telemetry tail support without changing ACK/ERR grammar. Inputs: apps/swarmui/src-tauri/main.rs, apps/swarmui/src/lib.rs, apps/root-task/src/event/mod.rs, apps/root-task/src/ninedoor.rs, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md. Changes: - apps/root-task/src/event/mod.rs — stream telemetry ring contents for tail requests with cursor tracking. - apps/root-task/src/ninedoor.rs — expose worker telemetry reads for console tail. - apps/swarmui/src/lib.rs — add console backend using cohsh transport and server-managed telemetry tails. - apps/swarmui/src-tauri/main.rs — select console vs 9P transport via env settings. - docs/USERLAND_AND_CLI.md — document SwarmUI transport selection and console telemetry tail behavior. - docs/INTERFACES.md — record SwarmUI console transport alignment and non-goals. Commands: - cargo check -p cohsh -p swarmui -p root-task - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp Checks: - SwarmUI connects via console transport and renders live hive updates. - Interactive cohsh command set succeeds against TCP console. Deliverables: - Updated docs and telemetry tail audit logs. Title/ID: m20f-console-frame-integrity Goal: Prevent partial TCP console sends from corrupting frame boundaries for cohsh and SwarmUI sessions. Inputs: apps/root-task/src/net/stack.rs, apps/root-task/src/drivers/virtio/net.rs, logs/qemu-run.log, logs/cohsh-queen-interactive.log. Changes: - apps/root-task/src/net/stack.rs — gate TCP sends on available TX capacity; abort on partial send. - apps/root-task/src/drivers/virtio/net.rs — fix TX written_len accounting to avoid payload truncation on repeated bytes. Commands: - cargo check -p root-task -p cohsh -p swarmui - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp - ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role queen - scripts/cohsh/run_regression_batch.sh Checks: - Interactive cohsh commands (tail, ping, ls, cat, echo, spawn, kill, bind, mount) remain attached without reconnect loops. - SwarmUI console session stays connected and updates hive telemetry. - Applicable regression pack passes with existing contract outputs unchanged. - virtio-net TX logs show written_len == payload_len for console frames; no invalid UTF-8 in console stream. Deliverables: - Updated qemu + cohsh logs showing stable tail output. Title/ID: m20f-console-utf8-safe-truncation Goal: Prevent log truncation from emitting invalid UTF-8 that drops console sessions. Inputs: apps/root-task/src/net/outbound.rs, logs/cohsh-queen-*.log. Changes: - apps/root-task/src/net/outbound.rs — truncate log lines on UTF-8 boundaries; add regression test. Commands: - cargo test -p root-task Checks: - LineBuf truncation preserves valid UTF-8; cohsh no longer drops on bind/mount sequence. Deliverables: - Updated root-task test output; cohsh interactive logs for bind/mount. Title/ID: m20f-console-parity-plan Goal: Capture a reproducible trace of TCP console frame integrity issues and validate cohsh/SwarmUI parity before fixes. Inputs: logs/tcpdump-new-*.log, logs/qemu-run-*.log, apps/root-task/src/net/stack.rs, apps/root-task/src/net/outbound.rs, apps/cohsh/src/transport/tcp.rs, apps/cohsh/src/lib.rs. Changes: - docs/BUILD_PLAN.md — record the console parity debug/validation plan and required logs. - docs/BUILD_PLAN.md — capture interactive vs script-mode differences (auto-log, REPL keepalive, console lock) and trace-correlation checklist. Commands: - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp - COHSH_TCP_DEBUG=1 ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role queen - COHSH_TCP_DEBUG=1 ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role worker - scripts/cohsh/run_regression_batch.sh - rg "Flags \\[R\\]" logs/tcpdump-new-*.log Checks: - Console frames remain valid (no invalid UTF-8 payloads, no send.partial aborts) during the full interactive command surface. - Interactive vs script traces show consistent ACK/ERR/END ordering for log/tail/cat without server-side RST. - Console lock semantics preserved; concurrent attachments require explicit COHSH_CONSOLE_LOCK=0 (debug only). Deliverables: - Updated cohsh/QEMU/tcpdump logs documenting frame integrity and interactive parity. - Trace-correlation notes mapping cohsh commands to tcpdump RST/FIN events. Title/ID: m20f-cohsh-interactive-parity Goal: Ensure interactive cohsh commands and SwarmUI console sessions match script-mode behavior without connection churn. Inputs: apps/root-task/src/event/mod.rs, apps/root-task/src/net/stack.rs, apps/root-task/src/net/console_srv.rs, apps/cohsh/src/transport/tcp.rs, apps/swarmui/src/lib.rs, logs/cohsh-*.log. Changes: - apps/root-task/src/event/mod.rs — align CAT/TAIL streaming with pending stream handling and consistent END emission. - apps/root-task/src/net/stack.rs — tune console send pacing/backpressure handling for stream output; rate-limit `tcp.flush.blocked` audit spam. - apps/root-task/src/net/console_srv.rs — preserve END delivery without reordering stream data lines. - apps/cohsh/src/transport/tcp.rs — harden console stream reads/reconnect logic and enforce exclusive console locking. - apps/swarmui/src/lib.rs — match SwarmUI console error handling to cohsh transport semantics. Commands: - cargo check -p root-task -p cohsh -p swarmui - SEL4_BUILD_DIR=$HOME/seL4/build ./scripts/cohesix-build-run.sh --sel4-build "$HOME/seL4/build" --out-dir out/cohesix --profile release --root-task-features cohesix-dev --cargo-target aarch64-unknown-none --raw-qemu --transport tcp - ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role queen - ./out/cohesix/host-tools/cohsh --transport tcp --tcp-host 127.0.0.1 --tcp-port 31337 --role worker - scripts/cohsh/run_regression_batch.sh Checks: - All interactive cohsh commands succeed without reconnect loops for both queen and worker roles. - SwarmUI console transport remains attached and renders hive updates. - Applicable regression pack passes with existing contract outputs unchanged. Deliverables: - Updated QEMU + cohsh logs validating interactive parity and SwarmUI stability. Title/ID: m20f-ticket-mint-oneshots Goal: Add host-only ticket mint one-shots to cohsh and SwarmUI without changing console grammar. Inputs: configs/root_task.toml, docs/WORKER_TICKETS.md, docs/HOST_TOOLS.md, docs/USERLAND_AND_CLI.md. Changes: - apps/cohsh/src/main.rs — add `--mint-ticket` CLI path with config-backed secrets. - apps/cohsh/src/ticket_mint.rs — shared ticket mint helper (config parsing, defaults, subject validation). - apps/cohsh/tests/ticket_mint.rs — verify minted tickets decode with defaults and subject rules. - apps/cohsh/Cargo.toml — add test dependency for ticket mint fixtures. - apps/swarmui/src-tauri/main.rs — add `--mint-ticket` CLI path and Tauri command for UI button. - apps/swarmui/frontend/index.html — add Mint Ticket controls. - apps/swarmui/frontend/app.js — wire Mint Ticket button to backend. - docs/WORKER_TICKETS.md — document cohsh/SwarmUI one-shot minting. - docs/HOST_TOOLS.md — add CLI usage examples. - docs/USERLAND_AND_CLI.md — document flags and env vars. - docs/TEST_PLAN.md — add the ticket mint test step. Commands: - cargo test -p cohsh --test ticket_mint - cargo test -p swarmui --test security Checks: - Worker roles require subject; queen subject optional. - Minted ticket decodes with the role secret and includes default budgets. Deliverables: - Cohsh/SwarmUI minting examples and updated docs. ``` --- ## Milestone 20f1 — SwarmUI Host Tool Packaging + Tauri API Fix [Milestones](#Milestones) **Status:** Complete — SwarmUI is packaged in cohesix-dev host tools, the Tauri invoke bridge is resilient, and a clean build is warning-free. **Why now (host tools):** SwarmUI must be buildable and runnable from the standard `cohesix-dev` profile, and its frontend must reliably bind to the Tauri backend without changing protocol semantics. **Goal** Ensure SwarmUI is packaged with the `cohesix-dev` host tool set and fix the Tauri invoke bridge so the UI connects without altering 9P/console grammar. **Deliverables** - `cohesix-dev` host tool build includes SwarmUI in `out/*/host-tools`. - SwarmUI frontend uses the supported Tauri invoke bridge (no "Tauri API unavailable"). - SwarmUI defaults to the console TCP port (`31337`) unless overridden by `SWARMUI_9P_PORT`. - Clean `cohesix-dev` build emits no root-task warnings. - Build from a clean `out/` and `target/` completes successfully. **Commands (Mac ARM64)** ```bash rm -rf out target SEL4_BUILD_DIR=$HOME/seL4/build \ ./scripts/cohesix-build-run.sh \ --sel4-build "$HOME/seL4/build" \ --out-dir out/cohesix \ --profile release \ --root-task-features cohesix-dev \ --cargo-target aarch64-unknown-none \ --raw-qemu \ --transport tcp ``` **Checks (DoD)** - SwarmUI binary is present in `out/cohesix/host-tools`. - SwarmUI connects without `ERR CONNECT Tauri API unavailable`. - No changes to ACK/ERR/END grammar or ordering. **Task Breakdown** ``` Title/ID: m20f1-swarmui-packaging Goal: Package SwarmUI with the cohesix-dev host tool set. Inputs: scripts/cohesix-build-run.sh, apps/swarmui/Cargo.toml. Changes: - scripts/cohesix-build-run.sh — include swarmui when cohesix-dev is enabled. Commands: - rm -rf out target - ./scripts/cohesix-build-run.sh --root-task-features cohesix-dev ... Checks: - out/cohesix/host-tools/swarmui exists. Deliverables: - Updated build script; clean build output. Title/ID: m20f1-tauri-invoke-bridge Goal: Fix SwarmUI invoke bridge detection for Tauri. Inputs: apps/swarmui/frontend/app.js. Changes: - apps/swarmui/frontend/app.js — use supported invoke bridge. Commands: - cargo run -p swarmui Checks: - UI connects without "Tauri API unavailable". Deliverables: - Updated frontend invoke path. Title/ID: m20f1-default-port Goal: Align SwarmUI default TCP port with the console listener. Inputs: apps/swarmui/src-tauri/main.rs, crates/net-constants. Changes: - apps/swarmui/src-tauri/main.rs — default to `COHSH_TCP_PORT` when `SWARMUI_9P_PORT` unset. Commands: - cargo run -p swarmui Checks: - SwarmUI connects with no `SWARMUI_9P_PORT` set when QEMU forwards port 31337. Deliverables: - Default port matches console transport. Title/ID: m20f1-clean-build-warnings Goal: Eliminate root-task build warnings during cohesix-dev builds. Inputs: apps/root-task/src/event/mod.rs. Changes: - apps/root-task/src/event/mod.rs — remove unused assignments in log streaming path. Commands: - ./scripts/cohesix-build-run.sh --root-task-features cohesix-dev ... Checks: - No warnings emitted during root-task build. Deliverables: - Clean build with zero root-task warnings. ``` --- ## Milestone 20g — Deterministic Snapshot & Replay (UI Testing) [Milestones](#Milestones) **Status:** Complete — Trace record/replay fixtures and parity tests land across cohsh, SwarmUI, and coh-status; trace policy snippet and hashes align; SwarmUI header branding is live; release bundle replay verified on macOS 26.x and Ubuntu 24 (cohsh + SwarmUI). **Why now (compiler):** To stabilize UI regressions without live targets, we need deterministic trace capture and replay consistent with CLI/console semantics. **Goal** Add trace record/replay across `cohsh-core`, `cohsh`, SwarmUI, and coh-status to enable deterministic UI testing. **Deliverables** - `cohsh-core` trace recorder/replayer for 9P frames + ACKs (`.trace` files) with size targets ≤ 1 MiB per 10 s of tail traffic. - `cohsh` CLI supports `--record-trace ` and `--replay-trace ` via `cohsh-core`; CLI usage is documented in `docs/USERLAND_AND_CLI.md` and referenced in `docs/TEST_PLAN.md`. - SwarmUI “offline replay” mode consuming trace files; docs in `docs/TEST_PLAN.md`. - coh-status offline replay hook for field diagnostics. - SwarmUI frontend header includes the Cohesix SVG branding at the top of the shell. **Commands** - `cargo test -p cohsh-core --test trace` - `cargo test -p cohsh --test trace` - `cargo test -p swarmui --test trace` - `cargo test -p coh-status --test trace` **Checks (DoD)** - Replay reproduces identical telemetry curves and ACK sequences across `cohsh`, SwarmUI, and coh-status; diff harness reports zero delta. - Abuse case: tampered trace (truncated or modified hash) is rejected with deterministic error and no UI state change. - UI/CLI/console equivalence MUST be preserved: ACK/ERR/END sequences must remain byte-stable relative to the 7c baseline. All testing and verification for this milestone is governed by: > **`docs/TEST_PLAN.md` — the sole authority on test phases, execution order, and acceptance criteria.** **Compiler touchpoints** - `coh-rtc` emits trace metadata schema and default size limits into docs/TEST_PLAN.md; regeneration guard verifies hash alignment. **Task Breakdown** ``` Title/ID: m20g-trace-core Goal: Implement trace recorder/replayer in cohsh-core with bounds. Inputs: crates/cohsh-core, tests/fixtures/traces/, docs/TEST_PLAN.md. Changes: - crates/cohsh-core/src/trace.rs — bounded recorder/replayer with hash validation. - crates/cohsh-core/tests/trace.rs — tampered trace negative case. Commands: - cargo test -p cohsh-core --test trace Checks: - Truncated or tampered trace rejected; valid trace replays byte-identical ACK/ERR. Deliverables: - Trace schema referenced in docs/TEST_PLAN.md via compiler snippet. Title/ID: m20g-cohsh-replay Goal: Wire cohsh CLI record/replay to cohsh-core trace format. Inputs: apps/cohsh/src/main.rs, apps/cohsh/src/lib.rs, apps/cohsh/src/trace.rs, tests/fixtures/traces/, tests/fixtures/transcripts/trace_v0/, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md. Changes: - apps/cohsh/src/main.rs — add `--record-trace` and `--replay-trace` CLI entry points using cohsh-core. - apps/cohsh/src/lib.rs — expose trace driver for CLI use. - apps/cohsh/tests/trace.rs — record/replay parity + tamper rejection. Commands: - cargo test -p cohsh --test trace Checks: - cohsh record/replay matches cohsh-core fixtures; tampered trace rejected deterministically. Deliverables: - cohsh trace CLI documented; canonical trace capture path referenced in docs/TEST_PLAN.md. Title/ID: m20g-ui-replay Goal: Add offline replay to SwarmUI and coh-status for deterministic UI tests. Inputs: apps/swarmui/src/transport.rs, apps/swarmui/src-tauri/main.rs, apps/swarmui/tests/trace.rs, apps/coh-status/src/lib.rs, apps/coh-status/tests/trace.rs, docs/TEST_PLAN.md. Changes: - apps/swarmui/src/transport.rs — trace transport factory for replay. - apps/swarmui/src-tauri/main.rs — `--replay-trace` entry point and decoding. - apps/swarmui/tests/trace.rs — trace replay transcript parity. - apps/coh-status/src/lib.rs — trace replay client wrapper + policy. - apps/coh-status/tests/trace.rs — trace replay transcript parity. Commands: - cargo test -p swarmui --test trace - cargo test -p coh-status --test trace Checks: - Replay matches stored trace_v0 transcripts; tampered trace rejected deterministically. Deliverables: - Offline replay documentation; trace fixture in tests/fixtures/traces/trace_v0.trace and transcripts in tests/fixtures/transcripts/trace_v0/. Title/ID: m20g-swarmui-header Goal: Add Cohesix header branding to the SwarmUI shell. Inputs: apps/swarmui/frontend/index.html, docs/COHESIX_LOGO.png, apps/swarmui/frontend/styles/. Changes: - apps/swarmui/frontend/index.html — add Cohesix header at the top of the SwarmUI shell. - apps/swarmui/frontend/styles/ — define header layout and spacing rules. Commands: - cargo test -p swarmui Checks: - Cohesix header renders at the top without disrupting layout or live hive rendering. Deliverables: - SwarmUI displays the Cohesix header consistently across desktop and mobile sizes. ``` ## Milestone 20h — Alpha Release Gate: As-Built Verification, Live Hive Demo, SwarmUI Replay, & Release Bundle [Milestones](#Milestones) **Status:** Complete — Test Plan gates executed (clean build + CLI + regression + packaging), Live Hive + replay demos validated, and macOS/Ubuntu release bundles verified end-to-end. **Why now (compiler):** Milestone 20g defines the point at which Cohesix becomes **control-plane complete and deterministic**. An alpha release is only valid if the **as-built system passes the full Test Plan**, from a clean checkout, with no hidden assumptions. This milestone is a **release gate**, not a feature milestone. It adds **no new architecture, protocols, or semantics**. It exists to prove correctness, operability, and legibility. --- ## Goal 1. **Complete Milestone 20g** exactly as specified in `docs/BUILD_PLAN.md`. 2. Verify the **as-built system** against **all applicable phases in `docs/TEST_PLAN.md`**. 3. Deliver both: - a **Deterministic Replay Demo** (trust, auditability), and - a **Live Hive Demo** (real-time, exciting, but controlled). 4. Produce a **self-contained alpha release bundle** that a third party can run using only: - the bundle - the QEMU runner - `docs/QUICKSTART.md` --- ## Hard Preconditions ### A) Milestone 20g completion (blocking) - All deliverables for Milestone 20g implemented. - All Milestone 20g checks satisfied. - Documentation reflects **as-built** behavior. **Rule:** Milestone 20h MUST NOT be marked *Complete* unless Milestone 20g is already complete. --- ## Testing & Verification (Canonical) All testing and verification for this milestone is governed by: > **`docs/TEST_PLAN.md` — the sole authority on test phases, execution order, and acceptance criteria.** Ad-hoc commands, manual test lists, or one-off scripts **must not** be used as acceptance criteria. They may be *inputs* to the Test Plan, but **DoD is defined only by Test Plan gates**. --- ### B) Clean Build & Reproducibility Gate (Per TEST_PLAN: *Build Integrity* + *Reproducibility* phases) **Requirements** - Remove all build artifacts (`target/`, `out/`, and equivalents). - Rebuild Cohesix from a clean workspace using the canonical build flow. - Re-run `coh-rtc` and verify generated artifacts match committed expectations. **Acceptance** - Clean build succeeds. - No new build warnings remain unaddressed. - No features are disabled or bypassed to achieve a clean build. - Generated artifacts, manifests, and doc snippets are consistent. --- ### C) CLI & Control-Plane Surface Gate (Per TEST_PLAN: *CLI Semantics*, *Role Enforcement*, *Concurrency*) The full `cohsh` command surface MUST be validated via the **CLI test phases** defined in `docs/TEST_PLAN.md`, including: - Queen role coverage - Worker role coverage - Concurrent session behavior - Deterministic ACK/ERR semantics - Negative/denial cases **Key properties verified (via TEST_PLAN)** - Every documented `cohsh` command is exercised. - Role-scoped authority is enforced (queen vs worker). - Concurrent sessions do not corrupt state or reorder acknowledgements. - All failures are explicit, deterministic, and auditable. **Evidence** - Test Plan artifacts (logs, transcripts, or summaries) are collected and referenced. - No manual “it looked right” validation is acceptable. --- ### D) Regression & Stability Gate (Per TEST_PLAN: *Regression*, *Long-Run*, *Non-Regression*) - Execute the **full regression batch** as defined by `docs/TEST_PLAN.md`. - Long-running tests must complete within declared time bounds. - Output drift fails the gate unless explicitly approved and documented. **Acceptance** - All regression phases PASS. - No existing regression tests are weakened. - New tests (if any) are additive and documented. --- ## Demo Deliverables (Post-Gate) Only after all **TEST_PLAN gates pass** may the following demo artifacts be finalized. --- ### 1) Deterministic Replay Demo - Canonical snapshot / trace generated under Milestone 20g. - Canonical trace is shipped in the alpha bundle under `traces/` with its hash for tamper checks. - Used by: - CLI replay demo (`cohsh --replay-trace `) - SwarmUI Replay Mode - Replay produces byte-identical behavior across runs. This demo proves: - determinism - auditability - UI correctness without live risk --- ### 2) Live Hive Demo (Controlled) **Purpose:** demonstrate Cohesix *alive* — Worker model entries being created and telemetry flowing — without implying that a target Worker task was launched. **Rules (strict)** - Live mutation occurs only via: - `cohsh` - scripted flows covered by TEST_PLAN - SwarmUI is **observational only** in live mode. - No UI-initiated control. **Validated via** - TEST_PLAN live-operation phase - Role enforcement + audit verification - Deterministic logging under live load --- ### 3) SwarmUI — Dual-Mode Alpha **Replay Mode (default)** - Loads canonical snapshot from `traces/` - Full timeline scrub (pause / rewind / step) - Deterministic visualization **Live Hive Mode** - Read-only view of live state - Mirrors CLI-driven actions in real time - No write capability SwarmUI behavior is validated under TEST_PLAN UI/CLI convergence criteria. --- ## Alpha Release Bundle Produced **only after all TEST_PLAN gates pass**. cohesix-alpha-/ ├── bin/ ├── image/ ├── qemu/ ├── scripts/ ├── traces/ │ └── (canonical .trace + hash) ├── ui/ │ └── swarmui/ ├── docs/ │ ├── QUICKSTART.md │ └── (as-built snapshots) ├── VERSION.txt └── LICENSE.txt Bundle contents, integrity, and runnability are validated under TEST_PLAN *Packaging* phase. Release bundles are emitted per host OS; the macOS tarball appends `-MacOS`, and the Linux aarch64 bundle appends `-linux` to the release name and carries Linux host tools in `bin/`. --- ## QUICKSTART.md The Quickstart MUST reference: - TEST_PLAN phases at a high level - What has already been verified - What the user is expected to run vs observe - Where the canonical trace lives in the bundle and the replay commands already defined in the Test Plan It must not introduce new testing procedures outside the Test Plan. --- ## Definition of Done (Authoritative) Milestone 20h is **Complete** if and only if: 1. Milestone 20g is complete per `docs/BUILD_PLAN.md`. 2. All applicable phases in `docs/TEST_PLAN.md` PASS: - Build Integrity - CLI Semantics - Role Enforcement - Concurrency - Regression - Packaging 3. Clean rebuild from scratch succeeds. 4. Replay demo and Live Hive demo are both validated outcomes of the Test Plan. 5. SwarmUI behavior (replay + live read-only) is consistent with CLI behavior. 6. A third party can run the alpha using only: - the release bundle - `qemu/run.sh` - `docs/QUICKSTART.md` If any Test Plan gate fails, this milestone remains **Incomplete**. --- ## Outcome After Milestone 20h: - Cohesix has a **test-plan-validated alpha**. - Demos are exciting *and* trustworthy. - There is one source of truth for correctness: `docs/TEST_PLAN.md`. - The system is ready for external evaluation without hand-holding. ---- **Release 0.1.0 alpha** ---- Next, Alpha Release 2 targets a plug-and-play operator experience immediately after Milestone 20.x. Milestones 21-24 define the Alpha track; Pi 4 bare-metal (`U-Boot + binary image`) and AWS AMI work follows starting at Milestone 26. ## Milestone 21a — Telemetry Ingest with OS-Named Segments (Severely Limited Create) [Milestones](#Milestones) **Why now (compiler):** Operators, demos, and UI testing need a safe way to inject telemetry from host tools without turning Cohesix into a general file transfer system. This milestone introduces a **Plan-9-style telemetry ingest path** that supports *severely constrained create*: the OS controls naming, retention, and quotas; clients can only append bounded records. This increases utility while preserving Cohesix’s control-plane boundary and minimal TCB. --- ### Goal Provide a deterministic, bounded telemetry ingest surface where host tools can: 1. Request a new telemetry segment with **OS-assigned naming**, and 2. Append bounded telemetry records into that segment using existing Secure9P primitives. --- ### Non-Goals (Explicit) - No arbitrary file upload or “scp-like” behaviour - No client-chosen filenames or paths - No delete / remove / rename semantics - No random writes or truncation - No new in-VM TCP listeners beyond the existing console - No schema-aware parsing of CSV / XML / JSON payloads --- ### Deliverables - Fixed telemetry namespace under `/queen/telemetry//` with: - `ctl` (append-only control) - `seg/` (OS-named, append-only segments) - `latest` (read-only pointer to the most recent segment) - OS-assigned segment creation via control file (no path-based create) - Hard quotas on segment count and bytes with deterministic refuse/evict behaviour - Bounded, versioned telemetry envelope (opaque payload) - `cohsh telemetry push` host command - CLI regression coverage added to the Regression Pack - Documentation updated to reflect **as-built** semantics --- ### Task Breakdown ``` Title/ID: m21a-telemetry-namespace Goal: Introduce a fixed telemetry namespace with OS-named segments. Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, existing NineDoor providers. Changes: • apps/nine-door/src/host/telemetry.rs — add provider for: /queen/telemetry//ctl /queen/telemetry//seg/ /queen/telemetry//latest • apps/nine-door/src/host/namespace.rs — mount telemetry provider under /queen. Commands: • cargo test -p nine-door Checks: • Telemetry paths appear only when enabled. • Segment files are append-only and OS-named. Deliverables: • Telemetry namespace live with no client-controlled naming. ``` ``` Title/ID: m21a-telemetry-create-ctl Goal: Implement severely limited “create” via control file. Inputs: docs/INTERFACES.md (new schema), existing append-only control patterns. Changes: • apps/nine-door/src/host/telemetry.rs — handle ctl command: {“new”:“segment”,“mime”:””} • Emit deterministic ACK with assigned seg_id. • Update /latest pointer on successful creation. Commands: • cargo test -p nine-door –test telemetry_create Checks: • Client cannot create files by path. • Only ctl-based segment allocation is accepted. Deliverables: • OS-controlled segment allocation with deterministic responses. ``` ``` Title/ID: m21a-telemetry-quotas Goal: Enforce deterministic quotas and retention for telemetry segments. Inputs: configs/root_task.toml (new fields), coh-rtc validation rules. Changes: • tools/coh-rtc/src/ir.rs — add telemetry_ingest.* fields: max_segments_per_device max_bytes_per_segment max_total_bytes_per_device eviction_policy (refuse | evict-oldest) • apps/nine-door/src/host/telemetry.rs — enforce quotas and eviction. Commands: • cargo run -p coh-rtc – configs/root_task.toml • cargo test -p nine-door –test telemetry_quotas Checks: • Quota exhaustion yields deterministic ERR or deterministic eviction. Deliverables: • Manifest-driven, bounded telemetry retention. ``` --- ``` Title/ID: m21a-telemetry-envelope Goal: Define and document the telemetry envelope format. Inputs: docs/INTERFACES.md. Changes: • docs/INTERFACES.md — add schema cohsh-telemetry-push/v1. • Enforce max_record_bytes (≤ 4096) server-side. Commands: • cargo test -p nine-door –test telemetry_envelope Checks: • Oversized records rejected deterministically. Deliverables: • Versioned, opaque telemetry envelope documented and enforced. ``` ``` Title/ID: m21a-cohsh-telemetry-push Goal: Add host-side telemetry push command to cohsh. Inputs: docs/USERLAND_AND_CLI.md, existing cohsh 9P write helpers. Changes: • apps/cohsh/src/lib.rs — add command: telemetry push –device • Enforce file size limits, extension allowlist, chunking, and fixed destination. • Resolve seg_id via ACK detail or /latest before appending. Commands: • cargo test -p cohsh Checks: • cohsh cannot write outside telemetry allowlist. • Oversized files fail locally with deterministic ERR. Deliverables: • Safe host-side telemetry injection command. ``` ``` Title/ID: m21a-telemetry-regression Goal: Lock behaviour with deterministic CLI regression. Inputs: scripts/cohsh/telemetry_push_create.coh. Changes: • scripts/cohsh/telemetry_push_create.coh — cover: create success push success oversize failure quota exhaustion behaviour • Add script to the Regression Pack. Commands: • cargo run -p cohsh –features tcp – –transport tcp –script scripts/cohsh/telemetry_push_create.coh Checks: • Script passes unchanged across runs. Deliverables: • Regression coverage preventing scope ``` ``` Title/ID: m21a-docs-sync Goal: Update documentation to reflect as-built telemetry ingest. Inputs: docs/ARCHITECTURE.md, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md. Changes: • Document telemetry namespace, quotas, and create semantics. Commands: • mdbook build docs (if configured) Checks: • Docs match code behaviour exactly. Deliverables: • Docs-as-built alignment. ``` --- ### Checks (Definition of Done) - Telemetry segments are OS-named and append-only. - Clients cannot choose names or paths. - Quotas and eviction/refusal behaviour are deterministic. - No new in-VM network services are introduced. - Applicable regression pack passes with existing contract outputs unchanged. - Documentation reflects actual behaviour. --- ### Outcome After Milestone 21a, Cohesix supports **safe, Plan-9-style telemetry creation** with strict bounds and OS-owned lifecycle—improving utility for demos, UI testing, and early deployments without compromising the control-plane boundary. --- ## Milestone 21b — Host Bridges (coh mount, coh gpu, coh telemetry pull) [Milestones](#Milestones) **Why now (adoption):** After Milestone 20.x, we need plug-and-play host UX that integrates with existing CUDA/MIG workflows without new protocols or VM expansion. **Goal** Deliver host-only mount views for Secure9P namespaces, GPU lease UX, and pull-based telemetry export while preserving Secure9P and console semantics (no new server-side filesystem behavior). **Deliverables** - `coh` host tool (single binary) with subcommands `mount`, `gpu`, and `telemetry pull`, built on `cohsh-core` transports and policy tables without introducing new verbs. - `coh mount` FUSE mount of Secure9P namespaces (for example `/mnt/coh`) with strict path validation, append-only enforcement, and fid lifecycle checks; never bypasses policy. The mount is a **client convenience view only** and does not add POSIX semantics to the system. - `coh gpu` discovery/status/lease UX with `--mock` backend for CI and non-NVIDIA hosts, plus NVML backend on Linux; MIG visibility only when defined in `docs/GPU_NODES.md`. - `coh telemetry pull` pulls bundles from `/queen/telemetry/*` into host storage; resumable and idempotent (no streaming). - Invariant envelope: `msize <= 8192`, walk depth <= 8, no `..`, ACK-before-side-effects, bounded work per command. **Commands** - `cargo test -p coh --features mock` - `cargo run -p coh --features mock -- mount --mock --at /tmp/coh-mount` - `cargo run -p coh --features mock -- gpu list --mock` - `cargo run -p coh --features mock -- telemetry pull --mock --out out/telemetry` **Checks (DoD)** - `coh mount` works in `--mock` and against a dev instance; invalid paths return deterministic ERR with audit line. - `coh gpu` lease grant/deny is deterministic and logged; mock and NVML backends produce identical lease semantics. - `coh telemetry pull` resumes without duplicates and is idempotent across restarts; no streaming or background polling. - Golden transcript markers or fixtures prove stable ACK/ERR ordering for `coh` subcommands. - Deterministic denial semantics for invalid tickets/paths/quotas are verified in tests. - Bounded memory and bounded work per operation (no unbounded queues, no infinite retries) are enforced by limits and tests. - Secure9P invariants preserved (msize <= 8192, path validation, fid lifecycle). - Console semantics preserved (ACK-before-side-effects) for console-backed flows. - Applicable regressions pass; canonical output fixtures remain authoritative, while tests evolve only under `AGENTS.md` Test Discipline. - CI runs mock-mode tests on x86_64. **Compiler touchpoints** - `coh-rtc` emits `coh` defaults (mount root, allowlisted paths, telemetry export bounds, retry ceilings) into a manifest snippet consumed by `coh` and documented in `docs/USERLAND_AND_CLI.md`. - Manifest gates enforce host-tool-only features (FUSE, NVML) with explicit fallbacks to `--mock`. **Task Breakdown** ``` Title/ID: m21b-coh-cli-skeleton Goal: Introduce coh host CLI with strict subcommand parsing and policy loading. Inputs: crates/cohsh-core, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md. Changes: - apps/coh/src/main.rs — CLI entrypoint with mount/gpu/telemetry pull subcommands. - apps/coh/src/policy.rs — manifest-backed limits and allowlist loader. Commands: - cargo test -p coh --features mock Checks: - Unknown subcommand or invalid args returns deterministic ERR without side effects. Deliverables: - coh CLI skeleton and policy loader documented in docs/USERLAND_AND_CLI.md. Title/ID: m21b-coh-mount Goal: Implement Secure9P-backed FUSE mount with bounded operations. Inputs: secure9p-core, docs/SECURE9P.md. Changes: - apps/coh/src/mount.rs — FUSE adapter enforcing path validation, append-only, and fid lifecycle. - apps/coh/tests/mount.rs — invalid path and offset denial tests. Commands: - cargo test -p coh --features mock --test mount Checks: - `..` walk attempts and oversized reads return deterministic ERR; mount never bypasses policy. Deliverables: - FUSE mount docs and regression fixtures. Title/ID: m21b-coh-gpu-telemetry Goal: Add coh gpu UX and telemetry pull with mock backend. Inputs: docs/GPU_NODES.md, docs/INTERFACES.md. Changes: - apps/coh/src/gpu.rs — list/status/lease UX with mock and NVML backends. - apps/coh/src/telemetry.rs — resumable pull from /queen/telemetry/*. Commands: - cargo run -p coh --features mock -- gpu list --mock - cargo run -p coh --features mock -- telemetry pull --mock --out out/telemetry Checks: - Lease grant/deny is deterministic; telemetry pull resumes without duplicates. Deliverables: - coh gpu + telemetry pull behavior documented with transcript fixtures. ``` --- ## Milestone 21c — SwarmUI Interactive cohsh Terminal (Full Prompt UX) [Milestones](#Milestones) **Why now (operator UX):** SwarmUI already embeds `cohsh-core` and speaks the TCP console. A full terminal prompt improves operator ergonomics without adding new verbs or protocols. **Goal** Add a cohesive, terminal‑grade command prompt inside SwarmUI that reuses existing console semantics and `cohsh-core` parsing. **Deliverables** - SwarmUI “Console” panel with command input, scrollback, and clear/stop controls. - Prompt supports multiline output, `OK/ERR/END` framing, and tail streams. - Single‑session multiplexing: the prompt reuses SwarmUI’s existing console session (no second client). - No new verbs, no new transports, and no VM changes. - SwarmUI help output lists only console commands and points to `cohsh` for additional CLI features. **Commands** - `cargo check -p swarmui` - `cargo test -p cohsh-core --test transcripts` **Checks (DoD)** - Prompt output matches `cohsh` transcript ordering (ACK/ERR/END) for `help → attach → log → spawn → tail → quit`. - Tail streams can be stopped without breaking the shared session. - Reconnect logic mirrors `cohsh` (connection loss surfaces clearly and resumes cleanly). - Console lock is enforced (SwarmUI prompt does not allow a second TCP client). - No new console verbs or transport semantics introduced. **Task Breakdown** ``` Title/ID: m21c-swarmui-console-ui Goal: Add a console panel with input, scrollback, and tail controls. Inputs: apps/swarmui/frontend, docs/USERLAND_AND_CLI.md. Changes: - apps/swarmui/frontend/components/console.js — input + scrollback UI. - apps/swarmui/frontend/styles/console.css — terminal styling. Commands: - npm run lint (if configured) or cargo check -p swarmui Checks: - Console renders without layout regressions; input accepts commands and displays output. Deliverables: - SwarmUI console panel wired to the UI. Title/ID: m21c-swarmui-console-bridge Goal: Bridge console input/output through the existing SwarmUI session. Inputs: apps/swarmui/src-tauri/main.rs, crates/cohsh-core. Changes: - apps/swarmui/src-tauri/main.rs — expose send-line + stream events for prompt output. - apps/swarmui/src/lib.rs — reuse existing session; no new transport. Commands: - cargo check -p swarmui Checks: - Prompt uses the same TCP session; no parallel client sockets. Deliverables: - Prompt input/output routed through existing console session. Title/ID: m21c-swarmui-console-parity Goal: Ensure prompt output ordering matches cohsh transcripts. Inputs: crates/cohsh-core/tests/transcripts.rs, docs/TEST_PLAN.md. Changes: - apps/swarmui/tests/console_parity.rs — compare prompt output framing to cohsh transcripts. Commands: - cargo test -p swarmui --test console_parity Checks: - ACK/ERR/END sequences match cohsh fixtures for baseline verbs. Deliverables: - Parity test ensuring terminal output consistency. ``` --- ## Milestone 21d — Deterministic Node Lifecycle & Operator Control [Milestones](#Milestones) **Why now (operator):** Cohesix nodes must behave predictably across power loss, network partitions, maintenance windows, and redeployments. Lifecycle semantics must be explicit, inspectable, and controllable — not inferred from side effects. **Goal** Define and enforce a **finite lifecycle state machine** for Cohesix nodes, exposed entirely via file-shaped control surfaces, with deterministic transitions and regression coverage. **Status:** Reopened for `m21d-maintenance-outstanding-work-restoration`, discovered during the Milestone 26e release burn-in. Restore maintenance after complete Worker containment and enforce the existing active-lease prerequisite; retain terminal evidence and all lifecycle, policy, and admission contracts. ### Lifecycle states (normative) - `BOOTING` - `DEGRADED` - `ONLINE` - `DRAINING` - `QUIESCED` - `OFFLINE` ### State definitions | State | Meaning | | --- | --- | | `BOOTING` | Root-task started, manifest loaded, identity pending. | | `DEGRADED` | Identity ok, but one or more required dependencies are missing (network, storage, sidecar, or policy gates). | | `ONLINE` | Full control-plane available; workers and telemetry allowed within policy bounds. | | `DRAINING` | No new work accepted; telemetry ingestion remains enabled. | | `QUIESCED` | All work drained; safe to reboot or power off. | | `OFFLINE` | Explicitly disabled or unrecoverable failure; control-plane actions denied. | ### Control & observation (NineDoor) **Observability (read-only)** - `/proc/lifecycle/state` - `/proc/lifecycle/reason` - `/proc/lifecycle/since` **Control (append-only, queen-only)** - `/queen/lifecycle/ctl` **Supported control commands (append-only, single line)** `cordon`, `drain`, `resume`, `quiesce`, `reset` ### Hard rules - Transitions are **explicit** and must occur only via `/queen/lifecycle/ctl` or deterministic system events enumerated in docs; no heuristic or hidden state changes. - Invalid transitions return deterministic `ERR` and emit audit entries. - Every transition emits an audit record in `/log/queen.log` with old/new state and reason. - Tickets, telemetry ingest, worker authority, and host sidecar publishes are gated by lifecycle state. ### Telemetry Spool Policy (Addendum to Milestones 21a & 29) **Rationale:** Telemetry storage must be predictable under pressure. Operators must know *when*, *why*, and *how* data is retained or dropped. This addendum **aligns policy terminology** between 21a telemetry ingest quotas and the 29 persistent spool store; it does **not** retroactively change 21a's completed behavior. #### Policy surface (alignment) - **Telemetry ingest (21a):** keep `telemetry_ingest.eviction_policy` (`refuse` | `evict-oldest`) as the source of truth for per-device segment limits. - **Persistent spool (29):** use `persistence.spool.mode` (`refuse` | `overwrite_acked`) and `persistence.spool.max_record_bytes` to mirror 21a's refusal/eviction semantics while remaining crash-safe. **Manifest example (bytes only)** ```toml [telemetry_ingest] max_segments_per_device = 64 max_bytes_per_segment = 262144 max_total_bytes_per_device = 16777216 eviction_policy = "refuse" # or "evict-oldest" [persistence.spool] max_bytes = 67108864 max_record_bytes = 32768 mode = "refuse" # or "overwrite_acked" ``` #### Operator visibility - `/proc/spool/status` MUST expose policy and pressure fields (used_bytes, max_bytes, records, dropped, pressure, mode, ack_cursor). - If additional nodes are required for UI providers, add `/proc/spool/policy` and `/proc/spool/pressure` **only** with corresponding updates to `ARCHITECTURE.md` and `INTERFACES.md`. #### CLI surface (host-only, target milestone 29 or later) - `cohsh telemetry status` — read spool/ingest status and render policy + pressure. - `cohsh telemetry explain` — summarize current policy and refusal/eviction outcomes. #### Mandatory regression cases - Quota exhaustion: `refuse` vs `evict-oldest` (21a) and `overwrite_acked` (29). - Ack cursor behind overwrite window (29). - Record-too-large rejection (29). - Offline accumulation → online drain (21a + 29). #### Invariants - All drops are auditable. - Backpressure is observable. - No data loss occurs without an explicit policy allowing it. ### Regression coverage - `scripts/cohsh/lifecycle_basic.coh` - `scripts/cohsh/lifecycle_drain_spool.coh` - `scripts/cohsh/lifecycle_reboot_resume.coh` ### Checks (DoD) - Lifecycle transitions are byte-stable across serial/TCP. - Telemetry is not lost during `DRAINING` (spool or queue behavior is deterministic). - `QUIESCED` guarantees zero outstanding leases. - Replay reproduces identical state transitions and audit lines. ### Task Breakdown ``` Title/ID: m21d-maintenance-outstanding-work-restoration Milestone: Reopened Milestone 21d — Deterministic Node Lifecycle & Operator Control; discovered in Milestone 26e / m26e-host-integration-dependency-contract and restored with m26e-worker-supervisor-child-isolation Goal: Refuse maintenance while work retains authority and allow it after exact Worker containment, even while terminal evidence remains visible. Inputs: The 2026-09-13 Pi GENET release burn-in reached 43 completed CUDA/PEFT jobs in 86 minutes, then drain reported 48 outstanding leases from retained Worker entries while the lease table was empty; current Worker projections and registered lease state. Changes: - apps/root-task/src/{ninedoor.rs,worker_supervisor.rs,hal/worker_task.rs} — count queued, starting, ready, closing and faulted slots under the existing projection lock without copying the population; count registered active leases; preserve terminal identity and telemetry. - apps/nine-door/src/host/{core.rs,schedule.rs} — enforce registered lease obligations alongside active host-model Workers. - apps/root-task/tests/worker_supervisor.rs + apps/nine-door/tests/lifecycle.rs — independent state classification and lease refusal/preemption contracts. - docs/INTERFACES.md + docs/OPERATOR_RECIPES.md — distinguish Worker containment from the active lease table and retained evidence. Compatibility review: cohsh, coh, Hive Gateway/REST, host-ticket-agent, gpu-bridge-host, host-sidecar-bridge, cas-tool, SwarmUI, cohesix-py and raw/REST performance scripts keep their existing grammar, schemas, finite budgets, error mappings, workloads and thresholds. Only the NineDoor host model and maintenance documentation require changes; generated contracts and other host implementations require none. This restores existing maintenance prerequisites without adding an admission path or changing Worker teardown. Commands: - cargo test -p root-task --test worker_supervisor --test worker_fault_lifecycle - cargo test -p nine-door --test lifecycle - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml - scripts/check-generated.sh - scripts/ci/check_test_plan.sh Checks: Queued/starting/ready/closing/faulted states block maintenance; absent/terminal states do not; registered leases refuse drain/quiesce/reset until preemption; fresh exact-image Pi work remains live, retires, permits drain with retained terminal evidence, and resumes new work after both host FUSE remounts. Preserve the original failed timed run and perform only the focused revalidation requested by the operator. Deliverables: Scoped repair, host checks, exact Pi build/first-raw and focused maintenance evidence; no new full burn-in or release acceptance claim. Title/ID: m21d-lifecycle-state-machine Goal: Implement the node lifecycle state machine in root-task. Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/ROLES_AND_SCHEDULING.md. Changes: - apps/root-task/src/lifecycle.rs — state machine + transition validation. - apps/root-task/src/lib.rs — hook lifecycle into boot + worker/ticket gating. Commands: - cargo test -p root-task Checks: - Invalid transitions return deterministic ERR with audit lines. Deliverables: - Root-task lifecycle state machine with deterministic transitions. Title/ID: m21d-lifecycle-ir Goal: Add lifecycle policy fields to compiler IR and regenerate artifacts. Inputs: configs/root_task.toml, tools/coh-rtc, docs/ARCHITECTURE.md. Changes: - tools/coh-rtc/src/ir.rs — lifecycle policy fields (initial state, allowed auto transitions). - configs/root_task.toml — lifecycle policy configuration. Commands: - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Generated snippets update; invalid lifecycle policy is rejected. Deliverables: - Manifest-backed lifecycle policy with validated defaults. Title/ID: m21d-lifecycle-namespace Goal: Expose lifecycle nodes via NineDoor and enforce permissions. Inputs: apps/nine-door, docs/INTERFACES.md. Changes: - apps/nine-door/src/host/lifecycle.rs — /proc/lifecycle/* + /queen/lifecycle/ctl. - apps/nine-door/src/host/namespace.rs — mount lifecycle provider. Commands: - cargo test -p nine-door --test lifecycle Checks: - `/proc/lifecycle/*` is read-only; `/queen/lifecycle/ctl` is queen-only append. Deliverables: - Lifecycle nodes live with deterministic error semantics. Title/ID: m21d-cohsh-lifecycle Goal: Add cohsh lifecycle commands and update CLI docs. Inputs: docs/USERLAND_AND_CLI.md, docs/INTERFACES.md. Changes: - apps/cohsh/src/lib.rs — add `lifecycle` commands (cordon/drain/resume/quiesce/reset). - docs/USERLAND_AND_CLI.md — document lifecycle CLI surface and examples. Commands: - cargo test -p cohsh Checks: - CLI rejects invalid transitions locally with deterministic ERR. Deliverables: - cohsh lifecycle commands with documented grammar. Title/ID: m21d-lifecycle-regressions Goal: Lock lifecycle behavior with deterministic regression scripts. Inputs: scripts/cohsh/. Changes: - scripts/cohsh/lifecycle_basic.coh - scripts/cohsh/lifecycle_drain_spool.coh - scripts/cohsh/lifecycle_reboot_resume.coh Commands: - cohsh --script scripts/cohsh/lifecycle_basic.coh Checks: - Scripts pass unchanged; transcript ordering stable. Deliverables: - Regression coverage for lifecycle transitions and gating. Title/ID: m21d-docs-failure-modes Goal: Add operator-facing failure semantics and walkthroughs. Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/USERLAND_AND_CLI.md. Changes: - docs/FAILURE_MODES.md — explicit failure behavior and recovery actions. - docs/OPERATOR_WALKTHROUGH.md — end-to-end lifecycle narrative with artifacts. Commands: - mdbook build docs (if configured) Checks: - Docs describe as-built behavior and reference canonical interfaces. Deliverables: - Failure modes and operator walkthrough docs committed and referenced. ``` --- ## Milestone 21e — Rooted Authority, Cut Detection, Explicit Session Semantics, and Live Hive Visibility [Milestones](#Milestones) **Why now (operator and systems):** Cohesix enforces strict Queen/Worker authority and bounded control, but operators need those guarantees to be visible and interpretable during live operation. This milestone strengthens control-plane semantics using rooted-network ideas and extends SwarmUI Live Hive to reflect these states explicitly. The goal is less ambiguity, not more intelligence. No new protocols, no consensus, no background convergence - only explicit state, refusal, and audit. ## Goal 1. Make root reachability and network cuts explicit and inspectable. 2. Formalize session setup, drain, and teardown semantics. 3. Surface back-pressure (busy, quota, cut, policy) as first-class signals. 4. Ensure SwarmUI Live Hive visualizes these states so operators do not infer health incorrectly. ## Non-Goals (Explicit) - No leader election or consensus protocols - No automatic failover or self-promotion - No hidden retries or background loops - No new transports or networking paths - No relaxation of Secure9P / NineDoor invariants - No changes to ACK/ERR grammar beyond reason tags ## Deliverables ### 1) Root Reachability and Cut Detection New read-only nodes (IR-gated, bounded): `/proc/root/reachable` (ro: `reachable=yes|no`) `/proc/root/last_seen_ms` (ro: `last_seen_ms=`) `/proc/root/cut_reason` (ro: `cut_reason=`) **Rules** - Workers MUST NOT exercise authority when `/proc/root/reachable=no`. - Queen authority is never inferred or mirrored. - `last_seen_ms` updates on authenticated Queen activity. - `cut_reason=none` when `reachable=yes`; otherwise use deterministic priority: `lifecycle_offline` > `session_revoked` > `policy_denied` > `network_unreachable`. - Cut detection feeds lifecycle state transitions per Milestone 21d (explicit events only, no heuristics). --- ### 2) Explicit Session Semantics (Telephone-Exchange Model) Expose session lifecycle explicitly: `/proc/9p/session/active` `/proc/9p/session//state` `/proc/9p/session//since_ms` `/proc/9p/session//owner` Session states: - `SETUP` - `ACTIVE` - `DRAINING` - `CLOSED` **Rules** - No implicit resurrection of sessions. - Revocation immediately transitions to `CLOSED`. - `DRAINING` forbids new control actions but allows telemetry completion. - `/proc/9p/sessions` remains unchanged; new per-session nodes are additive only. --- ### 3) Busy / Back-Pressure as First-Class Signals Standard refusal reason tags (console): - `ERR reason=busy` - `ERR reason=quota` - `ERR reason=cut` - `ERR reason=policy` NineDoor error codes remain within the existing error surface; no new error names are introduced. Pressure counters (IR-gated, bounded): `/proc/pressure/busy` `/proc/pressure/quota` `/proc/pressure/cut` `/proc/pressure/policy` **Rules** - No automatic retries inside Cohesix. - All refusals are deterministic and audited. - Callers decide retry behavior. --- ### 4) SwarmUI Live Hive — Visualizing Authority and Pressure **Rationale:** Without visualization, correct behavior looks like failure. Live Hive must reflect authority, reachability, and contention so operators do not infer false health or blame the wrong layer. **Constraints** - No new protocols - No new data collection - Purely renders existing file-shaped state - Live Hive reads text nodes (no CBOR requirement) #### 4a) Root / Cut Status Badge Live Hive reads: - `/proc/root/reachable` - `/proc/root/cut_reason` UI: - Prominent `ROOT OK` or `CUT` badge per node - Cut reason displayed inline - Nodes in CUT state are visually distinct (no "healthy" styling) #### 4b) Session Indicator Live Hive reads: - `/proc/9p/session/active` - `/proc/9p/session//state` UI: - Session count per node - Highlight when sessions enter `DRAINING` - Summary only (no per-session deep UI) #### 4c) Back-Pressure Strip Live Hive reads: - `/proc/pressure/busy` - `/proc/pressure/quota` - `/proc/pressure/cut` - `/proc/pressure/policy` UI: - Small pressure indicators or counters - Makes contention visible instead of mysterious slowdown #### 4d) Error Classification Live Hive classifies ACK/ERR events: - Distinguish `reason=busy`, `reason=quota`, `reason=cut`, `reason=policy` - Display as categorized events, not generic failures --- ### 5) Audit and Replay Integration All new semantics: - Emit audit lines via existing AuditFS - Are replayable via ReplayFS - Produce byte-identical ACK/ERR sequences on replay ## Files and Components Touched - `apps/root-task/` — root reachability state and refusal tagging - `apps/nine-door/` — session lifecycle tracking and `/proc/9p/session/*` - `apps/swarmui/` — Live Hive rendering of root, sessions, and pressure - `tools/coh-rtc/` — observability gates and bounds - `configs/root_task.toml` - `docs/ARCHITECTURE.md` - `docs/INTERFACES.md` - `docs/SECURITY.md` - `docs/USERLAND_AND_CLI.md` ## Regression Coverage (Required) New scripts: - `scripts/cohsh/root_cut_basic.coh` - `scripts/cohsh/session_lifecycle.coh` - `scripts/cohsh/busy_backpressure.coh` Live Hive validation: - Visual state matches `/proc/*` values - Replay shows identical transitions and UI markers ## Checks (Definition of Done) - Root cuts are explicit, auditable, and visible in Live Hive. - No worker acts under partition. - Session teardown is immediate and deterministic. - Back-pressure is visible and never silent. - Replay reproduces identical control outcomes. - No new transports or background logic introduced. - Regression Pack passes with additive coverage only. ## Compiler touchpoints - `coh-rtc` emits observability gates and bounds for `/proc/root/*`, `/proc/9p/session/*`, and `/proc/pressure/*`. - Generated snippets update `docs/ARCHITECTURE.md` and `docs/INTERFACES.md`; drift fails CI. ## Task Breakdown ``` Title/ID: m21e-root-reachability-ir Goal: Add root reachability and pressure nodes to IR and regenerate artifacts. Inputs: configs/root_task.toml, tools/coh-rtc, docs/ARCHITECTURE.md, docs/INTERFACES.md. Changes: - tools/coh-rtc/src/ir.rs — add /proc/root/* and /proc/pressure/* gates + bounds. - configs/root_task.toml — manifest toggles and size limits. Commands: - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Generated snippets list the new nodes with correct bounds. Deliverables: - Regenerated snippets and manifest artifacts. Title/ID: m21e-root-reachability-runtime Goal: Track and expose root reachability and cut reason deterministically. Inputs: apps/root-task, docs/ROLES_AND_SCHEDULING.md. Changes: - apps/root-task/src/lifecycle.rs — integrate cut reason updates. - apps/root-task/src/observability.rs — emit /proc/root/* values. Commands: - cargo test -p root-task Checks: - reachable/cut_reason updates are deterministic and audited. Deliverables: - Root reachability state wired to observability. Title/ID: m21e-session-semantics Goal: Expose per-session state for NineDoor sessions. Inputs: apps/nine-door, docs/INTERFACES.md. Changes: - apps/nine-door/src/host/session.rs — state tracking + /proc/9p/session/*. - apps/nine-door/src/host/namespace.rs — mount session provider. Commands: - cargo test -p nine-door --test session_state Checks: - Session transitions match SETUP/ACTIVE/DRAINING/CLOSED with stable output. Deliverables: - Per-session observability nodes with deterministic state. Title/ID: m21e-pressure-refusal Goal: Standardize refusal reason tags and pressure counters. Inputs: apps/root-task, apps/nine-door, docs/SECURITY.md. Changes: - apps/root-task/src/event/mod.rs — emit ERR reason tags (busy/quota/cut/policy). - apps/nine-door/src/host/security.rs — increment /proc/pressure/* counters. Commands: - cargo test -p root-task - cargo test -p nine-door --test pressure_counters Checks: - Refusals increment counters and emit reason tags without new error names. Deliverables: - Deterministic refusal tagging and pressure counters. Title/ID: m21e-swarmui-livehive Goal: Render root, session, and pressure state in Live Hive. Inputs: apps/swarmui/frontend, apps/swarmui/src-tauri, docs/INTERFACES.md. Changes: - apps/swarmui/frontend/hive/ — badges, counters, and session summary. - apps/swarmui/src-tauri/ — read new /proc text nodes. Commands: - cargo check -p swarmui Checks: - Live Hive displays root/cut, sessions, and pressure when view is active. Deliverables: - Live Hive visuals wired to text-based /proc nodes. Title/ID: m21e-regressions Goal: Lock behavior with deterministic regression scripts and UI replay. Inputs: scripts/cohsh/, docs/TEST_PLAN.md. Changes: - scripts/cohsh/root_cut_basic.coh - scripts/cohsh/session_lifecycle.coh - scripts/cohsh/busy_backpressure.coh Commands: - cohsh --script scripts/cohsh/root_cut_basic.coh Checks: - Scripts pass unchanged; ACK/ERR ordering stable. Deliverables: - Regression scripts for reachability, session lifecycle, and pressure. ``` --- ## Milestone 22 — Runtime Convenience (coh run) + GPU Job Breadcrumbs [Milestones](#Milestones) **Status:** Complete — coh run + breadcrumb schema, docs, and tests are in place; regression pack and full test plan (source + macOS/Ubuntu bundles) completed. **Why now (adoption):** Operators need a two-minute "lease -> run -> observe -> release" loop without introducing a runtime orchestrator. **Goal** Provide a `coh run` wrapper that validates leases, runs a user command, and records bounded lifecycle breadcrumbs. **Deliverables** - `coh run` subcommand that verifies an active lease via `/gpu//lease` before execution and refuses to run without one. - Wrapper executes a user-specified command (Docker or local binary) and appends bounded lifecycle breadcrumbs to `/gpu//status` (per `docs/GPU_NODES.md`) through the host bridge interface. - Denial path emits deterministic ERR with no side effects; wrapper remains non-orchestrating. **Commands** - `cargo test -p coh --features mock --test run` - `cargo test -p coh --features mock --test transcript` - `cargo run -p cohsh -- --transport mock --mock-seed-gpu --script scripts/cohsh/run_demo.coh` **Checks (DoD)** - Demo script proves "lease -> run -> observe -> release" in under two minutes using `--mock`. - `coh run` denies when no valid lease exists and logs deterministic ERR without side effects. - Breadcrumbs in `/gpu//status` are bounded, ordered, and schema-tagged; regressions enforce ordering and denial semantics. - Deterministic denial semantics for invalid tickets/paths/quotas are verified in tests. - Bounded memory and bounded work per operation (no unbounded queues, no infinite retries) are enforced by limits and tests. - Secure9P invariants preserved (msize <= 8192, path validation, fid lifecycle). - Console semantics preserved (ACK-before-side-effects) for console-backed flows. - Applicable regressions pass; canonical output fixtures remain authoritative, while tests evolve only under `AGENTS.md` Test Discipline. - CI runs mock-mode tests on x86_64. **Compiler touchpoints** - `coh-rtc` emits breadcrumb schema, max line bytes, and lease validation defaults into a manifest snippet consumed by `coh`. - Manifest gates ensure breadcrumb fields match documented `/gpu//status` semantics. **Task Breakdown** ``` Title/ID: m22-coh-run Goal: Implement coh run wrapper with lease validation and bounded lifecycle logging. Inputs: docs/GPU_NODES.md, docs/INTERFACES.md, cohsh-core transport. Changes: - apps/coh/src/run.rs — lease check, command spawn, breadcrumb emission. - apps/coh/tests/run.rs — denial path and ordered breadcrumb tests. Commands: - cargo test -p coh --features mock --test run Checks: - No-lease path returns deterministic ERR; breadcrumbs are ordered and bounded. Deliverables: - coh run behavior documented with transcript fixtures. Title/ID: m22-breadcrumb-schema Goal: Define and lock breadcrumb schema for /gpu//status entries. Inputs: docs/GPU_NODES.md, manifest IR. Changes: - tools/coh-rtc/ — emit breadcrumb schema and limits for host tooling. - docs/INTERFACES.md — update status schema snippet via codegen. Commands: - cargo run -p coh-rtc Checks: - Generated schema hash matches committed docs; invalid fields rejected by coh. Deliverables: - Breadcrumb schema published and referenced by host tools. Title/ID: m22-run-regressions Goal: Add regression coverage for run wrapper ordering and denial semantics. Inputs: scripts/cohsh/*.coh, tests/fixtures/transcripts/. Changes: - scripts/cohsh/run_demo.coh — lease, run, observe, release sequence. - apps/coh/tests/transcript.rs — compare coh run transcript to cohsh baseline. Commands: - cargo test -p coh --features mock --test transcript Checks: - Transcript diff is zero; denial case emits deterministic ERR. Deliverables: - Regression fixtures stored; CI hook updated. ``` --- ## Milestone 23 — PEFT/LoRA Lifecycle Glue (coh peft) [Milestones](#Milestones) **Status:** Complete — PEFT lifecycle flows, dev-virt GPU mock entries, SwarmUI replay/path/layout fixes, regression pack, and full test plan (source + macOS/Ubuntu bundles) validated. **Why now (adoption):** PEFT users need a file-native loop to export jobs, import adapters, and activate or rollback safely without a new control plane. **Goal** Provide `coh peft` commands that export LoRA jobs, import adapters, and atomically activate or rollback models. **Deliverables** - `coh peft export` pulls `/queen/export/lora_jobs//` (telemetry.cbor, base_model.ref, policy.toml) into a host directory; any new manifest/provenance file must be introduced via `coh-rtc` and documented in `docs/GPU_NODES.md` and `docs/INTERFACES.md` in the same change. - `coh peft import` stages adapters into host storage and exposes them as `/gpu/models/available//manifest.toml` with hash/size/provenance checks. - `coh peft activate` swaps `/gpu/models/active` atomically; `coh peft rollback` reverts to the previous pointer with a documented recovery path. - No training in VM and no registry service; file-native only. - New namespaces (`/queen/export/*`, `/gpu/models/*`) have explicit NineDoor provider ownership and manifest gating; docs are updated before code depends on them. - `dev-virt` QEMU runs without a host GPU bridge expose mock `/gpu//{info,ctl,lease,status}` entries for CLI demos (GPU-0/GPU-1); `/gpu/models` remains host-mirrored only. - SwarmUI replay flags (`--replay-trace`, `--replay`) accept absolute or relative paths so release bundles can replay fixtures without path assumptions. - SwarmUI pressure/error labels break to their own line and chips render slightly smaller for readability. **Commands** - `cargo test -p coh --features mock --test peft` - `cargo run -p coh --features mock -- peft export --job job_8932 --out out/lora_jobs` - `cargo run -p coh --features mock -- peft import --model llama3-edge-v7 --from out/adapter` - `cargo run -p coh --features mock -- peft activate --model llama3-edge-v7` **Checks (DoD)** - End-to-end demo covers export -> import -> activate -> rollback with deterministic outputs. - Adapter hash/size/provenance checks reject invalid input with deterministic ERR and no side effects. - Rollback procedure is documented and tested. - Deterministic denial semantics for invalid tickets/paths/quotas are verified in tests. - Bounded memory and bounded work per operation (no unbounded queues, no infinite retries) are enforced by limits and tests. - Secure9P invariants preserved (msize <= 8192, path validation, fid lifecycle). - Console semantics preserved (ACK-before-side-effects) for console-backed flows. - Applicable regressions pass; canonical output fixtures remain authoritative, while tests evolve only under `AGENTS.md` Test Discipline. - CI runs mock-mode tests on x86_64. **Compiler touchpoints** - `coh-rtc` emits any LoRA job schema/provenance fields (if/when added) and pointer-swap limits for `coh peft`. - Generated snippets refresh `docs/INTERFACES.md` and `docs/GPU_NODES.md` to keep schema alignment. - Manifest gating enumerates the new export/model namespaces and their provider ownership. **Task Breakdown** ``` Title/ID: m23-peft-export Goal: Implement coh peft export from /queen/export/lora_jobs/* with bounded pulls. Inputs: docs/GPU_NODES.md, docs/INTERFACES.md. Changes: - apps/coh/src/peft/export.rs — pull job directory with manifest validation. - apps/coh/tests/peft_export.rs — resumable pull and idempotency tests. Commands: - cargo test -p coh --features mock --test peft_export Checks: - Export resumes without duplicates; missing job returns deterministic ERR. Deliverables: - Export workflow documented with fixtures. Title/ID: m23-peft-import-activate Goal: Import adapters and atomically activate model pointers. Inputs: host model registry, docs/GPU_NODES.md. Changes: - apps/coh/src/peft/import.rs — hash/size/provenance checks for adapters. - apps/coh/src/peft/activate.rs — atomic pointer swap with rollback metadata. Commands: - cargo test -p coh --features mock --test peft_import Checks: - Invalid hashes rejected; pointer swap is atomic and rollback restores previous model. Deliverables: - Activation/rollback behavior documented with transcript fixtures. Title/ID: m23-peft-regressions Goal: Validate end-to-end PEFT lifecycle flows. Inputs: scripts/cohsh/*.coh, tests/fixtures/transcripts/. Changes: - scripts/cohsh/peft_roundtrip.coh — export/import/activate/rollback sequence. - apps/coh/tests/transcript.rs — parity check with cohsh output. Commands: - cargo test -p coh --features mock --test transcript Checks: - Transcript diff zero; rollback emits deterministic ACK/ERR ordering. Deliverables: - Regression fixtures stored and referenced in docs. Title/ID: m23-dev-virt-gpu-mock Goal: Provide mock `/gpu` entries for CLI demos in dev-virt. Inputs: docs/GPU_NODES.md, docs/INTERFACES.md. Changes: - apps/root-task/src/ninedoor.rs — seed mock `/gpu/` entries and bounded logs when no host GPU bridge is present. Commands: - cargo run -p cohsh --features mock -- --transport tcp --host 127.0.0.1 --port 31337 --script resources/proc_tests/selftest_quick.coh Checks: - `coh gpu list` returns mock GPU-0/GPU-1 and reads `/gpu//info` without errors. Deliverables: - Mock `/gpu` entries documented in GPU/NineDoor interface docs. Title/ID: m23-swarmui-replay-path Goal: Normalize SwarmUI replay paths for release bundle replay. Inputs: docs/TEST_PLAN.md, release bundle layout. Changes: - apps/swarmui/src-tauri/main.rs — resolve replay paths as absolute when provided relative inputs. Commands: - cargo test -p swarmui --test trace Checks: - `swarmui --replay-trace ` and `swarmui --replay ` work from bundle root. Deliverables: - Replay instructions remain consistent in docs/TEST_PLAN.md. Title/ID: m23-swarmui-pressure-layout Goal: Improve SwarmUI pressure/error strip readability. Inputs: apps/swarmui/frontend/index.html, apps/swarmui/frontend/styles/layout.css. Changes: - apps/swarmui/frontend/styles/layout.css — line-break pressure/error labels and shrink status chips slightly. Commands: - cargo test -p swarmui --test console_parity Checks: - Pressure and error labels render above chips; chip text remains legible. Deliverables: - UI layout changes tracked in the milestone. ``` --- ## Milestone 24 — Python Client + Examples (cohesix) + Doctor + Release Cut [Milestones](#Milestones) **Status:** Complete — cohesix Python client + examples, coh doctor, and alpha2 release bundles validated; regression pack and full test plan (source + macOS/Ubuntu bundles) completed. **Why now (adoption):** A thin, non-authoritative Python layer and a setup doctor reduce friction for CUDA, PEFT, and edge users without altering the control plane. **Goal** Deliver the `cohesix` Python client, runnable examples, `coh doctor`, and Alpha packaging/quickstart. **Deliverables** - `cohesix` Python library with filesystem backend (via `coh mount`) and TCP backend (via `cohsh-core` grammar); parity tests prove no new semantics. - Examples (fast, inspectable artifacts): CUDA lease+run, MIG lease+run (when available), PEFT export/import/activate/rollback, edge telemetry write + `coh telemetry pull`. - `coh doctor` subcommand for deterministic environment checks (tickets, mount capability, NVML or `--mock`, runtime prerequisites). - Alpha packaging and minimal quickstart docs for `coh` + `cohesix`. - Release bundle updated to include `coh`, `cohesix`, and the doctor/quickstart artifacts in the shipped tarballs. **Commands** - `cargo run -p coh --features mock -- doctor --mock` - `python -m pytest -k cohesix_parity` - `python tools/cohesix-py/examples/lease_run.py --mock` **Checks (DoD)** - Fresh host can run `coh doctor` then a demo in < 15 minutes using `--mock`. - Python parity tests match `cohsh` or namespace behavior byte-for-byte where applicable; no new semantics introduced. - Examples leave inspectable artifacts and exit deterministically. - Deterministic denial semantics for invalid tickets/paths/quotas are verified in tests. - Bounded memory and bounded work per operation (no unbounded queues, no infinite retries) are enforced by limits and tests. - Secure9P invariants preserved (msize <= 8192, path validation, fid lifecycle). - Console semantics preserved (ACK-before-side-effects) for console-backed flows. - Applicable regressions pass; canonical output fixtures remain authoritative, while tests evolve only under `AGENTS.md` Test Discipline. - CI runs mock-mode tests on x86_64. **Compiler touchpoints** - `coh-rtc` emits Python client defaults (paths, size limits, example fixtures) and `coh doctor` checks into manifest-backed snippets for docs. - Parity fixtures are hashed and referenced in docs/TEST_PLAN.md. **Task Breakdown** ``` Title/ID: m24-python-client Goal: Build cohesix Python client with filesystem + TCP backends and parity tests. Inputs: crates/cohsh-core, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md. Changes: - tools/cohesix-py/ — Python package with fs and TCP backends. - tools/cohesix-py/tests/parity.py — parity tests against cohsh transcripts. Commands: - python -m pytest -k cohesix_parity Checks: - Parity tests match cohsh transcripts; invalid ticket yields deterministic ERR. Deliverables: - Python client package and parity fixtures. Title/ID: m24-examples Goal: Provide quick examples that leave inspectable artifacts. Inputs: tools/cohesix-py/examples/, docs/GPU_NODES.md. Changes: - tools/cohesix-py/examples/lease_run.py — lease -> run -> release example. - tools/cohesix-py/examples/peft_roundtrip.py — export/import/activate/rollback. Commands: - python tools/cohesix-py/examples/lease_run.py --mock Checks: - Example outputs are deterministic and bounded; artifacts stored under out/examples/. Deliverables: - Example artifacts and docs/USERLAND_AND_CLI.md updates. Title/ID: m24-doctor-release Goal: Implement coh doctor and Alpha packaging/quickstart. Inputs: apps/coh/, docs/USERLAND_AND_CLI.md, README.md. Changes: - apps/coh/src/doctor.rs — deterministic checks for tickets, mounts, NVML/mock, runtime prerequisites. - docs/QUICKSTART_ALPHA.md — minimal Alpha quickstart for coh + cohesix. Commands: - cargo run -p coh --features mock -- doctor --mock Checks: - Doctor emits deterministic actionable output; packaging contains coh + cohesix. Deliverables: - Alpha quickstart docs and packaging notes. Title/ID: m24-swarmui-header-unify Goal: Unify SwarmUI header alignment and scale so the banner reads as a single product surface. Inputs: apps/swarmui/frontend/index.html, apps/swarmui/frontend/styles/layout.css. Changes: - apps/swarmui/frontend/styles/layout.css — align banner grid, status rows, and header badge/chip sizing. Commands: - npm run lint (if configured) or cargo check -p swarmui Checks: - Header elements align cleanly at desktop and stack without overflow at 980px/720px breakpoints. Deliverables: - Updated SwarmUI header styling. ``` ## Milestone 24b — Live GPU Bridge Wiring + PEFT Live Flow + Live Hive Telemetry Text [Milestones](#Milestones) **Status:** Complete — live `/gpu/models` publish verified, non-mock PEFT flow unblocked, Live Hive telemetry text overlays validated. **Why now (adoption):** Operators can’t complete a non-mock PEFT flow because the live VM still does not expose `/gpu/models/*`. The Queen currently returns `ERR LS reason=policy detail=invalid-path` on `/gpu/models`, so `coh peft import --host ...` has nowhere to publish the registry. This milestone wires the host GPU bridge into the live namespace and adds bounded telemetry text in Live Hive without introducing new protocols. **Goal** Enable a non-mock PEFT flow by publishing live `/gpu/models` and `/gpu/telemetry` into the VM, extend Live Hive with bounded telemetry text overlays + details panel, and enforce per-path polling defaults for cohsh/SwarmUI. **Deliverables** - Live GPU bridge publish path that installs `/gpu/`, `/gpu/models/*`, and `/gpu/telemetry/schema.json` inside the live VM using existing Secure9P file semantics (no new RPC services). - `gpu-bridge-host` gains live publish mode (`--publish`, `--interval-ms`, TCP config flags) that pushes bounded `GpuNamespaceSnapshot` payloads to the Queen. - `coh peft import` supports a live refresh step (`--publish`/`--refresh-gpu-models`) so the host registry is mirrored into `/gpu/models/available/*` and `/gpu/models/active`. - Live host telemetry adapters for `systemd`, `k8s`, `docker`, and `nvidia` (NVML) publish read-only snapshots under `/host/*` (no new control semantics). - Live Hive renders per-worker text overlays (last N lines) plus a selectable details panel; truncation/polling logic lives in `cohsh-core` only. - Real-world telemetry defaults (manifest-backed): - Tail poll default: 1000 ms; min 250 ms; max 10_000 ms. - NVML status poll: 1000 ms; systemd: 2000 ms; docker: 2000 ms; k8s: 5000 ms. - Live Hive overlay: N=3 lines, details panel M=50 lines, line cap 160 bytes, per-worker text budget 2 KiB. - PEFT/LoRA telemetry window: 1s (`time_window` label `ms:-`); `lora_id` required for LoRA records. - Documentation updates (as-built): `docs/TEST_PLAN.md`, `docs/HOST_TOOLS.md`, `docs/GPU_NODES.md`, `docs/INTERFACES.md`, `docs/USERLAND_AND_CLI.md`, `docs/ARCHITECTURE.md`, and `README.md` where behavior is surfaced. **Commands** - `cargo run -p coh-rtc` - `scripts/check-generated.sh` - `cargo test -p gpu-bridge-host` - `cargo test -p host-sidecar-bridge` - `cargo test -p cohsh-core` - `cargo test -p swarmui --test console_parity` - `scripts/cohsh/run_regression_batch.sh` - `scripts/release_bundle.sh --name Cohesix-0.3.0-alpha2 --version 0.3.0-alpha2 --force` **Checks (DoD)** - Live Queen returns a non-error for `ls /gpu/models` after the GPU bridge publish step; `/gpu/telemetry/schema.json` is readable. - Non-mock PEFT flow succeeds end-to-end: - `coh peft import --host ... --publish` installs `manifest.toml` under `/gpu/models/available//`. - `coh peft activate --host ...` updates `/gpu/models/active`. - `coh peft export --host ...` reads `/queen/export/lora_jobs//telemetry.cbor` within configured bounds. - Live Hive text overlays and details panel render bounded telemetry lines without UI-owned polling logic. - Per-path polling respects min/max bounds; defaults match the values above. - `docs/TEST_PLAN.md` includes a non-mock PEFT flow section and live telemetry checks; new steps pass on macOS 26 and Ubuntu 24 bundles. - `docs/HOST_TOOLS.md` and `docs/GPU_NODES.md` document the live publish flow and required commands. - Applicable regression pack passes; existing contract-output drift fails. - After Test Plan gates pass, release bundle minor version increments (e.g., `Cohesix-0.2.0-alpha2` → `Cohesix-0.3.0-alpha2`), with directory and tarball names updated. **Compiler touchpoints** - `coh-rtc` emits telemetry polling defaults and Live Hive text budgets into manifest-backed snippets. - Any new `/gpu/bridge/*` nodes and provider ownership are represented in IR and docs snippets. **Task Breakdown** ``` Title/ID: m24b-gpu-bridge-publish Goal: Enable live GPU bridge publishing of `/gpu/models` and telemetry schema into a running Queen. Inputs: apps/gpu-bridge-host, apps/nine-door, docs/GPU_NODES.md. Changes: - apps/gpu-bridge-host/src/main.rs — add `--publish`, `--interval-ms`, TCP config flags; serialize bounded snapshots. - apps/nine-door/src/host/core.rs — accept snapshot payloads and update `/gpu` namespace deterministically. - docs/GPU_NODES.md — document live publish flow and error semantics. Commands: - cargo test -p gpu-bridge-host - cargo test -p nine-door --test integration Checks: - Live `ls /gpu/models` succeeds after publish; invalid payloads return deterministic ERR. Deliverables: - Live GPU bridge publish path + updated GPU docs. Title/ID: m24b-peft-live-flow Goal: Unblock non-mock PEFT import/activate by refreshing `/gpu/models` after registry updates. Inputs: apps/coh/, docs/USERLAND_AND_CLI.md, docs/HOST_TOOLS.md. Changes: - apps/coh/src/main.rs — add `--publish`/`--refresh-gpu-models` option for `peft import`. - docs/USERLAND_AND_CLI.md — document live PEFT flow and required commands. - docs/HOST_TOOLS.md — update PEFT examples to include live publish. Commands: - cargo test -p coh --features nvml Checks: - `coh peft import --host ... --publish` yields `/gpu/models/available//manifest.toml` in the VM. Deliverables: - Live PEFT flow documented and validated. Title/ID: m24b-host-telemetry-live Goal: Provide live host telemetry providers for systemd/k8s/docker/NVML. Inputs: apps/host-sidecar-bridge, docs/INTERFACES.md, docs/ARCHITECTURE.md. Changes: - apps/host-sidecar-bridge/ — add live adapters and bounded snapshot formatting. - docs/INTERFACES.md — document `/host/*/status` line formats. - docs/ARCHITECTURE.md — record telemetry polling defaults. Commands: - cargo test -p host-sidecar-bridge Checks: - Live publish works over TCP; mock path remains deterministic. Deliverables: - Live host telemetry adapters + updated docs. Title/ID: m24b-live-hive-text Goal: Render bounded telemetry text overlays and a details panel in Live Hive using cohsh-core tails. Inputs: crates/cohsh-core, apps/swarmui, docs/INTERFACES.md. Changes: - crates/cohsh-core/ — add tail polling policy and line budget enforcement. - apps/swarmui/ — render overlays + details panel; no UI polling logic. - docs/INTERFACES.md — Live Hive text overlay rules. Commands: - cargo test -p cohsh-core - cargo test -p swarmui --test console_parity Checks: - Overlay shows last N lines; details panel shows last M; line truncation enforced. Deliverables: - Live Hive text overlay + deterministic bounds. Title/ID: m24b-test-plan-release Goal: Update Test Plan and cut a new release bundle after gates pass. Inputs: docs/TEST_PLAN.md, scripts/release_bundle.sh, releases/. Changes: - docs/TEST_PLAN.md — add non-mock PEFT flow + live telemetry checks. - releases/ — bump minor version bundle and tarball names. Commands: - scripts/cohsh/run_regression_batch.sh - scripts/release_bundle.sh --name Cohesix-0.3.0-alpha2 --version 0.3.0-alpha2 --force Checks: - Test Plan additions pass on macOS 26 and Ubuntu 24 bundles. Deliverables: - Updated Test Plan and new release bundle. ``` ---- **Release 0.2.0 alpha** ---- ## Milestone 24b1 — Live Hive UX Patch: Performance, Labels, Clickability, Telemetry Harness [Milestones](#Milestones) **Status:** Complete — Live Hive responsiveness, labeling, clickability, and telemetry harness are in place and verified. **Why now (adoption):** Operators cannot trust Live Hive when it is slow and ambiguous. The UI must remain responsive, worker dots must be identifiable at a glance, and clicking a worker must deterministically reveal telemetry. This patch is a focused UX + telemetry correctness fix, not a new protocol or capability change. **Goal** Diagnose and fix Live Hive slowness, add worker labels and type color-coding, guarantee clickability with tests, and add a deterministic performance + telemetry harness. **Deliverables** - Root-cause analysis of Live Hive slowness (profiling notes + findings captured in docs). - Worker dots show a short numeric label (stable per worker id) in the Hive view. - Worker dots are color-coded by role/type (worker-heartbeat, worker-gpu, worker-lora, worker-bus). - Click selection is reliable and verified by an automated UI test. - A performance + telemetry harness that validates: - UI remains responsive under N workers and M telemetry lines. - Telemetry lines appear when a worker is selected. - Documentation updates: `docs/TEST_PLAN.md` and `docs/INTERFACES.md` updated with the new UI and test expectations. **Commands** - `cargo test -p swarmui --test console_parity` - `cd tools/swarmui-ui-tests && npm test` - `scripts/cohsh/run_regression_batch.sh` **Checks (DoD)** - Live Hive remains responsive at N=8 workers and 2 KiB per-worker telemetry text budget. - Each worker dot renders a numeric label and role-specific color. - Clicking a worker reliably selects it and reveals telemetry in the details panel. - Playwright test asserts that clicking a worker changes the selected worker and loads telemetry text. - Performance harness reports within thresholds: 60 FPS target with < 16 ms avg frame time (or explicit measured threshold captured in test output). - No new protocols or console grammar changes. **Task Breakdown** ``` Title/ID: m24b1-hive-perf-diagnose Goal: Identify and fix the root cause of Live Hive slowness without changing protocols. Inputs: apps/swarmui, crates/cohsh-core, docs/INTERFACES.md. Changes: - apps/swarmui/ — profiling instrumentation + performance fixes (render loop, data diffs, throttling). - docs/INTERFACES.md — record any clarified UI constraints or telemetry rendering rules. Commands: - cargo test -p swarmui --test console_parity Checks: - UI remains responsive with 8 workers and active telemetry tails. Deliverables: - Performance fix + recorded diagnosis summary. Title/ID: m24b1-hive-labels-colors Goal: Add worker labels and role-based color-coding to Live Hive. Inputs: apps/swarmui, docs/INTERFACES.md. Changes: - apps/swarmui/ — render numeric labels near worker dots; add role palette mapping. - docs/INTERFACES.md — document label format + role color scheme. Commands: - cargo test -p swarmui --test console_parity Checks: - Each worker dot has a stable numeric label; colors reflect worker role. Deliverables: - Labeled and color-coded Live Hive nodes. Title/ID: m24b1-hive-clickability Goal: Guarantee worker dots are clickable and selection is deterministic. Inputs: tools/swarmui-ui-tests, apps/swarmui. Changes: - tools/swarmui-ui-tests/ — add Playwright test for worker selection. - apps/swarmui/ — ensure click targets map to selection state. Commands: - cd tools/swarmui-ui-tests - npm test Checks: - Playwright validates click selection updates the details panel. Deliverables: - UI clickability test and stable selection behavior. Title/ID: m24b1-hive-perf-telemetry-harness Goal: Add a deterministic harness that checks performance and telemetry visibility. Inputs: tools/swarmui-ui-tests, docs/TEST_PLAN.md. Changes: - tools/swarmui-ui-tests/ — add perf + telemetry fixtures + thresholds. - docs/TEST_PLAN.md — add the harness run steps and expected thresholds. Commands: - cd tools/swarmui-ui-tests - npm test Checks: - Telemetry lines appear after selection; perf thresholds met. Deliverables: - Performance + telemetry harness and Test Plan update. ``` ---- **Release 0.3.0 alpha** ---- ## Milestone 24c — Authoritative Scheduling Grammar + REST Gateway + Scheduler/Lease Observability [Milestones](#Milestones) **Status:** Complete. **Why now (adoption):** Operators want frictionless API access without weakening Cohesix’s authority model. This milestone adds VM‑authoritative scheduling/lease/policy/export control grammar, a host‑only REST gateway that is a strict projection of file/console semantics, and read‑only `/proc` observability surfaced in Live Hive. **Goal** Add additive, non‑breaking control grammar for: - Lease renewal/preemption + quotas - Declarative VM scheduling queue - Policy apply/rollback enforcement - Export scheduling / data‑diode controls Expose the new control surfaces through a host‑only REST gateway (OpenAPI 3.1), add Python REST backend parity, render read‑only scheduler + lease panels in SwarmUI using new `/proc` nodes, and support running the REST gateway as a systemd service on Linux with automatic reconnect to the Cohesix TCP console. **Deliverables** - New append‑only control files (strict JSONL schemas, bounded): - `/queen/lease/ctl` — lease quotas/renew/preempt - `/queen/schedule/ctl` — scheduling queue - `/queen/export/ctl` — export windows - `/policy/ctl` — apply/rollback schema - Manifest‑gated bounds for new control files and `/proc` nodes (IR‑driven via `coh-rtc`). - New `/proc` nodes (read‑only, bounded): - `/proc/schedule/summary` + `/proc/schedule/queue` - `/proc/lease/summary` + `/proc/lease/active` + `/proc/lease/preemptions` - Host‑only REST gateway + OpenAPI 3.1 spec + Swagger UI. - Linux systemd service unit for the REST gateway with restart/reconnect behavior. - Python REST backend with parity tests. - SwarmUI read‑only panels: Scheduler Queue and Lease/Preemption Timeline. - Docs updates: `docs/INTERFACES.md`, `docs/ARCHITECTURE.md`, `docs/USERLAND_AND_CLI.md`, `docs/HOST_TOOLS.md`, `docs/QUICKSTART.md`, `docs/PYTHON_SUPPORT.md`, `docs/TEST_PLAN.md`. **Commands** - `cargo run -p coh-rtc` - `scripts/check-generated.sh` - `cargo test -p nine-door --test schedule_create` - `cargo test -p nine-door --test schedule_bounds` - `cargo test -p nine-door --test lease_bounds` - `cargo test -p nine-door --test policy_ctl` - `cargo test -p nine-door --test export_ctl` - `cargo test -p cohsh-core` - `cargo test -p cohsh --test transcripts` - `cargo test -p swarmui --test console_parity` - `cd tools/swarmui-ui-tests && npm test` - `cargo test -p hive-gateway` - `python -m pytest -k cohesix_parity` - `scripts/cohsh/run_regression_batch.sh` **Checks (DoD)** - New control files accept valid JSONL and reject invalid fields with deterministic `ERR`. - New `/proc` nodes respect manifest bounds and render deterministic, line‑oriented output. - REST gateway returns OK/ERR/END‑equivalent responses and enforces manifest bounds. - Python REST backend matches cohsh semantics in parity tests. - SwarmUI panels render queue + lease state from `/proc` without adding any control verbs. - REST gateway can be run under systemd on Linux, and auto‑reconnects to the Cohesix console after a QEMU restart. - `docs/TEST_PLAN.md` is updated and its new steps are completed as part of DoD for this milestone. - Regression pack passes with updated fixtures; no ACK/ERR/END drift outside new fixtures. **Task Breakdown** ``` Title/ID: m24c-grammar-manifest Goal: Add manifest gates + bounds for new control files and `/proc` nodes. Inputs: configs/root_task.toml, tools/coh-rtc, docs/INTERFACES.md. Changes: - configs/root_task.toml — add scheduler/lease/export/policy gates + size bounds. - tools/coh-rtc — emit generated bounds for new control and `/proc` nodes. Commands: - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Generated outputs hash-match; bounds appear in snippets. Deliverables: - IR-driven gates and bounds for new control files and `/proc` nodes. Title/ID: m24c-grammar-runtime Goal: Implement VM/NineDoor handling of new control files with strict JSONL validation + audit lines. Inputs: apps/root-task/src/ninedoor.rs, apps/nine-door, docs/INTERFACES.md. Changes: - apps/root-task/src/ninedoor.rs — handlers for `/queen/lease/ctl`, `/queen/schedule/ctl`, `/queen/export/ctl`, `/policy/ctl`. - apps/nine-door/ — host-mode providers for the same paths. - docs/INTERFACES.md — document schemas + error semantics. - docs/ARCHITECTURE.md — update control surfaces/data flows. Commands: - cargo test -p nine-door --test schedule_create - cargo test -p nine-door --test schedule_bounds - cargo test -p nine-door --test lease_bounds - cargo test -p nine-door --test policy_ctl - cargo test -p nine-door --test export_ctl Checks: - Valid lines accepted; invalid lines rejected deterministically; audit lines emitted. Deliverables: - Authoritative scheduling/lease/policy/export grammar in VM and host NineDoor. Title/ID: m24c-proc-observability Goal: Add read-only `/proc` nodes for schedule + lease observability (bounded). Inputs: apps/root-task, docs/INTERFACES.md. Changes: - apps/root-task — `/proc/schedule/*` and `/proc/lease/*` providers. - docs/INTERFACES.md — new `/proc` node formats. Commands: - cargo test -p nine-door --test schedule_bounds - cargo test -p nine-door --test lease_bounds Checks: - `/proc` nodes respect manifest byte/line limits and stable formatting. Deliverables: - Read-only schedule/lease observability nodes. Title/ID: m24c-swarmui-scheduler-lease-panels Goal: Add read-only Live Hive panels for scheduler queue and lease/preemption timeline. Inputs: apps/swarmui, tools/swarmui-ui-tests, docs/INTERFACES.md. Changes: - apps/swarmui/ — panels that read `/proc/schedule/*` and `/proc/lease/*`. - tools/swarmui-ui-tests/ — replay fixtures + Playwright checks for panel wiring. - docs/INTERFACES.md — UI expectations (read-only). Commands: - cargo test -p swarmui --test console_parity - cd tools/swarmui-ui-tests - npm test Checks: - Panels render bounded content and update on replay fixtures. Deliverables: - Read-only SwarmUI panels for schedule and lease state. Title/ID: m24c-host-rest-gateway Goal: Provide host-only REST gateway mapping 1:1 to file/console semantics with systemd service support and reconnect behavior. Inputs: crates/cohsh-core, docs/HOST_TOOLS.md. Changes: - apps/hive-gateway/ — new host tool (REST server + OpenAPI 3.1 + Swagger UI). - docs/HOST_TOOLS.md — add gateway usage + auth/ticket guidance. - docs/HOST_API.md — OpenAPI spec + examples. - systemd unit file (Linux) — run gateway as a service with restart policy and env overrides. Commands: - cargo test -p hive-gateway Checks: - REST responses mirror OK/ERR/END; no new semantics. - Systemd unit reconnects to QEMU after console disconnect. Deliverables: - REST gateway + OpenAPI spec + systemd service unit. Title/ID: m24c-python-rest-backend Goal: Add REST backend to cohesix-py with parity coverage. Inputs: tools/cohesix-py, docs/PYTHON_SUPPORT.md. Changes: - tools/cohesix-py/cohesix/backends.py — RestBackend. - tools/cohesix-py/tests/test_parity.py — REST parity fixtures. - docs/PYTHON_SUPPORT.md — REST usage docs. Commands: - python -m pytest -k cohesix_parity Checks: - REST backend matches cohsh semantics. Deliverables: - REST backend + parity tests. Title/ID: m24c-docs-quickstart-testplan Goal: Update Quickstart and Test Plan for REST gateway + new control grammar. Inputs: docs/QUICKSTART.md, docs/TEST_PLAN.md, docs/USERLAND_AND_CLI.md. Changes: - docs/QUICKSTART.md — REST gateway quickstart (mock + live QEMU). - docs/TEST_PLAN.md — add schedule/lease/export/policy checks + REST gateway tests (including systemd service + reconnect). - docs/USERLAND_AND_CLI.md — document new control files (`echo` JSONL). Commands: - scripts/ci/check_test_plan.sh Checks: - Quickstart steps run on macOS 26 + QEMU. - New Test Plan steps executed and recorded as part of DoD. Deliverables: - Updated docs for frictionless adoption. Title/ID: m24c-regression-pack Goal: Add fixtures and run the regression pack unchanged. Inputs: scripts/cohsh/run_regression_batch.sh, tests/fixtures/*. Changes: - tests/fixtures/ — add schedule/lease/export/policy fixtures. Commands: - scripts/cohsh/run_regression_batch.sh Checks: - No ACK/ERR/END drift outside updated fixtures. Deliverables: - Updated fixtures and regression evidence. ``` ---- **Release 0.4.0 alpha** ---- ## Milestone 24d — Jetson CUDA Host Support (NVML Fallback + Doctor) [Milestones](#Milestones) **Status:** Complete. **Why now (adoption):** Jetson Orin hosts ship NVML with feature gaps. Host tools must still publish `/gpu/*` and pass `coh doctor` without weakening lease semantics or requiring mock mode. **Goal** Enable CUDA-based GPU discovery by default in host tools, with a deterministic NVML→CUDA fallback for Jetson-class NVML limitations. `coh doctor` must always succeed on Jetson by falling back to CUDA APIs when NVML is feature-limited. **Deliverables** - CUDA inventory backend for `gpu-bridge-host` (driver/runtime APIs) with deterministic NVML→CUDA fallback. - CUDA support enabled by default in affected host tools (`gpu-bridge-host`, `coh`), while preserving NVML support for dGPU hosts. - `coh doctor` treats NVML “not supported/feature-limited” as non-fatal and falls back to CUDA; emits an explicit degraded status line. - Docs updates: `docs/HOST_TOOLS.md`, `docs/GPU_NODES.md`, `docs/USERLAND_AND_CLI.md` (Jetson guidance + backend behavior). - Host setup supports Ubuntu 22.04 and documents Python 3.11 venv usage in Quickstart (for Jetson-class hosts). **Commands** - `cargo test -p host-cuda` - `cargo test -p gpu-bridge-host` - `cargo test -p coh --test transcript` - `cargo test -p coh --test run` **Checks (DoD)** - On Jetson Orin (JP 6.2.1), `./bin/gpu-bridge-host --list` reports `memory_mb > 0`, `sm_count > 0`, and non-empty driver/runtime versions via CUDA. - On Jetson Orin, `./bin/coh doctor` succeeds without `--mock` and emits a CUDA fallback status line. - On dGPU hosts with NVML, `gpu-bridge-host` still uses NVML and returns unchanged inventory fields. - `/gpu//info` schema remains unchanged and leases continue to enforce `mem_mb` bounds. **Task Breakdown** ``` Title/ID: m24d-gpu-bridge-cuda Goal: Add CUDA inventory backend and deterministic NVML→CUDA fallback for GPU discovery. Inputs: apps/gpu-bridge-host/src/lib.rs, apps/gpu-bridge-host/Cargo.toml, docs/INTERFACES.md. Changes: - crates/host-cuda/ — CUDA driver/runtime probe (host-only, unsafe isolated). - apps/gpu-bridge-host/src/lib.rs — add CUDA inventory implementation and fallback logic. - apps/gpu-bridge-host/Cargo.toml — enable CUDA support by default. - docs/INTERFACES.md — document backend selection and Jetson behavior. - docs/REPO_LAYOUT.md — document the new host CUDA crate. Commands: - cargo test -p host-cuda - cargo test -p gpu-bridge-host Checks: - CUDA discovery succeeds on Jetson; NVML remains active on dGPU. Deliverables: - CUDA-backed GPU discovery with deterministic fallback. Title/ID: m24d-coh-doctor-cuda Goal: Ensure `coh doctor` passes on Jetson by falling back to CUDA when NVML is feature-limited. Inputs: apps/coh/src/doctor.rs, apps/coh/Cargo.toml, docs/USERLAND_AND_CLI.md. Changes: - apps/coh/src/doctor.rs — detect NVML limitations and fallback to CUDA APIs. - apps/coh/Cargo.toml — enable CUDA support by default alongside NVML. - docs/USERLAND_AND_CLI.md — document NVML fallback behavior. Commands: - cargo test -p coh --test transcript Checks: - `coh doctor` succeeds on Jetson without `--mock` and emits a degraded CUDA fallback line. Deliverables: - Deterministic Jetson-friendly doctor checks. Title/ID: m24d-docs-host-tools Goal: Update host tool docs for Jetson CUDA discovery and fallback semantics. Inputs: docs/HOST_TOOLS.md, docs/GPU_NODES.md. Changes: - docs/HOST_TOOLS.md — clarify CUDA-by-default behavior and NVML fallback. - docs/GPU_NODES.md — describe Jetson inventory via CUDA APIs and limits. Commands: - scripts/ci/check_test_plan.sh Checks: - Docs accurately describe as-built host discovery behavior. Deliverables: - Jetson-ready host tool documentation. Title/ID: m24d-host-setup-ubuntu Goal: Support Ubuntu 22.04 host setup and document Python 3.11 venv usage for Quickstart. Inputs: scripts/setup_environment.sh, docs/QUICKSTART.md. Changes: - scripts/setup_environment.sh — allow Ubuntu 22.04; add explicit override for unsupported versions with best-effort package selection. - docs/QUICKSTART.md — add non-mock `coh doctor` expectations (NVML vs Jetson) and document Python 3.11 venv path for cohesix-py. Commands: - scripts/ci/check_test_plan.sh Checks: - Quickstart steps are clear for Ubuntu 22.04 + Python 3.11 venv users. Deliverables: - Jetson-friendly host setup and Quickstart guidance. Title/ID: m24d-coh-fuse-default Goal: Enable FUSE support by default for Linux `coh` builds while keeping macOS opt-in. Inputs: apps/coh/Cargo.toml, docs/HOST_TOOLS.md, docs/QUICKSTART.md, docs/PYTHON_SUPPORT.md, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md. Changes: - apps/coh/Cargo.toml — default FUSE on Linux, macOS opt-in via feature. - docs/HOST_TOOLS.md — update OS-specific FUSE defaults. - docs/QUICKSTART.md — document macOS opt-in behavior. - docs/PYTHON_SUPPORT.md — align FUSE notes with OS defaults. - docs/USERLAND_AND_CLI.md — clarify live mount prerequisites. - docs/TEST_PLAN.md — note macOS default FUSE disabled. Commands: - cargo check -p coh - cargo test -p coh --test transcript - cargo test -p coh --test run Checks: - `coh doctor` passes the mount check when Linux `/dev/fuse` (or macOS `/dev/macfuse0`) is available. - Docs reflect OS-specific FUSE defaults. Deliverables: - Linux-default FUSE-enabled `coh` builds with aligned documentation. Title/ID: m24d-toolchain-linux Goal: Provide a Linux toolchain bootstrap script aligned with Cohesix host tool requirements. Inputs: toolchain/setup_macos_arm64.sh, toolchain/setup_linux_arm64.sh. Changes: - toolchain/setup_linux_arm64.sh — install build/runtime prerequisites, rustup, and QEMU checks for Ubuntu hosts. Commands: - toolchain/setup_linux_arm64.sh Checks: - Script installs required packages and reports tool versions. Deliverables: - Linux toolchain setup script for host builds. ``` ## Milestone 24e — REST Multiplexer Transports + SwarmUI Gateway Mode [Milestones](#Milestones) **Status:** Complete. **Why now (adoption):** Live multi-host publishing requires a single console client. We need host tools and SwarmUI to speak to the `hive-gateway` REST projection so multiple external workers can publish and observe without breaking the single-client console constraint. **Goal** Add REST-backed transports for host publishers (`gpu-bridge-host`, `host-sidecar-bridge`, `cas-tool`), `coh` (including a REST-backed mount mode), and SwarmUI so they can multiplex through `hive-gateway` while retaining all existing console and Secure9P features. **Deliverables** - REST client crate for hive-gateway (`/v1/fs/ls`, `/v1/fs/cat`, `/v1/fs/echo`). - `cohsh` REST transport implementing the existing transport trait (no new semantics). - `cohsh` CLI supports `--transport rest` with `--rest-url` (env: `COHSH_REST_URL`, `COH_REST_URL`, `HIVE_GATEWAY_URL`). - `gpu-bridge-host` publish via REST (`/gpu/bridge/ctl`) with `--rest-url`. - `host-sidecar-bridge` publish via REST (`/host/*`) with `--rest-url`. - `cas-tool` upload via REST (`/updates/*`) with `--rest-url`. - `coh` REST mode for `mount`, `gpu`, `telemetry pull`, `peft`, and `run` via `--rest-url` (REST mount is exclusive: one active mount per gateway URL). - REST transport clamps `/proc` reads to manifest bounds so SwarmUI shows schedule/lease data in REST mode. - SwarmUI transport option (`SWARMUI_TRANSPORT=rest|gateway`) that routes through hive-gateway and preserves all existing features in console/9p modes (REST transport is enabled by default; disable with `--no-default-features` if needed). - SwarmUI live hive PixiJS renderer remains responsive under load (particle containers + capped sim steps). - Docs updated for REST multiplexer usage and SwarmUI transport selection. - REST multiplexer is queen-role only; worker-role attach remains console/9P-only. **Commands** - `cargo check -p cohesix-rest` - `cargo test -p cohsh` - `cargo test -p gpu-bridge-host` - `cargo test -p host-sidecar-bridge` - `cargo test -p swarmui` **Checks (DoD)** - REST transport maps `LS`/`CAT`/`ECHO` to gateway responses with deterministic errors. - `cohsh --transport rest --rest-url` attaches and reads `/proc/schedule/*` + `/proc/lease/*` without max_bytes bound errors. - REST publish paths populate `/gpu/*` and `/host/*` without console attachment. - `cas-tool --rest-url` uploads CAS bundles via `/updates/*` without console attachment. - `coh mount --rest-url` mounts via gateway (queen-role only, append-only semantics preserved, single REST mount per gateway URL). - SwarmUI REST mode connects through hive-gateway and renders the same panels/features as console/9p modes (REST transport enabled by default). - SwarmUI live hive view remains responsive (no PixiJS stalls) with live multi-worker telemetry. - Multiplexer smoke coverage: `cohsh` REST attach/ping; `gpu-bridge-host --rest-url --publish`; `host-sidecar-bridge --rest-url --watch`; `cas-tool upload --rest-url`; `coh mount|gpu|telemetry|peft|run --rest-url`; `SWARMUI_TRANSPORT=rest` with live hive view and console commands. - Docs describe REST multiplexer usage and transport selection clearly. **Task Breakdown** ``` Title/ID: m24e-rest-client Goal: Provide a shared hive-gateway REST client for host tools. Inputs: docs/HOST_API.md. Changes: - crates/cohesix-rest/ — add GatewayClient + response models. - Cargo.toml — add cohesix-rest to workspace. Commands: - cargo check -p cohesix-rest Checks: - REST client validates OK/ERR and preserves gateway error details. Deliverables: - Shared REST client crate for host tools. Title/ID: m24e-cohsh-rest-transport Goal: Add a REST-backed transport that implements the cohsh Transport trait. Inputs: apps/cohsh/src/lib.rs, apps/cohsh/src/transport. Changes: - apps/cohsh/src/transport/rest.rs — implement Transport over hive-gateway. - apps/cohsh/src/transport/mod.rs — export rest transport. - apps/cohsh/Cargo.toml — add cohesix-rest dependency/feature. Commands: - cargo test -p cohsh Checks: - Transport methods (`list`, `read`, `write`, `tail`) map to REST without changing semantics. Deliverables: - REST transport available to host tools and SwarmUI. Title/ID: m24e-cohsh-rest-cli Goal: Expose REST transport selection in the cohsh CLI. Inputs: apps/cohsh/src/main.rs, docs/USERLAND_AND_CLI.md, docs/HOST_TOOLS.md. Changes: - apps/cohsh/src/main.rs — add `--transport rest` + `--rest-url` resolution. - docs/USERLAND_AND_CLI.md — document REST transport option for cohsh. - docs/HOST_TOOLS.md — add cohsh REST example. Commands: - cargo test -p cohsh Checks: - `cohsh --transport rest --rest-url` connects to hive-gateway and supports core verbs. Deliverables: - CLI access to REST multiplexer transport. Title/ID: m24e-rest-proc-bounds Goal: Clamp REST `/proc` reads to manifest bounds so SwarmUI shows schedule/lease data. Inputs: apps/cohsh/src/transport/rest.rs, docs/HOST_API.md. Changes: - apps/cohsh/src/transport/rest.rs — enforce `/proc` read bounds via gateway metadata. Commands: - cargo test -p cohsh Checks: - REST reads for `/proc/schedule/*` and `/proc/lease/*` succeed with bounded `max_bytes`. Deliverables: - SwarmUI REST schedule/lease visibility retained. Title/ID: m24e-bridge-rest-publish Goal: Allow host bridge publishers to use hive-gateway as a multiplexer. Inputs: apps/gpu-bridge-host/src/main.rs, apps/host-sidecar-bridge/src/main.rs. Changes: - apps/gpu-bridge-host/src/main.rs — add `--rest-url` publish mode. - apps/host-sidecar-bridge/src/main.rs — add `--rest-url` publish mode. - apps/gpu-bridge-host/Cargo.toml — add cohesix-rest dependency. - apps/host-sidecar-bridge/Cargo.toml — enable cohsh REST transport feature. Commands: - cargo test -p gpu-bridge-host - cargo test -p host-sidecar-bridge Checks: - REST publish mode writes valid snapshot lines and respects bounds. Deliverables: - REST-capable host publishers. Title/ID: m24e-cas-tool-rest Goal: Allow cas-tool to upload bundles through hive-gateway. Inputs: apps/cas-tool/src/main.rs, docs/HOST_API.md. Changes: - apps/cas-tool/src/main.rs — add `--rest-url` upload mode. - apps/cas-tool/Cargo.toml — add cohesix-rest dependency. Commands: - cargo test -p cas-tool Checks: - REST upload writes base64 chunks to `/updates/*` without console attachment. Deliverables: - REST-capable cas-tool upload. Title/ID: m24e-coh-rest-mount Goal: Add REST-backed CohAccess for `coh` and support `coh mount --rest-url`. Inputs: apps/coh/src/main.rs, apps/coh/src/mount.rs, apps/coh/src/rest.rs. Changes: - apps/coh/src/rest.rs — implement REST CohAccess. - apps/coh/src/mount.rs — add REST-backed mount path. - apps/coh/src/main.rs — add `--rest-url` handling for live operations. - apps/coh/Cargo.toml — add cohesix-rest dependency. Commands: - cargo test -p coh Checks: - REST mount uses queen-role gateway, preserves append-only semantics, and enforces a single mount per gateway URL. Deliverables: - `coh` REST mode including mount support. Title/ID: m24e-swarmui-rest-transport Goal: Add SwarmUI transport option that connects through hive-gateway. Inputs: apps/swarmui/src-tauri/main.rs, apps/swarmui/src/lib.rs. Changes: - apps/swarmui/src-tauri/main.rs — support `SWARMUI_TRANSPORT=rest|gateway`. - apps/swarmui/Cargo.toml — enable cohsh REST transport feature. Commands: - cargo test -p swarmui Checks: - SwarmUI REST mode renders existing panels and console commands without regressions (REST transport enabled by default). Deliverables: - SwarmUI gateway mode for REST multiplexing. Title/ID: m24e-swarmui-pixi-perf Goal: Keep SwarmUI Live Hive responsive under multi-worker telemetry load. Inputs: apps/swarmui/frontend/hive/renderer.js, apps/swarmui/frontend/hive/index.js. Changes: - apps/swarmui/frontend/hive/renderer.js — shift to particle containers + sprite-based clusters. - apps/swarmui/frontend/hive/index.js — cap sim steps per frame + throttle render rate under pressure. Commands: - cargo test -p swarmui Checks: - Live Hive view remains responsive (no UI stalls) with active telemetry and multiple workers. Deliverables: - PixiJS rendering optimizations for live mode. Title/ID: m24e-docs-rest-multiplexer Goal: Document REST multiplexer usage and SwarmUI transport selection. Inputs: docs/HOST_TOOLS.md, docs/API_GUIDELINES.md, docs/HOST_API.md, docs/USERLAND_AND_CLI.md. Changes: - docs/HOST_TOOLS.md — add REST publish examples for host bridges and SwarmUI. - docs/API_GUIDELINES.md — add transport guidance for REST multiplexer deployments. - docs/HOST_API.md — add `/gpu/bridge/ctl` and `/host/*` REST examples. - docs/USERLAND_AND_CLI.md — document SwarmUI transport options. Commands: - scripts/ci/check_test_plan.sh Checks: - Docs reflect as-built REST multiplexer behavior. Deliverables: - Updated operator-facing documentation. ``` ## Milestone 25 — SMP Utilization via Task Isolation (Multicore without Multithreading) [Milestones](#Milestones) **Why now (platform and performance):** Cohesix targets modern aarch64 hardware where multicore CPUs are the norm. To scale throughput without sacrificing determinism, auditability, or TCB size, Cohesix must exploit seL4 SMP scheduling rather than introducing shared-memory multithreading. This milestone formalizes multicore usage through task isolation, sharding, and explicit authority boundaries. This is a performance and clarity milestone, not a feature expansion. **Status:** Complete. ## Goal Enable Cohesix to take advantage of multicore aarch64 CPUs by: 1. Running multiple isolated seL4 tasks in parallel, 2. Keeping authoritative state single-threaded and serial, and 3. Scaling throughput through replication and partitioning, not threads. The result must preserve: - deterministic ACK/ERR ordering, - replayability, - bounded work per tick, - and a minimal trusted computing base. ## Non-Goals (Explicit) - No POSIX threads or shared-memory multithreading - No async runtimes with implicit scheduling - No background work queues with unbounded growth - No relaxation of replay or audit guarantees - No changes to Secure9P / NineDoor semantics - No new protocols or transports ## Design Principles (Normative) These are target-state acceptance requirements, not claims that every named service is already a child task. The as-built profile currently applies them to manifest-declared physical-driver runtimes; root-task still owns NineDoor, console/network, provider, policy, and Worker model/session paths. 1. **Concurrency via isolation, not sharing** All parallelism is achieved by running separate seL4 tasks. 2. **Single-threaded authority** All authoritative decisions (tickets, lifecycle, policy, replay) are serialized through a single authority task. 3. **Parallelism at the edges** Parsing, IO, and provider logic may scale horizontally, but must request decisions from the authority task. 4. **Explicit back-pressure** When the authority or a shard is saturated, callers receive deterministic `ERR reason=busy`, not hidden queuing. ## Task-Level Parallelism Model ### Core Roles (Illustrative) | Task | Responsibility | Parallelism Strategy | |----|---------------|----------------------| | `root-task` | Authority, lifecycle, policy | Single instance, serialized | | `nine-door` | Secure9P parsing and routing | Sharded per session or subtree | | `console-transport` | TCP/serial framing, auth | One task per transport | | Providers (`/log`, `/proc`, `/gpu`, `/host`) | Namespace backends | One task per provider | | Workers (future executable profile) | Role-specific execution | One task per Worker only after the reopened execution gate closes | In a future profile that closes the reopened task-isolation gate, each listed service task runs a single-threaded event loop and seL4 schedules those tasks across available cores. Today root-owned service paths share the root-task event loop; only manifest-declared physical-driver runtimes are separate child tasks. ## SMP Affinity and Partitioning ### Affinity Guidelines - Authority task MAY be pinned to a single core for stability. - IO-heavy tasks MAY be pinned near device IRQ affinity. - Provider tasks MAY be distributed across remaining cores. Affinity is optional and platform-specific but must be: - declarative, - bounded, - and documented. ## Authority Interaction Contract All non-authority tasks: - Submit requests to the authority task via IPC, - Receive explicit `OK` / `ERR` responses, - MUST NOT mutate authoritative state directly. If the authority task cannot accept work: - It responds with `ERR reason=busy`, - The refusal is audited and observable, - No retries occur inside the VM. ## Determinism and Replay Guarantees - Authoritative decisions are totally ordered. - Parallel tasks must not reorder or speculate on outcomes. - Replay executes the same authority decisions in the same order, regardless of task scheduling or core count. - SMP must not introduce nondeterministic ACK/ERR sequences. ## Implementation Touchpoints - `apps/root-task/` - Explicit authority IPC surface - Busy/back-pressure signaling - `apps/nine-door/` - Optional sharding of protocol handling - `apps/root-task/src/net/console_srv.rs` and `apps/root-task/src/serial/` - Transport isolation from authority logic - `docs/ARCHITECTURE.md` - SMP model and invariants - `docs/SECURITY.md` - Rationale for rejecting multithreading ## Testing and Validation ### Functional - All existing regression scripts must pass unchanged. - New SMP runs must produce byte-identical ACK/ERR sequences to single-core runs. ### Stress - Saturate protocol handlers while authority remains correct. - Verify `ERR reason=busy` emission under load. - Confirm no state corruption or reordering. - Run concurrent cohsh regression scripts over the REST multiplexer (`hive-gateway` as the sole console client) using `scripts/cohsh/REST_regression_batch.sh`. ### Replay - Capture traces on multicore. - Replay on single-core QEMU and assert identical outcomes. ## Checks (Definition of Done) - Cohesix runs correctly on multicore aarch64 under QEMU and hardware. - Parallel tasks execute on multiple cores without shared-memory races. - Authority logic remains single-threaded and replayable. - Back-pressure is explicit and observable. - No new threads, runtimes, or hidden queues introduced. - `scripts/cohsh/REST_regression_batch.sh` passes unchanged with `hive-gateway` as the sole console client (concurrent REST runs). - `cohsh test --mode smp` completes without unexpected errors while the root console `smp` command reports bounded userspace activity. - Root console `smp dump` emits the raw scheduler snapshot only in a compatible debug context, or returns a deterministic unsupported result. - Documentation clearly explains the SMP model and its constraints. ## Task Breakdown ``` Title/ID: m25c-smp-kernel-enable Goal: Enable seL4 SMP in the external kernel build and document requirements. Inputs: ~/seL4/SMP_build, docs/ARCHITECTURE.md, docs/BUILD_PLAN.md. Changes: - ~/seL4/SMP_build/ — regenerate kernel artifacts with SMP enabled (do not touch ~/seL4/build). - docs/ARCHITECTURE.md — record SMP kernel requirements and QEMU CPU count. Commands: - cmake --build ~/seL4/SMP_build Checks: - SMP-enabled kernel boots under QEMU with >1 core. Deliverables: - SMP kernel artifacts and documented build requirements. Title/ID: m25c-smp-build-mirror Goal: Mirror SMP build outputs into the repo and make SMP the default build path. Inputs: ~/seL4/SMP_build, seL4/SMP_build, scripts/cohesix-build-run.sh. Changes: - seL4/SMP_build/ — copy SMP build outputs from ~/seL4/SMP_build (leave seL4/build untouched). - scripts/cohesix-build-run.sh — default SEL4_BUILD_DIR to seL4/SMP_build; allow override to seL4/build. Commands: - rsync -a ~/seL4/SMP_build/ seL4/SMP_build/ Checks: - `scripts/cohesix-build-run.sh` uses seL4/SMP_build by default; `--sel4-build seL4/build` overrides correctly. Deliverables: - Repo-local SMP build outputs and updated build defaults. Title/ID: m25c-smp-qemu-defaults Goal: Default QEMU SMP topology to four single-threaded cores while keeping overrides explicit. Inputs: scripts/qemu-run.sh, scripts/cohesix-build-run.sh, scripts/release_bundle.sh, releases/*/qemu/run.sh, docs/QUICKSTART.md, docs/TEST_PLAN.md. Changes: - scripts/qemu-run.sh — default to `-smp 4,cores=4,threads=1,sockets=1`; allow overrides via `COHESIX_QEMU_SMP` / `QEMU_SMP` (count) and `COHESIX_QEMU_SMP_TOPO` / `QEMU_SMP_TOPO` (full topology string). - scripts/cohesix-build-run.sh — same default and override handling as `scripts/qemu-run.sh`. - scripts/release_bundle.sh — bake the SMP defaults and env overrides into generated `qemu/run.sh`. - releases/-* — bump minor version per policy; update bundled `qemu/run.sh` defaults and rename tarballs accordingly. - docs/QUICKSTART.md, docs/TEST_PLAN.md — document the SMP default and override variables. Commands: - COHESIX_QEMU_SMP=1 scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none - COHESIX_QEMU_SMP=4 scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none Checks: - Default QEMU launches use `-smp 4,cores=4,threads=1,sockets=1`. - SMP overrides apply deterministically with no validation regressions. - Release bundle minor version increments and tarball names match directory names. Deliverables: - SMP-aware QEMU launch defaults with documented override behavior. Title/ID: m25c-authority-ipc Goal: Serialize authoritative decisions behind a single IPC surface. Inputs: apps/root-task, docs/ROLES_AND_SCHEDULING.md. Changes: - apps/root-task/src/authority.rs — authority IPC entrypoint and queueing. - apps/root-task/src/lib.rs — route all authority mutations through IPC. Commands: - cargo test -p root-task Checks: - Authority decisions are serialized and replay-stable. Deliverables: - Single-threaded authority IPC with deterministic ordering. Title/ID: m25c-sharded-tasks Goal: Run IO, parsing, and providers in separate single-threaded seL4 tasks. Inputs: apps/nine-door, apps/console, apps/root-task. Changes: - apps/root-task/src/spawn.rs — spawn NineDoor shards and provider tasks. - apps/nine-door/src/lib.rs — shard-aware request handling. Commands: - cargo check -p root-task - cargo test -p nine-door --test sharding Checks: - Shards execute in parallel without shared-memory coupling. Deliverables: - Task-isolated protocol handling. Title/ID: m25c-affinity-ir Goal: Add optional affinity hints to IR and enforce bounds. Inputs: configs/root_task.toml, tools/coh-rtc, docs/ARCHITECTURE.md. Changes: - tools/coh-rtc/src/ir.rs — affinity hints and validation. - configs/root_task.toml — optional affinity policy. Commands: - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Invalid affinity configurations are rejected deterministically. Deliverables: - Manifest-driven affinity policy (optional). Title/ID: m25c-smp-replay-regressions Goal: Prove SMP determinism vs single-core runs. Inputs: docs/TEST_PLAN.md, scripts/cohsh/. Changes: - scripts/cohsh/smp_parity.coh — compare ACK/ERR sequences across core counts. Commands: - cohsh --script scripts/cohsh/smp_parity.coh Checks: - Multicore and single-core transcripts match byte-for-byte. Deliverables: - SMP parity regression coverage. Title/ID: m25c-smp-cohsh-selftest Goal: Add `cohsh test --mode smp` to pressure SMP and surface activity for the `smp` console command. Inputs: apps/cohsh, apps/nine-door, resources/proc_tests, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md. Changes: - resources/proc_tests/selftest_smp.coh — SMP-oriented regression script. - apps/nine-door/src/host/namespace.rs — expose `/proc/tests/selftest_smp.coh`. - apps/cohsh/src/lib.rs — accept `test --mode smp` and map to the new script. - docs/USERLAND_AND_CLI.md — document the new selftest script and mode. - docs/TEST_PLAN.md — add `test --mode smp` to QEMU regression steps. Commands: - cargo test -p cohsh Checks: - `cohsh test --mode smp` completes without unexpected errors. - Root console `smp` shows bounded userspace activity. Deliverables: - SMP selftest script and cohsh mode support. Title/ID: m25-smp-console-metrics Goal: Add a root console path to emit the raw seL4 scheduler snapshot. Inputs: root console parser, seL4 debug syscall docs, docs/USERLAND_AND_CLI.md. Changes: - apps/root-task/src/console.rs — invoke seL4 debug scheduler/CPU dump APIs (`seL4_DebugDumpScheduler`, `seL4_DebugDumpCPUInfo`) when enabled; bounded output, no shared-memory access. The later `m26d-smp-command-post-cutover-usability` correction makes this explicit as `smp dump`. - docs/USERLAND_AND_CLI.md — document the raw scheduler output and debug-build gating. Commands: - QEMU diagnostic serial console: `smp dump` Checks: - Debug builds emit per-core scheduler/CPU metrics (core id, runnable/idle summary) with bounded output. - Non-debug builds return deterministic `ERR reason=unsupported` with no side effects. Deliverables: - Explicit raw SMP scheduler diagnostic with seL4-aligned semantics. Title/ID: m25-smp-rest-regression-batch Goal: Stress SMP using concurrent cohsh regression scripts via the REST multiplexer. Inputs: scripts/cohsh/*.coh, apps/hive-gateway, docs/TEST_PLAN.md. Changes: - scripts/cohsh/REST_regression_batch.sh — run multiple `cohsh --transport rest` scripts concurrently against `hive-gateway` using `COHESIX_GATEWAY_URL` (or `HIVE_GATEWAY_URL`/`COHSH_REST_URL`/`COH_REST_URL`); bounded concurrency, no script changes. - docs/TEST_PLAN.md — add a REST SMP stress run using the batch script. Commands: - `COHESIX_GATEWAY_URL=http://: scripts/cohsh/REST_regression_batch.sh` Checks: - All regression scripts pass unchanged under concurrent REST load. - `ERR ... reason=busy` appears only under saturation and is audited; ACK/ERR ordering remains deterministic. Deliverables: - REST multiplexer SMP stress harness and documented runbook. Title/ID: m25h-live-hive-turbo Goal: Deliver ≥100x Live Hive responsiveness by prioritizing fresh telemetry visibility, bounded aggregation, and adaptive rendering without changing protocol semantics. Inputs: apps/swarmui/src, apps/swarmui/frontend, tools/coh-rtc, docs/INTERFACES.md, docs/TEST_PLAN.md. Changes: - apps/swarmui/src/hive.rs — O(1) telemetry line parsing, per-worker pending caps, fresh-only coalescing, round-robin worker sampling, overlay/detail caching. - apps/swarmui/src/lib.rs — Live Hive polling uses freshness-first policy; status snapshots rate-limited behind IR-driven bounds. - apps/swarmui/frontend/hive/index.js — ring-buffer ingestion, drop-oldest under pressure, index-range event application (no per-step slicing). - apps/swarmui/frontend/app.js + apps/swarmui/frontend/hive/index.js — keep Live Hive rendering active during scroll (no pause) while degrading cadence/quality; pause rendering only when the canvas is offscreen; throttle cadence, cap detail LOD, and drop render resolution when the canvas is idle to keep page interactions smooth. - apps/swarmui/frontend/hive/world.js — cache per-tick positions; in-place compaction for pollen/pulse particles. - apps/swarmui/frontend/hive/renderer.js — adaptive resolution/AA/particle budgets under degraded mode. - tools/coh-rtc/src/ir.rs + generated configs — manifest-backed Live Hive performance knobs (sample size, pending caps, degrade thresholds). - docs/INTERFACES.md — document freshness-first Live Hive guarantees and aggregation bounds. - docs/TEST_PLAN.md — add Live Hive performance regression harness (target freshness + frame budget). Commands: - cargo run -p coh-rtc - cargo test -p swarmui - (SwarmUI UI regression) cd tools/swarmui-ui-tests && npm test Checks: - Live Hive shows current telemetry within one poll under 3–100 workers with bounded backlog. - Aggregation/caching preserves latest state while historical detail remains bounded and replay-safe. - Renderer meets frame budget targets under load; degraded mode engages deterministically. Deliverables: - Freshness-first Live Hive with documented bounds and ≥100x reduction in worst-case UI/ingest latency. ``` ---- **Release 0.6.0 alpha** ---- ## Milestone 25a — REST Live Hive Performance (Parallel Polling + Batching) [Milestones](#Milestones) **Why now (demo readiness):** REST is the only transport that supports the demo multiplexer, but Live Hive poll latency is dominated by serial REST reads. This milestone reduces REST wall-clock latency without changing protocols or semantics, while preserving Secure9P bounds and auditability. **Status:** Complete — REST status polling is parallelized, REST cache behavior honors `status_poll_ms`, pool sizing supports bounded concurrency, telemetry fan-out is pool-capped, and deterministic REST performance harness coverage is in place. ## Goal Reduce Live Hive REST status poll wall-clock time with minimal risk by: 1. Parallelizing REST status reads in SwarmUI, and 2. Honoring `status_poll_ms` caching in REST mode, 3. Increasing REST session pool sizing to support concurrency, 4. Parallelizing REST telemetry tails after pool sizing, with concurrency capped to pool limits, and 5. Adding a deterministic REST performance harness, and 6. Applying manifest-driven CPU affinity to the root-task authority thread during bootstrap. ## Non-Goals (Explicit) - No new protocols or transports. - No changes to ACK/ERR/END grammar. - No changes to Secure9P semantics or bounds. - No release bundle updates under `releases/`. - No UI feature expansion beyond performance. ## Design Principles (Normative) 1. **Protocol stability** — REST remains a thin wrapper over existing NineDoor semantics. 2. **Bounded concurrency** — parallelism must respect pool sizing and manifest limits. 3. **Deterministic behavior** — parallel reads must not reorder or coalesce event semantics. 4. **Opt-in batching** — new batch endpoints must be additive and backward compatible. ## Implementation Touchpoints - `apps/swarmui/src/lib.rs` — REST status polling: cache + parallel reads. - `configs/root_task.toml` — REST pool sizing adjustments (manifest-driven). - `configs/generated/cohsh_policy.toml` + generated policy artifacts (via `coh-rtc`). - `apps/swarmui/src/hive.rs` — REST telemetry tails: parallel with pool-capped concurrency. - `scripts/rest_perf_harness.py` — deterministic REST performance harness. - `apps/root-task/src/affinity.rs`, `apps/root-task/src/sel4.rs`, `apps/root-task/src/kernel.rs` — apply manifest-driven affinity during bootstrap. ## Testing and Validation ### Functional - SwarmUI REST mode must continue to render Live Hive without regressions. ### Performance - Run the REST performance harness to quantify sequential vs parallel status latency. - Verify pool sizing eliminates "session pool exhausted" under parallel polling. ## Checks (Definition of Done) - SwarmUI REST mode reduces status polling wall-clock latency by at least 2x on the same host. - `scripts/rest_perf_harness.py --suite status --assert-min-ratio 2.0` passes. - `scripts/rest_perf_harness.py --suite telemetry --assert-min-ratio 1.3` passes when workers are present. - `cargo test -p swarmui` passes. - `cargo run -p coh-rtc` + `scripts/check-generated.sh` pass after manifest changes. ## Task Breakdown ``` Title/ID: m25a-rest-perf-harness Goal: Add a deterministic REST performance harness for Live Hive polling. Inputs: scripts/rest_perf_harness.py. Changes: - scripts/rest_perf_harness.py — sequential vs parallel REST timing for status + telemetry. Commands: - python3 scripts/rest_perf_harness.py --help Checks: - Harness reports averages and enforces optional min speedup ratio. Deliverables: - REST performance harness script. Title/ID: m25a-swarmui-rest-status Goal: Parallelize and cache REST status polling in Live Hive. Inputs: apps/swarmui/src/lib.rs. Changes: - apps/swarmui/src/lib.rs — parallel `/proc` reads and honor `status_poll_ms` in REST mode. Commands: - cargo test -p swarmui Checks: - Live Hive status remains correct; poll latency drops. Deliverables: - SwarmUI REST status polling improvements. Title/ID: m25a-rest-pool-sizing Goal: Increase REST session pool sizing to support parallel polling. Inputs: configs/root_task.toml. Changes: - configs/root_task.toml — adjust `client_policies.cohsh.pool` sizes. - configs/generated/cohsh_policy.toml — regenerated. - apps/cohsh/src/generated/policy.rs — regenerated. - docs/snippets/cohsh_policy.md — regenerated. Commands: - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Generated policy artifacts match manifest. Deliverables: - Updated REST pool sizing and generated artifacts. Title/ID: m25a-swarmui-rest-telemetry Goal: Parallelize REST telemetry tails per worker after pool sizing. Inputs: apps/swarmui/src/hive.rs, configs/root_task.toml, configs/generated/cohsh_policy.toml. Changes: - apps/swarmui/src/hive.rs — parallel `tail` calls within pool-sized bounds. Commands: - cargo test -p swarmui Checks: - No changes to telemetry semantics; poll latency improves with multiple workers. - Parallelism never exceeds configured REST telemetry pool size. Deliverables: - SwarmUI REST telemetry polling improvements with pool-capped concurrency. Title/ID: m25a-root-affinity-wire Goal: Apply manifest-driven CPU affinity to the root-task authority thread and role-specific operations (NineDoor attach and worker spawns) and extend SMP debug output to iterate configured cores. Inputs: apps/root-task/src/affinity.rs, apps/root-task/src/sel4.rs, apps/root-task/src/kernel.rs, tools/coh-rtc, configs/root_task.toml, docs/ARCHITECTURE.md. Changes: - apps/root-task/src/affinity.rs — policy validation and role-based core selection helpers. - apps/root-task/src/sel4.rs — guarded TCB affinity syscall wrapper. - apps/root-task/src/kernel.rs — validate policy and pin the init TCB to `authority_core`. - apps/root-task/src/userland/mod.rs — apply NineDoor affinity during bridge attach. - apps/root-task/src/ninedoor.rs — apply worker affinity during worker spawns. - apps/root-task/src/console/mod.rs — per-core SMP debug dumps using configured affinity cores. - apps/root-task/src/event/mod.rs — per-core SMP debug dumps using configured affinity cores. - tools/coh-rtc/src/codegen/rust.rs — emit affinity policy tables. - tools/coh-rtc/src/codegen/docs.rs — include affinity fields in manifest snippet. - docs/ARCHITECTURE.md — document root-task affinity application. Commands: - cargo test -p root-task - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Root-task bootstrap logs authority core pinning when affinity is enabled. - NineDoor attach and worker spawns log role-core affinity applications. - `smp` debug output cycles through configured role cores. - Generated manifest snippet includes affinity fields and matches configs. Deliverables: - Manifest-driven root-task affinity wiring for the init TCB. ``` ---- **Release 0.7.0 alpha** ---- ## Milestone 25b — Secure Scale Gateway (1k Worker Readiness + Due Diligence Closure) [Milestones](#Milestones) **Why now (release integrity + scale):** The live benchmark demonstrates 100 workers sustained with timeout onset under heavier activity before 100 in ramp mode, while due-diligence still contains open P1 blockers in gateway auth, token handling, regression coverage, and platform gates. This milestone addresses both concerns in one bounded track so scale gains are security-valid and release-valid. **Status:** Complete - due-diligence gate baseline passed at `out/audit/gate/20260214T044955Z`, `P0/P1` blockers are closed in `docs/audit/findings.csv`, and Milestone 25b closure evidence is published in `docs/audit/AUDIT_REPORT_2026-02-14.md`. ## Goal Deliver a single-console-compliant gateway path that can be validated toward 1,000-worker operation while closing release-blocking due-diligence findings by: 1. Hardening gateway edge authentication and secret handling. 2. Preserving the one-console-client design while improving multiplexed throughput and fairness. 3. Expanding benchmark methodology to deterministic 8..1000 worker ramps with reproducible evidence. 4. Restoring failing regression/workspace gates so performance evidence is trustworthy. 5. Publishing closure evidence in audit artifacts and benchmark docs. ## Non-Goals (Explicit) - No new in-VM TCP listeners or alternate control-plane transports. - No changes to ACK/ERR/END grammar or Secure9P protocol semantics. - No bypass of role/ticket authorization inside the VM. - No broad UI feature work unrelated to scale or due-diligence closure. - No release bundle changes under `releases/` in this milestone. ## Design Principles (Normative) 1. **Single-console authority** - `hive-gateway` remains the sole TCP console client; all concurrent operators route through REST. 2. **Edge auth plus VM auth** - add caller authentication at REST ingress without changing VM attach semantics. 3. **Bounded fairness** - queueing, caching, and concurrency must be explicit, bounded, and manifest/policy constrained. 4. **Evidence-first closure** - every P1/P2 closure includes deterministic repro, command logs, commit SHA, and independent verification. 5. **No hidden drift** - docs, generated artifacts, and gate scripts must converge on one canonical command set. ## Implementation Touchpoints - `apps/hive-gateway/src/main.rs` - request-auth middleware, bind/exposure guardrails, bounded broker queueing and metrics. - `apps/cohsh/src/transport/tcp.rs`, `apps/cohsh/src/session_pool.rs` - transport/pool behavior required for gateway throughput under single console. - `apps/root-task/src/net/mod.rs`, `apps/root-task/src/net/console_srv.rs` - default token removal and auth-log redaction. - `scripts/rest_perf_harness.py` - deterministic ramp/seed support, resilient summaries, graph/CSV export. - `tests/tests/shard_1k.rs`, `scripts/cohsh/shard_1k.coh`, `crates/sel4-runtime/src/lib.rs`, `crates/sel4-sys/src/lib.rs` - regression/workspace gate repairs. - `docs/BENCHMARKS.md`, `docs/HOST_API.md`, `docs/USERLAND_AND_CLI.md`, `docs/TEST_PLAN.md`, `docs/audit/*` - as-built benchmark + assurance evidence alignment. ## Testing and Validation ### Security and Auth - Verify unauthenticated REST writes are rejected deterministically. - Verify startup fails fast when required auth token inputs are missing in non-test mode. - Verify auth rejection logs never include raw token bytes or token-adjacent material. ### Scale and Performance - Run fixed-seed worker ramps (`8..1000`) with preflight-gated VM boot/TCP/auth validation. - Compare baseline vs aggressive profiles with identical topology and bounds. - Confirm summary emission even on timeout-heavy runs to preserve evidence quality. ### Regression and Release Gates - Re-run `cargo test -p tests` and `cargo test --workspace` after fixture/platform fixes. - Re-run generated-artifact and test-plan guards with updated docs snippets. - Re-run `scripts/ci/due_diligence_gate.sh` and attach logs in audit evidence. ## Checks (Definition of Done) - Single-console design remains intact (no additional in-VM listener; gateway is sole console client in multiplexer mode). - `DD-2026-0001`, `DD-2026-0002`, `DD-2026-0003`, and `DD-2026-0010` move to `CLOSED_VERIFIED` with reproducible evidence. - `DD-2026-0004`, `DD-2026-0005`, and `DD-2026-0009` move to `CLOSED_VERIFIED` with passing gate commands. - `scripts/rest_perf_harness.py` supports deterministic 8..1000 worker runs and always emits machine-readable summary output. - `docs/BENCHMARKS.md` includes comparative 8..1000 results and graphs sourced from committed evidence logs. - `scripts/ci/due_diligence_gate.sh` passes without skipped/incomplete steps on milestone closure runs. ## Task Breakdown ``` Title/ID: m25b-gateway-edge-auth Goal: Close gateway-facing auth blockers while preserving VM authority semantics. Inputs: apps/hive-gateway/src/main.rs, docs/HOST_API.md, docs/OPERATOR_WALKTHROUGH.md, docs/audit/findings.csv. Changes: - apps/hive-gateway/src/main.rs - add required request authentication middleware for mutating routes and fail-fast startup when auth secrets are unset in non-test mode. - apps/hive-gateway/src/main.rs - enforce safe default exposure (loopback-only unless explicitly overridden with documented risk flags). - apps/hive-gateway/tests/* - add integration tests for unauthenticated/incorrect-token/authorized request paths. - docs/HOST_API.md - document request-auth contract, headers, and deployment hardening defaults. Commands: - cargo test -p hive-gateway Checks: - Unauthenticated POST `/v1/fs/echo` and equivalent write paths return deterministic authorization errors. - Gateway refuses insecure startup configuration in non-test mode. Deliverables: - Closure evidence for DD-2026-0002 and DD-2026-0010 with logs and commit SHA. Title/ID: m25b-console-token-hygiene Goal: Remove insecure token defaults and prevent auth token leakage in logs. Inputs: apps/root-task/src/net/mod.rs, apps/root-task/src/net/console_srv.rs, tools/coh-rtc, configs/root_task.toml, docs/audit/findings.csv. Changes: - apps/root-task/src/net/mod.rs - remove production default auth token path and require explicit configured token source. - apps/root-task/src/net/console_srv.rs - replace raw auth-byte logging with structured redacted diagnostics. - apps/root-task/tests/* - add negative assertions proving token material is not logged on auth rejection. - tools/coh-rtc + generated outputs - wire token requirements through generated policy/config where applicable. Commands: - cargo test -p root-task - cargo run -p coh-rtc - scripts/check-generated.sh Checks: - Missing token config fails fast outside test profiles. - Auth failure logs do not expose token contents or byte-equivalent payload. Deliverables: - Closure evidence for DD-2026-0001 and DD-2026-0003 with regenerated artifacts. Title/ID: m25b-single-console-broker Goal: Increase gateway multiplexing throughput under one attached console session. Inputs: apps/hive-gateway/src/main.rs, apps/cohsh/src/session_pool.rs, apps/cohsh/src/transport/tcp.rs, docs/USERLAND_AND_CLI.md. Changes: - apps/hive-gateway/src/main.rs - introduce bounded broker queueing with priority classes (control before telemetry), fairness scheduling, and explicit backpressure signals. - apps/hive-gateway/src/main.rs - add bounded read-through caches for hot `/proc` reads with deterministic TTL and invalidation. - apps/hive-gateway/src/main.rs - expose queue depth, saturation, timeout, and retry counters through gateway metrics/status paths. - docs/USERLAND_AND_CLI.md - clarify single-console behavior and REST multiplexer operational limits. Commands: - cargo test -p hive-gateway - python3 scripts/rest_perf_harness.py --suite status --assert-min-ratio 2.0 Checks: - Parallel REST load no longer collapses into avoidable "session pool exhausted" behavior at configured policy limits. - No change to console grammar or in-VM listener topology. Deliverables: - Single-console broker implementation with bounded throughput/fairness instrumentation. Title/ID: m25b-rest-harness-1k Goal: Extend the benchmark harness and report pipeline for deterministic 1k-worker readiness evidence. Inputs: scripts/rest_perf_harness.py, docs/BENCHMARKS.md. Changes: - scripts/rest_perf_harness.py - add deterministic seed handling for ramp profiles and worker bands up to 1000. - scripts/rest_perf_harness.py - require preflight boot/TCP/auth/LS checks before load execution. - scripts/rest_perf_harness.py - harden timeout/error handling so run summaries and per-op stats are always emitted. - scripts/rest_perf_harness.py - emit CSV/JSON artifacts consumable by benchmark graphs. - docs/BENCHMARKS.md - publish baseline vs aggressive 8..1000 runs, degradation thresholds, and graph-backed interpretation. Commands: - python3 scripts/rest_perf_harness.py --mode simulate --workers-min 8 --workers-max 1000 --duration-mins 5 --seed 2501 - python3 scripts/rest_perf_harness.py --mode simulate --workers-min 8 --workers-max 1000 --duration-mins 5 --seed 2501 --intensity-min 6 --intensity-max 6 Checks: - Both runs emit reproducible summaries and evidence files. - Report includes graphs and explicit onset points for buffer pressure and timeout behavior. Deliverables: - 1k-worker readiness benchmark evidence pack and updated benchmark report. Title/ID: m25b-regression-and-gate-closure Goal: Repair failing release gates so scale evidence is release-grade. Inputs: tests/tests/shard_1k.rs, scripts/cohsh/shard_1k.coh, crates/sel4-runtime/src/lib.rs, crates/sel4-sys/src/lib.rs, docs/TEST_PLAN.md, scripts/ci/due_diligence_gate.sh, docs/audit/*. Changes: - tests/tests/shard_1k.rs + scripts/cohsh/shard_1k.coh - align policy queue and shard fixture expectations with current namespace semantics. - crates/sel4-runtime/src/lib.rs - add target-aware section annotation handling for macOS Mach-O compatibility. - crates/sel4-sys/src/lib.rs - cfg-gate affinity invocation wrapper for kernels lacking affinity labels. - docs/TEST_PLAN.md - normalize commands to `python3` and include `cargo test -p tests` plus `cargo test --workspace` gate coverage. - docs/audit/findings.csv + docs/audit/BLOCKERS.md + docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md - update dispositions, closure evidence, and independent verification records. Commands: - cargo test -p tests --test shard_1k - cargo test --workspace - scripts/ci/check_test_plan.sh - scripts/ci/due_diligence_gate.sh Checks: - DD-2026-0004, DD-2026-0005, DD-2026-0009, DD-2026-0006, DD-2026-0007, DD-2026-0011, and DD-2026-0012 have closure evidence and pass relevant gates. - Due-diligence gate completes with no `P0/P1` blockers open. Deliverables: - Clean gate run logs and updated audit registers proving release-ready closure. ``` ## Milestone 25c — Python Orchestration SDK (1k Fleet Playbooks + Host Integrations) [Milestones](#Milestones) **Why now (adoption + operator scale):** 1k-worker readiness is not only transport and gateway throughput; operators also need low-friction automation that plugs into existing Python tooling while preserving Cohesix control semantics and auditability. **Status:** Complete - Python orchestration APIs, host integration adapters, playbook CLI, documentation updates, and local/G5g validation are complete. ## Goal Deliver a world-class Python SDK surface that: 1. Keeps Cohesix non-authoritative protocol boundaries intact. 2. Makes 1k-fleet operations simple to integrate from existing Python tooling and CI. 3. Covers high-impact Mac, Jetson, and mixed-fleet use cases with auditable playbooks. 4. Runs deterministically in local `.venv` and Linux (G5g) environments. ## Non-Goals (Explicit) - No new in-VM listeners, transports, or protocol verbs. - No bypass of role/ticket/policy gates. - No behavior drift from `/queen/*/ctl` and `/proc/*` schemas documented in `docs/INTERFACES.md`. - No changes under `releases/` in this milestone. ## Deliverables - Python orchestration core with typed schedule/lease/export/approval APIs mapped to existing control files. - Environment-driven backend selection (`mock`, mounted filesystem, REST gateway, TCP console) with deterministic precedence. - Host integration adapters for: - `systemd` service state, - Docker container inventory, - Kubernetes pod phase snapshots, - NVML/NVIDIA GPU telemetry, - PEFT/LoRA runtime package probes. - Built-in high-impact playbooks covering: - 1000 Mac: release factory, private PEFT grid, endpoint compliance. - 1000 Jetson: traffic safety mesh, manufacturing safety + QA, critical infrastructure sensing. - Mixed fleets: closed-loop AI factory, medical edge AI, logistics digital twin. - Frictionless CLI entrypoint (`cohesix-playbook`) plus example wrapper script. - Updated documentation in `tools/cohesix-py/README.md` and `docs/PYTHON_SUPPORT.md`. - Added Python tests for orchestration APIs, integration adapters, and playbook flows. ## Commands - `source .venv/bin/activate` - `python -m pip install -e 'tools/cohesix-py[integrations,ml,dev]'` - `python -m pytest tools/cohesix-py/tests -q` - `python -m cohesix.playbook_cli --list` - `python -m cohesix.playbook_cli --playbook mixed-closed-loop-ai-factory --dry-run --mock` - `python tools/cohesix-py/examples/use_case_playbook.py --playbook jetson-traffic-safety --dry-run --mock` - Linux validation (G5g): run the same install/tests/playbook dry-run over SSH on the G5g host defined in `~/cohesix_dev.txt`. ## Checks (DoD) - Python package installs cleanly into repo `.venv`. - New tests pass with deterministic output in mock mode. - Playbook CLI lists all built-in playbooks and executes dry-run reports without control writes. - Live-compatible control writes remain bounded and map only to canonical control files. - Host adapters degrade gracefully when optional host dependencies are unavailable. - Linux validation on G5g passes with the same test suite and playbook dry-run commands. ## Task Breakdown ``` Title/ID: m25c-python-orchestration-core Goal: Add typed, bounded orchestration APIs for schedule/lease/export/approval workflows. Inputs: tools/cohesix-py/cohesix/client.py, docs/INTERFACES.md. Changes: - tools/cohesix-py/cohesix/orchestration.py - typed request models, env backend discovery, /proc snapshot reads. Commands: - python -m pytest tools/cohesix-py/tests/test_orchestration.py -q Checks: - Control payloads are validated, bounded, and written only to canonical paths. Deliverables: - Orchestration API module with deterministic tests. Title/ID: m25c-python-host-integrations Goal: Integrate systemd, docker, k8s, NVML, and PEFT probes with graceful fallback behavior. Inputs: docs/HOST_TOOLS.md, docs/PYTHON_SUPPORT.md. Changes: - tools/cohesix-py/cohesix/integrations.py - provider probes + NDJSON rendering for telemetry shipping. - tools/cohesix-py/tests/test_integrations.py - probe fallback/parse tests. Commands: - python -m pytest tools/cohesix-py/tests/test_integrations.py -q Checks: - Missing dependencies are reported as skipped/degraded, not hard failures. Deliverables: - Provider adapter module and test coverage. Title/ID: m25c-python-playbooks Goal: Ship high-impact built-in playbooks for Mac, Jetson, and mixed 1k-fleet workflows. Inputs: docs/USE_CASES.md, docs/PYTHON_SUPPORT.md. Changes: - tools/cohesix-py/cohesix/playbooks.py - playbook catalog + execution helpers. - tools/cohesix-py/cohesix/playbook_cli.py - frictionless playbook CLI. - tools/cohesix-py/examples/use_case_playbook.py - example wrapper. - tools/cohesix-py/tests/test_playbooks.py - playbook catalog and execution tests. Commands: - python -m pytest tools/cohesix-py/tests/test_playbooks.py -q - python -m cohesix.playbook_cli --list Checks: - All nine use-case playbooks are discoverable and dry-run capable. Deliverables: - Playbook SDK + CLI + tests. Title/ID: m25c-python-docs-and-linux-validation Goal: Document world-class Python UX and validate on local + G5g Linux. Inputs: tools/cohesix-py/README.md, docs/PYTHON_SUPPORT.md, ~/cohesix_dev.txt. Changes: - tools/cohesix-py/README.md - install/CLI/playbook UX updates. - docs/PYTHON_SUPPORT.md - orchestration + integration + playbook docs. Commands: - source .venv/bin/activate - python -m pip install -e 'tools/cohesix-py[integrations,ml,dev]' - python -m pytest tools/cohesix-py/tests -q - ssh -i ~/.ssh/cohesix-cuda-builder.pem ubuntu@34.221.49.64 '' Checks: - Local and G5g test runs both pass; docs match as-built behavior. Deliverables: - Updated docs + Linux validation evidence. ``` ## Milestone 25d — REST Request-Auth Parity Across Host Tools (Gateway Capability Max) [Milestones](#Milestones) **Why now (gateway readiness at 1k scale):** `hive-gateway` now enforces request-auth at the REST edge for mutating paths. Any host tool that can route through REST must attach request-auth consistently or it becomes a brittle outlier in multi-tool, high-concurrency deployments. **Status:** Reopened for `m25d-fuse-owner-mount-restoration`, discovered during the Milestone 26e release burn-in. Existing request-auth, namespace, and TCP authentication contracts remain in force; restoration is limited to the incompatible FUSE startup options, macFUSE mount API selection, and their native host validation. ## Goal Deliver request-auth parity across all REST-capable host tools so gateway mode is predictable, secure, and low-friction: 1. Standardize token resolution order (CLI override + canonical env fallbacks). 2. Attach request-auth headers from every REST-capable host client path (including parallel fan-out paths). 3. Preserve single-console architecture (`hive-gateway` remains the only TCP console client in multiplexed mode). 4. Keep docs aligned with as-built CLI/env behavior. ## Non-Goals (Explicit) - No new REST routes, RPC semantics, or control-plane verbs. - No changes to in-VM console grammar (`ACK/ERR/END`) or NineDoor behavior. - No changes to ticket authorization semantics. - No changes under `releases/` in this milestone. ## Implementation Touchpoints - `apps/coh/src/main.rs`, `apps/coh/src/rest.rs` - add REST request-auth token CLI/env resolution and attach headers for all REST access paths. - `apps/coh/src/mount.rs` - ensure FUSE mount is a faithful projection of `LS`/`CAT`/`ECHO` semantics (non-zero file sizes, append-only offset discipline, and limited dynamic telemetry roots aligned with Milestone 21a). - `apps/root-task/src/net/mod.rs`, `apps/root-task/src/net/console_srv.rs` - adjust TCP console unauthenticated auth deadlines to support remote tunnel usage without changing console grammar. - `apps/cas-tool/src/main.rs` - add REST request-auth support for CAS uploads through gateway. - `apps/gpu-bridge-host/src/main.rs` - add REST request-auth support for `/gpu/bridge/ctl` publish mode. - `apps/swarmui/src-tauri/main.rs`, `apps/swarmui/src/lib.rs`, `apps/swarmui/src/hive.rs` - propagate request-auth token through REST transport bootstrap and parallel telemetry/status polling paths. - `docs/HOST_TOOLS.md`, `docs/USERLAND_AND_CLI.md` - document canonical REST request-auth flags/env fallbacks for host operators. ## Commands - `cargo test -p coh` - `cargo test -p cas-tool` - `cargo test -p gpu-bridge-host` - `cargo test -p swarmui` - `cargo check -p swarmui` ## Checks (DoD) - All REST-capable host tools attach request-auth when provided via CLI/env. - No REST-capable host tool requires ad-hoc or undocumented env variables. - SwarmUI REST parallel fan-out paths (status + telemetry) preserve request-auth headers. - Gateway-mode docs list the exact token flags/env keys operators must set. - Existing TCP/mock flows remain unchanged. ## Task Breakdown ``` Title/ID: m25d-fuse-owner-mount-restoration Milestone: Reopened Milestone 25d — REST Request-Auth Parity Across Host Tools / owner-only FUSE startup restoration; discovered under Milestone 26e / m26e-host-integration-dependency-contract Goal: Restore native Mac and Linux FUSE startup without broadening host access or changing Cohesix namespace authority. Inputs: apps/coh/src/mount.rs, fuser 0.18.0 owner-access contract, the exact Pi GENET burn-in image, MacFUSE 5.3.3, Linux FUSE, and retained failed mount evidence. Changes: - apps/coh/src/mount.rs — retain explicit Owner access and ordinary session cleanup, remove the incompatible AutoUnmount option, preserve the private-mount invariant in a focused regression, and use uncached reads so a zero-length metadata fallback cannot conceal live content or a backend refusal. - Cargo.toml, apps/coh/Cargo.toml, Cargo.lock, third_party/fuser — pin the unchanged fuser 0.18.0 runtime with a documented build-script patch selecting its existing libfuse3 adapter on macOS; preserve the macFUSE protocol ABI and default Linux mount implementation. - tools/rust-risk-audit/src/main.rs and docs/audit/rust_risk_baseline.toml — seal the exact vendored dependency tree, reject drift and path redirection, and preserve every first-party risk ceiling. - docs/HOST_TOOLS.md — document host-user privacy, the macFUSE 5 library requirement, and normal/disconnected-mount cleanup. - Compatibility review: all coh mount backends share the corrected configuration. cohsh, hive-gateway, gpu-bridge-host, host-sidecar-bridge, host-ticket-agent, cas-tool, SwarmUI, tools/cohesix-py, and performance benchmark scripts keep their existing wire, policy, namespace, request-auth, and evidence contracts; no changes are required on those surfaces. Commands: - cargo test --locked -p coh --features fuse - cargo clippy --locked -p coh --features fuse --all-targets -- -D warnings - cargo build --locked --release -p coh --features fuse,nvml - scripts/check-generated.sh - scripts/ci/check_test_plan.sh Checks: focused host tests and exact native builds pass; both real host mounts read the Pi-backed namespace and unmount cleanly while owner-only access is retained. Failed pre-repair evidence remains distinct from the repaired diagnostic candidate and timed run. Deliverables: bounded FUSE repair, native Mac/Linux command and mount evidence, and compatibility review. Broader release qualification is unchanged. Title/ID: m25d-rest-auth-parity-host-tools Goal: Ensure every REST-capable host tool resolves and attaches gateway request-auth headers. Inputs: apps/coh/src/main.rs, apps/coh/src/rest.rs, apps/cas-tool/src/main.rs, apps/gpu-bridge-host/src/main.rs. Changes: - apps/coh/src/main.rs, apps/coh/src/rest.rs - add `--rest-auth-token` support and env fallback resolution for REST mode. - apps/cas-tool/src/main.rs - add `--rest-auth-token` and env fallbacks for REST upload mode. - apps/gpu-bridge-host/src/main.rs - add `--rest-auth-token` and env fallbacks for REST publish mode. Commands: - cargo test -p coh - cargo test -p cas-tool - cargo test -p gpu-bridge-host Checks: - REST clients instantiate `GatewayClient` with request-auth when configured. Deliverables: - Host-tool REST request-auth parity with deterministic fallback order. Title/ID: m25d-swarmui-rest-auth-fanout Goal: Propagate request-auth through SwarmUI REST boot and parallel fan-out reads/tails. Inputs: apps/swarmui/src-tauri/main.rs, apps/swarmui/src/lib.rs, apps/swarmui/src/hive.rs. Changes: - apps/swarmui/src-tauri/main.rs - resolve `SWARMUI_REST_AUTH_TOKEN` + canonical gateway env fallbacks. - apps/swarmui/src/lib.rs - carry request-auth token in REST parallel config and pass to all spawned transports. - apps/swarmui/src/hive.rs - attach request-auth token in parallel telemetry tail workers. Commands: - cargo test -p swarmui - cargo check -p swarmui Checks: - No SwarmUI REST code path creates `CohshRestTransport` without request-auth propagation. Deliverables: - SwarmUI REST transport parity with gateway auth policy. Title/ID: m25d-docs-as-built-rest-auth Goal: Keep operator docs fully aligned with REST auth semantics after parity fixes. Inputs: docs/HOST_TOOLS.md, docs/USERLAND_AND_CLI.md. Changes: - docs/HOST_TOOLS.md - document per-tool `--rest-auth-token` and env fallback behavior. - docs/USERLAND_AND_CLI.md - reflect gateway request-auth requirements for `coh` and `swarmui` REST mode. Commands: - scripts/ci/check_test_plan.sh Checks: - Docs match shipped tool flags and env keys exactly. Deliverables: - Updated host-tool operator guidance with no auth ambiguity. Title/ID: m25d-coh-mount-rest-writable-and-bidir Goal: Make `coh mount --rest-url` reliably readable/writable and suitable for safe bidirectional telemetry transfer (Milestone 21a semantics). Inputs: apps/coh/src/mount.rs, apps/coh/src/main.rs, apps/coh/src/rest.rs, docs/OPERATOR_WALKTHROUGH.md, docs/TEST_PLAN.md. Changes: - apps/coh/src/mount.rs - fix FUSE file attrs (non-zero file sizes), ensure `readdir` reports accurate directory vs file types (macOS uses the type eagerly), eliminate write-only “ghost” entries, allow host-side appends by avoiding POSIX-perm EPERM (kernel-level checks), and support limited dynamic telemetry roots under `coh.telemetry.root` without introducing generic POSIX create semantics. - apps/coh/src/main.rs, apps/coh/src/rest.rs - ensure REST request-auth token is accepted and attached for mount-backed `ECHO` paths so gateway mode stays writable when request-auth is enforced. - docs/OPERATOR_WALKTHROUGH.md - document FUSE mount prerequisites and a bidirectional telemetry transfer smoke using supported MIME types. - docs/TEST_PLAN.md - add a gateway-mode mount regression: REST mount can `cat` `/proc/*` and append to `/queen/telemetry//ctl` with request-auth enabled. Commands: - cargo test -p coh Checks: - REST mount `cat` shows non-empty content for bounded files like `/proc/lifecycle/state` and `/log/queen.log`. - REST mount can create a new telemetry device root by addressing `${coh.telemetry.root}//ctl`, then append records into the OS-named segment, and another host can read them via mount. - macOS REST mounts can append to `/queen/telemetry//ctl` without local EPERM/permission denials (errors must come from Cohesix bounds/policy, not host file mode bits). - No new generic create/mkdir/unlink/rename semantics are introduced; dynamic behavior is strictly scoped to telemetry ingest roots and remains OS-owned. Deliverables: - Writable, bounded REST mount suitable for multi-host gateway ops with deterministic, policy-aligned behavior. Title/ID: m25d-console-auth-timeout-remote-tcp-mount Goal: Make remote TCP console attachments (and `coh mount --host/--port`) reliable over SSH tunnels/high-latency links without changing console grammar. Inputs: apps/root-task/src/net/mod.rs, apps/root-task/src/net/console_srv.rs, apps/cohsh/src/transport/tcp.rs, docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md. Changes: - apps/root-task/src/net/mod.rs, apps/root-task/src/net/console_srv.rs - increase unauthenticated auth deadline (or implement a bounded auth window) so a client can deliver its token over WAN latency. - apps/cohsh/src/transport/tcp.rs - keep client-side retry/backoff bounded and emit a crisp error that points operators at gateway mode when auth times out. - docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md - document that REST via `hive-gateway` is the default for remote multi-host ops; TCP console is best-effort over WAN until this is fixed. Commands: - scripts/cohesix-build-run.sh --transport tcp --tcp-port 31337 - (remote) cohsh/coh attach or mount over an SSH reverse tunnel Checks: - g5g (AWS) can attach/mount over a reverse tunnel without `authentication timed out waiting for server response`. Deliverables: - Remote-safe TCP auth window with unchanged console wire grammar and updated operator guidance. Title/ID: m25d-macos-coh-fuse-default Goal: Ship macOS `coh` builds with FUSE enabled so operators can use `coh mount` once MacFUSE is installed/approved. Inputs: scripts/cohesix-build-run.sh, docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md, docs/TEST_PLAN.md. Changes: - scripts/cohesix-build-run.sh - build `coh` with `--features fuse` on macOS hosts. - docs/HOST_TOOLS.md, docs/OPERATOR_WALKTHROUGH.md, docs/TEST_PLAN.md - document MacFUSE prerequisites (`/dev/macfuse0`) and keep examples as-built. Commands: - cargo build -p coh --release --features fuse Checks: - macOS `coh mount` no longer reports “fuse support disabled”. Deliverables: - macOS-ready `coh mount` binary and aligned operator docs. ``` ---- **Release 0.8.0 alpha** ---- --- ## Milestone 25e — Evidence Packs + Integration Kits (Audit-First Adoption) [Milestones](#Milestones) **Why now (buyability + integration):** Cohesix has a scale-capable, request-authenticated gateway path (25b–25d) and Python orchestration (25c). The highest leverage remaining adoption blocker is not new VM semantics; it is the absence of deterministic, auditor-friendly evidence artifacts and turnkey integration patterns that reuse existing control surfaces without introducing new protocols. **Status:** Reopened for `m25e-evidence-timeline-error-records`, `m25e-evidence-export-failure-retention` and the separately user-authorized `m25e-session-evidence-byte-budget`, discovered during the Milestone 26e release burn-in. Timeline restoration accepts emitted structured errors while retaining the existing output schema. Export restoration restores partial-summary retention, nonzero capture failures and existing bounded CAT framing for long AuditFS JSON. The budget task raises the finite default session allowance to 8 MiB for full evidence capture and shared operator traffic. Per-read bounds, retained-log coverage, redaction, rate/cursor limits and transport contracts remain unchanged. ## Goal Deliver high-impact, low-risk adoption accelerators that remain host-side and strictly protocol-faithful: 1. Deterministic evidence packs for audits, due diligence, and incident review, sourced only from existing `/proc`, `/log`, `/audit`, `/replay`, and telemetry surfaces. 2. A correlated timeline view derived from evidence pack contents (no new runtime behavior). 3. Turnkey integration kits (CI + SIEM) that consume the REST/OpenAPI gateway and/or `coh`/Python tooling without introducing new control-plane semantics. 4. GPU lease receipts and chargeback-friendly exports derived from `/proc/lease/*`, `/audit/journal`, and `/gpu/*` status files (no changes to lease enforcement). ## Non-Goals (Explicit) - No new in-VM listeners, protocols, transports, or control verbs. - No changes to ACK/ERR/END grammar, NineDoor error semantics, or Secure9P bounds. - No device identity enrollment or attestation work (covered by Milestone 26 and Milestone 27 `coh attest`). - No changes under `releases/` in this milestone. ## Implementation Touchpoints - `apps/coh/src/main.rs` + `apps/coh/src/lib.rs` — add evidence subcommands and shared helpers. - `apps/coh/src/telemetry.rs` — reuse bounded telemetry pull implementation inside evidence packs. - `crates/cohesix-rest/src/lib.rs` + `apps/hive-gateway` — consume `GET /v1/meta/bounds` and REST file projections for evidence reads. - `apps/nine-door/src/host/audit.rs` + `apps/root-task/src/ninedoor.rs` — ensure evidence pack includes `/audit/export` and correlatable audit journal entries (read-only). - `docs/HOST_TOOLS.md`, `docs/HOST_API.md`, `docs/OPERATOR_WALKTHROUGH.md` — document evidence pack CLI and integration recipes. ## Commands - `cargo test -p coh` - `cargo test -p hive-gateway` - `python -m pytest tools/cohesix-py/tests -q` ## Checks (Definition of Done) - `coh evidence pack` succeeds in `--mock` mode and in REST gateway mode with request-auth enabled, emitting a deterministic directory structure under `out/evidence//`. - Evidence packs contain: manifest/policy fingerprint, bounds snapshot, `/proc` snapshots, `/replay/status`, a bounded `/log/queen.log` capture, and (optionally) downloaded telemetry segments. When `/audit/export` is present, packs include `/audit/export` plus redacted `/audit/journal` and `/audit/decisions`. - `coh evidence timeline` produces stable, correlated output from an evidence pack without network access. - GPU lease receipts can be emitted from `coh gpu lease` / `coh run` without changing VM control semantics, and include correlatable identifiers (`lease id`, `subject`, `resource`, `seq`) captured from `/proc/lease/*`. - Integration kits run in mock mode end-to-end and contain no hardcoded secrets; all tokens/URLs are supplied via env vars. ## Task Breakdown ``` Title/ID: m25e-session-evidence-byte-budget Milestone: Milestone 25e — Evidence Packs + Integration Kits; discovered in Milestone 26e release burn-in Goal: Make a full retained-log evidence capture usable with ordinary shared operator traffic under a finite default session allowance. Inputs: Fresh-session Queen-log ELIMIT from exact Pi image c07fdd9c7ba3; explicit user instruction to increase the default byte budget. Changes: - configs/root_task*.toml and tools/coh-rtc/src/ir.rs — set the default and manifest ceiling to 8388608 bytes (8 MiB); retain explicit smaller ticket quotas. - coh-rtc outputs, selected native host profiles and installed Python wheel — regenerate all affected fingerprints and projected defaults. - docs/SECURITY.md, docs/HOST_TOOLS.md and docs/OPERATOR_RECIPES.md — explain sizing, cumulative shared-session accounting and unchanged per-request/resource limits. Commands: cargo test -p coh-rtc; scripts/check-generated.sh; scripts/ci/check_test_plan.sh; native host builds; fresh exact-image Pi raw entry and full evidence export. Checks: 8 MiB is finite and exceeds three worst-case retained logs plus 2 MiB operator traffic; smaller explicit ticket values survive parsing and existing quota refusal tests still pass. No rate, cursor, payload, role or namespace limit increases. Deliverables: regenerated contracts, configuration regression, native build identities, new frozen burn-in profile and live export evidence. No UEFI activation or release acceptance claim. Title/ID: m25e-evidence-timeline-error-records Milestone: Reopened Milestone 25e — Evidence Packs + Integration Kits; discovered during Milestone 26e release burn-in maintenance revalidation Goal: Export a usable incident timeline when AuditFS includes correctly refused operations. Inputs: The captured Pi maintenance case contains error={code:Permission,message:EPERM}; the existing timeline reader only accepted string errors and rejected the pack. Changes: - apps/coh/src/evidence_timeline.rs — accept canonical structured errors and legacy strings; normalize objects to the unchanged timeline-v1 error string while retaining the original pack. - apps/coh/tests/evidence_timeline.rs — verify structured, legacy and null errors, retained refusal outcomes, and deterministic rejection of malformed objects. - docs/HOST_TOOLS.md — document input compatibility and unchanged timeline output. Commands: - cargo test -p coh --test evidence_timeline - cargo build --release -p coh --features fuse,nvml - coh evidence timeline --input Checks: Native Mac and Linux readers consume the unchanged captured case, preserve all refusal events, and keep malformed input failing. The installed Python CI/SIEM consumers validate that same case without another target workload. All required repository checks pass before merge. Compatibility review: Reviewed cohsh, coh, Hive Gateway/REST, gpu-bridge-host, host-ticket-agent, host-sidecar-bridge, cas-tool, SwarmUI, cohesix-py, and raw/REST benchmark scripts. Only coh timeline and its documentation need changes; Python SIEM already preserves object-valued errors, and the library/CI consumer parse JSON generically. Target producers, generated contracts, timeline schema, other binaries, SDK wheel, benchmark inputs and report schemas remain unchanged. No Pi rebuild or full burn-in rerun is needed for this host-only reader repair. Deliverables: Bounded compatibility repair, focused tests, two native readers and offline validation of the original captured failure evidence. Title/ID: m25e-evidence-export-failure-retention Milestone: Milestone 25e — Evidence Packs + Integration Kits; discovered in Milestone 26e release burn-in Goal: Preserve failed exports truthfully and restore bounded reads of legitimate long AuditFS records. Inputs: Pi GENET image from commit 15923ebbfe8f, timed-01 Queen-log ELIMIT refusal, fresh-session audit-journal buffer-full result with prior exit code zero. Changes: - apps/coh/src/evidence.rs — seal partial summaries on capture failure; return an error for retained capture errors; use a positive REST read bound to verify empty audit streams. - apps/root-task/src/ninedoor.rs — serialize AuditFS journal/decision records with the existing C1 framing, preserving line and stream bounds. - apps/coh/tests/evidence_pack.rs — assert required-read stop and optional-read error retention independently of target scheduling. - docs/OPERATOR_RECIPES.md and docs/HOST_TOOLS.md — describe nonzero failure, partial case inspection and unchanged quota boundaries. Commands: cargo test --locked --release -p coh --features fuse --test evidence_pack; cargo build --locked --release -p coh --features fuse,nvml Checks: both native builds preserve refusal detail and partial summary, return nonzero on capture errors, and retain exact successful-export contents and redaction. Deliverables: native host evidence, focused AuditFS serialization regression, fresh exact-image Pi export and first-failure cases; no manifest, ticket quota, public framing or release acceptance changes. Title/ID: m25e-coh-evidence-pack Goal: Add a deterministic evidence pack exporter that captures bounded, auditor-friendly system state without new semantics. Inputs: apps/coh/src/main.rs, apps/coh/src/lib.rs, apps/coh/src/telemetry.rs, crates/cohesix-rest/src/lib.rs, docs/INTERFACES.md. Changes: - apps/coh/src/main.rs - add `coh evidence pack` subcommand (supports `--mock`, `--rest-url`, and TCP console flows). - apps/coh/src/lib.rs + apps/coh/src/evidence.rs - implement bounded evidence reads for canonical nodes (`/proc/*`, `/log/queen.log`, `/audit/*`, `/replay/*`, `/proc/lease/*`, `/proc/schedule/*`). - apps/coh/src/evidence.rs - include manifest fingerprint + gateway bounds snapshot (`GET /v1/meta/bounds`) to bind evidence packs to a concrete as-built contract. - apps/coh/src/evidence.rs - optionally reuse `telemetry::pull` to download telemetry segments into the pack under manifest bounds. - docs/HOST_TOOLS.md + docs/OPERATOR_WALKTHROUGH.md - document evidence pack usage and output layout. Commands: - cargo test -p coh - cargo run -p coh -- --mock evidence pack --out out/evidence/mock Checks: - Pack includes all required nodes and never reads past manifest-bounded byte caps. - Pack output is stable for identical inputs (deterministic file names + ordering). Deliverables: - `coh evidence pack` implementation + docs. Title/ID: m25e-coh-evidence-timeline Goal: Produce a correlated timeline view from evidence packs for incident review and audit traceability. Inputs: apps/coh/src/evidence.rs (from m25e-coh-evidence-pack), apps/nine-door/src/host/audit.rs (journal format reference), docs/audit/CONTROL_TRACEABILITY.md. Changes: - apps/coh/src/main.rs - add `coh evidence timeline --in ` that emits `timeline.ndjson` and `timeline.md`. - apps/coh/src/evidence_timeline.rs - parse `/audit/journal` JSONL + `/audit/decisions`, correlate with `/proc/lease/*` snapshots and `seq` fields, and emit stable, bounded output. - apps/coh/tests/evidence_timeline.rs - add fixture-driven tests ensuring stable ordering and robust handling of partial packs. Commands: - cargo test -p coh Checks: - Timeline output is deterministic for a fixed evidence pack and does not require network access. Deliverables: - Timeline generator suitable for postmortems and due diligence artifacts. Title/ID: m25e-integration-kits-ci-siem Goal: Ship turnkey, protocol-faithful integration kits that reduce adoption friction in CI and SIEM pipelines. Inputs: docs/HOST_API.md (OpenAPI), docs/HOST_TOOLS.md, tools/cohesix-py. Changes: - docs/HOST_TOOLS.md - add a dedicated section: CI usage (generate evidence pack, upload artifacts) and SIEM export patterns (audit journal + decisions + lease snapshots). - tools/cohesix-py/examples/ci_evidence_pack.py - run `coh evidence pack` (or REST equivalents) in mock/dry-run, validate output layout, emit a machine-readable summary JSON. - tools/cohesix-py/examples/siem_export_ndjson.py - read an evidence pack and emit normalized NDJSON suitable for Splunk/Elastic ingestion (no network by default; optional `--post` with env-configured URL/token). - tools/cohesix-py/tests/test_examples_ci_siem.py - ensure examples run deterministically in mock mode and never require external connectivity. Commands: - python -m pytest tools/cohesix-py/tests -q Checks: - Examples run in mock mode on macOS and produce stable outputs with no secrets in logs. Deliverables: - Integration kits that demonstrate “buyable” workflows without new control semantics. Title/ID: m25e-gpu-lease-receipts Goal: Add receipt-backed GPU leasing outputs for audit and chargeback without changing lease enforcement. Inputs: apps/coh/src/gpu.rs, apps/coh/src/run.rs, docs/INTERFACES.md. Changes: - apps/coh/src/gpu.rs - add optional `--receipt-out` that writes a JSON receipt including request parameters, ACK line, and a bounded `/proc/lease/*` snapshot captured immediately after the lease request. - apps/coh/src/run.rs - extend host command wrapper to emit receipts for lease-validated runs (breadcrumb correlation). - apps/coh/tests/receipts.rs - validate receipt schema, bounds, and determinism. Commands: - cargo test -p coh Checks: - Receipts never include secrets (tokens, raw tickets) and are stable for fixed inputs. Deliverables: - Receipt artifacts suitable for audit and internal billing pipelines. ``` --- ## Milestone 25f — Gateway Broker Refactor + Large Telemetry Reference Manifests (No-Retry Reliability Gate) [Milestones](#Milestones) **Why now (beta reliability + telemetry realism):** Strict no-retry gateway runs still surface backpressure and timeout failures under accelerated mixed control/telemetry load. The gateway currently multiplexes logical pool sessions over one locked TCP transport, and current harness coverage does not explicitly pressure MB/GB telemetry scenarios. This milestone addresses the root cause while preserving Cohesix red lines and single-console architecture. ## Goal Deliver a Cohesix-aligned reliability and scale step that: 1. Replaces lock-contention request handling in `hive-gateway` with a bounded broker model (single wire owner, concurrent REST callers). 2. Allows many chunk references per telemetry manifest so MB/GB-class host artifacts can be represented without turning telemetry ingest into generic file transfer. 3. Expands the performance harness to explicit `1 MB`, `10 MB`, `100 MB`, and `1 GB` gateway scenarios with `--no-retries`, fast ramp, and strict error-budget gating. ## Non-Goals (Explicit) - No new in-VM TCP listeners, RPC channels, or ad-hoc host/VM protocols. - No change to ACK/ERR/END grammar, NineDoor error semantics, or Secure9P red lines (`msize <= 8192`, walk depth <= 8). - No generic POSIX create/upload semantics under telemetry paths; segment naming/retention remains OS-owned and bounded. - No hidden retry paths in benchmark mode; failures must remain visible and count against pass/fail. ## Implementation Touchpoints - `apps/hive-gateway/src/main.rs` - brokerized request scheduler/dispatcher, bounded queueing, fairness between control and telemetry classes, and queue/backpressure observability. - `apps/cohsh/src/transport/tcp.rs`, `apps/cohsh/src/session_pool.rs` - align transport/session abstractions with gateway broker ownership (single wire writer, no concurrent socket mutation). - `tools/coh-rtc/src/ir.rs`, `configs/root_task.toml`, generated policy artifacts - introduce bounded telemetry reference-manifest limits (count/bytes) as manifest-driven controls. - `apps/nine-door/src/host/telemetry.rs`, `apps/root-task/src/ninedoor.rs` - validate and enforce reference-manifest envelopes and quotas deterministically. - `apps/cohsh/src/lib.rs`, `apps/coh/src/telemetry.rs`, `tools/cohesix-py` - support telemetry push/pull workflows that emit and consume chunk-reference manifests under manifest limits. - `scripts/rest_perf_harness.py`, `tests/test_rest_perf_harness.py` - add explicit large-size scenario matrix, no-retry mode, fast-ramp presets, and strict error-budget exit behavior. - `docs/INTERFACES.md`, `docs/HOST_TOOLS.md`, `docs/TEST_PLAN.md` - document as-built manifest-reference envelope semantics and benchmark gates. ## Commands - `cargo test -p hive-gateway` - `cargo test -p cohsh` - `cargo test -p nine-door` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `.venv/bin/python -m pytest -q tests/test_rest_perf_harness.py` - `python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-1mb --error-budget-rate 0.01` - `python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-10mb --error-budget-rate 0.01` - `python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-100mb --error-budget-rate 0.01` - `python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-1gb --error-budget-rate 0.01` ## Checks (Definition of Done) - Gateway REST handlers use a bounded broker queue/dispatcher instead of per-request lock contention on shared transport state; control-path latency remains protected under telemetry pressure. - Backpressure is explicit and deterministic (`429` / gateway backpressure path), with queue depth and timeout counters exposed in status telemetry. - Telemetry reference manifests accept many bounded chunk references per segment (manifest-driven limits), reject malformed/oversized entries deterministically, and never relax existing per-record Secure9P bounds. - Large-file scenarios (`1 MB`, `10 MB`, `100 MB`, `1 GB`) run through gateway mode with `--no-retries` and fast ramp; heavy-ish beta gate is `error_rate <= 1.0%` (`--error-budget-rate 0.01`) and harness exits non-zero on violation. - `docs/TEST_PLAN.md` includes mandatory commands and pass criteria for all four scenarios (no skip path). ## Task Breakdown ``` Title/ID: m25f-gateway-broker-refactor Goal: Replace lock-contention transport access with a bounded broker model while preserving single-console wire ownership. Inputs: apps/hive-gateway/src/main.rs, apps/cohsh/src/session_pool.rs, apps/cohsh/src/transport/tcp.rs, docs/HOST_TOOLS.md. Changes: - apps/hive-gateway/src/main.rs - add broker request queues (control + telemetry), deterministic scheduling/fairness, and queue-aware backpressure responses. - apps/hive-gateway/src/main.rs - keep `hive-gateway` as sole console client; remove direct per-request competition on shared transport mutex. - apps/cohsh/src/session_pool.rs, apps/cohsh/src/transport/tcp.rs - align lease/session lifecycle with broker ownership and bounded shutdown/reconnect behavior. Commands: - cargo test -p hive-gateway - cargo test -p cohsh Checks: - Under concurrent REST load, checkout timeout/backpressure rates fall materially from baseline and control-plane operations remain serviceable. Deliverables: - Brokerized gateway transport path with deterministic backpressure telemetry. Title/ID: m25f-telemetry-manifest-chunk-references Goal: Support MB/GB telemetry artifacts via many bounded chunk references rather than bulk inline payload transfer. Inputs: tools/coh-rtc/src/ir.rs, configs/root_task.toml, apps/nine-door/src/host/telemetry.rs, apps/root-task/src/ninedoor.rs, docs/INTERFACES.md. Changes: - tools/coh-rtc/src/ir.rs + configs/root_task.toml - add manifest-driven limits for telemetry reference manifests (max refs, max manifest bytes, max referenced bytes scope as required). - apps/nine-door/src/host/telemetry.rs + apps/root-task/src/ninedoor.rs - enforce deterministic validation for reference-manifest envelopes and bounded append semantics. - apps/cohsh/src/lib.rs + apps/coh/src/telemetry.rs - add/extend host tooling for emitting reference manifests and resolving latest segment IDs without new control verbs. - docs/INTERFACES.md - document reference-manifest schema and limits as-built. Commands: - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - cargo test -p nine-door - cargo test -p cohsh Checks: - Valid manifests append successfully; malformed and over-limit manifests fail with deterministic ERR details. Deliverables: - Manifest-reference telemetry ingest path suitable for real-world artifact sizes while preserving Cohesix control-plane boundaries. Title/ID: m25f-harness-large-scenarios-no-retry Goal: Make gateway reliability regressions visible with explicit no-retry large-size scenario gates. Inputs: scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, docs/TEST_PLAN.md. Changes: - scripts/rest_perf_harness.py - add explicit scenario presets (`telemetry-1mb`, `telemetry-10mb`, `telemetry-100mb`, `telemetry-1gb`) routed through gateway paths. - scripts/rest_perf_harness.py - enforce `--no-retries` mode, fast-ramp controls, and strict `--error-budget-rate` pass/fail behavior. - tests/test_rest_perf_harness.py - cover scenario wiring, no-retry semantics, and error-budget failure behavior. - docs/TEST_PLAN.md - add canonical commands and required outputs for all four scenarios. Commands: - .venv/bin/python -m pytest -q tests/test_rest_perf_harness.py - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-1mb --error-budget-rate 0.01 - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-10mb --error-budget-rate 0.01 - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-100mb --error-budget-rate 0.01 - python scripts/rest_perf_harness.py --mode simulate --rest-url http://127.0.0.1:8080 --no-retries --fast-ramp --scenario telemetry-1gb --error-budget-rate 0.01 Checks: - Each scenario emits deterministic summary artifacts and fails hard (exit code non-zero) when error rate exceeds budget. Deliverables: - A repeatable large-object gateway reliability gate with no hidden retries. Title/ID: m25f-docs-sync-and-operator-guidance Goal: Keep docs-as-built alignment for broker behavior, large telemetry references, and no-retry gates. Inputs: docs/INTERFACES.md, docs/HOST_TOOLS.md, docs/TEST_PLAN.md, docs/ARCHITECTURE.md. Changes: - docs/INTERFACES.md - describe telemetry reference-manifest envelopes and manifest-driven limits. - docs/HOST_TOOLS.md - document gateway broker behavior, expected backpressure signals, and operator tuning knobs. - docs/TEST_PLAN.md - codify the mandatory 1MB/10MB/100MB/1GB no-retry fast-ramp matrix and pass/fail policy. - docs/ARCHITECTURE.md - update transport implementation notes to reflect brokerized gateway path while preserving single-console architecture. Commands: - scripts/ci/check_test_plan.sh Checks: - Documentation matches implemented flags, limits, and failure semantics exactly. Deliverables: - Canonical operator and test documentation for Milestone 25f. ``` --- ## Milestone 25g — Host Control Tickets via FUSE (GPU/PEFT + systemd/docker + K8s Coexistence) [Milestones](#Milestones) **Why now (high-value orchestration):** Cohesix already has bounded control surfaces for `/gpu/*`, `/host/*`, policy gates, and evidence packs, but host actions still require tool-specific flows. The highest-leverage next step is a unified, auditable host execution queue where Queen emits bounded JSON control tickets and host executors consume them through mounted file views without adding new protocols. ## Goal Deliver a deterministic, policy-gated host control-ticket plane that: 1. Defines a manifest-driven ticket contract with idempotency and lifecycle states. 2. Adds a host ticket agent that watches mounted ticket files and executes bounded adapters. 3. Prioritizes high-value adapters: GPU lease/PEFT lifecycle, systemd remediation, Docker remediation, and Kubernetes coexistence translation. 4. Extends evidence/replay so every ticket decision is traceable and reproducible. ## Non-Goals (Explicit) - No new in-VM TCP listeners, RPC channels, or host/VM sideband protocols. - No change to ACK/ERR/END grammar, NineDoor error semantics, or Secure9P bounds. - No in-VM CUDA/NVML, no in-VM container runtime, and no bypass of role/ticket authorization. - No unbounded queueing, retries, or background mutation loops. ## Design Principles (Normative) 1. **Spec/status split** - ticket requests and ticket outcomes are append-only, separate streams. 2. **At-least-once + idempotency** - executors may re-read; outcomes are deduplicated by `id` + `idempotency_key`. 3. **Policy-first execution** - Queen gating and ticket scopes remain authoritative before host side effects. 4. **Replayability** - ticket state transitions are deterministic and captured by existing audit/evidence paths. ## Implementation Touchpoints - `tools/coh-rtc/src/ir.rs`, `configs/root_task.toml`, generated artifacts - emit ticket schema/bounds (`host-ticket/v1`) and allowlisted action kinds. - `apps/nine-door/src/host/*`, `apps/root-task/src/ninedoor.rs` - expose bounded ticket files under `/host/tickets/*` with append-only semantics. - `apps/host-ticket-agent/*` (new host tool) - watch mounted ticket streams, claim work, execute adapters, and append status receipts. - `apps/gpu-bridge-host/*`, `apps/coh/src/peft/*` - GPU/PEFT ticket executors. - `apps/host-sidecar-bridge/*` - systemd/docker/K8s adapter execution and status projection. - `tools/cohesix-py/*` - optional RBAC-to-ticket translation helpers for Kubernetes coexistence workflows. - `docs/INTERFACES.md`, `docs/HOST_TOOLS.md`, `docs/USERLAND_AND_CLI.md`, `docs/USE_CASES.md`, `docs/TEST_PLAN.md`, `docs/ARCHITECTURE.md` - docs-as-built and operator/test alignment. ## Commands - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/check-generated.sh` - `cargo test -p nine-door` - `cargo test -p host-sidecar-bridge` - `cargo test -p gpu-bridge-host` - `cargo test -p coh --features mock` - `cargo test -p tests --test shard_1k` - `python3 -m pytest tools/cohesix-py/tests -q` - `scripts/ci/check_test_plan.sh` ## Checks (Definition of Done) - Ticket namespace is manifest-gated and bounded, with deterministic state transitions: - `queued` -> `claimed` -> `running` -> `succeeded|failed|expired`. - Host ticket agent executes only allowlisted actions and writes bounded status receipts without leaking auth tokens or raw signing secrets. - GPU/PEFT tickets drive `lease`, `import`, `activate`, and `rollback` flows using existing `/gpu/*` and `/queen/export/*` semantics. - systemd/docker tickets perform bounded remediation (restart/stop/status verify) through host adapters and emit correlatable outcomes. - Kubernetes coexistence flow translates RBAC-scoped intents into Cohesix tickets without introducing alternative control-plane semantics. - Evidence packs and timeline tooling include ticket request/outcome correlation so incident replay and chargeback are deterministic. - `docs/TEST_PLAN.md` includes mandatory ticket-flow runs (GPU/PEFT, systemd, docker, K8s coexistence, replay/evidence) with no skip path. ## Task Breakdown ``` Title/ID: m25g-ticket-ir-and-namespace Goal: Define host control-ticket schema/bounds and expose append-only ticket streams in the namespace. Inputs: tools/coh-rtc/src/ir.rs, configs/root_task.toml, apps/nine-door/src/host, apps/root-task/src/ninedoor.rs, docs/INTERFACES.md. Changes: - tools/coh-rtc/src/ir.rs + configs/root_task.toml - add `host-ticket/v1` schema, action allowlist, byte caps, and lifecycle enums. - apps/nine-door/src/host/tickets.rs + apps/root-task/src/ninedoor.rs - add `/host/tickets/spec`, `/host/tickets/status`, `/host/tickets/deadletter`, and bounded snapshot nodes. - docs/INTERFACES.md - document ticket file paths, schema, and deterministic failure semantics. Commands: - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - cargo test -p nine-door Checks: - Valid ticket lines append successfully; malformed/over-limit lines fail deterministically. Deliverables: - Manifest-driven host ticket contract with generated artifacts and interface docs. Title/ID: m25g-host-ticket-agent-core Goal: Add a host-only ticket agent that watches mounted ticket streams and executes bounded work with idempotent claims. Inputs: apps/coh/src/mount.rs, apps/host-ticket-agent (new), docs/HOST_TOOLS.md, docs/ARCHITECTURE.md. Changes: - apps/host-ticket-agent/src/main.rs - tail/watch loop for `/host/tickets/spec` with deterministic cursor resume. - apps/host-ticket-agent/src/claim.rs - claim/idempotency handling keyed by `id` + `idempotency_key`. - apps/host-ticket-agent/src/status.rs - append bounded `host-ticket-result/v1` receipts to `/host/tickets/status`. - docs/HOST_TOOLS.md + docs/ARCHITECTURE.md - document runtime model, failure handling, and single-console constraints. Commands: - cargo test -p host-ticket-agent Checks: - Agent survives watcher interruptions, resumes from cursor, and avoids duplicate side effects for repeated tickets. Deliverables: - Host ticket execution agent with deterministic claim/execute/report lifecycle. Title/ID: m25g-gpu-peft-ticket-executors Goal: Implement high-value GPU lease and PEFT lifecycle ticket actions. Inputs: apps/gpu-bridge-host, apps/coh/src/peft, docs/GPU_NODES.md, docs/USE_CASES.md. Changes: - apps/host-ticket-agent/src/executors/gpu.rs - execute `gpu.lease.grant|renew|release` and verify via `/gpu//lease`. - apps/host-ticket-agent/src/executors/peft.rs - execute `peft.import|activate|rollback` using existing host registry and `/gpu/models/*` flows. - docs/GPU_NODES.md + docs/USE_CASES.md - document ticket-driven GPU/PEFT orchestration for multi-tenant edge and model governance use cases. Commands: - cargo test -p gpu-bridge-host - cargo test -p coh --features mock Checks: - Ticketed GPU/PEFT flows are auditable, bounded, and preserve existing lease/model semantics. Deliverables: - Ticket executors for the highest-value GPU/PEFT control loops. Title/ID: m25g-systemd-docker-remediation Goal: Add deterministic systemd/docker remediation ticket actions through host-side adapters. Inputs: apps/host-sidecar-bridge, apps/host-ticket-agent, docs/HOST_TOOLS.md, docs/INTERFACES.md. Changes: - apps/host-ticket-agent/src/executors/systemd.rs - support allowlisted `start|stop|restart|status-check` unit actions. - apps/host-ticket-agent/src/executors/docker.rs - support allowlisted container restart/stop/status actions with bounded output capture. - apps/host-sidecar-bridge/src/providers/* - normalize status verification for post-action receipts. - docs/HOST_TOOLS.md + docs/INTERFACES.md - document remediation action schemas and safeguards. Commands: - cargo test -p host-sidecar-bridge - cargo test -p host-ticket-agent Checks: - Remediation actions emit deterministic success/failure receipts and never execute non-allowlisted commands. Deliverables: - Policy-bounded systemd/docker ticket remediation path. Title/ID: m25g-k8s-rbac-ticket-translation Goal: Preserve Kubernetes coexistence by translating RBAC-scoped intents into Cohesix host tickets. Inputs: tools/cohesix-py, apps/host-ticket-agent, docs/USE_CASES.md, docs/PYTHON_SUPPORT.md. Changes: - tools/cohesix-py/cohesix/orchestrator.py - add optional RBAC-to-ticket translation helpers for cordon/drain/lease workflows. - apps/host-ticket-agent/src/executors/k8s.rs - execute allowlisted K8s actions and emit bounded receipts. - docs/USE_CASES.md + docs/PYTHON_SUPPORT.md - document coexistence constraints, identity mapping, and ticket translation flow. Commands: - python3 -m pytest tools/cohesix-py/tests -q - cargo test -p host-ticket-agent Checks: - K8s coexistence remains out-of-band governance (no scheduler replacement) with deterministic ticket/audit linkage. Deliverables: - RBAC-scoped K8s coexistence adapter over ticketed control semantics. Title/ID: m25g-evidence-replay-and-testplan Goal: Extend audit/evidence/replay and codify mandatory ticket-flow validation in the Test Plan. Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, docs/TEST_PLAN.md, docs/SECURITY.md, docs/USERLAND_AND_CLI.md. Changes: - apps/coh/src/evidence.rs + apps/coh/src/evidence_timeline.rs - correlate ticket `id`/`idempotency_key` across spec/status/audit/lease artifacts. - docs/TEST_PLAN.md - add mandatory control-ticket matrix: GPU/PEFT, systemd remediation, docker remediation, K8s coexistence translation, and replay/timeline validation. - docs/SECURITY.md + docs/USERLAND_AND_CLI.md - document token redaction, idempotency semantics, and operator procedures. Commands: - cargo test -p coh - scripts/ci/check_test_plan.sh Checks: - Evidence packs and timelines are deterministic and include ticket correlation for all mandatory ticket classes. Deliverables: - Canonical docs and regression requirements for Milestone 25g ticketed orchestration. ``` --- ## Milestone 25h — Multi-Hive Federation via Ticket Relay (Single-Writer Preserved, 10x1k Fleet Pattern) [Milestones](#Milestones) **Why now (historical planning context):** At Milestone 25h planning time, an earlier local benchmark snapshot was interpreted as a 1500-worker hard cap, with gateway pressure observed around 1000-1200 workers per hive. That snapshot is not a current qualified capacity claim; [BENCHMARKS.md](BENCHMARKS.md) owns the active evidence and acceptance rules. The architectural conclusion remains: scale across independently bounded hives instead of introducing active/active writes to one logical hive. [FAILOVER.md](FAILOVER.md) defines the single-writer active/standby and host-orchestrated cutover model extended by this milestone. ## Goal Deliver a deterministic multi-hive interoperability layer that: 1. Scales operational control across many independent hives using host-side ticket relay. 2. Preserves single-writer semantics per hive and explicit split-brain fencing. 3. Enables pragmatic "10 queens -> 10,000 workers" orchestration patterns without adding new in-VM protocols. 4. Produces replayable, correlated evidence for cross-hive intents and outcomes. ## Non-Goals (Explicit) - No active/active multi-queen writes to one logical hive namespace. - No built-in cross-queen state replication or consensus protocol. - No new in-VM TCP listeners, RPC channels, or shared-memory authority paths. - No relaxation of Secure9P limits, ACK/ERR/END grammar, or existing policy gates. - No dependence on REST-backed FUSE appends for mutation paths in federated mode; control writes remain REST `/v1/fs/echo`-driven. ## Design Principles (Normative) 1. **Hive as authority island** - each hive remains independently authoritative and bounded. 2. **Forward intents, not mutable state** - relay append-only tickets and receipts, never raw state replication. 3. **Idempotent by construction** - cross-hive actions correlate by `id + idempotency_key + source_hive + target_hive`. 4. **Host-owned federation logic** - keep routing, WAL, and retry policy host-side to preserve tiny VM TCB. 5. **Read-many, write-disciplined** - broad fleet reads are allowed; writes are fenced per-hive and explicit. ## Implementation Touchpoints - `tools/coh-rtc/src/ir.rs`, `configs/root_task.toml`, generated artifacts - add manifest-gated federation config: - peer inventory, per-peer auth references, relay queue bounds, allowed cross-hive actions, and WAL bounds. - `apps/host-ticket-agent/*` and/or new `apps/hive-federation-relay/*` - implement bounded cross-hive relay worker over existing REST gateway paths. - `apps/hive-gateway/*` - expose relay-safe status counters (queue, dedupe, remote write failures) without adding control semantics. - `apps/coh/src/evidence.rs`, `apps/coh/src/evidence_timeline.rs` - include cross-hive correlation fields in evidence/timeline exports. - `scripts/failover_watchdog.py` - integrate federation-aware fencing hooks (pause relay during cutover, resume after health checks). - `tools/cohesix-py/*` - optional fleet orchestrator helpers for fan-out by shard/hive policy while preserving ticket semantics. - `docs/FAILOVER.md`, `docs/HOST_TOOLS.md`, `docs/INTERFACES.md`, `docs/ARCHITECTURE.md`, `docs/TEST_PLAN.md`, `docs/USE_CASES.md` - canonical as-built behavior and operator runbooks. ## Commands - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/check-generated.sh` - `cargo test -p host-ticket-agent` - `cargo test -p hive-gateway` - `cargo test -p coh` - `python3 -m pytest tools/cohesix-py/tests -q` - `python3 scripts/failover_watchdog.py --help` - `scripts/ci/check_test_plan.sh` ## Checks (Definition of Done) - Per-hive single-writer invariant is preserved during normal operations, relay fan-out, planned failover, and unplanned cutover. - Cross-hive relay is deterministic and idempotent: duplicate spec lines or relay restarts do not produce duplicate side effects. - Federated writes use authenticated REST mutation paths; read-only FUSE mounts may be used for observability. - Relay queueing is bounded with explicit backpressure/timeout counters and deterministic failure receipts. - Evidence/timeline output correlates source hive intent -> target hive execution -> terminal receipt with stable IDs. - A multi-hive validation matrix (minimum 3 hives; stretch 10 hives) passes with no split-brain writes and no grammar drift. - `docs/TEST_PLAN.md` includes mandatory federation runs (relay success, relay failure, dedupe, failover pause/resume, evidence correlation) with no skip path. ## Task Breakdown ``` Title/ID: m25h-federation-ir-and-policy Goal: Add manifest-driven federation config and bounds for cross-hive relay behavior. Inputs: tools/coh-rtc/src/ir.rs, configs/root_task.toml, docs/INTERFACES.md, docs/ARCHITECTURE.md. Changes: - tools/coh-rtc/src/ir.rs + configs/root_task.toml - add `federation` section (peers, allowlisted actions, queue/WAL bounds, auth references). - Generated artifacts/snippets - emit federation bounds for docs and host tooling. - docs/INTERFACES.md + docs/ARCHITECTURE.md - document federation envelope and invariants. Commands: - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh Checks: - Invalid peer config or over-limit bounds fail generation deterministically. Deliverables: - Manifest-backed federation policy with generated docs snippets and hash-checked artifacts. Title/ID: m25h-relay-agent-core Goal: Implement bounded cross-hive ticket relay with WAL and deterministic cursor resume. Inputs: apps/host-ticket-agent, apps/hive-gateway, docs/HOST_TOOLS.md, docs/FAILOVER.md. Changes: - apps/host-ticket-agent/src/relay.rs (or new apps/hive-federation-relay) - watch source `/host/tickets/spec`, forward allowlisted intents to target `/host/tickets/spec`. - apps/host-ticket-agent/src/wal.rs - persist pending relay intents and replay unapplied entries after restart. - apps/hive-gateway - expose relay observability counters under existing status surfaces. Commands: - cargo test -p host-ticket-agent - cargo test -p hive-gateway Checks: - Relay restarts resume from cursor/WAL without duplicate side effects. Deliverables: - Host-side relay engine with bounded queueing and restart-safe behavior. Title/ID: m25h-federated-ticket-envelope Goal: Define cross-hive ticket envelope and status correlation rules. Inputs: apps/nine-door/src/host/tickets.rs, apps/root-task/src/ninedoor.rs, docs/INTERFACES.md. Changes: - Ticket schema evolution (`host-ticket/v1` additive fields or `host-ticket-federated/v1`) including `source_hive`, `target_hive`, `relay_hop`, and correlation IDs. - Deterministic mapping from target status receipts back to source status/deadletter. - docs/INTERFACES.md - normative schema and lifecycle transitions for federated flow. Commands: - cargo test -p nine-door - cargo test -p host-ticket-agent Checks: - Malformed or unauthorized federated envelopes are rejected with deterministic ERR/receipts. Deliverables: - Stable cross-hive envelope contract and receipt-correlation semantics. Title/ID: m25h-fleet-read-model Goal: Add operator-grade fleet read model without introducing global write semantics. Inputs: apps/coh, apps/hive-gateway, docs/HOST_TOOLS.md. Changes: - apps/coh/src/fleet.rs - read-only fan-in helpers (`coh fleet status`, `coh fleet lease-summary`, `coh fleet pressure`). - docs/HOST_TOOLS.md - document read-only fleet commands and write-fencing guidance. - Optional REST/FUSE examples for multi-hive observability trees. Commands: - cargo test -p coh Checks: - Fleet read commands produce deterministic merged output and never mutate hive state. Deliverables: - Read-only fleet observability surface aligned with single-writer control semantics. Title/ID: m25h-failover-fencing-integration Goal: Integrate relay behavior with failover fencing and cutover runbooks. Inputs: scripts/failover_watchdog.py, docs/FAILOVER.md, docs/TEST_PLAN.md. Changes: - scripts/failover_watchdog.py - add relay pause/resume hooks tied to hold-down and health thresholds. - docs/FAILOVER.md - federation-aware runbook: freeze relay, cut over, replay WAL, resume relay. - docs/TEST_PLAN.md - mandatory failover + relay consistency checks. Commands: - python3 scripts/failover_watchdog.py --help - scripts/ci/check_test_plan.sh Checks: - Planned/unplanned cutovers do not create split-brain relay writes or duplicate downstream actions. Deliverables: - Federation-aware failover automation and validated operator procedure. Title/ID: m25h-federation-scale-gate Goal: Validate pragmatic multi-hive scale targets with deterministic pass/fail criteria. Inputs: scripts/rest_perf_harness.py, docs/BENCHMARKS.md, docs/TEST_PLAN.md, docs/USE_CASES.md. Changes: - scripts/rest_perf_harness.py - add multi-hive scenario mode (N gateways, per-hive worker caps, relay load profile). - docs/BENCHMARKS.md - publish 3-hive baseline and optional 10-hive stretch results with first-failure mode analysis. - docs/USE_CASES.md + docs/TEST_PLAN.md - map federated scale to concrete use-case flows and mandatory gate commands. Commands: - python scripts/rest_perf_harness.py --mode simulate --multi-hive --hives 3 --workers-per-hive 1000 --no-retries --error-budget-rate 0.01 Checks: - Multi-hive scenarios hit target worker totals via federation without breaching per-hive invariants. Deliverables: - Federation scale gate evidence and use-case-aligned capacity guidance. Title/ID: m25h-evidence-and-timeline-correlation Goal: Make cross-hive relay flows first-class in evidence packs and timelines. Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, docs/HOST_TOOLS.md. Changes: - apps/coh/src/evidence.rs - export source/target relay correlation fields and redacted auth metadata. - apps/coh/src/evidence_timeline.rs - stitch multi-hive ticket lifecycle into deterministic timeline ordering. - docs/HOST_TOOLS.md - operator guidance for multi-hive postmortems and chargeback. Commands: - cargo test -p coh Checks: - Evidence/timeline output is deterministic and sufficient to reconstruct federated control flow. Deliverables: - Cross-hive evidence correlation integrated into existing audit-first tooling. ``` ---- **Release 0.9.0 alpha** ---- --- The next planned releases target official Raspberry Pi 4 bare-metal boot (`U-Boot + binary image`) and AWS native boot via AMI. --- ## Milestone 26 — Official Pi 4 Bring-up (U-Boot + Binary Image) [Milestones](#Milestones) **Status:** Complete. **As-built attestation correction (2026-09-14):** Schema 1.20 replaces the public policy-hash TPM/DICE labels with explicit implementation modes. Root reports `measurement_only` and development ticket keys; required signed modes without a device provider fail before ticket registration. The shared host TPM2 quote/certificate verifier and versioned challenge/evidence/trust contract are implemented in [ATTESTATION.md](ATTESTATION.md). Device issuance and sealed or derived production ticket material remain the reopened task below. **Stock Pi 4 exception (Lukas Bower, 2026-09-14):** The current Pi has no onboard TPM or provisioned device-bound DICE chain. It is excluded from positive signed-device acceptance and explicitly selects optional measurement-only mode. This exception does not enable secure boot, attest static keys, waive ordinary Pi operator/trace validation, or qualify an added TPM module. The hardware-independent host verifier and its negative/cryptographic conformance gates remain required. No CYW43 behavior or historical proof is relabelled. **Why now (context):** Upstream seL4 Pi 4 bring-up documentation originally used direct U-Boot image loading examples on `bcm2711`, not a UEFI handoff chain. Cohesix now follows the active staged U-Boot path: `scripts/pi4-image-build.sh` validates and consumes immutable `seL4/build_UBOOT` artifacts, composes the new rootserver and wrapper only in disposable output, stages the seL4 binary image, driver-runtime CPIO, and padded DTB, then hands off with `bootm `. This preserves deterministic control at the U-Boot prompt while matching the isolated runtime layout used by Milestone 26a/26b. **Non-negotiable constraints:** - Boot chain for Pi 4 Milestone 26 is: `Pi firmware (start4/fixup) -> U-Boot -> seL4 image -> root-task`. - Milestone 26 acceptance no longer depends on UEFI firmware settings or `BOOTAA64.EFI`. - Backward compatibility remains mandatory: Pi 4 changes must not break existing QEMU workflows on macOS (`hvf`/`tcg`) or Linux (`kvm`/`tcg`) for `aarch64/virt`. - Local diagnostics on Pi 4 must reuse the existing root-console parser and command semantics; no new shell grammar or in-VM protocol is permitted. - Local diagnostics seat remains primitive: USB keyboard input + HDMI text output only; no compositor/windowing stack. - Milestone 26 remains a strict no-NIC runtime baseline on Pi 4; root-task network bring-up and TCP console reachability on Pi 4 start in Milestone 26a. - Milestone 26 has no Pi 4 NIC throughput or latency acceptance target; QEMU U-Boot harness timing is script/debug feedback only and cannot be used as Pi hardware latency or network-performance proof. - U-Boot may be used for pre-kernel network setup and diagnostics, but no new Cohesix protocol semantics may be introduced there. - All post-seL4 hardware access (UART, NET, USB input, HDMI text output, TPM, RTC) must go through HAL-owned traits/drivers. --- ### Prerequisites (must be completed before Milestone 26 DoD) **Upstream seL4 Pi 4 binary image support** - Confirm and use upstream seL4 image output for `KernelPlatform=bcm2711` (for example `sel4test-driver-image-arm-bcm2711`). - The generated image must preserve existing VM boot semantics once seL4 is entered. **Upstream U-Boot Pi 4 support** - Build Pi 4 U-Boot using `rpi_4_defconfig`. - Ensure SD card firmware handoff is configured to load `u-boot.bin` as kernel payload. --- ### Goal Deliver a **Pi firmware -> U-Boot -> seL4 image -> root-task** boot path on Raspberry Pi 4 that reaches the `cohesix>` prompt with primitive local diagnostics (USB keyboard input + HDMI text output) and deterministic no-NIC runtime evidence. --- ### Deliverables - **Pi 4 U-Boot boot chain** - Standard FAT boot partition contains: - Raspberry Pi firmware assets (`start4.elf`, `fixup4.dat`, board DTBs/overlays as needed), - `u-boot.bin`, - seL4 generated image (`sel4test-driver-image-arm-bcm2711`), - Cohesix manifest artifacts used by root-task. - Root-task remains the first user process post-kernel boot. - **U-Boot command path (authoritative for boot control)** - Document and standardize operator commands: - `fatls` to verify media, - `fatload` to load the staged image, runtime CPIO, and DTB into RAM, - `bootm` to transfer execution through the staged U-Boot image contract. - Define the environment conventions that 26a/26b will extend (`loadaddr`, `ipaddr`, `serverip`, `ethact`, `autoload`, `bootcmd`). - **macOS debug harness for U-Boot scripts** - Add a reproducible QEMU U-Boot harness on macOS using `qemu_arm64_defconfig` and `qemu-system-aarch64 -machine virt`. - Use this harness to debug U-Boot env scripts and pre-boot network setup logic quickly. - Explicitly document that QEMU harness does not prove Pi 4 USB keyboard, HDMI, or GENET hardware behavior. - **Identity & attestation** - Root retains attestation policy and ticket-authority admission, while any physical TPM transport follows the mandatory isolated-driver/HAL boundary. A DICE mode is valid only when a device-bound CDI and signed certificate chain are established before root-task; hashing public configuration in root is not a DICE fallback. - Capability ticket seeds are TPM-sealed or DICE-derived and become usable only after the selected measured-boot policy and signed evidence validate. Raw production seeds are never emitted into generated Rust, manifests, images, logs, or release bundles. - Versioned, nonce-bound evidence is bound to the exact boot, kernel, root, resolved manifest, and image identities and projected through bounded `/proc/attest/*` nodes over existing Secure9P/console transport semantics. Measurement-only and unavailable states remain explicit and fail closed when attestation is required. - **Schema & validation** - Introduce profile naming aligned to boot reality (`pi4-uboot-aarch64`), with a compatibility alias from `uefi-aarch64` permitted only during migration. - Validate bounded hardware declarations (`uart`, `rtc`, local-seat, attestation policy/device requirements). - Enforce no-NIC runtime gate for Milestone 26 profile(s). - **Local diagnostics seat (Pi 4, essential-only)** - Profile-gated local-seat path consumes USB keyboard input and routes bytes into the existing root console parser. - Primitive HDMI text sink mirrors root-console output lines with bounded memory and deterministic truncation. - If `hw.local_seat.required=true` and the local-seat declaration or schema cannot be admitted, boot fails deterministically before ticket publication. Linked USB/HDMI runtime backend attach failures keep the serial shell alive with red local-seat acceptance evidence so Pi 4 recovery remains possible. - **No-NIC baseline validation (Milestone 26 only)** - Root-task completes boot/attestation/local-seat bring-up without NIC initialisation. - `/proc/boot` emits deterministic evidence that networking is intentionally disabled in Milestone 26 runtime. --- ### Commands - Build seL4 Pi 4 image: - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml` - Build U-Boot for Pi 4: - `make -C third_party/u-boot rpi_4_defconfig` - `make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)` - U-Boot boot commands on Pi 4: - `fatls mmc 0:1` - `fatload mmc 0:1 ${loadaddr} cohesix-image-arm-bcm2711` - `fatload mmc 0:1 0x15000000 cohesix-driver-runtimes.cpio.uimg` - `fatload mmc 0:1 0x14000000 bcm2711-rpi-4-b.dtb` - `bootm ${loadaddr} 0x15000000 0x14000000` - U-Boot pre-boot networking setup commands (for 26a/26b preparation and diagnostics): - `setenv autoload no` - `setenv ipaddr ` - `setenv serverip ` - `dhcp` - `ping ${serverip}` - `saveenv` - macOS QEMU U-Boot harness: - `make -C third_party/u-boot qemu_arm64_defconfig` - `make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)` - `qemu-system-aarch64 -machine virt -cpu cortex-a57 -m 2048 -nographic -bios third_party/u-boot/u-boot.bin` - Runtime checks: - `cargo check -p root-task` - `cargo test -p root-task --features "kernel serial-console" local_seat` --- ### Checks (DoD) - Pi 4 boots through U-Boot using the staged `bootm` image + runtime CPIO + DTB handoff into seL4/root-task with deterministic log ordering. - `cohesix>` prompt appears on HDMI text output and accepts USB keyboard commands (`help`, `bi`, `caps`, `ping`) with unchanged parser semantics. - Command responses typed on USB keyboard are visible on HDMI and match serial transcript semantics. - Manifest fingerprint is printed and matches packaged hash. - If `hw.attestation.required=true`, a real nonce-bound TPM2 Quote or device-bound DICE signature chain validates against the configured trust policy before ticket authority is published; measurement-only, replayed, stale, unsigned, wrong-boot, or unavailable evidence aborts deterministically. Merely matching a manifest hash is not attestation. - Milestone 26 runtime on Pi 4 emits deterministic no-NIC evidence and does not require TCP console reachability. - Root-task post-seL4 paths use HAL-only device access; no direct firmware-service assumptions in runtime code. - macOS QEMU U-Boot harness can execute U-Boot env/network commands for script validation; Pi 4 hardware remains authoritative for USB/HDMI/NIC proof and QEMU timing is not accepted as Pi hardware latency evidence. - Existing macOS/Linux QEMU regression scripts continue to pass unchanged unless explicitly profile-gated and documented. --- ### Compiler touchpoints - `coh-rtc` emits hardware tables for selected profile(s) and docs import them into `docs/HARDWARE_BRINGUP.md` and `docs/ARCHITECTURE.md`. - `coh-rtc` extends Pi 4 profile schema with bounded local-seat declarations (`enabled`, `required`, declared keyboard/display devices) and validates that required local-seat profiles name matching `required=true` keyboard/display device entries. - `coh-rtc` enforces Milestone 26 no-NIC runtime gates while allowing U-Boot pre-boot network env declarations for future milestones. - Migration guard: accept legacy `uefi-aarch64` manifests only through an explicit compatibility path and emit deterministic deprecation diagnostics. --- ## Task Breakdown ``` Title/ID: m26-uboot-bootchain Goal: Boot Pi 4 via the staged U-Boot `bootm` handoff into seL4/root-task with stable manifest fingerprint output. Inputs: `seL4/build_UBOOT/images/sel4test-driver-image-arm-bcm2711`, `third_party/u-boot`, Pi firmware boot partition files, profile manifest, staged driver-runtime CPIO, padded Pi 4 DTB. Changes: - `scripts/pi4-image-build.sh` — build deterministic Pi 4 FAT payload (`u-boot.bin` + seL4 image + manifest artifacts). - `docs/HARDWARE_BRINGUP.md` — document canonical Pi 4 U-Boot command flow and SD layout. - `apps/root-task` — preserve boot fingerprint line ordering relative to serial/local seat. Commands: - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml` - `make -C third_party/u-boot rpi_4_defconfig` - `make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)` Checks: - Pi 4 reaches root-task via staged `bootm `; missing/invalid manifest or DTB policy aborts before ticket publication. Deliverables: - Reproducible Pi 4 U-Boot boot artifacts with documented hashes and commands. --- Title/ID: m26-uboot-mac-debug-harness Goal: Provide a fast macOS U-Boot/QEMU harness for debugging boot scripts and future network env setup. Inputs: `third_party/u-boot` (`qemu_arm64_defconfig`), `qemu-system-aarch64`, docs updates. Changes: - `scripts/uboot/qemu-uboot-smoke.sh` — launch U-Boot on QEMU `virt` with deterministic serial logging. - `docs/HARDWARE_BRINGUP.md` — list supported harness use cases and explicit non-goals (no Pi4 USB/HDMI/GENET fidelity). Commands: - `make -C third_party/u-boot qemu_arm64_defconfig` - `make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu)` - `qemu-system-aarch64 -machine virt -cpu cortex-a57 -m 2048 -nographic -bios third_party/u-boot/u-boot.bin` Checks: - Harness reaches U-Boot prompt and can execute env and network setup commands deterministically. Deliverables: - Faster pre-hardware debug loop for U-Boot setup logic. --- Title/ID: m26-local-seat-minimal Goal: Provide primitive local post-boot diagnostics on Pi 4 by wiring USB keyboard input and HDMI text output into existing root-console path. Inputs: `apps/root-task/src/console/*`, `apps/root-task/src/userland/mod.rs`, `apps/root-task/src/event/*`, HAL mapping, `tools/coh-rtc`, profile manifest. Changes: - HAL-bound USB keyboard input path feeding existing parser/dispatcher. - Primitive HDMI text sink mirroring root-console output lines with bounded memory and deterministic truncation. - `coh-rtc` schema/codegen for `hw.local_seat` (`enabled`, `required`, declared devices). - Pi 4 VL805 local-seat remains cold-boot-only: Linux/U-Boot captures may provide layout diagnostics, but root-port power readback, connected/enabled/speed state, and reset must be proven in the current Cohesix boot after command/event-ring proof. Commands: - `cargo check -p root-task` - `cargo test -p root-task --features "kernel serial-console" local_seat` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` Checks: - USB keyboard commands yield identical parser semantics to serial. - Pi 4 USB enumeration does not synthesize root-port state from Linux/U-Boot captures after command-ring proof. - HDMI output mirrors root-console lines deterministically. - `hw.local_seat.required=true` fails fast when dependencies are unsatisfied. Deliverables: - Pi 4 local-seat evidence proving `cohesix>` command loop on USB keyboard + HDMI. --- Title/ID: m26-device-identity-attestation-closure Milestone: Milestone 26 — Official Pi 4 Bring-up / reopened device-identity, attestation, and ticket-secret defect Goal: Replace configuration hashing presented as TPM/DICE evidence with real device-bound, freshness-protected attestation and prevent authority publication when no accepted trust root exists. Inputs: apps/root-task/src/{attest.rs,kernel.rs,ninedoor.rs}, apps/pi4-driver-runtime/**, tools/coh-rtc/src/**, configs/root_task*.toml, selected seL4/U-Boot/QEMU/Pi images, host secret and trust-anchor tooling, docs/ARCHITECTURE.md, docs/HARDWARE_BRINGUP.md, docs/INTERFACES.md, docs/SECURITY.md, docs/TEST_PLAN.md, and the frozen CYW43 image identity when implementation begins. Changes: - tools/coh-rtc/src/** + configs/root_task*.toml — replace ambiguous `tpm-or-dice` selection with explicit `disabled|measurement_only|tpm2_quote|dice_evidence` implementation modes plus `required`, algorithms, bounded measurement/PCR policy, trust-anchor references, evidence/challenge limits, freshness window, ticket-key policy, and exact device/boot-chain prerequisites. Production generation rejects an attestation claim without a declared usable trust root, rejects DICE with no device-bound CDI chain, rejects TPM mode with no isolated TPM device contract, and rejects literal/static production ticket keys. - apps/pi4-driver-runtime/** + HAL manifests — when TPM mode is selected, add the least-authority isolated TPM transport/runtime required for bounded TPM2 startup, PCR read/extend policy, quote, and sealed-object unseal. Root receives typed evidence/results only; it receives no direct physical bus/MMIO shortcut and no raw endorsement or storage key. - boot/U-Boot handoff + apps/root-task/src/attest.rs — for DICE mode, consume a read-once, versioned, signed evidence descriptor rooted in a device-bound CDI/attestation key established before root-task. For TPM mode, request a TPM2 Quote over the generated PCR selection. Both evidence forms bind verifier nonce, boot/session id, monotonic/replay data, firmware/U-Boot/seL4 kernel/root/runtime archives/resolved-manifest/image hashes, algorithms, public-key/certificate chain, and signature. - apps/root-task/src/ninedoor.rs + generated interface — add bounded `/proc/attest/{capabilities,status,challenge,evidence}` semantics. `challenge` accepts only an authenticated, rate-limited, fixed-schema nonce request; `evidence` returns the uniquely correlated signed result. This is an ephemeral evidence operation over existing transport/authority, not a general RPC or configuration mutation. - ticket authority — replace generated static production role keys with TPM-sealed role material or DICE-domain-separated key derivation. Ticket publication occurs only after the selected measurement policy and signed chain validate; failure leaves ticket/network write authority unavailable while preserving the emergency serial failure report required by the profile. - QEMU/Pi evidence — use a vTPM only as explicit QEMU virtual-device evidence and require real Pi hardware TPM or a genuine Pi device-bound DICE/secure-boot chain for Pi attestation acceptance. If neither exists, the Pi profile reports `measurement_only` or `unavailable`; it may boot only when attestation is not required and cannot make an attested-production claim. - docs/tests/release — add enrollment/trust-anchor, rotation, nonce freshness, replay, wrong-PCR, wrong-image, wrong-key, expired-chain, TPM reset, DICE-chain, unavailable-device, secret-scan, and power-loss cases; historical deterministic hashes remain measurement fixtures and are never promoted. Commands: - cargo test -p coh-rtc attestation - cargo test -p root-task --tests attest - cargo test -p pi4-driver-runtime --features tpm2 - scripts/check-generated.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26-attestation-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26-attestation-pi4 Checks: a fresh verifier nonce produces a valid TPM2 Quote or DICE signature chain bound to the exact accepted image and manifest; replay, public-data hash synthesis, missing CDI/TPM, wrong measurement, stale nonce, signature/chain failure, static key material, and fixture substitution fail before ticket publication; QEMU virtual evidence and Pi hardware/device-root evidence remain distinct; no CYW43 behavior or proof classification is edited. Deliverables: Honest measurement-versus-attestation states, real device-bound signed evidence, sealed/derived ticket authority, host-verifiable freshness, and separate QEMU/Pi acceptance records. --- Title/ID: m26-hal-boundary Goal: Keep all post-seL4 runtime device access HAL-owned while allowing U-Boot-only pre-boot control. Inputs: `apps/root-task/src/hal/*`, `apps/root-task/src/drivers/*`, `apps/root-task/src/kernel.rs`, `tools/coh-rtc/src/*`, docs. Changes: - Ensure all Milestone 26 runtime paths (serial, local seat, attestation, future network handoff points) are represented through HAL interfaces. - Add deterministic checks and documentation language for bootloader-owned vs Cohesix-owned responsibilities. Commands: - `cargo check -p root-task` - `cargo test -p root-task hal:: -- --nocapture` - `rg -n "EFI_|boot_services|runtime_services|uefi::" apps/root-task/src apps/nine-door/src tools/coh-rtc/src` Checks: - No direct firmware-service assumptions in runtime code. - HAL remains sole runtime device access surface. Deliverables: - Auditable bootloader/runtime boundary with CI-friendly guard commands and docs-as-built updates. ``` --- ## Milestone 26a — Pi 4 Driver-Task Substrate + GENET/Serial/Display Isolation [Milestones](#Milestones) **Status:** Complete — the Pi 4 driver-task substrate, serial/display isolation, GENET linked-runtime migration, preserved GENET compatibility behavior, and physical wired TCP proof are accepted as meeting the 26a definition of done. Fresh Genet runs retain clean TCP/cohsh reachability, bounded driver-task service evidence, and no root-owned steady-state physical-driver service path. **Why now (platform continuity):** Milestone 25 established Cohesix's performance model: parallelism comes from isolated seL4 tasks, while root-task authority stays serialized. The first 26a implementation proved Pi 4 GENET reachability, but later Wi-Fi tuning exposed a system-level flaw: hardware drivers still share the cooperative root-task turn. The completed 26a closure converts HAL from a broad in-root provider into a driver admission layer with explicit scheduling contracts, then migrates low-risk hardware paths before CYW43. **Non-negotiable constraints:** - No new in-VM listeners or protocols; the authenticated root-task TCP console remains the only in-VM TCP listener. - Milestone 26a is the first milestone where Pi 4 TCP console reachability is expected; Milestone 26 must remain valid without NIC/TCP on Pi 4. - DHCP is intentionally out of scope for 26a and is delivered in Milestone 26b; 26a uses static IPv4 only. - Any VM vs Pi 4 networking differences must be profile-gated, manifest-defined, and documented. - Driver implementation must remain HAL-bound with bounded queues and deterministic memory budgets. - Root-task remains the single authority for tickets, console grammar, namespace, policy, and replay; driver tasks own only device progress. - Every hardware-facing service path must declare a HAL driver-task scheduling contract before it can be serviced. Missing, unbounded, or non-preemptible contracts fail closed. - Driver tasks receive only their declared MMIO, DMA, IRQ notification, endpoint, fault, and ring capabilities. No driver task may receive Secure9P authority, ticket material, broad namespace state, or a catch-all `KernelHal`. - Serial RX and USB/local-seat input are the highest-priority service class; HDMI/log flushing and network data are preemptible. - Direct root-task driver paths are not a steady-state Pi 4 driver model. They may remain only for early/emergency serial output before the driver-task substrate exists and for QEMU/host compatibility profiles; physical Pi 4 steady-state driver service must fail closed until the corresponding independent ring-backed driver task owns the hardware state. - Backward compatibility is mandatory: 26a network changes must preserve existing macOS/Linux QEMU console and networking workflows unless explicitly profile-gated for Pi 4 `pi4-uboot-aarch64` (with transitional alias support for legacy `uefi-aarch64` manifests). - QEMU remains compatibility and transport-substrate evidence for 26a, not a Pi 4 wired-NIC latency baseline. Any 26a GENET latency reporting is diagnostic boundedness evidence for the physical static-IPv4 path; Milestone 26b owns same-harness benchmark comparison and the physical-network latency SLO. ### Prerequisite - Milestone **26** completed (U-Boot boot chain + device identity attestation + local diagnostics seat + bootloader/HAL boundary enforcement). - Milestone 26 hardware evidence includes deterministic no-NIC boot transcripts for Pi 4 (`pi4-uboot-aarch64`). ### Goal Add the HAL-enforced driver-task substrate, migrate serial/display and GENET behind explicit scheduling contracts, and preserve the original Pi 4 GENET static IPv4 behavior as the compatibility target. ### Deliverables - **HAL driver-task admission substrate** - Add a HAL-owned driver scheduling contract surface for serial, USB/local-seat, HDMI text, GENET, CYW43, SDIO host, PCIe root, and QEMU compatibility NICs. - Each contract declares role, service class, authority, isolation target, per-turn operation/byte/frame budget, queue depth, and blocking policy. - Runtime driver construction and polling fail closed when a hardware-facing path does not declare a valid, preemptible contract. - The initial compatibility implementation may still run selected drivers in-process, but the same contract is the admission record for the dedicated seL4 task that replaces it. - **seL4 driver-task substrate** - Add root-owned wrappers for driver TCB creation, CSpace/VSpace setup, IPC-buffer installation, badged endpoints, notifications, IRQ binding, fault endpoints, scheduling-context parameters where available, and revocation. - As-built substrate work now includes non-MCS TCB priority/scheduling/resume/notification wrappers, CNode revoke, a remote-safe IPC-buffer bind helper, AArch64 VSpace root and boot-ASID-pool assignment wrappers, explicit page/page-table map wrappers for non-root VSpaces, bounded HAL driver-task command/completion rings, Pi 4 bootstrap-created driver TCB attempts for the manifest-selected subset of the seven acceptance-eligible Pi hardware runtime contracts, restricted child CSpaces, command endpoints, notifications, fault endpoint slots, stacks, and tolerant handling for boot-seeded intermediate page tables while mapping driver IPC/stack frames. The completed M26a classic-SMP profile used manifest-selected per-driver affinity through child-TCB `seL4_TCB_SetAffinity`; M26e supersedes that mechanism atomically with the selected core's generated SchedControl/SC bind and prohibits direct `TCB.SetAffinity` in an MCS transcript. The role-affinity wrapper used around legacy in-process operations changes the init TCB temporarily; it is not isolated-child evidence. Physical Pi 4 MCS owner-state boots must show `DRIVER_TASK_MCS_ACTIVE ... core=`, `DRIVER_TASK_AFFINITY_MCS ... source=sched-control-sc-bind direct-set-affinity=no status=configured`, and `DRIVER_TASK_BOOT ... affinity_core=` for the active selected contracts plus aggregate applied affinity before placement proof closes; any `TCB.SetAffinity`, affinity-failure marker, or `DRIVER_TASK_AFFINITY_DEFERRED ... reason=pi4-child-tcb-affinity-boot-stall-guard` line keeps affinity proof red. Physical Pi 4 owner-state boots bind the generated CYW43 and SDIO peer notifications during bootstrap and must emit `DRIVER_TASK_NOTIFICATION_BOUND ... source=generated-cyw43-sdio-topology`; other runtimes may still defer the optional early TCB-bound notification syscall and continue endpoint-backed command-ring startup with notification lifecycle proof red. QEMU compatibility smoke may still create all nine declared contracts, including RTL8139 and virtio-net, after virtio networking is ready. QEMU virtio compatibility builds keep the same contract set but publish an inactive `qemu-virtio-pre-net-resource-guard` report before network init so failed live-task bootstrap cannot exhaust resources needed by the virtio TCP regression path; with the explicit `qemu-driver-task-smoke` feature, they create all nine declared driver-task TCBs after virtio networking is ready, allocate per-driver VSpaces, assign ASIDs, map only a one-page driver trampoline plus stack/IPC/ring frames, complete a fixed-layout ring command without callback/context pointers, unmap root aliases for code/IPC/stack after the isolated task starts, and emit console-visible `DRIVER_TASK_BOOT_SMOKE phase=post-net-qemu status=summary ... vspace=isolated ipc_abi=shared-ring-command pointer_free_ipc=yes owner_state=not-proven` as QEMU transport-substrate proof. Physical Pi 4 builds now require the isolated VSpace constructor for normal driver bootstrap and reject virtual NIC trampoline work from the physical bootstrap set. For generated Pi 4 hot paths, root loads isolated `pi4-driver-*` runtime artifacts only from the raw driver-runtime CPIO embedded into the root-task image by `scripts/pi4-image-build.sh`; when an artifact is found by generated path, HAL maps every bounded `PT_LOAD` page from the runtime ELF plus stack/IPC/ring and declared MMIO/DMA/shared-buffer regions, stages a pointer-free `pi4-driver-abi` runtime-init descriptor containing physical page metadata, semantic resource ranges, bus-alias policy, optional IRQ descriptors, USB/PCIe and CYW43/SDIO bus-link descriptors, and framebuffer metadata, then starts the isolated fixed-ring runtime entry. Physical Pi pre-root bootstrap turns do not sample timer registers; later steady ring latency telemetry uses the EL0 virtual counter. Physical Pi ring turns use `seL4_Call` and isolated runtimes reply after publishing the primitive completion record, so lower-priority driver TCBs do not depend on `Yield` for service time. Runtime-init commands deliver topology and must be followed by hardware service turns before board proof can close. Per-driver runtime-image specs are compiler IR under `root_task.driver_images`, generated into the root-task manifest tables, and backed by separately isolated `pi4-driver-*` runtime image artifacts staged by both `scripts/cohesix-build-run.sh` and `scripts/pi4-image-build.sh`; `scripts/pi4-image-build.sh` packages the raw CPIO before the root-task build so the physical Pi image carries the required embedded runtime source. The staged U-Boot CPIO remains audit/packaging evidence and is not a runtime fallback for physical Pi owner-state boots. Generated `code-pages=320` covers the current 257-page multi-segment runtime ELF spans with a bounded 63-page growth margin, and the USB xHCI manifest aperture is 16 pages instead of the earlier 2-page stub. Runtime DMA/shared budgets are descriptor-backed and sized to current runtime use: serial shared=4 pages, USB DMA/shared=128/32 pages, HDMI DMA/shared=0/16 pages plus framebuffer, GENET DMA/shared=64/32 pages for a 32-RX/32-TX ring shape, CYW43 DMA/shared=0/64 pages, SDIO DMA/shared=10/32 pages, and PCIe shared=16 pages. SDIO's ten low, uncached pages are one private Pi firmware-mailbox request page, one control-block page, and eight CMD53 bounce pages spanning the exact 32-KiB reciprocal aperture. The child VSpace layout keeps MMIO at `0x70200000`, DMA at `0x70800000`, and shared control at `0x70c00000`; semantic resource ranges carry aggregate page counts while per-page DMA descriptors cover every runtime-owned DMA page. Those artifacts implement fixed-ring production service engines rather than smoke-only stubs: serial handles bounded mini-UART init/RX/TX; HDMI renders into the mapped framebuffer; PCIe services primitive mapped-aperture read/write/flush operations; USB owns the direct-root-port xHCI boot-keyboard path; GENET owns MDIO/MAC plus bounded RX/TX rings; and CYW43 owns the shared-control SDPCM surface without direct SDHCI authority or fallback. SDIO owns one HAL-declared SDHCI page, one noncontiguous firmware-mailbox page, one channel-4 BCM2835 DMA-controller page, and ten private low DMA pages. Its sole retained owner seals a Linux/Raspberry Pi `mmc-bcm2835` engine choice into each immutable CMD53 identity from normalized host-block geometry: at most two blocks use retained PIO, while more than two use the DREQ-11 external-DMA engine. One linked-runtime call may batch the finite Linux-ordered preissue setup and exactly one issue under the shared 256-operation service contract. Each fresh direction-owned PIO ready edge moves one complete normalized host block of at most 512 bytes and 128 `SDHCI_BUFFER` accesses without crossing into another block; external DMA advances through one immutable SDHCI/DMA snapshot per owner continuation and requires terminal `CS.INT` plus `CONBLK_AD == 0`. Both shapes join exact response/payload, authoritative `DATA_END`, and host quiescence. A full retained 32-KiB backplane window is partitioned as Linux MMC-shaped `511 * 64` external-DMA plus `1 * 64` retained-PIO children. Missing external-DMA authority fails its selected request closed; no engine switching, second lane, root-owned data path, legacy fallback, or post-issue replay exists. PMUCONTROL uses one incrementing four-byte Function 1 CMD53 read and one matching write at `0x8600`, never a partial bytewise CMD52 update. All seven generated runtime specs remain acceptance-eligible (`root_context_required=false`, `hardware_state_migrated=true`), while a fresh Pi boot activates only the selected network role: Wi-Fi selects SDIO plus CYW43 and wired selects GENET. Root hands firmware-mailbox authority to SDIO once after PCIe/VL805 readiness proof, and every later root mailbox call fails closed. A preseeded mailbox page is transferred by copying its cached HAL-admitted frame capability into the child rather than requesting fresh device-untyped coverage. SDIO retains the Linux-shaped GPIO129 GET-config/polarity, output-low, host power-off, 2 ms off, power-up-while-low, 10 ms settle, WL_ON high, startup-clock, and final 10 ms settle sequence as one-action phases with virtual-counter deadlines. Firmware property acceptance requires global transaction success plus the firmware-overwritten zero GPIO token; per-tag returned-length, tag, and end-marker metadata are not GPIO-consumer predicates. Each operation posts the proven Pi 4 VC address once, retains the same DMA page, and services one reply sample per turn under a 500 ms deadline. No synchronous mailbox spin, alias replay, GPIO state-only path, confirm-read path, or root fallback remains. Pending phases retain the exact ring intake and publish no premature completion. Missing exact SDIO IRQ/DPC proof fails closed, old-generation CCCR responses cannot prevent physical reset, and fresh Pi proof must still show useful USB, HDMI, selected-network DHCP, SDIO owner state for Wi-Fi, and PCIe/VL805 behavior. - QEMU/host compatibility profiles may still dispatch bounded service callbacks through live driver TCBs or root compatibility paths so existing virtual-device tests keep running. Those paths now enter through a single HAL callback-compatibility gate and a single HAL root-compatibility admission gate; physical Pi 4 builds compile out the callback slot state and both gates fail closed for steady-state hardware service. If the independent ring-backed path is unavailable, the service turn fails closed and acceptance remains red. The May 20 Pi 4 proof is not closure because every driver-task bootstrap failed with `seL4_DeleteFirst` and hot paths stayed root-task compatibility. CYW43, SDIO, and PCIe now have owner-ring service queues: SDIO records CMD52/CMD53/POLL_IRQ completion through the isolated runtime before owner-state can credit `sdio-host`, CYW43 firmware/NVRAM/SDPCM command records return from isolated runtime completions before root hardware execution, and PCIe port read/write/flush helpers return from isolated runtime completions before root hardware execution. Their current acceptance specs still need fresh Pi hardware proof to show the complete SDIO, CYW43, USB, and PCIe hardware state machines are live in the isolated runtimes. - The normal physical Pi 4 service path now uses linked-image command/completion rings where implemented and fails closed otherwise. Serial still keeps emergency boot logging alive, but normal UART runtime initialization now runs through the profile-selected `pi4-driver-serial` image and the event pump receives only a `driver-task-serial-client` after that command succeeds. Physical Pi network init selects ring-backed `GenetDriverTaskDevice` / `Cyw43DriverTaskDevice` clients; the isolated GENET image now owns MDIO/MAC plus bounded RX/TX descriptor-ring turns when wired is selected, and the isolated CYW43 image owns shared-control SDPCM command records while SDIO transport authority sits with the profile-selected `sdio-host` image when Wi-Fi is selected. Local-seat init has the same boundary: root has USB/HDMI ring-client shells, the isolated HDMI runtime can render with framebuffer metadata, and the isolated USB runtime owns the xHCI boot-keyboard path. The older `Pi4LocalSeat` root-resident selector handler and root-owned USB support crate have been removed and are not acceptance evidence. The physical Pi `KernelHal` no longer carries a direct `Pi4WifiState` slot and direct Wi-Fi HAL construction returns `pi4-wifi-driver-task-runtime-required`. The HAL still splits root-context diagnostic ring registration from pointer-free selector ring registration; QEMU/host compatibility can keep root-context diagnostic services, while physical Pi linked-image hardware service uses the fixed ring or fails closed. Shared-ring completions are tracked as `shared_ring_roles` and do not satisfy `hot_path=dedicated` or full acceptance; idle completions and zero-result progress completions cannot credit hot-path ownership. The proof layer also requires `DRIVER_TASK_OWNER_STATE_PROOF=yes` backed by per-active-hot-path `DRIVER_TASK_OWNER_STATE ... descriptor=present root_pointer=no` lines for the selected boot set, acceptance-eligible runtime-image specs, and the runtime transport mapping mask complete; `sdio-host` must prove the isolated SDIO runtime completed non-root-context hardware progress before it can credit Wi-Fi owner-state. Owner-state descriptor registration is rejected if the corresponding runtime-image spec is not acceptance-eligible. The QEMU smoke path proves the isolated trampoline, per-driver VSpace/ASID allocation, restricted mapping set, runtime-image declaration accounting, actual transport-region mapping, and pointer-free ring transport, but that is transport-substrate proof rather than Pi hardware hot-path ownership. Any callback-pointer, root-task compatibility, or root-resident selector service turn remains QEMU/host or migration evidence only and fails reopened Pi closure. - Root keeps authority and revocation; driver tasks receive only compiler-declared caps and bounded shared rings. - seL4 scheduling fields are profile-qualified. Current accepted profiles use non-MCS TCB priority/domain plus bounded IPC/poll budgets. A future MCS profile may claim explicit scheduling-context binding only after the Milestone 26e ABI, admission, timeout, reply/donation, and target-evidence gates pass for that exact profile. - The substrate must not introduce POSIX threads, implicit async runtimes, unbounded queues, or a second listener/protocol. - **Serial/display driver-task migration** - Move normal UART service behind a `driver-serial` contract and preserve emergency early-boot debug UART fallback only until handoff. - Move HDMI/text flushing behind a `driver-display` contract so display refresh cannot block serial input, USB keyboard input, or network control progress. - Prove serial command echo and HDMI mirror behavior under synthetic GENET traffic. - **GENETv5 NIC backend (Pi 4)** - Add a root-task driver backend for Broadcom GENETv5, implemented in pure Rust with HAL ownership for MMIO, IRQ, DMA, and cache maintenance. - Use this design-reference order for architecture review: Linux `bcmgenet` driver behavior (primary) -> Linux `bcm2711` Pi 4 DT bindings for GENET/MDIO/PHY wiring (secondary) -> U-Boot `bcmgenet` bring-up behavior (tertiary sanity reference). - References are design-only inputs; no direct code lift is permitted. - Integrate backend selection into existing `NetBackend` plumbing and keep QEMU backends (`rtl8139`/`virtio-net`) unchanged. - Promote GENET from in-root compatibility path to `driver-genet` once the frame-driver ABI, DMA ring grants, IRQ notification, and bounded frame IPC pass QEMU and Pi 4 checks. - **Profile-gated static IPv4 for `pi4-uboot-aarch64`** - Extend manifest IR and validation with bounded static IPv4 fields for Pi 4 U-Boot profile (interface IP, prefix length, optional gateway). - Generate root-task networking config from `coh-rtc` artifacts instead of hard-wired dev-virt defaults when `profile.name=pi4-uboot-aarch64` (or accepted legacy alias). - Reject invalid/static-zero network configs deterministically at compile time or early boot. - **Docs-as-built alignment** - Update `docs/ARCHITECTURE.md`, `docs/INTERFACES.md`, and `docs/SECURITY.md` with: - profile-gated backend matrix (QEMU vs Pi 4), - static IPv4 configuration source of truth, - deterministic bounds and failure modes for GENETv5 bring-up. - Update `docs/HARDWARE_BRINGUP.md` with Pi 4 U-Boot network checklist and expected boot evidence lines. ### Commands - `cargo check -p root-task` - `cargo test -p sel4-sys` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task` - `cargo test -p root-task net:: -- --nocapture` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml` - `scripts/uboot/qemu-uboot-smoke.sh --net user` - `cargo run -p cohsh --features tcp -- --transport tcp --tcp-host --tcp-port 31337 --script scripts/cohsh/boot_v0.coh` ### Checks (DoD) - HAL driver-task contracts exist and validate for serial, USB/local-seat, HDMI text, GENET, CYW43, SDIO host, PCIe root, RTL8139, and virtio-net. - Network stack construction rejects missing or invalid driver scheduling contracts before device initialisation. - Pi 4 and QEMU driver-task acceptance must distinguish contract declaration from isolation: root-task compatibility service turns are useful diagnostic evidence only, while reopened physical Pi closure requires the manifest-selected active driver-task set to report `DRIVER_TASK_COMPATIBILITY=0`, `DRIVER_TASK_DEDICATED_READY=yes`, role-specific `DRIVER_TASK_SERIAL_DEDICATED=yes`, `DRIVER_TASK_USB_DEDICATED=yes`, `DRIVER_TASK_DISPLAY_DEDICATED=yes`, `DRIVER_TASK_NET_DEDICATED=yes`, selected-role `DRIVER_TASK_SDIO_DEDICATED=yes` for Wi-Fi, and `DRIVER_TASK_PCIE_DEDICATED=yes`, plus `DRIVER_TASK_SUBSTRATE_READY=yes`, `DRIVER_TASK_FAILED_COUNT=0`, `DRIVER_TASK_CAPSET_PROOF=yes`, `DRIVER_TASK_FAULT_PROOF=yes`, `DRIVER_TASK_REVOKE_PROOF=yes`, `DRIVER_TASK_SCHED_PROOF=yes`, `DRIVER_TASK_AFFINITY_PROOF=yes`, selected active affinity configured/applied proof, `DRIVER_TASK_AFFINITY_MANIFEST_PROOF=yes`, `DRIVER_TASK_VSPACE_PROOF=yes`, `DRIVER_TASK_POINTER_FREE_IPC_PROOF=yes`, `DRIVER_TASK_OWNER_STATE_PROOF=yes`, and active-net identity proof under `scripts/pi4_gate_proof.sh --require-driver-task-proof`; QEMU compatibility smoke may still prove all nine declared contracts as transport-substrate evidence only. `DRIVER_TASK_OWNER_STATE_PROOF=yes` requires concrete descriptor proof for `serial-console`, `usb-keyboard`, `hdmi-text`, `pcie-root`, and the selected network role (`genet-nic` for wired, or `cyw43-wifi` plus `sdio-host` for Wi-Fi); SDIO only credits after a non-root-context isolated runtime CMD52/CMD53/POLL_IRQ completion proves hardware progress. Aggregate `owner_state=driver-owned` text is not closure. A `DRIVER_TASK_AFFINITY_DEFERRED ... reason=pi4-child-tcb-affinity-boot-stall-guard` line is stale mitigation evidence, not affinity proof; it must keep `DRIVER_TASK_AFFINITY_PROOF` and `DRIVER_TASK_AFFINITY_MANIFEST_PROOF` red. A `DRIVER_TASK_NOTIFICATION_BIND_DEFERRED ... reason=pi4-early-tcb-notification-bind-boot-stall-guard` line remains mitigation evidence for non-CYW43/SDIO runtimes and not notification lifecycle proof; for either generated CYW43/SDIO peer it is a Wi-Fi acceptance failure. Host tests must keep the pointer-free ring records fixed-layout and primitive-only, prove the physical Pi profile cuts over to driver-task client shells instead of root-owned hardware constructors, and cover the Pi 4 hot-path command catalog for serial console, USB keyboard, HDMI text, GENET RX/TX, CYW43 RX/TX, SDIO host, and PCIe root service. Callback-pointer service turns, including live-TCB callback turns, remain compatibility evidence until the driver state boundary is owned by a ring-backed task. The Pi 4 manifest assigns `bcmgenet-v5` to core `1` and retains `cyw43455` plus `sdio-host` on core `3`; boot evidence must show the selected contract's exact manifest affinity before claiming placement. - Root-owned driver-task substrate can create, monitor, fault-report, and revoke at least one non-authority driver task without changing console grammar. - Serial and HDMI service remain responsive while synthetic GENET traffic consumes its full allowed budget. - Pi 4 U-Boot boot reaches root-task network init and reports `GENETv5` backend with static IPv4 from manifest-generated config. - `cohsh --transport tcp` succeeds against the configured static address with no console grammar or ACK/ERR/END drift. - Any 26a GENET latency evidence is recorded as physical static-IPv4 responsiveness diagnostics and must not be compared against QEMU loopback latency as a closure gate. - Invalid Pi 4 static IPv4 manifest settings are rejected deterministically (compiler validation and/or early-boot fail-fast). - Pi 4 26a validation explicitly demonstrates transition from Milestone 26 no-NIC baseline to 26a NIC-enabled boot using profile-gated configuration only. - No DHCP client path is introduced in 26a; DHCP remains scoped to Milestone 26b. - Existing macOS/Linux QEMU test and operator flows remain backward compatible with pre-26 behavior. - Full regression pack remains green on QEMU; any profile-gated divergence is explicitly documented and fixture-backed. ### Compiler touchpoints - `coh-rtc` emits driver-task contract tables for profile-selected hardware roles, including task id, service class, priority band, period/budget target, IRQ badge, DMA/ring bounds, queue depth, and shutdown/revoke behavior. - `coh-rtc` emits profile-gated network config tables (backend selection + static IPv4 fields) into generated root-task artifacts. - Manifest validation enforces: - static IPv4 required for `pi4-uboot-aarch64` network-enabled profile, - prefix bounds (`1..=32`), - backend/profile compatibility (`bcmgenet` only where declared in `hw.devices`). - Docs snippet regeneration includes static IPv4 and backend mapping excerpts for Architecture/Interfaces docs. ### Task Breakdown ``` Title/ID: m26a-driver-task-hal-contracts Goal: Make hardware driver service admissible only through HAL-declared scheduling contracts. Inputs: apps/root-task/src/hal/*, apps/root-task/src/net/*, apps/root-task/src/serial/*, apps/root-task/src/local_seat.rs, docs/DRIVERS.md, docs/TEST_PLAN.md. Changes: - apps/root-task/src/hal/* — add driver-task contract types, built-in role contracts, and per-turn budget validation. - apps/root-task/src/net/mod.rs + apps/root-task/src/net/stack.rs — require valid NIC driver contracts before network device construction and expose active contract diagnostics. - apps/root-task/src/serial/mod.rs + apps/root-task/src/local_seat.rs — expose serial and local-seat contracts for event-loop admission. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib net::tests::network_driver_task_contracts_match_backend_labels - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib serial::tests::poll_io_obeys_driver_task_budget - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::serial_input_skips_ready_network_data_poll_for_driver_task_turn Checks: - Missing, zero-budget, blocking, or non-preemptible driver contracts fail deterministically before service. - Built-in contracts preserve the priority order: serial/USB input before network control, network control before network data, diagnostics/display last. Deliverables: - HAL scheduling-contract ratchet for current compatibility drivers and future dedicated seL4 driver tasks. Title/ID: m26a-smp-activity-diagnostic Goal: Add bounded root-console activity diagnostics for cross-core evidence without enabling seL4 kernel benchmark builds. Inputs: crates/cohsh-core/src/command.rs, crates/cohsh-core/src/verb.rs, apps/root-task/src/event/mod.rs, apps/root-task/src/console/mod.rs, apps/root-task/src/local_seat.rs, apps/root-task/src/net/mod.rs, apps/root-task/src/hal/driver_task.rs, apps/root-task/src/affinity.rs, docs/USERLAND_AND_CLI.md. Changes: - crates/cohsh-core/src/command.rs + crates/cohsh-core/src/verb.rs — expose the canonical grammar as `smp [activity|dump]`, reject unknown pseudo-profile arguments, map bare `smp` and explicit `smp activity` to bounded userspace telemetry, and retain the raw debug-kernel scheduler snapshot only as explicit `smp dump`. - apps/root-task/src/affinity.rs + apps/root-task/src/event/mod.rs — implement the default `smp` activity view from bounded userspace telemetry: event-pump command/timer counters, serial backpressure, local-seat keyboard/HDMI mirror counters, network status/counters when present, HAL driver-task contracts, driver-task runtime proof masks, manifest affinity assignments, and repeated-sample per-core counter-delta rows; keep `smp dump` on the same multi-assignment core bucket formatter. - apps/root-task/src/console/mod.rs — keep early-console behavior explicit when the event-pump telemetry source is unavailable. - docs/USERLAND_AND_CLI.md + docs/snippets/cohsh_grammar.md — document that default `smp` activity output is not a cycle-accurate profiler, does not require kernel benchmark builds, and is mirrored to HDMI through the local-seat path while explicit raw `smp dump` text remains UART-only. Commands: - cargo test -p cohsh-core smp - cargo test -p root-task smp_activity - cargo test -p root-task --features net-console smp_activity Checks: - `smp` and `smp activity` never depend on `CONFIG_BENCHMARK_TRACK_KERNEL_ENTRIES`, debug-kernel benchmark syscalls, PMU counters, or unbounded sampling. - Output is line-bounded and useful for Pi 4 diagnostics: it distinguishes parser/event-loop progress, serial pressure, HDMI/local-seat mirroring, attached network progress, driver-task compatibility vs dedicated proof, and configured role/driver affinity. - The htop-ish core rows are assignment buckets, not exclusive CPU owners: when multiple roles/drivers map to the same core, `tasks=` lists all of them and the rate fields aggregate only safe userspace counter deltas for that bucket while keeping `cpu_pct=unavailable`. - Explicit debug-kernel `smp dump` also treats core rows as assignment buckets: before each UART-only seL4 scheduler/CPU dump, the probe line includes every role/driver allocated to that core instead of dropping secondary assignments. - HDMI display receives the same event-pump activity lines when local-seat mirroring is active; raw kernel debug output from `smp dump` remains serial-only and unavailable after linked-UART cutover. - Unknown arguments such as `smp profile` fail grammar validation instead of silently aliasing to default `smp`. Deliverables: - Root-console `smp` activity diagnostic, compatibility spelling, explicit raw dump path, event-pump/HDMI mirroring, and feature-scoped network test coverage. Title/ID: m26a-driver-task-kernel-substrate Goal: Add root-owned seL4 task/capability substrate for hardware driver tasks without changing authority semantics. Inputs: apps/root-task/src/kernel.rs, apps/root-task/src/hal/*, apps/root-task/src/cspace*, configs/root_task.toml, docs/ROLES_AND_SCHEDULING.md. Changes: - crates/sel4-sys/src/lib.rs + apps/root-task/src/sel4.rs — add driver TCB scheduling/resume/notification wrappers, CNode revoke, and remote-safe IPC buffer install. - apps/root-task/src/hal/* + apps/root-task/src/kernel.rs — add driver-task handles/rings for TCB creation, CSpace/VSpace setup, scheduling attributes, per-driver SMP affinity, notification binding, fault endpoint badges, and revocation. - configs/root_task.toml + coh-rtc outputs — add profile-gated driver-task specs, per-driver affinity, and bounds. Commands: - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4 - cargo test -p sel4-sys - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task Checks: - Root retains cap ownership and can fault-report/revoke a driver task. - Driver tasks receive only declared device grants and bounded ring frames. Deliverables: - Dedicated driver-task creation substrate ready for serial/display, GENET, USB, CYW43, SDIO, and PCIe migration. Title/ID: m26a-serial-display-driver-tasks Goal: Move normal serial and HDMI display service behind dedicated driver-task contracts while preserving emergency debug fallback. Inputs: apps/root-task/src/serial/*, apps/root-task/src/local_seat.rs, apps/root-task/src/event/*, docs/DRIVERS.md. Changes: - apps/root-task/src/serial/* — replace blocking normal-output paths with bounded driver-task IPC after early boot handoff. - apps/root-task/src/local_seat.rs — route HDMI text refresh through a bounded display-sink task. - apps/root-task/src/event/* — preserve serial/USB priority over network data and display flushing. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib serial::tests - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests Checks: - Serial echo and HDMI mirror remain fluid while GENET consumes its full data budget. - Emergency debug UART remains available only for boot/fault diagnostics, not normal console output. Deliverables: - Serial/display task isolation proof with no ACK/ERR/END grammar drift. Title/ID: m26a-genet-driver-task Goal: Promote GENET from in-root compatibility driver to isolated frame driver task. Inputs: apps/root-task/src/drivers/driver_task_net.rs, apps/root-task/src/net/*, apps/pi4-driver-runtime/src/lib.rs. Changes: - apps/root-task/src/drivers/driver_task_net.rs — keep root as the GENET ring client only and fail closed when the isolated runtime has not returned owner progress. - apps/pi4-driver-runtime/src/lib.rs — keep DMA ring ownership, TX reclaim, RX refill, and service turns in the isolated `driver-genet` runtime. - apps/root-task/src/net/* — consume bounded Ethernet-frame IPC from the GENET task while keeping smoltcp/listener semantics in root. Commands: - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: - GENET static IPv4 reachability is preserved, ring pressure is observable, and serial/HDMI remain responsive under wired load. Deliverables: - First production dataplane driver task and preserved 26a static IPv4 behavior. Compatibility baseline tasks below are retained because they describe the original 26a GENET/static-IPv4 behavior that must keep working. They do not close reopened 26a by themselves; closure now requires both the baseline behavior and the driver-task substrate/migration checks above. Title/ID: m26a-bcmgenet-driver Goal: Preserve HAL-declared Broadcom GENETv5 NIC behavior through the isolated Pi driver runtime. Inputs: apps/root-task/src/net/*, apps/root-task/src/drivers/driver_task_net.rs, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/hal/*, docs/SECURITY.md, Linux `bcmgenet` + Linux `bcm2711` DT binding notes + U-Boot `bcmgenet` bring-up notes (reference-only). Changes: - apps/root-task/src/drivers/driver_task_net.rs — keep root as the GENET ring client only and fail closed when isolated runtime owner-state proof is missing. - apps/pi4-driver-runtime/src/lib.rs — carry the GENETv5 register/ring/IRQ/PHY implementation inside the isolated `driver-genet` runtime with HAL-declared MMIO/IRQ/DMA/MDIO resources only. - apps/root-task/src/net/mod.rs + apps/root-task/src/net/stack.rs — backend selection and ring-client init wiring. - docs/ARCHITECTURE.md + docs/SECURITY.md — record GENET design-reference provenance and explicit no-code-lift policy. Commands: - cargo check -p root-task - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib drivers::driver_task_net - cargo test -p pi4-driver-runtime - rg -n "EFI_|boot_services|runtime_services|uefi::" apps/root-task/src tools/coh-rtc/src Checks: - Link-up, RX/TX smoke, and deterministic error paths are covered by unit/integration tests. - GENET hardware service remains in the isolated runtime with HAL-declared resources; root exposes only the bounded ring client. Deliverables: - Pi 4 GENETv5 isolated runtime backend integrated behind existing net abstractions with documented source provenance order (Linux `bcmgenet` -> Linux `bcm2711` DT -> U-Boot `bcmgenet`) and reference-only compliance. Title/ID: m26a-static-ipv4-profile-gate Goal: Make Pi 4 U-Boot static IPv4 config manifest-authoritative and profile-gated. Inputs: configs/root_task.toml, tools/coh-rtc, apps/root-task/src/generated, docs/INTERFACES.md. Changes: - tools/coh-rtc/src/* — add IR fields + validation for `pi4-uboot-aarch64` static IPv4 network config. - apps/root-task/src/generated/* — regenerated network config outputs. - apps/root-task/src/net/mod.rs — consume generated profile config before dev-virt fallback defaults. Commands: - cargo test -p coh-rtc - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json Checks: - Invalid static IPv4 entries fail deterministically; valid configs produce stable generated artifacts. Deliverables: - Manifest-driven static IPv4 for Pi 4 U-Boot profile with docs-as-built parity. Title/ID: m26a-pi4-uboot-validation Goal: Prove end-to-end TCP console reachability on Pi 4 using static IPv4 with no protocol drift. Inputs: scripts/pi4-image-build.sh, docs/HARDWARE_BRINGUP.md, scripts/cohsh/boot_v0.coh. Changes: - docs/HARDWARE_BRINGUP.md — Pi 4 checklist, expected boot lines, static IPv4 examples. - docs/ARCHITECTURE.md + docs/SECURITY.md — backend and threat-model updates. Commands: - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml - cargo run -p cohsh --features tcp -- --transport tcp --tcp-host --tcp-port 31337 --script scripts/cohsh/boot_v0.coh Checks: - Validation includes a before/after proof: Milestone 26 no-NIC transcript and Milestone 26a NIC-enabled transcript for the same board profile family. - Console attach/tail/test flows are unchanged except for profile-gated backend/address selection. Deliverables: - Reproducible Pi 4 U-Boot network bring-up evidence and updated docs. Title/ID: m26a-nettest-profile-gate Goal: Extend `nettest` so the same command works on QEMU `dev-virt` and Pi 4 static IPv4 without changing console grammar. Inputs: apps/root-task/src/net/*, apps/root-task/src/event/mod.rs, docs/INTERFACES.md, docs/USERLAND_AND_CLI.md. Changes: - apps/root-task/src/net/stack.rs — remove `dev-virt`-only assumptions from self-test target selection and bind probe/echo targets to the active profile-gated interface config (including Pi 4 static IPv4/gateway paths). - apps/root-task/src/net/mod.rs — expose deterministic nettest target/report fields required by both QEMU and Pi 4 backends. - apps/root-task/src/event/mod.rs — update `help`/`netstats` lines so `nettest` no longer appears `dev-virt`-only when built for Pi 4 profiles. - docs/INTERFACES.md + docs/USERLAND_AND_CLI.md — document backend-agnostic `nettest` behavior and expected output fields. Commands: - cargo check -p root-task - cargo test -p root-task net:: -- --nocapture - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none Checks: - `nettest` remains unchanged for QEMU (`127.0.0.1:{31338,31339}` hostfwd workflows still valid). - Pi 4 static IPv4 profile can run `nettest` and produce deterministic pass/fail evidence with no new in-VM listeners. - ACK/ERR/END console grammar and existing command names remain unchanged. Deliverables: - Single `nettest` path that is profile-gated by backend/address config and validated on both QEMU and Pi 4 static IPv4. ``` --- ## Milestone 26b — Pi 4 USB/Wi-Fi Driver Tasks + DHCP/Benchmark Concurrency [Milestones](#Milestones) **Status:** Complete — exact image `7a10b8fd6accc3d47ab4726cdd3de5828042c9f3` restored the previously reliable USB enumeration/command-ready path and passed the operator-approved current-image Wi-Fi and same-image GENET closure. The five requested Wi-Fi reboot attempts were completed; W01-W03 and W05 passed, while W04 is retained honestly as an operator-excluded RF-affected sample rather than counted as a passing lifetime. The accepted cold, W01-W03, and W05 Wi-Fi samples had no semantic errors, and the GENET control did not regress. No fresh USB key was typed during this matrix. The operator explicitly accepted current Gate 10, the exact one-deep idle-report queue, command readiness, zero current USB recovery/no-reply debt, and healthy HDMI completions together with exact restoration of the previously board-proven `2668c34f76ff` path as sufficient final local-seat evidence; this record does not claim a fresh first-byte or printable-key observation. The operator-approved 2026-08-11 closure binds source commit `7a10b8fd6accc3d47ab4726cdd3de5828042c9f3`, build timestamp `2026-08-10T21:38:52Z`, build ID `54f78abe4cd2091b8aba2561f099e494f03983b9e0b845f468d9cfef7e7e9ee7`, image ID `5978c5c278b556dba235c3060803c46f4636ba3770d596d0669f16ef7617d926`, image SHA-256 `97874558bf93cfa4f2e323bf757a2a9d7a4d6d8d00e03db9202f106f152673cf`, and resolved manifest SHA-256 `34bdbce3528f3572d118609fbd48c04c9425edf424167df7680989e584f11928`. Every lifetime reached its selected-network DHCP frontier and USB Gate 10 command readiness with healthy HDMI completion; W01-W05 and G01 diagnostics additionally recorded the exact one-deep idle-report queue. Raw TCP completed `64/64` on every tested lifetime. The accepted Wi-Fi samples completed `16,446/16,446` no-retry pressure operations with zero errors; all fifteen accepted early `.coh` runs passed first attempt. W04 also completed all three `.coh` scripts and delivered a semantic terminal for every one of 1,150 wire commands, but recurring RF/ingress delay produced 85 client retransmissions and `25/757` REST timeouts (`3.3025%`, above the `1%` budget), so the operator excluded it. The GENET control completed `9,213/9,213` pressure operations with zero errors, raw TCP at `180.269` requests/s and `1.677` ms p95, and no transport regression against the accepted wired comparator. | Current-image lane | Raw TCP | No-retry REST pressure | Disposition | |---|---|---|---| | Cold Wi-Fi | `64/64`, `27.089` requests/s, `50.457` ms p95 | `3,040/3,040`, zero errors, `4.814` s p95 | Accepted | | Wi-Fi W01 | `64/64`, `38.871` requests/s, `28.282` ms p95 | `3,916/3,916`, zero errors, `4.107` s p95 | Accepted | | Wi-Fi W02 | `64/64`, `25.863` requests/s, `50.685` ms p95 | `2,665/2,665`, zero errors, `5.651` s p95 | Accepted | | Wi-Fi W03 | `64/64`, `29.732` requests/s, `50.945` ms p95 | `3,733/3,733`, zero errors, `4.348` s p95 | Accepted | | Wi-Fi W04 | initial `12.575` requests/s / `235.298` ms p95; paced repeat `18.201` requests/s / `106.379` ms p95 | `732/757`, 25 timeouts, `9.821` s p95 | Operator-excluded RF-affected sample | | Wi-Fi W05 | `64/64`, `28.257` requests/s, `67.581` ms p95 | `3,092/3,092`, zero errors, `5.683` s p95 | Accepted | | GENET G01 | `64/64`, `180.269` requests/s, `1.677` ms p95 | `9,213/9,213`, zero errors, `0.810` s p95 | Accepted; no wired regression | The current-image immutable evidence ledger records `serial / selected-transport pcap / paired-other-interface pcap` SHA-256 values. Pcap hashes cover exact completed-record prefixes; incomplete live-writer tails were excluded. G01's completed prefix contains the full gap-free, retransmission-free gateway pressure stream with one terminal for each of its `4,345` framed commands; the separate harness artifact reports `9,213/9,213` REST operations. Its final FIN record remained in the excluded live-writer tail; process/socket absence and gateway `reconnects=0` independently prove teardown. | Current-image boot | Serial SHA-256 | Selected-transport pcap SHA-256 | Paired-interface pcap SHA-256 | |---|---|---|---| | Cold Wi-Fi | `cd3dae6022720d2aca28077cf6f60594196ab3ce0ba2f070aabf52689f37f72e` | `c3308213e4cb8bd48db7c35b677ae907d611ec0cc94d539b83f56eccbf51722b` | `8def95914c8d58560ed25bd3bebbf48dc67d70ad653453e8c1f11aa20282c5bf` | | Wi-Fi W01 | `7144f6cb2382f563879b274331fcdc0f0b97ba69590928a77ca302589abe5004` | `87e13c8f91d847c7ef1149f7afab8dd5e2e0e45d9d5207f6bd9e8771cf1b6352` | `6eb8045165b56a0b3858b8549011c53e0d746d5172f646feaa93b0d5716746c1` | | Wi-Fi W02 | `ab8fc307e778322f8a5cb6af29c31e3764d1eaa8a7885ffeb3955627bcb65be9` | `a35e14f4cf6285fc7fcfd0019a85e6d8bbb7f2efa9cb43320179862b3a9f816b` | `f70b5c3626b9270d082fc3a9ab9bc23b65c5695dfdff1eddbc4e3ec11b4a2c15` | | Wi-Fi W03 | `1c194ada997b85dad481ed9f26a9553d721fa0a138f49083a53f4a44c4c643cd` | `4b48f48d06d67bb55f31033cc3113bca5a91719346c601ddbe1e159f24c25299` | `3bc325c77cd09452c62255bdc0f37a6c2dfa8071bfd9fed90efd639c282e383d` | | Wi-Fi W04 (excluded) | `a026b28a6240eaf5c1e72303eb29a9e822bd89a6388846cb856140677bf19591` | `ba111fa6cc9572ce940e764ace8e7ada6ada243ebb49650ba916f865bbb28667` | `465a453de2fdaa3c54f933a750248125ba1cee827cf2a6d944265d2d82e0f2d5` | | Wi-Fi W05 | `4ceb8e54c3679b35f6c0db5972c36967bd7ec3a3cb3b5c1d56b0935b121d93c8` | `414c33c7745029ac966e3523c89244768c8ac4a8b384e808914396053c7b24ed` | `43c35b569364bed8a0306bb4b131a019dc70599603ba7ba16c63d3856dff754a` | | GENET G01 | `45a06612b3bb8685a2619347055f81b2eb57090c6f6735b42d31dce780f8820f` | `12eb4008a6dede27f42a443e83e97800a4104777e79772be95148143a50fe4ff` | `0c71cbedc1f3c4872a11c12270480402f2aebacd2e6cc903b216cce587e8f1cb` | The prior operator-approved 2026-08-10 candidate matrix remains the historical performance/reliability baseline. It binds transport evidence to clean commit `2668c34f76ffde175a55c10085b03e8cc7ee1925`, build timestamp `2026-08-10T06:58:17Z`, build ID `54399c52aae6006affd3b526a8c7eb5860e2be73b88b8352eb9ca0f66434d56b`, image ID `23905de1e5e4da182c8b8727d52215b58ba4fa0be41049b705d6bcedc45159f0`, image SHA-256 `50ebaa44a64a4d400a5942fcc905efc863f569d4e0cbf06348c97556fabf2cb7`, and manifest SHA-256 `34bdbce3528f3572d118609fbd48c04c9425edf424167df7680989e584f11928`. One fully settled cold Wi-Fi boot, five rebooted Wi-Fi lifetimes, and one same-image GENET control passed the requested transport and pressure workload. Every Wi-Fi lifetime reached Gate 10, Gate 7a-e, Gate 8a-h, DHCP, `nettest`, balanced current DPC state with zero faults, USB queue-depth-one/Gate 10, and responsive HDMI. All 18 early `.coh` runs passed. The six Wi-Fi REST pressure runs completed 18,363 operations with zero semantic errors; their wire rates were `20.509`, `25.525`, `25.626`, `22.153`, `28.291`, and `27.784` commands/s. Raw TCP completed `256/256` cold and `64/64` on every reboot at `25.729`, `22.456`, `19.696`, `30.606`, `23.703`, and `27.637` requests/s, with p95 request-to-first-payload latency of `66.196`, `68.619`, `98.915`, `49.851`, `66.382`, and `59.412` ms. Paired pcaps showed bounded recovered retransmissions, but no semantic loss, reconnect, accepted-flow RST or zero window, drops, overruns, recovery, or driver faults. The GENET control completed raw TCP at `178.082` requests/s with `1.874` ms p95, all three `.coh` runs, and `9,711/9,712` REST operations; its sole typed buffer-full response was `0.0103%`, below the accepted `1%` error budget, while the wire path sustained `70.436` commands/s at `1.790` ms p95 with no core retransmission, sequence gap, RST, zero window, or reconnect. This usable, repeatable research/diagnostic Wi-Fi envelope and unchanged production GENET control replaced the earlier proposed 10/10 cold plus 10/10 warm and p95-at-most-40-ms/at-least-29-requests-per-second transport targets, without relaxing semantic error accounting. The host prompt-tail split repair used only by reboot orchestration is closure tooling, passes `79/79` focused tests, and changes no target runtime or acceptance authority. The immutable boot ledger below records `serial / selected-transport pcap / paired-other-interface pcap` SHA-256 values. Each pcap hash covers the completed-record prefix through that boot's workload terminal; an active-writer tail was excluded rather than classified as a packet fault. | Boot | Serial SHA-256 | Selected-transport pcap SHA-256 | Paired-interface pcap SHA-256 | |---|---|---|---| | Cold Wi-Fi | `4bd189312ce4e8ca68a893ed2de956215b5391b129bc8d962bf6a4a73097a351` | `63eec5166dbeb814e99c3e44821391f91da92b9144406a0b99fe058e3c2fac0d` | `b4f84edb68ddb0fff2645804476a2ce887f14822dbcf726aa515b58dffc2ea81` | | Wi-Fi W01 | `b4e7196c3c46a63c7a450a330ef097c74f20f1dfd2598d4b855305b5eb6f19df` | `73f1149fab7ee7b52a9d2e1b54a26d2ad9b3fefc44758dab94cd2ea0f69c1395` | `2378c95a003bc688f06997acf4a9d01993192ca15ec455fb004669c4c685dbc2` | | Wi-Fi W02 | `bc8f421d0a0297c81414054f97d951f3599eb2499cde37007349006c211ed3d0` | `e70f1b9f95733a6683f1d4a9f568e6dc51aa4d63f76b860791bb249c2f6317f2` | `325877e565bab0f1d7578ea7f531c38bd1a7966500023aa6c6fc63a70ba3a0f0` | | Wi-Fi W03 | `ea50060bd8c858adf69825c57e181dae934a7f99951f668adc8bf0d1d5880555` | `2b30d63476eeb49869f7c76b4c9aa8ada76a06ec8d3f843d90961038c1cd5fab` | `36fb41d14777b9dc2b7cf3e32e020a5285bd88fc02305defd5348c2132191ec6` | | Wi-Fi W04 | `f4da902eeca3591eacfe4534e7a34c0a1d014a28844b32091dcb98eb304135d4` | `aed069ff8a498ace9462cd637a32d269609e817f152a36cd704425e71f1f1873` | `d97bcccfc06b3c207d5a395722e9c971c810e552160c6195e7cb043c5e14fcb2` | | Wi-Fi W05 | `79c0cc5b1d337cbefecaacf1b05f384b6fe229fed6c2eb172d8b53037894dbfe` | `eb009c07e6b640e97fbc1ef98e456bd71f40e3d1c756c55754e1c196118f8869` | `fe6832e6045925a42c56b20d7d988d79ea39670e2294400163a5325b3d06ac23` | | GENET G01 | `460702747791b2f626c434a34f2b099838fbb8a538d2c801f965eaff80d97e89` | `ad22267074b60949f08d36e7f27093fa86ec2783ec67f3fcb5749af07ed4edf1` | `54c309f48ba6947af9f23d8a4c7f095a9888759be97de97aefb9a81f5fc2e981` | **Reopened defect history:** the prior bounded DHCP, USB/local-seat, QEMU compatibility, and production wired/GENET evidence remains accepted. Milestone 26d Wi-Fi boot investigation exposed the original pre-existing 26b defect: `m26b-wifi-driver-task` and `m26b-sdio-host-driver-task-graduation` used poll/yield service and consumable scheduling edges instead of the durable-condition CYW43/SDIO DPC boundary required by their original root-no-wait contract. The reciprocal generated IRQ/notification topology, bounded pointer-free DPC event ring, isolated-runtime IRQ/DPC service, Linux-aligned enable/ALP timing, durable sequence-last RX queue state, one-parent bounded RX batch handoff, post-prompt persistent bootstrap supervision, deterministic descriptor/controller coverage, and whole-action pair-restart cuts have since landed under `m26b-wifi-sdio-notification-dpc-closure`. The current source repair completes that contract across the full post-release lifetime: persistent op11, the separate finite urgent-op7 lease, and the event-sequence-bound DPC lease route from current durable conditions rather than snapshot novelty. Deterministic private phases continue to bounded quiescence even when a snapshot is equal; an exact child, credit, queue, or peer wait blocks immediately even when newly observed. Production DPC uses that event lease before Gate 8 as well as after it. Root masks only the self-demand of an exact issued persistent op11 whose stable HAL condition is `Waiting`, while independent committed DPC/RX/terminal work remains schedulable. Notifications are coalescing prompts only; immutable transaction identity and committed shared state carry authority and history. A sequence-last SDIO command is never discarded after its prompt: a missing or competing intake seal reaches the typed zero-I/O owner terminal. The 2026-08-01 exact-image repeatability run exposed a separate `m26b-net-control-priority` lifetime-ordering regression: TxToken consumption promoted a requestless op7 while an exact NetData op8 owned HAL, and unconditional copied-RX-first service could starve that op7 into `issued-owner-unknown`. The repaired EventPump keeps submission queue-only, preserves every exact active op7 through its terminal, then lets a committed copied/DPC/runtime RX level preempt promotion of a fresh or requestless op7. The 2026-08-04 exact image then proved that the runtime terminalized the host M4 Function-2 write but root incorrectly retained it behind a second, requestless `tx-drain` wait for a future SDPCM `tx_max` observation. `tx_max` is the runtime's admission window, not acknowledgement of a completed packet. The source repair therefore makes the joined Function-2 terminal the root release authority, continues the ordered EAPOL/key cursor directly, and leaves all subsequent SDPCM sequence/window admission solely inside the runtime. A full aggregate advances one eligible TX head to restore the reserved paired-response slot, and every successor remains queued for a later coordinator turn; if the runtime window is exhausted, that exact promoted op7 remains in `WAIT_CREDIT` rather than being withheld by a second root credit mirror. This scope adds no operator protocol, namespace, system authority, production-Wi-Fi parity claim, or unrelated 26d system-model change. Fresh Wi-Fi-selected Pi use also exposed a bounded defect in the retained USB/local-seat proof. Held arrow reports had no counter-scaled repeat contract; the HDMI prompt could advertise interactivity before current USB command admission; recovery could leave prompt/readiness-banner state needing explicit revocation and current-lifetime re-release; and queued prompt, input-row, and viewport work could be acknowledged by an older display completion or restart a full redraw during rapid history navigation. The `m26b-usb-hdmi-local-seat-liveness` repair reopened only this operator-surface proof. It changes no parser command, `ACK`/`ERR`/`END` grammar, Secure9P or REST schema, physical owner, network scheduling authority, retry path, or Wi-Fi lifecycle. The initial repair reserved the fixed 48-byte, pointer-free `DriverRuntimeUsbOldgoodReceipt` inside the existing role-qualified driver-task ring. Follow-up exact-image boots showed that its runtime bookkeeping regressed otherwise successful physical control-transfer progress at phases 198, 316, and 412. The current scoped repair therefore leaves the ABI slot and root's passive zero-record projection reserved, disables runtime partial/final publication, and restores the `2668c34f76ff` physical enumeration and one-deep command-ready path. The reserved record grants no command, wake, retry, recovery, scheduling, device, or acceptance authority. The exact `2668c34f76ff` candidate matrix then exposed an apparent retained-proof ordering mismatch without showing a physical xHCI/HID failure. A superseded follow-up attempted to hold endpoint completion and bytes behind an additional PCIe/USB descriptor-and-owner proof scheduler. The current source removes that second scheduler and its endpoint cache, restoring the known-working `2668c34f76ff` command/first-report path. The established attach phase performs PCIe descriptor/prep and owner registration, then USB descriptor replay and runtime initialization; it registers the USB owner once controller init is ready, before enumeration. HAL and gate tooling retain the general fresh-image requirement for current USB/PCIe owner and descriptor proof, Gate 10, the exact one-deep queue, and real HID/parser/HDMI liveness. Compact identity-bound USB/PCIe owner state and the reserved zero compatibility record remain passive `usb diag`/`usb status` evidence rather than local-seat progress authority. For exact image `7a10b8fd6acc`, the operator typed no key and explicitly accepted repeated Gate 10, one-deep idle-report, command-ready, recovery-free, and HDMI-complete sentinels plus exact restoration of the previously board-proven physical path as the final Milestone 26b local-seat boundary. This scoped closure records `physical_input_proven=no` honestly and does not turn Gate 10 into first-byte evidence or weaken the default proof required from a future changed image. This restoration adds no raw-UART writer, USB operation, retry, poll, wake, authority path, or acceptance inference from Gate 10. The 2026-08-06 exact `5b57ebcdcf73` boot reached firmware/control readiness and the pre-Join drain, then allocated request 64 without publishing its sequence-last command. That is the observed first break. Comparison with the 5/5 historical trace and inspection of the admission model indicate that Join could be reached without retained outer-pair coverage after the predecessor's named external wait, exposing a design-visible scheduling gap; the old image did not contain pre-fence scheduler telemetry that could prove the precise lease phase at failure. The source repair uses NetStack's exact association claim to open the outer lease before the first Join poll and keeps that lease `Open` across the named wait without polling. Durable IRQ/DPC/RX/terminal state resumes the same episode; ordinary traffic gains no retry, rescue wake, timer, grant, or second owner. At that source stage, fresh Pi Gate 10 and raw-TCP proof remained pending; the current-image closure recorded above subsequently supplied them. The 2026-08-03 exact `f9ba51abf` cold plus three paced warm lifetimes all completed release, `txglomalign`, and the following `ulp_sdioctrl` Function-2 TX, then stopped at control-reply RX before Gate 8. The first missing edge is therefore post-TX `CARD_INT -> DPC -> Function-2 RX`, not TX, root scheduling, GENET, or smoltcp. The current source repair makes a physically armed DPC condition for the same physical bus-link epoch an issue prerequisite for every persistent Function-2 child, with pre-install rearm/readback, a final pre-command durable-state linearization point, typed no-I/O defer for canonically masked visible source work, and fail-closed health handling including impossible event-plus-unmasked state. It also closes each condition-first request terminal with its shared IRQ episode before exposing the child completion, and makes the final empty-ring/masked-`CARD_INT` rearm due from durable owner state even when no SDIO command is queued. Historical `78d5195582c7` 5/5 boot code remains an oracle only: recurrent Poll/Grant/reply-probe turns masked both lifetime gaps but made inbound service scheduler-dependent and TCP unacceptably slow. No poller, fallback lane, source probe, smoltcp tuning, or GENET change is restored. At that source stage, fresh Pi repeatability and TCP performance remained unproved; the current exact-image matrix above supplies that proof. The later exact `9e673510bf43` cold plus R01-R03 matrix crossed firmware release, the complete control program, and the pre-Join drain, then stalled the generation-1 Join at a redundant per-control `DPC_ACTIVATE` boundary even though post-release activation and the same physical generation were already healthy. This isolates the remaining design defect: internal activation housekeeping was exposed to CYW43 as another bus transaction and therefore another consumable scheduling boundary. The source correction makes activation generation-long, lets healthy owner-active empty/unmasked state continue locally, binds at most one exact already-committed event before TX, and quarantines a vanished bound event. `DPC_ACTIVATE` is reserved for activation-absent or mask-skewed state and exact ACK debt retained by an already-submitted immutable activation frontier; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed and quarantines the generation. SDIO also re-reads the ring-only one-way command immediately before idle receive. At that source stage, focused runtime library coverage passed 822/822 while fresh exact-image Pi boot and TCP proof remained pending; the current closure matrix above supplies that later hardware proof. The subsequent exact `51741e5c25d9` cold plus R01-R03 matrix again reached the complete pre-Join drain but stopped before the first physical Join child. The generated DPC/bus epoch was `0x43595301`, while the immutable root parent correctly carried logical connection generation `1`; persistent and steady admissions had regressed by directly comparing those independent domains. The source repair keeps logical `aux1` sealed in every root parent, binds each retained CYW43 transaction once to the current private physical epoch, and requires every SDIO child to carry that physical epoch. DPC ring v3 now publishes explicit `OWNER_ACTIVE` state so empty/unmasked cannot impersonate admitted activation, and an exact source-bearing event already bound in `PreTxDpcProbe` services through canonical DPC in the same owner episode. Focused ABI/runtime/root/parser proof passed; fresh Pi Gate 8, DHCP, and TCP quality remained pending at that source stage and were supplied by the current closure matrix above. The exact `a9c01a58f2c0` cold plus R01-R03 matrix then crossed association and stopped after the host EAPOL-Key M2 parent was accepted and issued but before its Function-2 terminal. DPC capture/publication/consumption/rearm remained balanced and ordinary deadline-rescue counts remained zero. This exposed a narrow authority gap, not a reason to restore the historical poller: EAPOL-Start and ordinary control retain their acknowledged retained cadence, while only a completely intake-sealed M2, M4, or group-key response reuses the existing paired finite-op7 marker. That exact current-generation parent has one frame, four owner operations, 1,536 bytes, request-bound CYW43-plus-SDIO priority, one notification and no grant after issue, a Function-2 pre-TX DPC fence, and a durable terminal condition before root resumes. Its deadline can authorize recovery only. Ordinary post-Gate-8 TCP remains on the O(1) finite-op7 lane; there is no new ABI bit, poller, fallback, smoltcp change, or GENET change. The published `5fa7c3871d96` candidate proved that the EAPOL lifetime repair was incomplete rather than under-budget. Cold, R02, and R03 stranded the intake-sealed M4 parent before its exact terminal; R01 reached Gate 8 and then sent repeated DHCP Requests while the boot-paired capture showed valid broadcast DHCP replies from the AP within about 1-2 ms. Root delivered none of those replies upward. The first failure was therefore at the shared CARD_INT/DPC/runtime-RX-to-op8 boundary, not radio transmission, DHCP parsing, smoltcp, or GENET. The EAPOL-specific pre-TX fence introduced by `5fa7c` is now removed: Linux does not reject an already-sealed data/EAPOL write merely because durable CARD_INT work is pending. The exact four-operation parent remains `LOW/MID/HIGH/F2`; persistent control/Join keeps its explicit fence. Steady-parent identity is now admitted only from the sealed parent, logical and physical generations, and healthy owner-active ring. A committed source event is DPC service authority; an earlier `ACK_PENDING` observation without that sequence-last front event is a bounded publication window that retains the same parent, suppresses fresh root TX admission, and waits for the commit without becoming DPC authority or an ordinary grant. DPC service is admitted by the committed event or active exact cursor, independent of the consumed notification hint. After an issued op7 terminal, committed copied/DPC/runtime RX drains before any fresh retry or bulk TX. This preserves the historical 5/5 oracle's ability to revisit unfinished levels without restoring its recurrent grant cadence or second-scale TCP latency. The 2026-08-05 exact `514036b706f5` boot associated and completed M1 through M4, then exposed two later durable-lifetime gaps. The CYW43 runtime had sequence-committed a current-generation private RX queue poison, so ordinary Network correctly fenced itself, but the attached supervisor consulted only the separate pair-progress latch and could enter neither service nor recovery. HAL now admits that committed poison to the one existing pair-restart supervisor only when its generation matches the stable active SDIO DPC owner and both restart contexts exist; no aggregate diagnostic, wake edge, poller, grant, or fallback lane can authorize it. Separately, M4 terminal retirement had already published an immutable request-less PTK successor, but the fresh-parent time cap recognized only an extant HAL parent and rotated that successor out. Current-generation causal successor state now survives the cap after stable identity rechecks and reaches the same sole issuer in the same bus episode. The same boot also proved the HDMI runtime healthy while root stranded durable display output behind CYW43/USB edges. HDMI display admission and the root prompt are now independent durable levels; final Wi-Fi/console Ready and USB parser ingress retain their separate proofs. At that source stage, fresh exact-image Pi Gate 8, DHCP, TCP-quality, recovery, and HDMI evidence remained pending; the current closure matrix above supplies it. The exact `325756c800b0` boot then crossed the repaired bootstrap `txglomalign` parent and the complete control program before retaining Join request 64 without a terminal. Its immutable root evidence proves `recovery_required` preceded the generation-matched RX queue poison, but does not retain which existing runtime call made that first transition or the matching bus episode's child/exit tuple. The bounded evidence-only follow-up therefore adds one sequence-last `runtime_recovery_source_line` to the existing RX queue record and copies it into the already-passive first-pre-fence diagnostic. This field adds no wake, poll, owner, scheduler phase, recovery predicate, or fallback. At that source stage, one rebuilt exact image still had to supply the missing hardware fact before any behavioral correction; the later repair and current closure matrix supersede that pending frontier. **Why now (operator continuity):** Milestone 26b depends on completed 26a driver-task substrate and wired/serial/display isolation. Milestone 26b applies that model to the two paths that exposed the regression: USB keyboard/local-seat and CYW43 Wi-Fi. Wi-Fi and selected-network performance must improve by moving SDIO/firmware/RX/TX or GENET RX/TX progress onto bounded manifest-declared isolated driver runtimes, not by extending the root event-loop turn. **Non-negotiable constraints:** - DHCP implementation must be pure Rust, `no_std`, and intentionally bare-bones (DHCPv4 only: DISCOVER/OFFER/REQUEST/ACK plus bounded timeout/retry logic). - No new in-VM listeners or protocols are permitted; DHCP is only a client-side address acquisition path for existing network surfaces. - Post-seL4 runtime must remain HAL-only; no direct bootloader/firmware service calls are allowed in root-task. - NIC and Wi-Fi DHCP behavior must be policy-configurable for `pi4-uboot-aarch64` through compiler-validated profile settings sourced from U-Boot environment configuration when available; if bootloader policy inputs are absent, the Pi 4 manifest defaults are authoritative and select DHCP/`auto` so GENET DHCP is the no-credential path and Wi-Fi DHCP is selected by explicit Wi-Fi policy or credentials. - Wi-Fi scope is minimal diagnostics connectivity only (join + DHCP + existing TCP console path); no in-VM supplicant stack, roaming framework, or broad feature surface. - Wi-Fi is a research, diagnostics, and degraded-link bring-up transport. Production Pi 4 deployments that require high worker concurrency or predictable REST latency should use the wired GENET path unless a site-specific Wi-Fi envelope is freshly proven and documented. - Milestone 26b includes a new profile-gated Pi 4 CYW43xx Wi-Fi driver path; all Wi-Fi dataplane/control-plane access must be HAL-backed (SDIO, power/reset, IRQ/OOB, firmware handoff hooks) with no direct MMIO or firmware-service calls outside HAL. - CYW43xx design references must be used in this order for architecture review: OpenBSD `bwfm` -> Zephyr/Infineon WHD HAL split -> Linux `brcmfmac` SDIO edge-case behavior. These are design references only; no source copy/paste is permitted. - USB/xHCI/HID owns a higher-priority driver-task contract than Wi-Fi data. Keyboard first-byte and fast-typing proof are hard gates before Wi-Fi performance claims. - CYW43/SDIO runs under separate network-control and network-data budgets. EAPOL, DHCP, ARP, and TCP ACK progress may preempt Wi-Fi bulk data, but neither class may preempt USB/local-seat or serial input. - Runtime RX aggregation/glom may be enabled only after bounded superframe storage, capped deaggregation work, drop counters, and recovery gates are implemented inside the Wi-Fi driver task. - Performance claims use normalized parity: raw `cohsh` over Pi Wi-Fi is measured first, REST gateway overhead is measured separately, QEMU remains a compatibility/capacity reference by itself, and production Pi throughput-parity claims must come from a fresh same-harness wired/GENET Pi run that meets or exceeds the selected best-QEMU throughput reference. - Wi-Fi performance claims use the documented research envelope instead of QEMU parity: the safe sustained 26b Wi-Fi worker cap is `120` workers, short exploratory pressure may be run up to `300` workers, and `1500` workers is a fault-injection/stress ceiling only. Wi-Fi runs must pass the accepted error budget, preserve raw TCP/cohsh reachability, keep CYW43/SDIO counters free of drops/overflows/faults, and report latency separately as physical-link evidence. - The isolated runtime throughput verdict excludes QEMU-latency parity only after recording latency fields in the artifacts and showing Pi 4 wired NIC and Wi-Fi latency is explained and aligned with the selected transport's documented physical-network expectations. Throughput, successful operation count, error rate, and bounded-backpressure behavior remain verdict inputs for production wired/GENET. Persistent second-scale stalls, unbounded queue growth, drops, or timeout-driven success remain blockers for production throughput claims even when exploratory Wi-Fi stress passes its error budget. - Backward compatibility is mandatory: Milestone 26b must not break existing macOS/Linux QEMU workflows, fixtures, or transport semantics. ### Prerequisite - Milestone **26a** is complete before 26b closure, including the HAL driver-task admission substrate, serial/display isolation, GENET driver-task migration, and preserved Pi 4 GENETv5/static-IPv4 compatibility behavior. ### Goal Move USB/xHCI/HID and CYW43/SDIO Wi-Fi onto dedicated, HAL-admitted driver-task contracts, preserve DHCP and single-interface policy behavior, prove Wi-Fi/network load cannot degrade USB keyboard, serial console, or HDMI responsiveness, and close same-harness isolated runtime throughput parity for the production wired/GENET Pi path against the accepted best-QEMU reference. Wi-Fi closure proves bounded research/diagnostic transport behavior at the documented worker envelope and reports latency as physical-link evidence instead of QEMU-loopback parity. ### Deliverables - **USB/xHCI/HID driver task** - Promote Pi 4 VL805/xHCI/HID keyboard service from in-root compatibility polling to a `driver-usb` task with a realtime-input scheduling contract. - Preserve the poll-only xHCI lane until hardware proves interrupt delivery; timer IRQ 27 remains timer-only evidence, not USB evidence. - Preserve the 128 armed keyboard interrupt-IN runway, bounded HID event draining, bounded EP0 `GET_REPORT` input fallback, and Gate 10 first-byte/first-printable-byte acceptance criteria. - Preserve the May 18-19 physical hub-keyboard behavior through current descriptor/owner proof, Gate 10, the exact one-deep interrupt-IN queue, command readiness, and real linked-runtime first-report/first-byte/parser/HDMI evidence. The reserved old-good ABI receipt is not currently published and is not closure authority; late Gate 10 text without the functional evidence remains insufficient. - Root consumes only bounded local-seat byte events; it does not own xHCI registers, rings, DMA, or HID polling after driver-task handoff. - **CYW43/SDIO Wi-Fi driver task** - Promote SDIO host I/O, CYW43 firmware/control plane, EAPOL admission, RX/TX queues, credit handling, and optional glom/deaggregation into `driver-wifi`. - Graduate standalone `sdio-host` into the 26b acceptance set with one HAL-declared SDHCI MMIO page, fixed-layout CMD52/CMD53/POLL_IRQ service records, atomic card-reset/pending-generation/commit records, and required owner-state proof. - Split Wi-Fi work into network-control and network-data budgets so EAPOL/DHCP/TCP ACK progress cannot be starved by bulk RX/TX, while USB/serial still preempt both. - Preserve the May 18-19 Linux-shaped host-EAPOL order as an additive isolated runtime replay contract. Final Wi-Fi closure requires both `WIFI_GATE=10` / `WIFI_BLOCKER=none` and `WIFI_OLDGOOD_REPLAY=yes` / `WIFI_OLDGOOD_MISSING=none`; DHCP/netstats and condensed `join complete` summaries cannot substitute for ordered SDIO/CYW43 owner-state, control setup, association/link, M1/M2/M3/M4, PTK/GTK, secure release, DHCP, nettest, and final netstats proof. - Root receives Ethernet frames through bounded IPC/rings and never waits synchronously on SDIO credit, CMD52/CMD53 loops, firmware replies, or glom deaggregation. - CYW43 startup preserves Linux's `bus:rxglom=1` through `event_msgs_ext` and `WLC_UP`; aggregated RX is bounded in the driver task, and any future runtime disable/superframe expansion must run only after secure carrier proof with capped work and recovery gates. - Runtime Wi-Fi data/glom RX is separated from control-plane reply reads: control replies retain the conservative Linux first-read/remainder shape, while runtime RX uses one 512-byte block-aligned Function 2 read into the bounded 28-KiB RX partition of the compiler-declared 32-KiB shared aperture and caps deaggregation at 16 subframes plus a 16-entry ready queue. - **Normalized benchmark and isolated runtime parity gates** - Add benchmark reporting that separates raw `cohsh` over Pi Wi-Fi, REST cold gateway overhead, and REST hot/cache projection. - Define the accepted best-QEMU reference by artifact path, harness command, worker count, request suite, gateway/auth mode, QEMU SMP topology, pressure settings, and error-budget policy. - Compare QEMU and Pi isolated runtime artifacts with the same harness and matched workload/provenance. QEMU results alone remain semantic/capacity references; production Pi hardware parity requires fresh wired/GENET evidence. - Treat Wi-Fi as a separate research/diagnostic lane: the routine sustained Wi-Fi gate is capped at `120` workers, exploratory pressure is capped at `300` workers, and `1500` workers is retained only as a stress ceiling for driver fault discovery. - Exclude QEMU-latency parity from pass/fail only after preserving latency fields in JSON and human summaries and verifying Pi 4 wired NIC/Wi-Fi latency remains within the documented physical-network expectations for the selected transport; throughput, successful operation count, error rate, and bounded-backpressure behavior decide the production wired/GENET verdict. - Pi 4 performance acceptance requires zero USB/serial/HDMI responsiveness regression during Wi-Fi/NIC load and no root-owned steady-state physical-driver service path. - **Minimal DHCP core (`no_std`)** - Add a bounded DHCPv4 client core in root-task with strict packet validation, deterministic timers, bounded retransmits, and no dynamic protocol extensions beyond required lease fields. - Keep memory usage fixed and auditable; no unbounded allocations, no background worker threads, and no protocol parser ambiguity. - **Interface binding: wired + Wi-Fi (profile-gated)** - Wire DHCP core to existing Pi 4 GENETv5 backend. - Add a profile-gated Wi-Fi association + link-up path for Pi 4 CYW43xx-class devices sufficient to reach DHCP (design remains HAL-bound and capability-scoped). - Introduce a dedicated CYW43xx Wi-Fi backend wired through HAL traits and existing `NetBackend` policy selection; no alternate ad-hoc control path is allowed. - Record implementation provenance in docs (OpenBSD `bwfm` design shape, Zephyr/WHD HAL layering, Linux `brcmfmac` recovery/link edge cases) and enforce reference-only usage. - Maintain a single network control-plane surface: existing root console + NineDoor behavior only. - **U-Boot-configurable network policy** - Extend manifest/compiler schema with bounded policy fields for `pi4-uboot-aarch64`, including: - network mode (`off`, `static`, `dhcp`), - interface policy (`wired`, `wifi`, `auto`), - bounded static IPv4 override fields (`ip`, `prefix_len`, optional `gateway`) for explicit `mode=static`, - DHCP timing bounds and retry limits. - When bootloader setup can provide network policy inputs, capture them pre-handoff and normalize through manifest/DTB-generated structures validated by `coh-rtc`. - Preserve deterministic fallback behavior when U-Boot policy inputs are missing or invalid. - Stage an interactive Pi 4 U-Boot wizard whose `Cohesix boot menu` offers `Boot with saved settings` when coherent saved policy exists, otherwise `Boot with default settings`; use `Automatic (DHCP)` / `Manual (static IPv4)` and `Ethernet (wired)` / `Wi-Fi (wireless)` choices, `0` Back/Cancel and `9` advanced-shell submenu navigation, explicit one-time versus saved restart actions, reset confirmation, USB-keyboard/HDMI-only credential capture, and optional stateful HDMI logo display without introducing any new Cohesix protocol semantics. - **Backward-compatibility guardrails** - Keep QEMU `aarch64/virt` behavior for macOS/Linux unchanged by default (existing static/dev-virt flows must keep working with no required operator command changes). - Add explicit regression checks proving 26/26a/26b additions are profile-gated and do not alter prior QEMU console grammar, ACK/ERR/END behavior, or existing transport fixtures. ### Commands - `cargo check -p root-task` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib serial::tests` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests` - `cargo test -p root-task net:: -- --nocapture` - `cargo test -p pi4-driver-abi` - `cargo test -p pi4-driver-runtime` - `cargo test -p coh-rtc` - `python3 -m pytest tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml` - `scripts/uboot/qemu-uboot-smoke.sh --net user` - `scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26b-qemu-reference` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m26b-pi4-linked-runtime` ### Checks (DoD) - `driver-usb` proves `USB_GATE=10`, `USB_BLOCKER=none`, first-byte/first-printable-byte evidence, and fast typing remains fluid while the manifest-selected network driver consumes its data budget. - Serial command echo p50/p95 and HDMI mirror progress remain bounded while Wi-Fi or wired network tasks consume their data budgets; GENET/CYW43 pre-root runtime-init may defer before the root shell when pointer-free ring proof is incomplete, and that deferral must not be counted as selected-NIC proof. - `driver-wifi` reports bounded control/data service counters: SDIO ops, bytes, RX/TX frames, credit waits, budget exhaustion/yield count, queued frames, drops, and max service latency. - `driver-sdio` reports dedicated-role and owner-state proof from non-root-context isolated runtime SDIO hardware progress before `sdio-host` can count toward Pi 4 acceptance. - Wi-Fi accepts load only through the driver-task frame ABI; root never spins on SDIO credit, CMD52/CMD53 loops, firmware replies, or glom deaggregation. - Pi 4 wired path acquires a DHCP lease within bounded retries/timeouts and exposes acquired config through existing diagnostics surfaces. - Pi 4 Wi-Fi path (when enabled in profile and credentials are present) reaches link-up and acquires DHCP with deterministic failure modes and audited errors. - Invalid DHCP options, malformed offers, lease overflows, and timeout exhaustion fail safely and deterministically. - U-Boot-configurable network policy (where available) is honored through compiler-validated handoff structures; missing/unsupported bootloader policy cleanly falls back to manifest defaults. - Existing macOS/Linux QEMU workflows remain backward compatible, including serial/TCP console behavior and existing regression fixtures. - CYW43xx Wi-Fi path demonstrates HAL-only access in runtime code and tests; no direct MMIO/bootloader-service usage exists outside HAL-owned modules. - Raw Pi `cohsh` Wi-Fi latency, REST cold gateway overhead, and REST hot projection latency are reported separately; QEMU benchmark results are not used as Pi Wi-Fi hardware proof without a matched fresh Pi run. - Wi-Fi DoD uses the research envelope: a fresh `120`-worker sustained run must pass the accepted error budget, retain post-load raw `cohsh` reachability, and show clean CYW43/SDIO counters (`tx_submit == tx_complete`, no RX drops/overflows, no trace faults/retries outside explicitly recorded recovery). `300`-worker Wi-Fi runs are useful exploratory pressure, and `1500`-worker Wi-Fi runs are stress diagnostics rather than production or closure requirements. - A comparator identifies the selected best-QEMU benchmark artifact and the matched Pi isolated runtime artifact, rejects workload/provenance mismatches, excludes QEMU-latency parity from pass/fail, reports Pi 4 wired NIC/Wi-Fi latency against documented physical-network expectations, and reports a deterministic production PASS only when wired/GENET Pi throughput meets or exceeds QEMU with the accepted error budget. - Isolated runtime hot-path changes remain bounded and preserve active-slot, fingerprint, completion, and busy-on-conflict invariants; no root-owned physical driver service path is added or re-enabled to win the benchmark. - Pi benchmark evidence is fresh, non-empty, normalized, and separated from flash, shell, USB/local-seat, HDMI, and serial-responsiveness proof lanes. - Full regression pack remains green on QEMU; any profile-gated divergence is explicitly documented and fixture-backed. ### Compiler touchpoints - `coh-rtc` adds bounded `pi4-uboot-aarch64` network policy fields for mode/interface selection and DHCP retry/timing limits. - `coh-rtc` extends driver-task contract emission for USB, CYW43/SDIO, and network-control/network-data priority classes. - Benchmark or counter fields that become generated artifacts must be covered by `scripts/check-generated.sh` before 26b closes. - `docs/DRIVERS.md`, `docs/BENCHMARKS.md`, `docs/TEST_PLAN.md`, and `scripts/ci/test_plan_run.sh` must agree on which evidence is benchmark proof, board-acceptance proof, and compatibility-only proof. - Validation enforces: - policy bounds and enum validity, - interface/profile compatibility (wired vs Wi-Fi declarations), - deterministic fallback policy when optional U-Boot-provided inputs are absent. - Generated snippets in architecture/interfaces/security docs include the new policy and DHCP bounds so docs-as-built remains authoritative. ### Task Breakdown ``` Title/ID: m26b-usb-hdmi-local-seat-liveness Milestone: Milestone 26b — Pi 4 USB/Wi-Fi Driver Tasks + DHCP/Benchmark Concurrency / reopened USB/local-seat and HDMI liveness defect Goal: Restore truthful and fluid physical Pi local-seat behavior during selected-network startup without changing console grammar, device authority, or Wi-Fi progress. Inputs: crates/pi4-driver-abi/src/lib.rs, apps/pi4-driver-runtime/src/lib.rs, apps/root-task/src/{local_seat.rs,event/mod.rs,hal/driver_task.rs}, scripts/{pi4_trace_normalize.py,pi4_gate_proof.sh,pi4_serial_reboot.py}, tests/test_pi4_{trace_normalize,serial_reboot,gate_proof}.py, scripts/ci/check_driver_test_coverage.py, docs/{DRIVERS,HARDWARE_BRINGUP,TEST_PLAN,USERLAND_AND_CLI}.md, current Wi-Fi-selected Pi USB/HDMI evidence. Changes: - crates/pi4-driver-abi/src/lib.rs — retain one fixed 48-byte, commit-last, role-qualified USB old-good record reservation in the existing ring gap. It remains pointer-free and has no admission, command, wake, retry, recovery, scheduling, ownership, or acceptance semantics; root may passively project the zero record for compatibility. - apps/pi4-driver-runtime/src/lib.rs — request a one-second HID idle report on the existing interrupt-IN lifetime so an unchanged keyboard establishes its safe attach baseline before the separate five-second liveness deadline, repeat only held arrow usages from the exported virtual counter and selected timer frequency, preserve make/release edges for every ordinary key, and render bounded one-row HDMI scroll steps without report-count timing or a second input/display owner. Remove the USB old-good partial/final publication state and hooks after fresh exact-image regressions at phases 198, 316, and 412, restoring the prior physical enumeration/one-deep queue path while preserving every Wi-Fi change. - apps/root-task/src/local_seat.rs — revoke stale prompt and console-ready presentation across attach/recovery boundaries, re-release the interactive HDMI prompt after current USB command admission and display health, re-admit the ready banner after current USB command admission, retain the canonical prompt/input row until its matching display completion, preserve FIFO output and the prompt backspace floor, and chase completed viewport state through bounded receipts. Retain the bounded canonical `[local-seat] usb keyboard command-ready action=enable-command-input ...` receipt exactly once in `queen.log`, keep its verbose counter detail log-only, and do not project either through a pre-cutover raw-UART path. Restore the known-working `2668c34f76ff` command/first-report path: keep PCIe descriptor/prep and owner registration followed by USB descriptor replay/runtime init and USB owner registration before enumeration, but remove the second post-completion descriptor/owner proof scheduler and its deferred endpoint/byte cache. Valid linked input follows the existing parser-admission path once and a valid first report follows the existing command-ready transition. HAL and gate acceptance ordinarily require current USB/PCIe owners and descriptors, Gate 10, the exact one-deep queue, and real HID/parser/HDMI liveness. The final `7a10b8fd6acc` record uses the explicit operator-approved passive local-seat exception documented in the milestone status and does not claim a fresh key byte. An ordinary pending enumeration retry retains the existing pre-prompt deferral, which grants no descriptor or owner proof authority. - apps/root-task/src/event/mod.rs — project passive bounded USB controller, keyboard-enumeration, and first-report startup feedback, and attribute USB/HDMI SMP activity to each manifest-selected runtime core while preserving `Dispatch -> Display -> Serial` priority and granting no USB or HDMI scheduling authority. EventPump is the sole serial projector for the canonical command-ready receipt and queues it exactly once immediately before `[drivers] USB console ready` through the existing HighImpact/EventPump path. Sustained status treats the single armed interrupt-IN transfer and a zero current no-reply streak as healthy, and uses current HDMI driver-task active authority instead of cumulative submitted/completed gaps. The existing passive `usb diag`/`usb status` and `smp activity` response paths project compact current USB/PCIe owner state and the reserved zero compatibility record through the linked serial owner; they must fit the bounded line/backlog contract and cannot issue, retry, wake, or authorize hardware. - apps/root-task/src/hal/driver_task.rs — bound the retained steady USB poll to its existing finite no-progress allowance, fail closed instead of retaining a permanently split submitted/completed request, and require a current live-complete keyboard probe rather than promoting cached readiness. Classify the existing `USB_RESET_DONE` progress edge as part of the already bounded extended controller-init/reset timeout so the following run-stage setup is not cut down to the generic three-resume allowance. Preserve an exact retained descriptor request as pending rather than projecting a terminal no-reply blocker; only its own replacement, timeout, typed fault, or fail-closed terminal may make it red. Expose one shared compact owner-state formatter sourced only from the current HAL registration and descriptor-seal truth so USB, PCIe, CYW43, SDIO, and GENET diagnostic receipts cannot drift. - scripts/pi4_gate_proof.sh + focused gate-proof fixtures — keep passive `usb status` as the default hardware-proof action, make active `usb probe-kbd` opt-in, and accept only current end-to-end input/display receipt evidence. - scripts/pi4_serial_reboot.py + focused helper fixtures — preserve one bounded contiguous serial stream across the `OK PING`/fresh-root-prompt read boundary so a prompt split after its first byte cannot cause a false timeout, while rejecting an interrupted or noncontiguous tail and retaining existing secret redaction. This host-only orchestration repair adds no target command, proof authority, retry, or acceptance inference. - scripts/pi4_trace_normalize.py + focused Python fixtures — preserve the existing machine-consumed `usb-console-command-ready` token and keep display projection non-authorizing; report a command-ready boot with no current accepted linked-runtime byte as `usb-physical-input-unproven`, and never infer first-byte evidence from Gate 10 or emit a `usb-post-first-byte-*` blocker before that byte exists. Validate the current one-deep interrupt-IN queue, current no-progress/no-reply state, all exact `hdmi:` completion rows, and current USB/PCIe descriptor/owner proof without treating historical cumulative counters or the dormant receipt as live work. A pending retained descriptor identity is nonterminal; missing, replaced, timed-out, or faulted current proof remains acceptance-red. Under the reopened Wi-Fi DPC closure, scope selected-interface state separately from component-local booleans and bind DPC acceptance to the exact accounting/scope/live-ring-truth triplet, with stale client samples classified as rerun-required rather than live-ring poison. - focused Rust tests + scripts/ci/check_driver_test_coverage.py + docs — cover readiness revocation/re-release and bounded startup feedback, map the new USB/HDMI/event/local-seat invariants to production-feature tests, and describe the as-built local-seat behavior. - complete host-tool compatibility review — verify `coh`, `cohsh`, `hive-gateway`, SwarmUI, `tools/cohesix-py`, and the performance benchmark scripts require no implementation, fixture, schema, or workload change because the repair alters only physical local-seat projection and preserves authenticated console, Secure9P, REST, and benchmark semantics. Commands: - scripts/ci/test_plan_run.sh --list - cargo fmt --all -- --check - cargo test -p pi4-driver-runtime --lib usb_keyboard -- --test-threads=1 - cargo test -p pi4-driver-runtime --lib hdmi_runtime -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests::usb_command_ready_receipt_and_details_fit_bounded_log_records - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::usb_console_ready_projects_canonical_receipt_once_and_first - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::linked_usb_runtime_queue_fields_decode_first_report_telemetry - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::hdmi_completion_status_uses_current_active_request_not_cumulative_gap -- --exact - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task::tests::usb_engine_init_controller_reset_stage_uses_extended_bounded_timeout - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task::tests::retained_usb_keyboard_poll_fails_closed_at_its_protocol_bound -- --exact - python3 -m pytest tests/test_pi4_trace_normalize.py tests/test_pi4_serial_reboot.py tests/test_pi4_gate_proof.py -k 'usb or hdmi or local_seat or wifi_diag_complete' - python3 scripts/ci/check_driver_test_coverage.py - scripts/ci/check_test_plan.sh - scripts/check-generated.sh - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - SEL4_BUILD_DIR=seL4/build_UBOOT cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4 Checks: - Ordinary keys emit once per make/release edge; only held arrows repeat, after a 300 ms initial delay and at 50 ms intervals scaled from `CNTVCT_EL0` and `TIMER_CLOCK_HZ`, and arrow escape bytes never enter the command parser. - HID setup requests an unchanged boot report every one second on the existing endpoint lifetime, so an idle keyboard can establish the attach baseline before the unchanged five-second exact-transfer failure deadline; no additional poll, retry, wakeup, fallback, or owner is introduced. - A retained steady USB poll cannot remain permanently split between submitted and completed state: the existing bounded no-progress allowance terminalizes it fail-closed, and cached keyboard readiness alone cannot promote a pending live probe to attached. - The restored `2668c34f76ff` local-seat path has no second descriptor/owner proof scheduler or deferred endpoint/byte cache after a linked completion. The established attach phase performs PCIe descriptor/prep and owner registration, then USB descriptor replay and runtime initialization; it registers the USB owner once controller init is ready, before enumeration. HAL/gate acceptance ordinarily fails closed without current USB/PCIe owner and descriptor proof, Gate 10, the exact one-deep queue, and real HID/parser/HDMI liveness. The dormant old-good receipt authorizes neither progress nor acceptance. Exact image `7a10b8fd6acc` closes only through the separately recorded operator-approved passive exception. - `USB_RESET_DONE` retains the existing bounded extended controller-init/reset allowance; it does not create a new timeout, retry, wake, owner, or unbounded lifetime. - The canonical command-ready receipt remains exactly once in `queen.log` and appears exactly once on serial immediately before `[drivers] USB console ready`; EventPump is the only serial projector. Before a current linked-runtime HID byte is accepted, the truthful state is `usb-physical-input-unproven`, with no post-first-byte failure classification. - Serial remains usable during USB startup; HDMI shows bounded passive startup feedback but no interactive prompt until current USB command readiness and display health both hold. The console-ready banner is re-admitted canonically only after current USB command readiness and becomes visible only through healthy display service. Attach/recovery revokes stale first-report, command, prompt, and ready-banner presentation, and only current-lifetime proof re-releases them. - An older HDMI completion cannot acknowledge a newer canonical input row or viewport request; FIFO output remains ordered, backspace cannot erase the prompt prefix, and rapid arrows advance one completed viewport row per bounded display turn without stale tails, full-screen blink, or unbounded queue growth. - Passive hardware proof never turns a diagnostic into USB authority: default helpers use `usb status`, an active keyboard probe is explicit, and USB/HDMI SMP accounting names each selected runtime core from current manifest truth. - USB remains the sole xHCI/HID owner and HDMI remains child-only. The reserved fixed USB evidence record changes no authority or command ABI semantics and runtime publication remains dormant; no parser command, `ACK`/`ERR`/`END`, network, REST, `cohsh`, or benchmark semantic changes occur. - The exact rebuilt image preserves Wi-Fi first-pair progress and repeatedly proves USB enumeration, Gate 10, the one-deep idle-report queue, command readiness, zero current recovery/no-reply debt, and bounded HDMI completion under selected-network load. No fresh key was typed on `7a10b8fd6acc`; the closure record therefore makes no first-byte, printable-byte, arrow-history, or visible-key-echo claim. - Matrix closure ordinarily includes one same-image functional local-seat anchor captured after `usb diag` is armed, plus passive current owner/one-deep-queue/HDMI sentinels on each network-repeatability reboot. For `7a10b8fd6acc`, the operator explicitly accepted the passive sentinels and exact known-working-path restoration without a fresh anchor; this exception is image-specific and cannot be reused after changing the physical USB path. Deliverables: Focused source/tests/docs repair, warning-free Pi target builds, exact rebuilt image, and the operator-approved same-image USB/HDMI evidence recorded above. Title/ID: m26b-usb-driver-task Goal: Move Pi 4 xHCI/HID keyboard service behind the realtime USB driver-task contract. Inputs: apps/root-task/src/local_seat.rs, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/event/*, scripts/pi4_trace_normalize.py, tests/test_pi4_trace_normalize.py, docs/DRIVERS.md. Changes: - apps/root-task/src/local_seat.rs — route local-seat keyboard-byte consumption through the isolated `driver-usb` runtime. - apps/pi4-driver-runtime/src/lib.rs — own the direct-root-port xHCI command/event/EP0/interrupt-IN rings, root-port reset, slot/address/configuration, HID boot-protocol setup, and DMA report polling in the isolated USB runtime. - apps/root-task/src/local_seat.rs — keep root-task as a ring-client/prompt consumer only; no root-owned USB implementation crate remains. - apps/root-task/src/event/* — consume bounded local-seat byte events and preserve USB priority over serial dispatch and all network work. Commands: - cargo test -p pi4-driver-runtime --lib -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib local_seat::tests - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests Checks: - USB first-byte and first-printable-byte proof remain Gate 10. - Fast typing remains fluid while network data queues are saturated. Deliverables: - Isolated USB keyboard task path with existing local-seat console semantics preserved. Title/ID: m26b-wifi-driver-task Goal: Move CYW43/SDIO Wi-Fi service behind a dedicated driver task with bounded control/data budgets. Inputs: apps/root-task/src/drivers/driver_task_net.rs, apps/root-task/src/hal/pi4_wifi.rs, apps/root-task/src/hal/driver_task.rs, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/net/*, scripts/pi4_trace_normalize.py, scripts/pi4_compare_driver_models.py, tests/test_pi4_trace_normalize.py, tests/test_pi4_compare_driver_models.py, docs/DRIVERS.md. Changes: - apps/root-task/src/hal/pi4_wifi.rs — grant only SDIO, fixed Pi 4 WL_ON power/reset, firmware-bundle, IRQ/OOB, and DMA/ring resources declared for `driver-wifi`; `sdio-host` owns the noncontiguous firmware-mailbox page, a channel-bounded BCM2835 DMA-controller mapping, one private low request page, one low control-block page, and eight low CMD53 bounce pages after a one-way root bootstrap handoff. - apps/root-task/src/drivers/driver_task_net.rs — keep root as the CYW43 ring client only and fail closed when isolated SDIO/CYW43 service has not returned owner progress; retain immutable firmware/control context for a complete pair replay after a partially issued bootstrap. - crates/pi4-driver-abi/src/lib.rs + apps/pi4-driver-runtime/src/lib.rs — define fixed-layout SDIO CMD52/CMD53/POLL_IRQ plus atomic card-reset/pending-generation/commit command records and service them in the isolated SDIO runtime as the bus-owner ABI that CYW43 must use. Function enable and ALP acquisition use elapsed virtual-counter deadlines and Linux-compatible default windows rather than CPU-speed spin timing. - apps/root-task/src/net/* + apps/root-task/src/userland/mod.rs + apps/root-task/src/event/mod.rs — consume bounded Ethernet-frame IPC without changing authenticated TCP console semantics; publish serial/local-seat first and run exactly one outer CYW43 boot episode as `attempt=1`, with no automatic whole-bootstrap backoff, reset, or attempt 2. Before the unique service-ready terminal, an uncertain exact owner may be drained and fenced but cannot restart the physical pair or renew the absolute Gate 8 deadline. Exact service readiness alone admits one later consumed-once runtime pair repair; restored service publishes `CYW43_RUNTIME_RECOVERY`, never a second bootstrap Ready. Gate-local association, DHCP, and protocol retries remain independently bounded. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::pi4_wifi - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib net:: - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: - Wi-Fi control progress yields on budget exhaustion instead of spinning. - Root accepts smoltcp TX tokens into the bounded queue without mirroring firmware credit. The CYW43 runtime alone admits physical issue while its SDPCM window is open and retains the exact op7 in `WAIT_CREDIT` without a root spin or second completion boundary when it is not. - Runtime CYW43 TX staging lets smoltcp fill the bounded SDPCM/BDC transmit frame directly instead of copying through an extra stack frame buffer. - CYW43 startup does not write `bus:rxglom=0` before `event_msgs_ext`/`WLC_UP`; aggregated RX is bounded, counted, and recoverable inside the Wi-Fi driver task. - A transient startup fault cannot kill the physical-Pi boot or operator surfaces. A terminal boot failure quarantines network service for that boot, reports the typed cause, and returns to the ordinary EventPump with serial, local-seat, HDMI diagnostics, authentication, and reboot live. There is no automatic second whole-bootstrap attempt. Deliverables: - CYW43/SDIO driver task that can make Wi-Fi progress without stealing root-task USB/serial turns. Title/ID: m26b-sdio-host-driver-task-graduation Goal: Graduate standalone SDIO host service from diagnostic runtime to 26b acceptance-eligible driver task. Inputs: configs/root_task*.toml, apps/root-task/src/hal/{mod.rs,driver_task.rs,pi4_wifi.rs}, apps/pi4-driver-runtime/src/lib.rs, crates/pi4-driver-abi/src/lib.rs, scripts/pi4_gate_proof.sh, scripts/pi4_trace_normalize.py, docs/DRIVERS.md, docs/TEST_PLAN.md. Changes: - configs/root_task*.toml + generated manifest artifacts — declare `sdio-host` with one HAL-declared SDHCI MMIO page, one firmware-mailbox page, one channel-bounded BCM2835 DMA-controller page, ten private DMA pages, the shared budget, and `hardware_state_migrated=true`. - apps/root-task/src/hal/* — map SDHCI into the SDIO isolated runtime resource set, keep runtime commands pointer-free, and register `sdio-host` owner-state only after non-root-context CMD52/CMD53/POLL_IRQ hardware progress. - scripts/pi4_gate_proof.sh + scripts/pi4_trace_normalize.py — require SDIO dedicated-role and owner-state evidence as part of reopened 26a/26b Pi 4 acceptance. - docs/BUILD_PLAN.md + docs/DRIVERS.md + docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md — record SDIO as a 26b acceptance hot path rather than a future diagnostic guard. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::pi4_wifi - cargo test -p pi4-driver-runtime - python3 -m pytest -q tests/test_pi4_gate_proof.py tests/test_pi4_trace_normalize.py - scripts/check-generated.sh - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: - Generated Pi 4 specs report `sdio-host root_context_required=false hardware_state_migrated=true mmio_pages=3 dma_pages=10`. - `scripts/pi4_gate_proof.sh --require-driver-task-proof` requires `DRIVER_TASK_SDIO_DEDICATED=yes` and a `DRIVER_TASK_OWNER_STATE ... hot_path=sdio-host ... root_pointer=no` descriptor. - SDIO production ring commands do not carry `DRIVER_TASK_RING_FLAG_ROOT_CONTEXT_NON_ACCEPTANCE`; root-context diagnostic turns remain explicitly non-acceptance. Deliverables: - SDIO runtime acceptance promotion with generated, code, proof-gate, and docs-as-built alignment. Title/ID: m26b-wifi-sdio-notification-dpc-closure Goal: Restore the original 26b root-no-wait CYW43/SDIO contract with one durable persistent op11 transaction, one typed intake-sealed Host-EAPOL finite-op7 key-response transaction, one generation-long post-release DPC activation, a disjoint commit-last sideband RX/ACK handoff, a generated reciprocal notification topology, one bounded event-sequence DPC lease from the first post-release event through steady service, and fault-only deadline containment that cannot become a traffic scheduler. Inputs: configs/root_task*.toml, tools/coh-rtc/src/{ir.rs,codegen/**}, apps/root-task/src/generated/**, crates/pi4-driver-abi/src/lib.rs, apps/root-task/src/{drivers/driver_task_net.rs,event/mod.rs,hal/{mod.rs,driver_task.rs}}, apps/pi4-driver-runtime/src/lib.rs, scripts/{pi4_trace_normalize.py,pi4_gate_proof.sh,pi4_serial_reboot.py}, scripts/ci/check_driver_test_coverage.py, tests/test_pi4_{trace_normalize,serial_reboot}.py, docs/{DRIVERS,HARDWARE_BRINGUP,TEST_PLAN}.md, fresh Pi serial/pcap evidence gathered during Milestone 26d. Changes: - Diagnostic compatibility note — this task intentionally versions the non-authority-bearing `wifi diag` accounting and truth telemetry with `owner_active=yes|no`, updates the trace normalizer and gate proof together, and keeps historical lines readable but non-acceptable without active-owner proof. It changes no authority-bearing console command, network protocol, namespace, or benchmark workload grammar; later references to no console/network protocol change use that narrower meaning. - Current DPC-client accounting repair — add one cache-isolated, exact 128-byte `DriverRuntimeCyw43DpcClientRecord` at shared offset 49,984 through 50,111 (`[49,984, 50,112)`), immediately after the DPC-child timing record and below the 53,248-byte CYW43-private RX-region end. CYW43 is the sole writer and publishes the current physical epoch, live consumer sequence, owner-rearm attempts, errors, cause counters, DPC turns, owner children/turns, and completed-frame counters at existing initialization, quiescent owner-rearm, and terminal-fault checkpoints by clearing the final commit word, writing and cleaning the body, then repeating a nonzero publication sequence last. Root stable-double-reads the record and accepts it only between identical stable reads of the live SDIO owner ring (`ring -> record -> ring`) with exact physical-epoch and live-consumer binding. A torn, stale, raced, or mismatched sample is rerun-required and acceptance-red, but grants no admission, notification, wake, issue, retry, rearm, recovery, deadline, scheduling, or physical-owner authority. The additive v11 completion trace remains historical/compatibility input, not current DPC-client truth. - Current Gate 7/Gate 8 diagnostic transaction — bracket each passive current `wifi diag` with a nonzero `wifi: diag_begin id= pair_epoch= generation= snapshot=current` and matching `wifi: diag_complete id= ... snapshot=current pair= gen= ...`. Emit the compact retained Gate 7 `7a>7b>7c>7d>7e` receipt only when its exact pair/generation matches that transaction; `src=sm` means current retained host-EAPOL state-machine proof, not generic Gate 8 inference. Bind every intervening Gate 8 subgate to the same pair/generation. The normalizer accepts retained or clipped proof only from one exact begin/rows/complete identity and fails closed on standalone, prior, reordered, malformed, scrubbed, or cross-identity rows; these records remain passive evidence only. - Current owner/old-good diagnostic closure — the exact `2668c34f76ff` matrix proved Gate 10 and a healthy current DPC ring while every post-settle serial slice still lacked durable CYW43/SDIO owner-state, firmware-identity, and ordered pre-association control receipts. Do not infer those prerequisites from Gate 7, Gate 8, DHCP, TCP, or a bootstrap-stage breadcrumb. Source compact owner rows only from current HAL owner registration plus descriptor-seal truth, and project one bounded retained old-good transaction only from the current supervisor's monotonic firmware/control/association/EAPOL state for the exact `wifi diag` id, pair epoch, and generation. Split any identity fields that cannot fit one untruncated 243-byte payload into exact ordered same-identity rows, keep the essential transaction within the bounded response backlog, and fail closed on missing, malformed, reordered, clipped, cross-command, cross-pair, cross-generation, replacement, recovery, or later-attempt evidence. These rows are passive acceptance receipts only and add no driver issue, notification, wake, retry, poll, deadline, recovery, scheduling, or owner authority. - scripts/pi4_serial_reboot.py + focused helper fixtures — on the settled WiFi diagnostics path, request `smp activity` before fresh `nettest`/terminal `netstats` and `wifi diag` so the retained ordered old-good prefix precedes its fresh network/DPC tail in the durable serial transcript. Preserve the existing settled-supervisor and DHCP barriers, command grammar, error handling, redaction, and bounded command synchronization; this host-only ordering carries no target or acceptance authority and cannot make missing proof pass. - Diagnostic RX timing split (`m26b-wifi-join-owner-forensic-decision`) — version the fixed 128-byte RX batch to v3 while preserving `source_cntvct_lo: [u32; 8]` at bytes 88-119 and the sequence-last parent commit at byte 124. Bytes 120-123 become one sequence-covered `first_data_stage_deltas_q11` for the first populated `CHANNEL_DATA` entry: low `u16` is the floor of DPC source to successful durable private-queue commit and high `u16` is the floor of that queue commit to the final precommit evidence-word sample, both in 2^11-CNTVCT-tick units (about 37.9 us). Values `0x0000..=0xfffe` are valid, including raw zero; `0xffff` is saturated/UNKNOWN. The runtime writes zero when no DATA entry exists, but the passive word is excluded from batch validity and authority identity. If two otherwise exact stable samples differ only in that word, root accepts the batch with both halves degraded to `0xffff`; the mismatch cannot reject traffic or authorize recovery. Root retains a private stable-copy CNTVCT word and, only after exact paired response acceptance, reports the existing source-to-acceptance interval plus `rxsplit_q11a` (`s2q`, `q2p`) and `rxsplit_q11b` (`p2r`, `r2a`, `sat`, `inv`, and one same-sample slow tuple). `p2r` is the exact source-to-copy residual after subtracting both independently floored Q11 stages, so it includes less than 4,096 ticks of combined quantization remainder (about 75.9 us at 54 MHz). This evidence adds no wake, poll, timer, owner, lane, issue, retry, deadline, recovery, or scheduling authority. - J4 per-child owner-seam decision (`m26b-wifi-join-owner-forensic-decision`) — exact image `aabb9b39ecc4` reached first-pair Gate 8 and DHCP with no live-ring poison, RX-queue poison, `recovery_required`, sticky pair restart, or priority-lease poison; its stale compatibility client snapshot did not poison or govern the healthy live owner. Raw TCP still missed acceptance. Its valid worst same-sample split was 33.841 ms total: `s2q=27.154 ms` (80.2%), `q2p=5.309 ms`, `p2r=1.228 ms`, and `r2a=0.148 ms`. This is J4: association and the J1/J2/J3 ownership chain are complete, while the first causal performance seam remains inside DPC source admission to durable private-RX queue commit. Add one passive two-region trace that follows the same immutable physical epoch, DPC event, child sequence, descriptor fingerprint, action, I/O phase, and selected engine. `DriverRuntimeSdioChildTimingMailbox` occupies one cache-isolated line in the SDIO owner ring at offset 1,920, wholly within bytes 1,920-1,983: the owner fault record ends at 1,912, the clock snapshot begins at 1,984, and the shared payload starts at 4,096. CYW43 stages the immutable child identity and publication CNTVCT before the normal sequence-last command handoff; SDIO validates and preserves that body, records exact owner intake, physical issue, and joined-terminal CNTVCT, and commits the child sequence last before the normal completion. CYW43 then stable-reads the exact committed mailbox through its mapped owner ring and adds the acceptance CNTVCT to one 28-byte entry. `DriverRuntimeCyw43DpcChildTimingRecord` is an exact 512-byte CYW43/root record with at most sixteen entries beginning at shared offset 49,472, immediately after the 49,344-49,471 bus-episode record and ending at 49,984, before the RX-batch-region end at 53,248. Root reads only the joined CYW43 trace and never writes either record. The numeric owner-mailbox offset aliases CYW43's parent-descriptor offset only on CYW43's physically distinct local ring; every writer and reader must name the runtime role and ring base, and SDIO must never access the CYW43-private 36,864-53,247 pages. The staged/commit writers are sequential and disjoint in time; neither may mutate the other side's fields after handoff. The mailbox/trace may record passive publication, owner intake, physical issue, physical terminal, CYW43 acceptance, and queue-commit timestamps, validity and overflow accounting, but may not signal, wake, issue, retry, rearm, recover, alter a deadline, retain work, or select scheduling. - J4 decision branches — classify only valid exact-identity samples from the same slow DPC episode. Dominant source-to-first-child-publication time selects CYW43's local pre-child DPC path; dominant publication-to-SDIO-intake selects the reciprocal CYW43-to-SDIO handoff/admission seam; dominant SDIO-intake-to-issue selects SDIO's preissue service; dominant issue-to-terminal selects the already-selected SDHCI/PIO-or-DMA physical child. Dominant terminal-to-CYW43-acceptance selects the final diagnostic mailbox publication plus normal SDIO completion publication/handoff and CYW43 acceptance; only dominant between-child acceptance-to-publication or final-acceptance-to-queue-commit selects CYW43 local DPC continuation. A torn, stale, overflowed, wrapped-ambiguous, missing, cross-epoch, cross-child, or non-worst sample is UNKNOWN and authorizes no behavior. Only one repeated dominant seam with a direct code-path counterfactual may admit one minimal architecture-preserving correction; otherwise stop the current repair sequence. Exact historical `494e9cb0e9ad` remains a negative physical-ordering control because it reproduced first-ACK delay, retransmission, and about 1.5-second raw-TCP p95, so stopping does not authorize merging or restoring that implementation. - Cross-task bounded accepted-child continuation (`m26b-wifi-sdio-notification-dpc-closure` and `m26b-net-control-priority`) — after CYW43 accepts a normal exact `SteadyLease` DPC child terminal and releases that exact global child, the same already-admitted runtime call may execute one bounded deterministic private `FifoWindow` `AdvanceState` transition and publish at most one successor DPC child before returning at that successor's external wait. The released child cannot overlap the successor claim, publication is not physical issue, and SDIO remains the sole later physical issuer. This adds no root admission, poll, wake, notification, priority lease, retry authority, or topology. A contained-preissue `FAULT` retry, `OrdinaryContinuation`, `RxQuantumBoundary`, `RxQueueWait`, `RecoverySettle`, `CompleteEvent`, `DeferredOwner`, and every other external child, credit, peer, or recovery wait remain later-turn boundaries; malformed, stale, mismatched, issued-unknown, and fault-terminal state retains its existing fail-closed path. - J4 host-tool compatibility review — `cohsh`, `hive-gateway`, `coh`, SwarmUI, `tools/cohesix-py`, the `.coh` fixtures, and the raw/REST/hive benchmark workloads require no implementation, schema, fixture, or workload change because the new current DPC-client record and exact diagnostic transaction add only bounded passive `wifi diag` evidence and change no console command, ACK/ERR/END grammar, namespace, request framing, or benchmark arithmetic. The changed host consumers are `scripts/pi4_trace_normalize.py` with its focused proof fixtures and `scripts/pi4_serial_reboot.py` with its focused bounded orchestration fixtures; older logs remain readable by the normalizer and produce typed `UNKNOWN` when the new record is absent. - crates/pi4-driver-abi/src/lib.rs + apps/pi4-driver-runtime/src/lib.rs + apps/root-task/src/hal/driver_task.rs + apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/event/mod.rs — bump the sealed runtime descriptor to ABI v7 and reserve one cache-isolated 128-byte sequence-last `DriverRuntimeCyw43BusEpisodeRecord` at absolute shared offset 49,344. Separate foreground and DPC diagnostic accumulators preserve immutable parent/child identity, logical and physical generations, first/last CNTVCT, DPC sequence, bounded op8/RX/TX progress, final pending mask, and typed exit across foreground clear, runtime-state restoration, and pair-ring scrub. Publish only after a material terminal, typed fault, prewait checkpoint, or bounded fairness checkpoint; write body, clean/barrier, and commit the final publication sequence last with no signal. After a prewait publication, repeat the durable-condition and exact-child tests immediately before sleep. A parent terminal first commits and signals its authoritative completion, then updates this passive ledger so telemetry cannot lengthen the commit-to-signal path. Root double-samples and prints one bounded `CYW43_BUS_EPISODE` line in `wifi diag`. This record is diagnostic only and may not participate in admission, progress, recovery, retry, deadline, rearm, notification, or authority. - configs/root_task*.toml + tools/coh-rtc/src/** + generated artifacts — declare and validate SDHCI IRQ 158 and DMA channel-4 IRQ 116 under the sole SDIO physical owner, reciprocal CYW43/SDIO notification slots, the existing shared owner window, and a fixed four-entry DPC event ring as compiler-owned topology. PIO terminal state uses the SDHCI/host condition without DMA authority; when external DMA applies, the two physical IRQ results join into one immutable request terminal, either arrival order is legal, and neither creates another issuer. - crates/pi4-driver-abi/src/lib.rs — version the pointer-free reciprocal bus-link descriptor, define bounded sequence-stamped DPC event-ring metadata, and retain the fixed 24-byte sequence-last continuation-grant record for ordinary retained commands. Add a command-level persistent-transaction marker plus a paired SDIO-child marker that HAL/CYW43 may derive only from one fully validated, immutable op11 descriptor, payload, exact 192-operation/64-frame/65,536-byte budget, request, and logical generation. Logical zero and nonzero parents both remain immutable while CYW43 binds them once to the independent current physical epoch; retained transactions and SDIO children carry the physical epoch, and a changed logical parent, stale physical epoch, partial, caller-supplied, or mismatched marker fails closed. Version the fixed ring to v3 and add the durable `OWNER_ACTIVE` flag without changing its fixed size. A persistent Function-2 CMD53 write also carries the pre-TX DPC fence: it means the sole owner must establish and recheck same-physical-generation owner-active ring health plus a physically armed `CARD_INT` before issue, not merely sample one notification edge. Define the non-renewable 30-second root parent containment deadline. Add the fixed 24-byte sequence-last `DriverRuntimeCyw43RxQueueState` at CYW43 local-ring offset 192 and the 128-byte `DriverRuntimeCyw43RxBatchRecord` at shared offset 36,864. One immutable op8 parent or active persistent op11 commits one through eight entries whose fixed 1,536-byte payload slots begin at offset 36,992; the final parent-sequence word commits the batch after body/payload clean and barrier. Add the cache-line-isolated 64-byte `DriverRuntimeCyw43RxBatchAck` at shared offset 49,280; root clears its commit, writes the exact generation/parent/queue-commit/count body, cleans and barriers that disjoint line, and commits `queue_commit_sequence` last. Add the 20-byte sequence-last `DriverRuntimeSdioDeadlineArm` at SDIO owner-ring offset 2,028 with physical-lifetime epoch, request sequence, 64-bit expiry ticks, and request-sequence commit last. These records add no console or network protocol grammar. - apps/root-task/src/hal/{mod.rs,driver_task.rs} — admit only generated caps/topology, bind the selected runtime notifications, and keep root as a bounded ring client with no steady SDIO service loop. Non-op11 retained CYW43 foreground commands outside the finite urgent op7 path, including non-op11 bootstrap, recovery, EAPOL-Start, and ordinary control commands, keep their existing exact-grant cadence. The op7 steady lease remains a separate immutable identity with its existing admission and budget, while the linked runtime routes from its current durable condition: deterministic private phases continue even on an equal snapshot, and an exact child, credit, queue, or peer wait blocks immediately even when newly observed. Only a completely intake-sealed current-generation EAPOL-Key M2, M4, or group-key response may reuse its existing paired finite marker. HAL requires one frame, four owner operations, 1,536 bytes, and request-bound priority coverage for both CYW43 and SDIO; root commits and signals once, publishes no grant or later signal after issue, and resumes only for the durable matching terminal. Its deadline may enter recovery only. Ordinary post-Gate-8 TCP retains the O(1) finite-op7 path without the EAPOL-Key parser, poller, or fallback. Every exact op11 is persistent regardless of logical generation or lifecycle: HAL performs `Stage -> CommitRing` with body/payload clean and barrier, commits the command sequence last, transitions the retained request to `Issued`, and emits exactly one notification. It starts one non-renewable 30-second CNTVCT containment deadline at issue; a stable terminal wins at expiry and a double stable miss enters coordinated pair recovery without another grant, replay, or traffic-progress edge. Later root polls may observe only durable state or contain a fault. Root may copy and deliver a stable op11 sideband batch without terminating that parent, then publishes the exact disjoint sequence-last ACK; torn, stale, duplicate, mismatched, or authority-bearing post-copy-changed state fails closed; a change confined to the passive packed timing word instead preserves the copied payload and exact ACK while degrading both timing halves to UNKNOWN. Root also stable-reads the SDIO deadline arm during its existing outer service turn and, only after an unchanged exact arm has expired, emits at most one fault-containment hint through its existing reserved-root notification to CYW43. The hint carries no grant, retry, history, or direct SDIO authority. - apps/pi4-driver-runtime/src/lib.rs — let SDIO own IRQ capture/clear/ack and signal CYW43 only after durable publication; let CYW43 retain bounded software-pending DPC state and preserve wire order. Non-op11 root-to-runtime foreground commands keep their existing exact endpoint or grant contract. The urgent op7 parent retains its separate finite steady-service identity, and its current durable condition—not snapshot novelty—decides whether deterministic private work continues locally or an exact external wait blocks. The typed host-EAPOL specialization accepts only the already paired finite marker on a fully sealed M2, M4, or group-key response; it preserves the one-frame/four-operation/1,536-byte parent and keeps the current request authoritative to sequence-last terminal without another grant or signal. Its Function-2 child does not inherit the persistent-control pre-TX fence: a concurrent committed CARD_INT remains independent DPC work and cannot turn the already-sealed data write into a synthetic pre-issue rejection. EAPOL-Start and ordinary control do not self-promote into it, while ordinary post-Gate-8 TCP stays on the O(1) descriptor path. CYW43 admits an exact marker-paired op11 once, seals its immutable parent identity, and advances that parent from durable queue, credit, CARD_INT/DPC, control-phase, exact-child, sideband-batch, and exact sideband-ACK state without another root grant or notification. The root-owned logical connection generation remains sealed in parent `aux1`; CYW43 binds that parent once to the independent generated SDIO bus-link epoch, and every retained transaction and physical child carries only that physical epoch. Logical zero and nonzero parents follow the same rule, and neither domain is compared with or rewritten into the other. EVENT/DATA preceding the exact BCDC reply remain ordered and are exported in one durable sideband batch; they neither terminalize nor republish op11. CYW43 advances only after a stable ACK exactly matches generation, parent sequence, queue commit, and count. Every CMD52, CMD53, or `DPC_ACTIVATE` child derived from that parent carries the paired persistent marker; the sole SDIO owner validates the pair and retains the exact child with zero delegated continuation grants. Post-release `DPC_ACTIVATE` establishes one generation-long activation lifetime rather than a per-control prerequisite. The fixed v3 DPC ring publishes an explicit durable `OWNER_ACTIVE` bit with owner health; only a healthy current-physical-epoch, owner-active, empty, unmasked ring advances control locally. A committed event binds one exact sequence until durable consumption, including wrapped sequence zero, and a later reassertion cannot extend that dependency. Missing/replaced bound state quarantines the generation. Only activation-absent or mask-skewed state, plus exact ACK debt bound to an already-submitted immutable activation frontier, may enter activation repair; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed and quarantines the generation. Every persistent Function-2 write additionally inherits the pre-TX DPC fence. Before request installation, that fence requires exact physical generation, valid owner-active ring, no ACK/poison/overrun state, and mask agreement. For every healthy empty ring the owner commits a fresh masked baseline and runs the existing crossing-safe rearm rather than trusting an arm inherited from an earlier control lifetime. SDIO re-reads committed ring health and both enables after rearm, then repeats ring/enable/source checks immediately before `SDHCI_COMMAND`. A durable event or crossing source returns a typed proven-not-issued defer; an invariant failure performs zero command/DMA I/O and fails closed. This applies equally to PIO and external DMA, adds no recurring probe, and leaves steady op7 unchanged. Steady-parent identity is independent of the DPC publication phase: a source-bearing front event is immediately serviceable, while an earlier `ACK_PENDING` observation with no committed front is a blocked producer window that retains the exact parent and can never enter the ordinary grant lane. Once a sequence-last SDIO command is committed, pre-admission cannot discard it after consuming its prompt: a missing or competing intake seal reaches owner dispatch, performs zero physical I/O, and publishes the typed terminal. After firmware release, every production DPC event instead binds its own immutable event sequence and current physical generation to the existing finite steady-service child marker, before or after Gate 8; mutable `steady_data_plane_live` state cannot select an ordinary recurrent-grant path. The immutable DPC cursor and committed ring state—not `CYW43_DPC_DEFERRED` or notification history—remain authoritative between exact children until that event terminal; the semantic snapshot is diagnostic only. Persistent op11, urgent op7, and the DPC event lease route every owner turn from the current durable condition. An exact source-bearing event already bound during `PreTxDpcProbe` is service authority in that same owner turn, including its exact submitted ACK debt, rather than requiring another wake. Deterministic private phases continue to bounded quiescence even when the semantic snapshot is equal; an exact child, credit, queue, or peer wait blocks immediately even when its snapshot is newly observed, and returned RX-queue capacity resumes immediately without another hint. Each service helper remains bounded and each immutable hardware request issues at most once, but no yield, notification, or scheduler placement is a required transaction edge. PIO terminalizes from SDHCI IRQ158/host state with zero DMA authority; when external DMA applies, IRQ158 and DMA channel-4 IRQ116 join into one immutable child terminal in either order. SDIO alone takes one live joined-controller sample after a changed steady cursor before it may classify an external wait; this hardware-sample exception does not make snapshot novelty transaction authority. At the final condition-before-sleep boundary, every active autonomous SDIO phase that can remain blocked commits its exact counter expiry through the deadline-arm body then request sequence last. This includes pre-issue inhibit and status-clear admission, issued polling, containment/reset polls, and host-clock polls; containment clock settle publishes the earlier of its settle and overall expiries. Terminal/reset clears the commit before publishing terminal/reset state. Root and CYW43 may relay one expired-arm hint over the existing root-to-CYW43-to-SDIO notification chain only after stable exact-identity rechecks; SDIO alone rechecks terminal-before-deadline and owns containment. Completion body/cache clean/barrier precede sequence-last commit and only then may the owner signal CYW43. Immediately before blocking, CYW43 re-reads its authoritative parent/child terminal, DPC event frontier, RX queue/batch/ACK, credit, and foreground state. SDIO separately re-reads its active physical child/completion, joined IRQ/CARD_INT, deadline arm, owner health, and—immediately before idle receive—its own sequence-last one-way command ring. A fresh command re-enters SDIO arbitration. Neither runtime reads or acquires the other runtime's private authority, and missing, coalesced, or repeated notifications change no outcome. A normal post-TX op11 `WaitReply` parks because its current durable condition is an external peer wait, even when that condition was just observed, and does not force a source probe; ordinary traffic records zero fault-hint wakes. A retained foreground phase snapshots the DPC producer and ordinarily drains only work at or before that watermark before one foreground quantum, so a continuously reasserted level source cannot starve unrelated control progress. The sole dependency exception is durable rather than notification-driven: a persistent op11 in credit/reply wait and a sealed urgent op7 in `WAIT_CREDIT` admit a later committed front DPC event because it can carry that parent's reply or credit; private pre-TX phases and all other later events retain the watermark and RXBOUND fairness policy. Each immutable DPC event source/frame-length condition is admitted once when its sequence becomes active, and an overlapping sequence poisons rather than merging event identities. One physical interrupt episode completes active transfer state, drains bounded RX, applies SDPCM credit progress, admits an already-ready urgent TX before quiescence, and rechecks the durable condition before blocking. Current ring flags and exact pending-ACK state are live authority; the per-pair `ack_failures` count is historical telemetry and cannot revoke healthy work after exact ACK recovery. It does not require a second scheduling edge or fallback lane. - apps/pi4-driver-runtime/src/lib.rs — treat the Function-2 fence's request-local mask/readback/rearm as a linearization step inside the already-live generation activation, never as closure or recreation of that activation lifetime. - apps/pi4-driver-runtime/src/lib.rs — close a condition-first request terminal and its shared IRQ episode in the sole SDIO owner before exposing the child completion. Mask request and `CARD_INT` signalling with verified readback, W1C and re-read only exact request-owned residual status, then either commit visible `CARD_INT` durably before exact IRQ158 ACK or ACK IRQ158 and complete crossing-safe rearm. External DMA additionally joins exact IRQ116 ACK before the single terminal. While an immutable one-way command is intake-sealed or cursor-active, treat its event publication and joined IRQ state as terminal body and emit no inner peer hint; clean/barrier and commit the generic child completion sequence last, then emit exactly one CYW43 hint. A failed terminal commit emits none. Standalone idle `CARD_INT` and non-one-way service retain immediate post-event signalling because no later child terminal owns that handoff. Independently, make the final valid-empty-ring/masked-`CARD_INT` rearm due from durable owner state before command arbitration even when the command queue is empty; peer notifications remain optional hints. Add no poller, fallback, source probe, smoltcp change, GENET change, or second issuer. - apps/pi4-driver-runtime/src/lib.rs — admit a marker-paired persistent `DPC_ACTIVATE` from exact generation/link/non-poisoned/ring health even when activation or state/ring `CARD_INT` mask parity is not yet established, because this sole-owner operation creates and republishes those two postconditions. When IRQ158 is delivered after that exact immutable frontier is submitted, admit its current `ACK_PENDING` state only while the active parent, child ticket, generation, descriptor/source-probe identity, and global child sequence still match; this same retained owner cursor commits or coalesces the source, ACKs the frozen epoch, republishes cleared health, and terminalizes. Latch and retain that IRQ epoch across a zero host-status sample while the pre-activation immutable command or private cursor exists; only an unclaimed zero-status badge may be released immediately. ACK debt without that exact frontier remains fail-closed. Its retained state machine rechecks exact owner binding before MMIO and issues no SDHCI command. Ordinary persistent CMD52/CMD53 and urgent-op7 children retain the existing activation, ring, and mask-coherence gates. If the dedicated final empty-ring rearm fails, preserve its typed owner-health result before any later child can obscure the first break. - apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/event/mod.rs + apps/root-task/src/net/stack.rs + apps/root-task/src/userland/mod.rs — retain one no-allocation bootstrap/recovery owner for the network lifetime; run exactly one outer boot episode as `attempt=1` and one initial physical pair with zero pre-service pair restarts; publish atomic 8a-through-8h plus nonterminal `CYW43_GATE8_COMMIT`, then publish the unique bootstrap Ready only after exact-generation DHCP/listener readiness; advance descriptor, firmware/control, association/EAPOL, data-TX, ARP/GARP, and post-up work through immutable generation-bound cursors; admit one bounded pair-repair episode only after service readiness and report restored service with a distinct runtime marker; preserve linked-runtime-only serial, buffered-only local-seat, and reboot-first operator liveness while recovery fences NetStack. Root treats the CYW43 notification as a prompt to stable-read committed state. The canonical-terminal retirement exception is fenced only by an actually pending or in-progress pair restart: the HAL context-replay `required` state rejects generic submissions until the bootstrap supervisor atomically owns it, and that owned replay capability must admit the firmware/control actions that finish the same replay. Thus context replay cannot self-classify as a fresh recovery fence, while a superseding pair restart still wins and invalidates it. Bootstrap failure policy also preserves an already committed sequence-last HAL receipt and pair-drain exception until the enclosing outer-turn semantic finalizer releases their exact identity. When the exact issued persistent op11 parent or typed finite Host-EAPOL key-response parent has no stable terminal and HAL reports `Waiting`, EventPump masks only that exact parent's runtime-descriptor, logical-owner, and HAL-lease self-demand so repeated root polls cannot become a scheduling clock; independent committed DPC/RX work, sideband-batch consumption, deadline containment, recovery, and a newly visible exact terminal remain schedulable. For finite op7, HAL validates immutable request/ring/command identity and stable-reads the exact completion before consulting transient lease phase or priority coverage; those scheduler facts decide only whether a terminal-absent parent may wait. A committed terminal owns one explicit consume reason, while a waiting parent suppresses all Host-EAPOL policy self-demand, including BSSID refresh and active-session levels, without suppressing CARD_INT/DPC or root RX. Identity loss or typed deadline containment enters the sole recovery path instead of hot-running policy. The passive bounded `wifi: finite_parent` line exposes raw stable completion, immutable identity, wait identity, and the derived condition but grants no scheduling or recovery authority. One op8 parent returns detail `0x5803`, `result=count`, and the batch-header frame reference; root may copy one through eight entries only after validating generation, queue-commit, parent sequence, bounds, and a matching post-copy header re-read. The same validated record may be consumed as op11 sideband without closing op11, followed by one disjoint exact ACK. Remaining committed queue depth retains service without another notification. Deadlines contain an exact fault; the only hint they may cause is the one-shot stable-expired SDIO arm relay, never receive progress or an alternate transaction. - crates/pi4-driver-abi/src/lib.rs + apps/pi4-driver-runtime/src/lib.rs + apps/root-task/src/hal/driver_task.rs + apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/event/mod.rs — bump the sealed runtime descriptor to ABI v8 and overlay one distinct-magic, exact 24-byte `DriverRuntimePersistentWaitReceipt` at auxiliary offset 40, mutually exclusive with continuation grants and finite-progress records. CYW43 alone allocates a producer-monotonic nonzero wait epoch for an exact persistent op11; exhaustion fails closed. It clears the commit, writes request sequence, action fingerprint, logical generation including zero, and epoch, cleans/barriers, and commits the same epoch last only after its final durable-condition and child-terminal checks. A changed condition clears the receipt before local continuation; an actually blocked owner retains it only while armed on its generated local notification and clears it before interpreting a wake or publishing terminal. Root accepts only a stable double-read of the exact request, fingerprint, generation, epoch, and commit. Before that receipt or terminal, EventPump promptly re-admits the same parent across the existing Open, bounded Closing, and exact handoff boundary while preserving one externally uninterrupted bus-service episode; after the receipt it parks ordinarily. No receipt can grant, signal, issue, retry, renew a deadline, or authorize recovery, and publication/clear failure poisons the exact transaction through the sole fail-closed pair path. - scripts/pi4_trace_normalize.py + scripts/pi4_gate_proof.sh + scripts/pi4_wifi_repeatability.py + docs/DRIVERS.md — keep notification deferral red, reject any automatic attempt 2, bootstrap backoff, or whole-bootstrap reset, expose single-episode terminal state, require ABI v8 for current sealed-owner acceptance while retaining v7 text only as historical ledger evidence, and require bounded IRQ/DPC, ordered RX, exact-image multi-boot TCP/cohsh, and unchanged USB/serial proof. Commands: - cargo test -p coh-rtc - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task - cargo test -p pi4-driver-abi cyw43_dpc_client_layout_is_bounded_and_sequence_last - cargo test -p pi4-driver-runtime cyw43_dpc_client_record_is_current_sequence_last_and_passive - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::driver_task::tests::cyw43_dpc_client_reader_is_stable_passive_and_sequence_last - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::wifi_diag_authority_lines_fit_the_untruncated_console_budget - python3 -m pytest -q tests/test_pi4_wifi_repeatability.py tests/test_pi4_trace_normalize.py - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: - The current DPC-client record is exactly 128 bytes, 64-byte aligned at offset 49,984, ends at 50,112 without overlap, commits the nonzero publication sequence last, and is read only as one passive `ring -> record -> ring` snapshot. Exact physical epoch and live consumer sequence are mandatory; transient staleness requests a bounded rerun and never becomes recovery or owner authority. - Retained Gate 7 and current Gate 8 proof share one exact nonzero diagnostic id, pair, and generation between matching `diag_begin` and `diag_complete` records. Any clipped proof may be recovered only from that current terminal identity; malformed or cross-transaction evidence revokes acceptance. - HAL does not release an exact op11 at raw ring observation. It replaces the cleared active request with a sequence-last semantic-terminal receipt binding request, command fingerprint, logical `aux1`, and physical pair epoch. That receipt and the logical owner remain authoritative until the canonical consumer commits the copied or routed body and the complete outer policy turn compare-clears them. An interleaved physical terminal clears only its receipt and preserves the logical op11 owner; dropped, uncommitted, mismatched, or orphaned retirement authority fails closed through the existing pair-recovery lane. - Focused production-path root/HAL coverage proves healthy logical terminal retirement, interleaved physical-only retirement, recovery becoming sticky before canonical consumption, and successor fencing when an outer-turn finalizer is omitted. Construction-level raw-token-drop coverage proves that uncommitted authority fails closed; receipt matching separately proves every exact identity field gates release. Claims about duplicate or mismatch behavior require a production-reachable receipt test before publication. - EventPump derives one immutable canonical-owner snapshot and one combined service-routing snapshot per active outer policy turn, so repeated scheduling questions do not reconstruct staged WiFi payload identity or stable-read the same op7/op8/op11 and DPC state. Both snapshots are typed hints only: final consumer/HAL admission revalidate exact state, while the explicit before-sleep boundary double-samples a narrow current-lifetime and durable-level cut and HAL rechecks the active parent's sequence-last completion or op8 grant. Fresh DPC/runtime/root RX, control, requestless policy, or exact-parent progress overrides an idle same-turn routing hint; a merely waiting parent masks identity-only policy levels plus retained TCP flush, console, and ICMP demand and cannot hot-run, while independent committed driver progress still resumes the same episode. The finalizer invalidates both hints, outside-turn diagnostics bypass them, and no hint can issue, complete, retire, recover, or create notification-history authority. - Generation vocabulary is explicit throughout these checks: a root/CYW43 parent generation is logical connection identity, while a DPC ring generation is the generated physical bus-link epoch. Phrases such as `same-generation DPC ring` mean the same physical bus-link epoch and never authorize comparing it with parent `aux1`. - Generated topology contains exactly one SDIO physical owner for level-triggered SDHCI IRQ 158 and DMA channel-4 IRQ 116 plus one reciprocal `cyw43-sdio` link with bounded notification slots and four-entry event ring; malformed, split-owner, overlapping, unbounded, or unknown topology fails validation. PIO reaches one terminal from its SDHCI/host conditions with zero DMA use; external DMA joins the two IRQ results into one terminal for the immutable request in either arrival order. - A condition-first SDIO terminal cannot retire its cursor before the sole owner has closed the matching IRQ158 episode: request-owned residual bits are W1C/read-back exact, any visible or crossing `CARD_INT` is committed before exact handler ACK, otherwise crossing-safe rearm completes before the child terminal. An external-DMA terminal also joins exact IRQ116 ACK. Intake-sealed and active one-way children emit zero event/IRQ peer hints before completion commit and exactly one generic hint after sequence-last terminal; failed commit emits zero, while a standalone idle crossing emits one immediate post-event hint. The final valid-empty-ring/masked-`CARD_INT` level is serviced without a queued command and cannot require notification history. - Healthy current-physical-epoch activation is reused across the full control lifetime: only an explicitly owner-active, empty, unmasked ring reaches the Function-2 fence without a `DPC_ACTIVATE` child, while one visible front event is bound by exact sequence until its durable consumed watermark and later events cannot starve TX. Only when activation/mask state is absent or skewed may the physical-generation-bound Join source probe be admitted; if one IRQ158 ACK epoch becomes pending after its exact frontier is submitted, that same probe ACKs the epoch, commits cleared health, and reconciles state with zero SDHCI command issue before the parent continues. Removing or mutating the exact frontier, losing or replacing a bound event without consumed proof, wrong physical generation, absent owner-active proof, owner poison, invalid/poisoned/overrun ring, partial marker, and every non-activation child under the same unhealthy condition remain rejected. A failed final idle rearm records `DRIVER_RUNTIME_REJECT_SDIO_DPC_SOURCE_REARM_FAILED` rather than allowing the next child to appear marker-invalid. - Root never waits synchronously on SDIO credit, CMD52/CMD53, firmware replies, or glom work; durable DPC/transaction progress remains inside the isolated SDIO/CYW43 runtimes, notifications remain hints only, and pointer-free active-slot bounds hold. A stable `Waiting` result for the exact issued persistent op11 suppresses only that parent's root self-demand; independent committed DPC/RX work and `TerminalVisible` cannot be masked. - Driver-runtime ABI v8 wait-receipt tests prove exact offset 40, exact 24-byte size and distinct magic; logical generation zero; body clean/barrier and commit-last publication; a producer-monotonic nonzero epoch with overflow failure; root stable double-read; and rejection of torn, stale, wrong-request, wrong-fingerprint, wrong-generation, wrong-epoch, or wrong-commit state. Production composition crosses `Stage -> CommitRing -> Issued`, exactly one signal, prompt same-parent re-admission through Open and bounded Closing, exact receipt or terminal, ordinary park, later exact-terminal resume, semantic consumption, and deterministic lease release. It covers Stage clearing, changed-condition clearing, terminal-before-receipt, terminal-after-receipt, publish/clear failure, clear-before-wake interpretation, and proves receipt and terminal are alternative handoff proofs rather than simultaneous authority. It admits no second request, grant, signal, issue, rescue wake, unrelated NIC owner, idle policy gap, or duplicate path. - Driver-runtime ABI v7 placed the 128-byte episode ledger exactly at shared offset 49,344 with its publication sequence committed in the final word; ABI v8 retains that ledger unchanged and non-authoritative. Stable, staged, torn, stale-version, wrong-sequence, overlapping foreground/DPC, PIO, DMA, queue-only-op8, prewait, fairness, first-fault-dominant, reset, transaction-clear, and pair-scrub tests preserve one diagnostic identity without changing any command, notification, operation, retry, deadline, recovery, or queue count. The exact child descriptor records its selected PIO/DMA and required IRQ contract while the child-terminal flag distinguishes an expected active contract from a completed owner join. A condition changed across passive publication prevents sleep, and completion signalling precedes diagnostic work. Root rejects unstable records and emits at most one bounded `CYW43_BUS_EPISODE` line per `wifi diag`; current trace/gate fixtures require descriptor version 8 and reject version 7 or earlier as historical-only evidence. - An accepted normal exact `SteadyLease` completion releases the old global child before one bounded deterministic private `FifoWindow` `AdvanceState` transition may claim and publish exactly one successor. That CYW43 call returns at the successor's external child wait and performs no physical issue. Focused coverage compositionally proves the old terminal mailbox is stable-read into its immutable accepted CYW43 trace entry before coherent successor staging reuses the sequential mailbox, and `OrdinaryContinuation`, `RxQuantumBoundary`, `RxQueueWait`, `RecoverySettle`, `CompleteEvent`, `DeferredOwner`, contained or fatal fault, malformed identity, issued-unknown, quarantine, and recovery produce no same-call successor. The one-child-at-a-time invariant, later SDIO-only issue, foreground fairness, and zero new poll, signal, priority, EventPump, GENET, or authority behavior remain explicit. - The production reciprocal ring has one CYW43 producer and one SDIO physical owner. Non-op11 foreground commands preserve their exact endpoint/grant cadence. The finite urgent-op7 lease preserves its identity and budget, while its current durable condition decides the handoff: deterministic private phases continue even on an equal snapshot, and an exact child, credit, queue, or peer wait blocks immediately even when newly observed. An exact op11 crosses one sequence-last parent commit and exactly one root notification, stays `Issued` through every completion miss, and reaches one terminal with zero recurrent root grants or notification signals. Interleaved EVENT/DATA is delivered through the committed sideband batch plus exact disjoint ACK without completing or republishing op11. Each derived SDIO child carries the paired persistent marker and reaches its terminal under the sole SDIO owner with zero delegated grants. The one post-release activation remains valid for the physical generation; ordinary controls do not manufacture a new activation child. Before every persistent Function-2 child issues, the same owner proves a healthy empty same-generation DPC ring and physical `CARD_INT` enable; masked-empty state is rearmed and durably committed, pending source work defers without issue, and health or ACK debt fails closed. The final ring/register/source sample is the issue linearization point for both PIO and DMA. A committed sequence-last SDIO command always reaches matching owner dispatch; a missing or competing seal produces a typed zero-I/O terminal rather than disappearing as no intake. From the first post-release DPC event, the separate event-sequence steady lease is the only production DPC child mode and never falls back to ordinary recurrent grants based on Gate 8 state. Each immutable hardware request issues at most once; bounded condition-driven private progress may traverse consecutive owner-loop iterations to quiescence without a yield, while SDIO alone preserves one live joined-hardware sample after a changed steady cursor before blocking. Its final idle boundary rechecks the ring-only one-way intake, and a fresh command re-enters arbitration without another signal. Non-CYW43 retained endpoints cannot substitute for any boundary. The RX handoff above the CYW43 runtime is batch-shaped: a full 256-frame software backlog requires 32 committed eight-frame parents rather than 256 per-frame root grants, terminals, or notification signals. Current flags and pending state, not historical `ack_failures`, decide admission; DPC overrun and ACK-attempt counters are scoped to the current physical pair and reset on pair replacement. Every blockable active SDIO phase publishes its exact physical-lifetime counter deadline, including pre-issue inhibit/status-clear; containment clock settle publishes the earlier settle/overall expiry. Phase progress refreshes or clears the arm, terminal/reset clears it before publication, ordinary service records no hint, and an unchanged expired arm permits at most one root-to-CYW43-to-SDIO fault hint before SDIO alone terminalizes or contains it. EventPump/NetStack have no private Wi-Fi EAPOL, pre-root, tail-ingest, TCP-flush, hot-dispatch, or device-operation burst; stale completions and issued-unknown actions cannot mutate or replay into a replacement generation. - Real production-chain tests drive an exact op11 through one HAL admission with zero root continuation-grant publications, prove there is no grant 19 or second root notification after the `PreTxDrain -> WaitCredit` transition, and then drive its marker-paired cached-window F2 child to one terminal with no delegated grant. Focused scheduler coverage proves an owner-active healthy physical epoch reaches `PreTxDrain` without a `DPC_ACTIVATE` child; a committed front event binds exactly one attempt-scoped sequence, services that event through canonical DPC from `PreTxDpcProbe` without another wake, and advances after durable consumed proof even if a later event is queued. Wrapped sequence zero remains valid, and a missing or replaced bound event quarantines rather than creating activation work. Equal snapshots in deterministic private phases still route to `ContinueToQuiescence`, while exact child, credit, queue, and peer waits route to `WaitForWake` regardless of snapshot novelty; SDIO steady coverage separately preserves one changed-cursor live joined-hardware sample before blocking. A separate masked/ACK-pending production-chain test drives one marked logical-generation-zero persistent op11 through the retained `DPC_ACTIVATE` repair state machine, production SDIO intake and owner dispatch, a sequence-last terminal commit, a coalesced notification, and hintless exact-parent replay. The healthy control-lifetime composition then reuses the independent physical epoch, canonically consumes an owner-published source event, issues one persistent Function-2 TX child with exact terminal replay and no continuation grant, takes modeled IRQ158/CARD_INT capture through durable publication and Function-2 RX, publishes the control queue, and completes from the matching CONTROL reply. That Function-2 child must inherit the pre-TX arm fence even when its parent control flags are zero. Focused PIO and external-DMA tests prove masked-empty rearm and committed owner-active unmasked health before one command; existing-event and physical-source crossings produce a typed zero-I/O defer; event-plus-unmasked, ACK debt, bad epoch, absent activation, poison, and enable mismatch fail closed without command or DMA. Seal-conflict coverage proves an already committed command reaches a typed zero-I/O busy/missing-seal terminal and cannot be discarded as no intake. Tests separately exercise persistent op11 at logical generation zero and nonzero generations against a different physical epoch, prove parent `aux1` remains logical while every physical child uses the physical epoch, root masking for exact persistent-op11 `Waiting` without masking independent DPC/RX/sideband/deadline or `TerminalVisible`, the first post-release DPC event selecting the exact event lease before Gate 8 with no continuation grant, a PIO child terminalizing from IRQ158/host state with zero DMA use, external-DMA children joining IRQ158/IRQ116 in both arrival orders, an immediate terminal committed just before sleep, and missing, coalesced, and repeated notification hints. The idle-owner test commits a fresh ring-only one-way child after the earlier intake sample and requires the final sequence-last command-ring check to re-enter arbitration without another hint. Ordinary post-TX `WaitReply` must block because its current durable condition is an external peer wait, regardless of whether that condition was just observed, resume only for real CARD_INT/DPC/RX/credit/child-terminal progress, and record zero forced source probes or ordinary-traffic deadline hints. Production-reachable dependency tests retain a real op11 in `WaitReply` and a tagged no-credit op7 in `WAIT_CREDIT`, publish a current-physical-epoch DPC event after the original foreground watermark, and prove current durable state preflights that event despite a coalesced hint; the same sealed op7 then reaches its exact Function-2 child without a root or delegated continuation grant. The finite urgent-op7 lease and every non-op11 foreground retained grant cadence, including non-op11 bootstrap/recovery, receive regression coverage. Further production-chain coverage drives normal control and EAPOL TX through one cached-window F2 child, a genuine cold-window miss through exactly LOW/MID/HIGH/F2 with no steady-state IORx child, the 20-command post-F2 release culminating in the generation's one real DPC activation, and one physical DPC RX episode into the committed queue/batch handoff. The eight-frame case produces one immutable op8 parent and one terminal, survives missing/coalesced/repeated hints, and rejects torn queue/batch commits, stale logical or physical generation, mismatched queue commit or parent sequence, invalid entry bounds, and an authority-bearing header change during copy; a change confined to the passive packed timing word instead preserves the payload and exact ACK while degrading both timing halves to UNKNOWN. The same batch under active op11 must be nonterminal, deliver once, and advance only after the exact disjoint ACK commits last. A failed IRQ ACK followed by exact recovery clears current authority flags while retaining per-pair history and healthy admission. Deadline-arm tests cover phase selection for every timed autonomous owner wait, exact pre-issue inhibit and status-clear expiry publication, earlier settle/overall containment selection, body-before-commit, clear-before-terminal/reset, fail-closed handling when a blockable phase lacks a counter deadline, one stable-expired root-to-CYW43-to-SDIO hint, terminal-before-deadline, and zero ordinary-traffic hints. Reapplying one event's immutable frame hint, fabricating mailbox readiness or a terminal stream, substituting generic card commands for CMD52, or directly completing DPC activation fails this coverage. - Diagnostic split tests prove v3 size/offset/version stability, raw-zero and modulo-wrap handling, Q11 floor/saturation, first-`CHANNEL_DATA` selection after an EVENT, post-queue-commit admission stamping, physical-slot reorder/clear, stable-copy coverage, and sequence-last publication. They also prove body validity ignores the passive word and a timing-only stable-sample mismatch yields `0xffff/0xffff` without batch rejection or recovery. Every split field's leading `n` remains visible coverage but may legitimately be below `rx2a_mod32 n`, because only the first DATA entry in a batch carries the packed word; each missing, saturated, or invalid sample is individually UNKNOWN. The bottleneck decision is complete only when the valid same-sample `slow.total` equals `rx2a_mod32.max`; if `slow.total` is smaller, the worst sample remains UNKNOWN. The `slow=////` tuple must come from that single valid sample rather than mixing independent per-stage maxima. - The retained supervisor remains live after initial network attachment and deterministically owns every sticky pair, generation, association, EAPOL, and data recovery. Steady paths publish only an immutable recovery record that binds both the current recovery generation and the unresolved action's owner generation, then perform lock-free admission fencing. A logical association-epoch change or pair-restart signal while an op11 join cursor is unresolved retains that cursor's original owner generation and exact descriptor, payload digest, and ticket under the current recovery generation; it cannot collapse the cursor into an empty pair signal. After guards unwind, the supervisor alone clears retained session state and poisons the current generation. The sole outer boot episode is always `attempt=1`, admits one initial physical pair, and has zero pre-service pair-repair budget. Gate-local association, DHCP, and protocol retries remain bounded inside their owning gates, while Gate 8 commit, DHCP, and listener admission share the original absolute deadline. A pre-service physical fault drains/fences ownership and terminates/quarantines instead of opening pair 2. Exact service readiness alone admits one later consumed-once runtime repair; duplicate Ready cannot replenish it, and restored new-generation service uses `CYW43_RUNTIME_RECOVERY` before one later episode can be re-armed. Gate 10 remains downstream acceptance proof, not recovery authority. A lease conflict before issue that changed no scheduler state fails locally, while issued or scheduler-mutating uncertainty requires the bounded runtime repair. Duplicate current records coalesce, stale records cannot mask current faults, and neither can relock a steady session, replay a child operation, or mutate a replacement generation. Terminal boot failure quarantines network service and returns to ordinary operator service; recovery fencing never prevents independent linked serial, buffered local-seat input, HDMI status, timer/IPC, authentication, diagnostics, or reboot dispatch from remaining bounded and available. - Host tests execute the production descriptor-validation and SDHCI owner-transfer path through an injected deterministic controller model; cut every whole action in the production pair-restart schedule with stateful register/resume/ready/descriptor/engine transitions; inject each modeled CARD_INT and notification/IRQ substep plus persistent outer-suspend and CARD_INT-mask failures; and prove continuously reasserted CARD_INT remains bounded without weakening quarantine or issued-unknown ownership. - Fresh repeated Wi-Fi boots show no `DRIVER_TASK_NOTIFICATION_BIND_DEFERRED`, no DPC-ring overrun/drop, no IRQ-ACK failure, `sdio_deadline_hints=0` during ordinary traffic, ordered control/event/data delivery, working DHCP/TCP/cohsh, and unchanged serial/USB/local-seat gates. Per-pair counters are evaluated separately for every physical lifetime and must not be stitched across a restart. Deliverables: - Generated reciprocal CYW43/SDIO notification contract, typed persistent op11 parent/child ABI, typed commit-last wait receipt, fixed bounded DPC event-ring ABI, diagnostic-only scrub-surviving episode ledger, isolated-runtime implementation, deterministic offline fault/schedule coverage, exact-image repeatability gate, docs-as-built alignment, and repeatable Wi-Fi TCP evidence. Title/ID: m26b-net-control-priority Goal: Split network-control and network-data work so EAPOL/DHCP/TCP ACK progress is prioritized without starving physical input. Inputs: apps/root-task/src/net/*, apps/root-task/src/drivers/driver_task_net.rs, apps/pi4-driver-runtime/src/lib.rs, apps/root-task/src/event/*. Changes: - apps/root-task/src/net/* — add diagnostics and scheduling hooks for network-control vs network-data service classes. - apps/root-task/src/drivers/driver_task_net.rs + apps/pi4-driver-runtime/src/lib.rs — expose ring-client/runtime counters for EAPOL/DHCP/control progress and bulk RX/TX data. Admit CYW43 stack output through one generation-scoped bounded aggregate of 16 immutable frames, represented as urgent-control and bulk FIFO classes but feeding the sole active op7 owner. ARP, EAPOL, DHCP, TCP SYN/FIN/RST, payload-free TCP control frames, and any copied-RX paired response are urgent; other payload-bearing TCP and fragmented or ordinary data remain bulk; FIFO order is preserved within each class. Ordinary TxTokens reserve at most 15 aggregate slots; a TxToken paired with copied RX may reserve the final slot before RX dequeue, and consumption remains queue-only. EventPump is the sole production TX coordinator. An exact retained foreign HAL descriptor, including NetData op8, is non-revocable and keeps op7 queued/requestless without spending TX budget, deadline, or recovery. An already-started op7 remains exact and advances to its terminal. Before promoting a fresh or requestless op7, however, one committed copied/DPC/runtime RX level receives the next bounded drain/op8 turn so an immediate peer reply cannot sit behind a later DHCP or TCP retransmit. At full capacity, promotion removes one eligible head and restores a paired slot before its one advance. A terminal never promotes a successor; that frame remains queued for a later EventPump coordinator turn. `Device::receive` and reservation failure do not service TX. Promotion starts the sole op7 lifetime without a root-owned predecessor-credit gate. The runtime alone owns `sdpcm_seq` and the dongle-advertised `tx_max` admission window; an exhausted window retains the same op7 in `WAIT_CREDIT` until DPC commits a newer window. The exact joined Function-2 terminal releases the root frame and may advance its ordered logical continuation without a later RX acknowledgement. A stable committed terminal wins before lifetime policy; a terminal-absent `Waiting` op7 remains retained only while its exact generation, pair epoch, and physical-lifetime epoch are current, and an invalidated lifetime enters the sole pair-recovery lane without replay. Generation/reset purges never-issued queued frames, while an issued or otherwise ambiguous active op7 deadline remains fail-closed; GENET is excluded. - apps/root-task/src/event/* — preserve actual serial/local-seat input and physical-response priority before either network class. For selected CYW43 only, a complete command belonging to the exact active authenticated connection may end its Network quantum and use the next existing hardware-free `Dispatch` turn before passive USB service debt. Its response advances only through the existing bounded connection-owned flush cursor; after any exact retained parent receives its current already-admitted turn, cursor completion hands passive USB debt the ordinary `Serial -> LocalSeat -> Dispatch` rotation before another buffered command. GENET and unauthenticated, stale-connection, physical-input, or response-tail cases retain the ordinary phase rotation. - Cross-task boundary (`m26b-net-control-priority` with `m26b-wifi-sdio-notification-dpc-closure`) — the root rule that an op7 terminal cannot promote a queued successor is unchanged. The only same-call continuation is inside one already-admitted CYW43 DPC runtime invocation after a normal exact `SteadyLease` child terminal: one bounded deterministic private `FifoWindow` `AdvanceState` transition may publish at most one next DPC child, which SDIO can issue only on its own later owner turn. `OrdinaryContinuation`, `RxQuantumBoundary`, `RxQueueWait`, `RecoverySettle`, `CompleteEvent`, `DeferredOwner`, fault, and every other external-wait boundary remain later-turn. It creates no EventPump admission, priority episode, physical-operation burst, or authority path. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib net:: Checks: - Synthetic Wi-Fi data backlog cannot delay keyboard bytes or serial command echo. - Control traffic is not blocked behind bulk data queue pressure. A received DHCP Offer cannot remain head-of-line behind the next retained Discover TX terminal. - An exact authenticated CYW43 command dispatches in a separate hardware-free outer turn before passive USB service debt, while actual input and physical response tails still preempt it and continuous TCP cannot defer one post-cursor USB rotation. Deliverables: - Observable network-control/data scheduling contract for Pi 4 Wi-Fi and future high-performance drivers. Title/ID: m26b-rest-normalized-parity Goal: Reframe Wi-Fi performance proof as raw Pi Wi-Fi latency plus measured REST gateway overhead. Inputs: scripts/rest_perf_harness.py, docs/BENCHMARKS.md, apps/hive-gateway/src/main.rs, apps/cohsh/src/transport/tcp.rs. Changes: - scripts/rest_perf_harness.py — report raw/cold/hot modes separately and preserve no-retry failure accounting. - docs/BENCHMARKS.md — distinguish QEMU loopback capacity from Pi Wi-Fi physical proof. - apps/hive-gateway/src/main.rs — preserve cache/coalescing as host-side projection only; no write bypass. Commands: - .venv/bin/python -m pytest -q tests/test_rest_perf_harness.py - cargo run -p cohsh --features tcp -- --transport tcp --tcp-host --tcp-port 31337 --auth-token --script scripts/cohsh/boot_v0.coh - python3 scripts/rest_perf_harness.py --mode perf --rest-url --suite status --runs 20 --no-transient-retries Checks: - REST cold p95 is reported as raw `cohsh` p95 plus gateway overhead. - Hot projection results are labeled separately and cannot satisfy raw Wi-Fi hardware gates. Deliverables: - Honest Pi Wi-Fi benchmark model that optimizes toward QEMU semantics without claiming impossible physical loopback parity. Title/ID: m26b-benchmark-comparator Goal: Define and enforce same-harness QEMU-vs-Pi isolated runtime throughput parity while evaluating Pi latency against documented physical-network norms instead of QEMU loopback parity. Inputs: scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, tests/test_pi4_compare_driver_models.py, docs/BENCHMARKS.md, existing out/bench QEMU and Pi summaries. Changes: - scripts/rest_perf_harness.py or scripts/pi4_compare_driver_models.py — emit/compare benchmark provenance, reject mismatched workloads, and calculate pass/fail from throughput/error metrics only. - tests/test_rest_perf_harness.py and tests/test_pi4_compare_driver_models.py — cover matched PASS, throughput FAIL, workload mismatch, stale-artifact rejection, and latency-excluded verdict behavior. - docs/BENCHMARKS.md — document the best-QEMU selection rule, Pi artifact requirements, and latency-exclusion rule. Commands: - python3 -m pytest tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py Checks: comparator rejects stale or mismatched artifacts and produces deterministic PASS/FAIL for matched QEMU/Pi runs without using QEMU latency parity as a verdict metric; it still flags Pi wired NIC/Wi-Fi latency outside documented industry-normal physical LAN/control-plane ranges. Deliverables: benchmark comparator, tests, and documented parity rule. Title/ID: m26b-linked-runtime-counters Goal: Add bounded counters required to explain isolated runtime benchmark misses without UART spam. Inputs: crates/pi4-driver-abi, apps/pi4-driver-runtime, apps/root-task/src/hal/driver_task.rs, apps/root-task/src/drivers/driver_task_net.rs. Changes: - crates/pi4-driver-abi/src/** — fixed-layout counter fields for turns, drained descriptors, staged bytes, cache work, busy/backpressure, and overruns where existing records are insufficient. - apps/pi4-driver-runtime/src/** — update counters inside GENET, CYW43, SDIO, USB, HDMI, serial, and PCIe service loops. - apps/root-task/src/hal/driver_task.rs and apps/root-task/src/drivers/driver_task_net.rs — expose bounded, activity-gated counter snapshots through existing diagnostics/evidence surfaces. - scripts/pi4_trace_normalize.py + tests/test_pi4_trace_normalize.py — normalize `DRIVER_TASK_COUNTER_*` fields, reject empty or truncated counter lines through `DRIVER_TASK_COUNTER_INVALID`, and keep counters diagnostic-only. Commands: - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib drivers::driver_task_net - python3 -m pytest -q tests/test_pi4_trace_normalize.py Checks: counters are fixed-layout, bounded, non-authority-bearing, activity-gated, not updated from polling-loop atomics, normalized with `DRIVER_TASK_COUNTER_INVALID=0`, and do not change console grammar or Secure9P semantics. Deliverables: counter ABI, runtime updates, root-side evidence snapshots, normalizer guard fields, and tests. Title/ID: m26b-linked-driver-hotpath-closure Goal: Remove avoidable single-frame or single-descriptor overhead while preserving isolated runtime active-slot invariants. Inputs: apps/pi4-driver-runtime, crates/pi4-driver-abi, apps/root-task/src/hal/driver_task.rs, docs/DRIVERS.md. Changes: - apps/pi4-driver-runtime/src/** — bounded local batching for descriptor drain, cache maintenance, completion publication, and telemetry counters where benchmark evidence shows contention. - crates/pi4-driver-abi/src/** — fixed burst bounds and max-turn evidence where ABI fields are needed. - apps/root-task/src/hal/driver_task.rs — preserve staged active-slot submit, range validation, busy-on-conflict, and completion publication under batching. Commands: - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib Checks: batching is bounded, cannot overwrite active payload-bearing turns, and does not add root-owned physical-driver service. Deliverables: lower-contention isolated runtime hot paths with contract-local backpressure evidence. Title/ID: m26b-target-benchmark-proof Goal: Produce fresh same-harness QEMU and Pi 4 isolated runtime benchmark evidence before 26b closes. Inputs: scripts/rest_perf_harness.py, selected QEMU reference, Pi 4 serial capture, active wired or Wi-Fi profile, docs/TEST_PLAN.md. Changes: - out/bench/m26b-* — archived QEMU reference, Pi isolated runtime run, comparator output, and normalized serial evidence. - docs/BENCHMARKS.md — update benchmark verdict and artifact table after proof is produced. - docs/TEST_PLAN.md and scripts/ci/test_plan_run.sh — add 26b QEMU/Pi benchmark stages if not already covered by target-qualified runner configuration. Commands: - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26b-qemu-reference - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m26b-pi4-linked-runtime Checks: Pi isolated runtime throughput meets or exceeds the selected QEMU reference under matched workload/provenance, latency remains recorded and checked against documented industry-normal physical LAN/control-plane ranges but excluded from the QEMU-throughput parity verdict, and side proof lanes stay separate. Deliverables: fresh benchmark artifacts, comparator PASS/FAIL, normalized Pi proof, and updated benchmark docs. Title/ID: m26b-authenticated-cohsh-reboot Goal: Add an authenticated `cohsh reboot` command that works over TCP and local-seat without introducing a new in-VM listener or bypassing existing Queen secrets. Inputs: crates/cohsh-core/src/{verb.rs,command.rs,help.rs}, apps/cohsh/src/lib.rs, apps/cohsh/src/transport/tcp.rs, apps/root-task/src/{event/mod.rs,reboot.rs,kernel.rs}, scripts/pi4-image-build.sh, third_party/u-boot/configs/rpi_4_defconfig, docs/{HARDWARE_BRINGUP.md,INTERFACES.md,USERLAND_AND_CLI.md}. Changes: - crates/cohsh-core/src/* — add the shared `reboot` console verb and `REBOOT` ACK label so serial, TCP, cohsh, and local-seat parse the same command. - apps/root-task/src/reboot.rs + apps/root-task/src/kernel.rs — register the Pi 4 BCM2711 watchdog reset backend through HAL-owned device mapping, best-effort mark authenticated Pi resets as one-shot fast boots through a Cohesix-specific BCM2711 PM RSTS high marker before watchdog arming, report the retained watchdog software-reset status bit as diagnostics only, follow the BCM2711 PM WDOG/RSTC restart sequence for reset, and fail closed when that reset path is unavailable. - apps/root-task/src/event/mod.rs — require a secret-backed Queen session, emit `OK REBOOT detail=scheduled`, then defer the hardware reboot request long enough to flush the acknowledgement. - apps/cohsh/src/* — expose `cohsh reboot` through the existing authenticated TCP console flow and stop waiting for trailing lines once `OK REBOOT` is received. - scripts/pi4-image-build.sh + third_party/u-boot/configs/rpi_4_defconfig — generate a Pi 4 U-Boot script that loads saved `cohesix.env` policy, consumes and clears the authenticated reboot marker when visible, reports software-reset status as diagnostics only, enters the interactive Cohesix menu by default, and rejects stale U-Boot binaries that still use generic `bootflow scan`. - docs/USERLAND_AND_CLI.md + docs/snippets/cohsh_grammar.md — document reboot grammar and the TCP/local-seat authorization model. - docs/HARDWARE_BRINGUP.md + docs/INTERFACES.md — document the authenticated reboot fast-boot handoff and saved-policy behavior. Commands: - cargo test -p cohsh-core - cargo test -p cohsh --lib network_console_verbs_forward_to_transport - cargo test -p root-task reboot --lib - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib event::tests::local_seat_ticket_backed_reboot_schedules_backend_request - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: Bare `reboot` without an authenticated session fails; physical console/local-seat reboot requires a Queen ticket minted from the existing Queen secret; TCP reboot remains gated by the existing TCP auth token plus Queen session; Pi 4 reset access uses only HAL-mapped PM/watchdog registers; an authenticated Pi reset best-effort sets the Cohesix high RSTS marker without making marker readback a policy gate; the watchdog reset path follows the BCM2711 PM WDOG/RSTC restart sequence and fails closed if those reset-critical accesses are unavailable; the next generated U-Boot script load consumes high marker state before menu/input setup when present, reports the software-reset bit as diagnostics only, and enters the interactive Cohesix menu whose first action is `Boot with saved settings` or `Boot with default settings` as appropriate; the Pi 4 U-Boot default command sources `boot.scr.uimg` directly rather than entering EFI/bootflow scan. Deliverables: Shared reboot verb, host CLI forwarding, authenticated root-task scheduling, HAL-backed Pi 4 reboot backend, one-shot authenticated reboot marker diagnostics, preserved interactive splash/menu behavior, generated-script validation, and tests for denial/success paths. Title/ID: m26b-queen-log-evidence-dump Goal: Make `/log/queen.log` a bounded, useful Pi 4 benchmark evidence surface and expose a host-side dump workflow through `cohsh` and SwarmUI without changing console or Secure9P semantics. Inputs: apps/root-task/src/{log_buffer.rs,event/mod.rs,ninedoor.rs,bootstrap/log.rs}, apps/cohsh/src/lib.rs, apps/swarmui/src/{lib.rs,transport.rs}, apps/swarmui/frontend/{app.js,index.html,styles.css}, scripts/rest_perf_harness.py, docs/{HOST_TOOLS.md,USERLAND_AND_CLI.md,INTERFACES.md,TEST_PLAN.md}. Changes: - apps/root-task/src/log_buffer.rs — raise live `/log/queen.log` retention to 2048 lines, add sequence/eviction metadata if needed for evidence integrity, and preserve bounded line storage. - apps/root-task/src/event/mod.rs + apps/root-task/src/ninedoor.rs — export the retained log through chunked, non-lossy streaming so `cat`/`tail`/`log` do not allocate or copy a 2048-line snapshot in one pending buffer and `END` is emitted only after the final retained line. - apps/root-task/src/bootstrap/log.rs + selected audit call sites — keep high-rate driver chatter out of the log while adding curated benchmark evidence markers: boot/build/session identity, log retention metadata, benchmark start/end, host write summaries, policy/lifecycle denials, telemetry wrap/quota, and bounded backpressure/error summaries. - apps/cohsh/src/lib.rs — add `log dump ` as a host-only command that reads `/log/queen.log` through the existing transport, writes only payload lines to the destination, refuses existing files unless an explicit force form is documented, and preserves ACK/ERR/END grammar on the wire. - apps/swarmui/src/** + apps/swarmui/frontend/** — expose the same bounded log dump/read workflow as a SwarmUI projection over existing console/REST transport semantics, with no UI-owned evidence serializer, no second session in live console mode, and no hidden polling. - docs and tests — document the 2048-line bounded retention/export behavior, diagnostic contents, `cohsh log dump` usage after REST harness runs, SwarmUI workflow, and performance constraints. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib log_buffer event::tests - cargo test -p cohsh - cargo test -p swarmui - python3 -m pytest -q tests/test_rest_perf_harness.py Checks: `/log/queen.log` retains up to 2048 curated lines with explicit oldest-line eviction, host/UI dumps preserve every retained line without truncation, generic command streaming remains bounded per turn, Pi 4 benchmark hot paths do not gain high-rate log writes, `cohsh log dump` and SwarmUI use existing read semantics only, and REST harness benchmark evidence can identify the run, transport/session, recent control failures, backpressure, and retention window without relying on UART spam. Deliverables: 2048-line bounded queen log, non-lossy chunked dump path, curated benchmark evidence contents, `cohsh log dump` command, SwarmUI log dump/read projection, docs, and focused regression coverage. Compatibility baseline tasks below are retained because they describe the original 26b DHCP, U-Boot policy, Wi-Fi, and QEMU guardrails that must not regress. They did not close reopened 26b by themselves; accepted closure combined the USB/Wi-Fi driver-task and concurrency/benchmark gates above with the retained baseline checks below. Title/ID: m26b-dhcp-core-nostd Goal: Implement bare-bones, bounded DHCPv4 client logic for root-task networking. Inputs: apps/root-task/src/net/*, docs/INTERFACES.md, docs/SECURITY.md. Changes: - apps/root-task/src/net/dhcp.rs — deterministic DHCP state machine and packet parser (DISCOVER/OFFER/REQUEST/ACK only). - apps/root-task/src/net/mod.rs — integrate DHCP mode into existing net bootstrap sequencing. Commands: - cargo check -p root-task - cargo test -p root-task --features "kernel net-console" dhcp Checks: - Lease acquisition and timeout paths are bounded and test-covered. Deliverables: - `no_std` DHCP core integrated with deterministic diagnostics. Title/ID: m26b-uboot-net-policy Goal: Make wired/Wi-Fi DHCP policy compiler-authoritative with optional U-Boot-provided inputs. Inputs: configs/root_task.toml, tools/coh-rtc, apps/root-task/src/generated, docs/HARDWARE_BRINGUP.md. Changes: - tools/coh-rtc/src/* — add policy IR fields (`mode`, `interface`, DHCP bounds) and validation. - apps/root-task/src/generated/* — regenerated network policy constants/artifacts. - docs/HARDWARE_BRINGUP.md — document U-Boot policy source, fallback rules, and expected boot lines. Commands: - cargo test -p coh-rtc - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json Checks: - Invalid policy settings fail deterministically; valid settings generate stable artifacts. Deliverables: - Manifest/U-Boot-policy-driven DHCP mode selection with docs-as-built parity. Title/ID: m26b-uboot-network-wizard Goal: Add an interactive Pi 4 U-Boot network wizard with saved-config continue flow, bounded static IPv4 prompts, and optional logo display. Inputs: scripts/pi4-image-build.sh, third_party/u-boot/configs/rpi_4_defconfig, docs/HARDWARE_BRINGUP.md, docs/INTERFACES.md, docs/COHESIX_LOGO.png. Changes: - scripts/pi4-image-build.sh — generate an `askenv`-driven Pi 4 boot script that can continue with saved policy, choose DHCP vs static, choose wired vs Wi-Fi, collect bounded static IPv4 fields, persist only Cohesix policy to a dedicated FAT-side file, and optionally render a staged BMP logo on HDMI. - third_party/u-boot/configs/rpi_4_defconfig — enable the `askenv` and `bmp display` support required by the wizard while keeping the seL4-recommended Pi 4 USB baseline. - docs/HARDWARE_BRINGUP.md + docs/INTERFACES.md — document the wizard flow, persisted `coh_*` variables, bounded `/chosen/cohesix,*` static IPv4 properties, and the saved-config fast path. Commands: - bash -n scripts/pi4-image-build.sh - make -C third_party/u-boot rpi_4_defconfig - make -C third_party/u-boot CROSS_COMPILE=aarch64-linux-gnu- -j$(sysctl -n hw.ncpu) - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: - The first wizard action is `Boot with saved settings` when a coherent persisted network override exists; a logo-only or cleared policy presents `Boot with default settings`. - `Manual (static IPv4)` collects bounded static IPv4 fields and mirrors them into DTB `/chosen/cohesix,static-*` properties before handoff. - Review distinguishes `Boot once without saving` from `Save settings and restart`; saved-settings reset requires explicit confirmation, and a new Wi-Fi policy can be entered without deleting or reflashing the SD image. - The HDMI logo is optional: it renders when enabled and available, and boot still proceeds cleanly when it is disabled or cannot be staged. Deliverables: - Pi 4 U-Boot network wizard with deterministic saved-config continuation and optional logo display. Title/ID: m26b-pi4-wifi-dhcp-baseline Goal: Add minimal Pi 4 Wi-Fi path sufficient for DHCP-backed diagnostics connectivity. Inputs: apps/root-task/src/drivers/*, apps/root-task/src/hal/*, docs/ARCHITECTURE.md, docs/SECURITY.md. Changes: - apps/root-task/src/hal/* — add Pi 4 Wi-Fi HAL traits for SDIO host I/O, power/reset control, OOB/host-wake observation, and firmware/NVRAM/CLM handoff; default implementations must fail deterministically with `unsupported`. - apps/root-task/src/drivers/* — add a dedicated CYW43455/CYW43xx-class driver path that follows the reference shape `bwfm` -> Zephyr/WHD HAL split -> Linux `brcmfmac` (`sdio.c`, `firmware.c`, `cfg80211.c`) without lifting source. - apps/root-task/src/drivers/* — implement the Pi 4 SDIO transport path first (function-0 direct I/O, function-1/2 enable, mailbox/interrupt handling, bounded firmware download, NVRAM/CLM staging) before join/auth logic. - apps/root-task/src/net/* — bind Wi-Fi link state and Ethernet frame ingress/egress into the shared smoltcp bootstrap/DHCP flow without introducing any new in-VM listener surface. - docs/ARCHITECTURE.md + docs/SECURITY.md — update the network backend matrix, bounds, threat notes, silicon identification (Pi 4B uses CYW43455 over SDIO), and reference-only provenance (`bwfm` -> Zephyr/WHD HAL split -> `brcmfmac` edge-case guidance; no code lift). Commands: - cargo check -p root-task - cargo test -p root-task wifi:: -- --nocapture - rg -n "EFI_|boot_services|runtime_services|uefi::" apps/root-task/src tools/coh-rtc/src Checks: - Wi-Fi join + DHCP works when enabled and declared; failure modes remain deterministic and auditable. - Wi-Fi runtime/device access remains HAL-only; any non-HAL direct access path fails review. Deliverables: - Profile-gated CYW43xx Wi-Fi DHCP diagnostics path for Pi 4 with explicit reference-only provenance documentation. Title/ID: m26b-pi4-wifi-hal-foundation Goal: Add the HAL surface required to support Pi 4 Wi-Fi without any direct MMIO or firmware-service bypass in drivers. Inputs: apps/root-task/src/hal/*, apps/root-task/src/kernel.rs, docs/ARCHITECTURE.md. Changes: - apps/root-task/src/hal/mod.rs — add bounded SDIO, Wi-Fi control GPIO, OOB/host-wake, and firmware bundle traits/types with deterministic `unsupported` defaults. - apps/root-task/src/kernel.rs — keep Wi-Fi runtime rejection paths explicit until HAL-backed implementations are present. - docs/ARCHITECTURE.md — document HAL ownership of Pi 4 Wi-Fi transport/control resources. Commands: - cargo check -p root-task --no-default-features --features net-console - cargo test -p root-task hal:: -- --nocapture Checks: - All Wi-Fi transport/control operations are represented in HAL before any driver code depends on them. - Non-Pi4 or pre-implementation HALs fail deterministically with `unsupported`. Deliverables: - Auditable Wi-Fi HAL contract for subsequent 26b tasks. Title/ID: m26b-pi4-sdio-host-bringup Goal: Implement the Pi 4 SDIO host path needed by CYW43455. Inputs: apps/root-task/src/hal/*, apps/root-task/src/drivers/*, Pi 4 DTB/U-Boot handoff artifacts. Changes: - apps/root-task/src/hal/* — add Pi 4 SDIO host implementation for the BCM2835/BCM2711 SDIO controller used by the on-board Wi-Fi device. - apps/root-task/src/drivers/* — add bounded command/data path helpers for function-0 direct I/O and function-1/2 CMD53 transfers. - docs/HARDWARE_BRINGUP.md — record the Pi 4 SDIO host node/pin assumptions and bring-up evidence. Commands: - cargo check -p root-task - cargo test -p root-task sdio:: -- --nocapture Checks: - SDIO host init, clocking, bus-width changes, and direct/extended transfers are HAL-only and test-covered. Deliverables: - Pi 4 SDIO transport substrate for CYW43455. Title/ID: m26b-cyw43455-firmware-transport Goal: Bring the CYW43455 to a firmware-ready state with bounded mailbox and firmware/NVRAM/CLM handling. Inputs: apps/root-task/src/drivers/*, out/pi4-sd/*, docs/SECURITY.md. Changes: - apps/root-task/src/drivers/* — add CYW43455 reset/attach sequencing, core discovery, mailbox handling, firmware download, NVRAM application, and CLM load. - docs/SECURITY.md — document firmware provenance, bounds, and runtime trust assumptions for the bundled Pi 4 Wi-Fi blobs. Commands: - cargo check -p root-task - cargo test -p root-task cyw43:: -- --nocapture Checks: - Firmware bundle validation is bounded and deterministic. - Driver reaches a ready-for-join state without bypassing HAL. Deliverables: - CYW43455 transport/firmware path ready for association work. Title/ID: m26b-cyw43455-join-dhcp Goal: Complete Pi 4 Wi-Fi diagnostics connectivity by joining a network and binding the shared DHCP/bootstrap flow. Inputs: apps/root-task/src/net/*, apps/root-task/src/drivers/*, docs/INTERFACES.md, docs/HARDWARE_BRINGUP.md. Changes: - apps/root-task/src/drivers/* — add bounded open-network/WPA2-PSK join sequencing, link-state reporting, and audited failure reasons. - apps/root-task/src/net/* — route `wifi` and `auto` policy through the CYW43455 path while preserving single-active-interface guarantees. - docs/INTERFACES.md + docs/HARDWARE_BRINGUP.md — document required credentials handoff, join breadcrumbs, DHCP evidence, and operator workflow. Commands: - cargo check -p root-task - cargo test -p root-task wifi:: -- --nocapture - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml Checks: - `wifi` reaches link-up + DHCP when credentials are present. - `auto` prefers Wi-Fi only when the CYW43455 path is healthy and still exposes at most one active control-plane interface. Deliverables: - End-to-end Pi 4 Wi-Fi diagnostics path with DHCP and console reachability. Title/ID: m26b-pi4-wifi-hardware-validation Goal: Capture Pi 4 on-device evidence for CYW43455 join, DHCP, and deterministic historical `auto` compatibility behavior before closing the retained 26b compatibility baseline. Inputs: flashed Pi 4 SD image, serial capture, Linux known-good brcmfmac/MMC/SDHCI capture, U-Boot USB handoff trace, Wi-Fi credentials, direct-link/compatibility host setup, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md. Changes: - scripts/pi4_trace_normalize.py — normalize Pi 4 USB/Wi-Fi serial traces into JSONL/summary artifacts for boot-to-boot comparison. - docs/HARDWARE_BRINGUP.md — record the exact serial breadcrumbs, host commands, and observed IP/console evidence for a successful Wi-Fi boot. - docs/TEST_PLAN.md — add the final Pi 4 Wi-Fi validation transcript and `auto` fallback proof. Commands: - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml - minicom -D /dev/cu.usbserial-0001 -b 115200 -o -C pi4-serial.log - python3 scripts/pi4_trace_normalize.py pi4-serial.log --summary - python3 scripts/pi4_trace_normalize.py pi4-serial.log --gate-summary --expect USB_GATE=10 --expect USB_BLOCKER=none --expect WIFI_GATE=10 --expect WIFI_BLOCKER=none --expect WIFI_EXACT=none - python3 scripts/pi4_trace_normalize.py pi4-serial.log --gate-summary --expect USB_BOOTLOADER_HANDOFF_SEEN=no --expect USB_COLD_BOOT_SEEN=yes --expect BOOT_HALTED=no --expect TIMER_IRQ27_SEEN=no - python3 scripts/pi4_trace_normalize.py pi4-linux-known-good.log --domain wifi --summary - cargo run -p cohsh --features tcp -- --transport tcp --tcp-host --tcp-port 31337 --auth-token bootstrap Checks: - Normalized Cohesix, U-Boot, and Linux comparison traces preserve USB/Wi-Fi stages, blockers, and latest verdicts as machine-readable evidence. - Final Pi 4 USB acceptance requires `USB_COLD_BOOT_SEEN=yes`, command/event-ring proof before live Cohesix-owned root-port power assertion/readback/sampling/reset, and no Linux/U-Boot captured root-port enumeration. - Serial shows CYW43455 attach/join breadcrumbs followed by `[dhcp] lease bound ...`. - `netstats` / `netstatus` report the Wi-Fi lease on `policy=wifi`. - `auto` proves single-active-interface behavior; historical compatibility profiles may exercise absent-device wired fallback, while the physical driver-task profile treats selected-CYW43 attach/join/runtime failure as fatal driver evidence. Deliverables: - Pi 4 hardware validation evidence, normalized trace summaries, and known-good Linux/U-Boot comparison artifacts required to preserve the historical Milestone 26b compatibility baseline. Title/ID: m26b-qemu-compat-gate Goal: Prove 26/26a/26b changes do not break macOS/Linux QEMU backward compatibility. Inputs: scripts/qemu-run.sh, scripts/uboot/qemu-uboot-smoke.sh, regression fixtures, docs/TEST_PLAN.md. Changes: - docs/TEST_PLAN.md — add explicit compatibility matrix checks for macOS/Linux QEMU after 26/26a/26b. - scripts/ci/* — add guard checks that fail on console/protocol drift for existing QEMU fixtures. Commands: - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none - scripts/uboot/qemu-uboot-smoke.sh --net user Checks: - Existing QEMU fixtures on macOS/Linux remain passing with no operator-facing behavior regressions. Deliverables: - Auditable compatibility evidence for the Pi 4 bare-metal rollout milestones. Title/ID: m26b-nettest-interface-policy Goal: Extend `nettest` to honor 26b network policy (`wired|wifi|auto`) while enforcing a single active control-plane interface at runtime. Inputs: apps/root-task/src/net/*, tools/coh-rtc/src/*, apps/root-task/src/generated/*, docs/INTERFACES.md, docs/HARDWARE_BRINGUP.md. Changes: - apps/root-task/src/net/mod.rs + apps/root-task/src/net/stack.rs — add policy-aware interface selection for self-test execution and report active/standby interface state in `netstats`. - apps/root-task/src/net/dhcp.rs — surface bounded lease/state signals needed by `nettest` diagnostics for DHCP paths. - tools/coh-rtc/src/* + apps/root-task/src/generated/* — emit and validate nettest-relevant policy fields (`mode`, `interface`, retry/timing bounds) for `pi4-uboot-aarch64`. - docs/INTERFACES.md + docs/HARDWARE_BRINGUP.md — codify deterministic single-active-interface behavior and failover evidence requirements for `auto`. Commands: - cargo check -p root-task - cargo test -p root-task net:: -- --nocapture - cargo test -p coh-rtc - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json Checks: - `nettest` on `wired` and `wifi` policies executes against only the selected interface. - `auto` policy uses deterministic priority/failover, with at most one active TCP console interface at any moment. - Existing QEMU `nettest` behavior and host workflows remain backward compatible with no required command changes. Deliverables: - Policy-driven `nettest` behavior for Pi 4 DHCP milestones with explicit single-active-interface guarantees and compatibility evidence. Title/ID: m26b-swarmui-tauri2-host-upgrade Goal: Keep SwarmUI on the latest stable Tauri desktop line without changing Cohesix transport or UI semantics during the Pi 4 DHCP rollout. Inputs: apps/swarmui/*, scripts/setup_environment.sh, scripts/linux_host_tools_sync.sh, docs/HOST_TOOLS.md. Changes: - apps/swarmui/Cargo.toml + apps/swarmui/src-tauri/main.rs + apps/swarmui/tauri.conf.json — migrate SwarmUI from Tauri 1 to Tauri 2 while preserving the existing command surface, replay/bootstrap flow, CSP, and `window.__TAURI__` frontend bridge. - apps/swarmui/src-tauri/capabilities/default.json — add the minimum desktop capability set required by the Tauri 2 permission model. - apps/swarmui/tests/no_http_deps.rs — scope dependency-policy checks to the active desktop target so Tauri 2 mobile-only transitive crates do not create false failures. - scripts/setup_environment.sh + scripts/linux_host_tools_sync.sh + docs/HOST_TOOLS.md — align Linux runtime/build prerequisites to the Tauri 2 WebKitGTK 4.1 package line. Commands: - cargo check -p swarmui - cargo test -p swarmui Checks: - SwarmUI keeps the existing host-side command/invoke surface and passes its replay, cache, security, transcript, and console-parity tests after the Tauri 2 migration. - Linux host setup/build scripts install WebKitGTK 4.1 packages required by Tauri 2. - No new Cohesix protocol verbs, transports, or UI authority are introduced. Deliverables: - SwarmUI upgraded to the current Tauri 2 desktop line with host-tool packaging and test coverage kept in sync. Title/ID: m26b-swarmui-spectrum-shell Goal: Rebuild the SwarmUI desktop shell around Spectrum Web Components while preserving Cohesix transport semantics, replay behavior, and Live Hive rendering. Inputs: apps/swarmui/frontend/*, tools/swarmui-ui-tests/*, docs/USERLAND_AND_CLI.md. Changes: - apps/swarmui/frontend/index.html + app.js + components/console.js + styles/* — adopt a vendored Spectrum-based shell (`sp-theme`, `sp-button`, `sp-textfield`, `sp-picker`, `sp-divider`) for operator controls while preserving all current IDs, panel outputs, and Pixi-backed Live Hive behavior. - apps/swarmui/frontend/vendor/spectrum.bundle.js — self-host the exact Spectrum Web Components bundle needed by SwarmUI so Tauri/release builds remain offline-safe and CDN-free. - tools/swarmui-ui-tests/tests/swarmui.spec.js + screenshots — update the Playwright harness for Spectrum-backed text fields/buttons, keep replay/canvas coverage intact, and add shell regression checks for ticket minting and control wiring. - docs/USERLAND_AND_CLI.md — record that SwarmUI ships a vendored Spectrum shell while remaining a presentation-only frontend over existing Cohesix transports. Commands: - cargo check -p swarmui --all-targets - cargo clippy -p swarmui --all-targets -- -D warnings - cargo test -p swarmui - cd tools/swarmui-ui-tests && npm test Checks: - SwarmUI keeps the same Tauri command surface, replay/bootstrap flow, and Live Hive polling semantics after the Spectrum shell migration. - The shell remains self-hosted for Tauri/release bundles with no CDN requirement and no new transport authority. - Playwright coverage exercises the Spectrum-backed controls without weakening existing Live Hive and transcript assertions. Deliverables: - World-class SwarmUI shell using vendored Spectrum Web Components with replay-safe UI regression coverage and warning-free SwarmUI Rust builds. ``` --- ## Milestone 26c — Regression-Gated Refactor + Surface Audit (Zero-Regression) [Milestones](#Milestones) **Why now (reviewer trust):** Milestones 25-26b establish technical capability, transport breadth, Pi 4 bring-up evidence, and isolated runtime benchmark closure, but the implementation has accumulated visible scaffolding, duplicated validation paths, long runtime modules, and uneven characterization coverage. Milestone 26c is the aggressive refactor window after isolated runtime benchmark closure and before seL4 15 realignment: it inventories tracked Markdown authoring surfaces, records docs-as-built truth, expands characterization and boundary gates, and then permits broad behavior-preserving refactors across Cohesix-authored host tools, root-task adapters, HAL-facing network code, tests, and public documentation. Cleanup is complete only when the target-qualified staged Test Plan passes on both QEMU and Pi 4 with evidence that external behavior did not drift. **Current planning status:** Complete. The documentation-only task `m26c-readme-linked-doc-suite-remediation`, including its preservation and newcomer-glossary follow-ups, completed on 15 July 2026. The later correction that removed fabricated LoRa-radio semantics was authorized and closed separately under Milestone 18; it does not leave Milestone 26c open. Historical release snapshots remain immutable, and their superseded wording is recorded in `docs/audit/M26C_DOC_DRIFT_LEDGER.md`. Milestone 26d reopened only the truth and evidence attached to the former Worker-execution, endpoint-cap, notification, and applied-scheduling claims. The helper loops and generated badge/scheduling records remain useful model artifacts, but they did not establish a loaded Worker image, TCB, CSpace, VSpace, delivered cap, or target invocation. The historical implementation tasks below are inactive and retained for traceability only; they may not be executed under this reopening. Actual Worker objects, endpoint authority, notifications, or MCS scheduling require a future explicitly authorized atomic task that also satisfies the 26d MCS and root-TCB decision gates. Milestone 26e owns root-service and Worker task isolation plus the SMP+MCS architecture and target acceptance; Milestone 27d validates mixed-load operator scheduling on that accepted architecture, and Milestone 27e owns production Worker ticket/lease ledger binding, complete driver-inventory projection, and structured quarantine/evidence. Other accepted 26c QEMU/Pi evidence remains historical and is not invalidated by this correction. The original QEMU and Pi 4 closure remains accepted. QEMU closure is anchored by `out/test-plan/m26c-qemu` and Stage 05 due-diligence root `out/audit/gate/20260628T015332Z`. Pi 4 closure is anchored by the final wired GENET boot in `/Users/lukasbower/pi4-serial-20260629-135454.log`, paired USB-Ethernet capture `/Users/lukasbower/tcpdump-usb-eth-20260629-135504.pcap`, runtime/DMA proof bundle `out/test-plan/m26c-pi4-live/pi4-runtime-dma-proof-genet-latest.env`, direct TCP proof `out/test-plan/m26c-pi4-live/cohsh-tcp-proof-genet-latest.txt`, and Stage 05 due-diligence root `out/audit/gate/20260629T061204Z`. That accepted proof is wired GENET at `192.168.10.50` with `PI4_RUNTIME_DMA_PROOF=fresh-pi`, `PI4_RUNTIME_DMA_COUNTER_PROOF=counter-qualified`, `TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, DHCP-bound TCP `cohsh`, and REST/gateway validation. It does not substitute for current-image Milestone 26d Pi 4 revalidation. **Non-negotiable constraints:** - No protocol, namespace, ACK/ERR/END, telemetry, manifest, console grammar, Secure9P, or release-behavior drift may hide under a "refactor", "cleanup", or "humanizing" label. - Refactors are behavior-preserving only: extraction, decomposition, deduplication, typed-error cleanup, naming cleanup, and invariant documentation after characterization coverage exists for the touched surface. - The earlier named Worker architecture, phase-1 cap-backed endpoint, notification-lifecycle, and MCS tasks are inactive historical proposals. No 26c behavior change is authorized by this truth-correction reopening. - Future Worker/root-task isolation and the one SMP+MCS QEMU/Pi transition must land and obtain target acceptance in Milestone 26e. Milestone 29b optimizes that accepted scheduler with core-local service buckets, Milestone 27d proves mixed-load operator responsiveness on it, and Milestone 27e binds production Worker ticket/lease ledgers, projects the already complete driver inventory, and adds structured quarantine/evidence. Each requires its own post-behavior external-contract baseline. - The target-qualified staged runner is an enabling blocker, not merely closure polish. `scripts/ci/test_plan_run.sh --target qemu|pi4` and `scripts/ci/check_test_plan.sh` must exist and agree before cleanup or structural decomposition can start. - Humanization is evidence-first and mostly subtractive: delete generic boilerplate before rewriting, keep comments only for invariants/bounds/authority/failure behavior, and make the AI-fingerprint audit an independent gate. - Simplicity must be measured, not asserted. Cleanup/refactor waves must show reduced duplication, clearer ownership, fewer generic comments, smaller or better-named hot modules where practical, and no new abstraction unless it removes real repetition or isolates authority. - Every cleanup/refactor wave must be bisectable: one owned surface, one preserved-contract list, one characterization artifact, one scorecard entry, one targeted test subset, and final QEMU/Pi staged-run compatibility evidence before milestone closure. - Generated snippets, generated reports, tracked release snapshots, append-only audit evidence, seL4/reference mirrors, and vendored Markdown are update-by-source or inventory-only surfaces. Do not hand-edit them for style. - VM-side Cohesix remains `no_std`; shared semantic helpers must be `no_std` by construction and must not pull host transport, filesystem, process, network, or provider crates into VM closure profiles. - HAL remains the only path for device authority, MMIO, DMA publication, IRQ binding, physical-address handling, firmware-service handoff, and cache-maintenance policy. SDIO/USB seams are extraction-only and must not introduce new hardware support or a parallel driver framework. - Pi 4 DMA truth is `bounded_no_iommu`: bounded HAL-managed DMA ownership and evidence, not malicious-device DMA confinement or SMMU/IOMMU isolation. - Linked Pi 4 runtime-image specs, `pi4-driver-abi`, runtime CPIO staging, owner-state descriptors, the 26b SDIO acceptance state, and fresh-Pi hardware proof remain separate evidence states; generated eligibility or QEMU proof is not board closure. Milestone 26c may audit and preserve this evidence split, but SDIO graduation belongs to 26b. - Isolated runtime performance evidence is counter-qualified: valid `DRIVER_TASK_COUNTER` snapshots, owner-state proof, and same-harness Pi benchmark evidence do not close latency claims unless the Pi profile proves `timers-arch-counter` with `TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, and `DUMMY_TIMER_SEEN=no`. Dummy-timer captures, stale serial logs, or physical-counter/timer-control exports leave performance proof red. - Multi-agent execution is mandatory. Each lane must leave a checked-in or attached handoff with inputs, files touched or intentionally skipped, commands, artifact paths, blockers, deferrals, residual gaps, and PASS/FAIL status. - Milestone closure requires a clear/deferred blocker ledger, complete lane handoffs, green task gates, and full target-qualified staged Test Plan PASS on QEMU and Pi 4 with no `INCOMPLETE` markers. ### Prerequisite - Reopened Milestones **26a** and **26b** completed or explicitly scoped for this historical 26c dependency, including checked-in Pi 4 USB/serial/HDMI responsiveness evidence under wired and Wi-Fi load, driver-task scheduling evidence, arch-counter timer-backend proof, GENET/static compatibility evidence, DHCP/Wi-Fi compatibility evidence, QEMU compatibility evidence, regenerated profile-specific manifest evidence, isolated `pi4-driver-*` runtime image/ABI evidence, and explicit closure or deferral of any runtime-image owner-state proof boundary. ### Goal Humanize and simplify Cohesix-authored code and documentation without losing behavioral proof. The milestone succeeds only if the audit artifacts, characterization gates, accepted runtime additions, cleanup refactors, generated outputs, and QEMU/Pi 4 staged evidence all agree on the as-built system. The former Worker behavior proposals below are retained as inactive history and are not part of the accepted implementation set. ### Execution Order Later phases may start only when earlier phase gates are complete for the touched surface or explicitly deferred in `docs/audit/M26C_AS_BUILT_BLOCKERS.md` with dependency impact. | Phase | Purpose | Tasks | Gate | | --- | --- | --- | --- | | 0 | Scope, ownership, blockers | `m26c-as-built-blocker-ledger`, `m26c-target-qualified-runner-baseline`, `m26c-refactor-map-and-risk-ratchet`, lane setup in `M26C_AGENT_HANDOFFS.md` | No unowned files, hidden blockers, missing target-qualified runner contract, missing sub-agent lanes, or unmeasured simplification targets. | | 1 | Documentation and provenance truth | `m26c-authoring-charter-and-header-rules`, `m26c-ai-fingerprint-authorship-review`, `m26c-markdown-inventory-and-disposition`, `m26c-mermaid-as-built-diagram-audit`, `m26c-docs-as-built-audit`, `m26c-runtime-boundary-and-semantic-parity-audit` | Inventories, drift ledger, AI-fingerprint audit, parity matrix, and generated-source dispositions are complete. | | 2 | Accepted runtime additions and superseded Worker proposals | Accepted: `m26c-pi-runtime-dma-proof-closure`, `m26c-dma-protection-profile-truth`, and the non-Worker baseline evidence. Inactive history: `m26c-worker-architecture-implementation`, `m26c-cap-backed-worker-endpoints`, `m26c-notification-backed-worker-lifecycle`, and `m26c-worker-driver-mcs-budget-evidence`. | Accepted Pi/runtime behavior remains compiler-declared and tested. Inactive Worker proposals supply no implementation claim; 26e owns complete Worker isolation plus linked-driver SMP+MCS authority, 29b owns later core-local optimization, and 27e owns production Worker ledger binding, driver-inventory projection, and structured quarantine/evidence. | | 3 | Refactor safety gates | `m26c-characterization-gates-before-refactor`, `m26c-no-std-boundary-gates` | Cleanup-sensitive behavior and VM dependency closures are pinned before structural edits. | | 4 | Humanization and structural cleanup | `m26c-low-risk-surface-cleanup`, `m26c-host-tool-structural-cleanup`, `m26c-root-task-runtime-decomposition`, `m26c-hal-network-and-local-seat-decomposition` | Each cleanup wave is bisectable and starts only after its characterization artifact, preserved-contract list, owner, scorecard entry, and target test subset are recorded; risk-ratchet does not regress and HAL/no_std/protocol boundaries hold. | | 5 | Closure | `m26c-full-test-plan-qemu-and-pi4` | QEMU and Pi 4 staged Test Plan runs pass with target-qualified artifacts and no incomplete markers. | ### Documentation Scope The Markdown and Mermaid lanes cover only tracked Markdown returned by `git ls-files '*.md' | sort`. Ignored build output, local evidence folders, caches, virtualenvs, and nested external checkouts are excluded unless the main Cohesix repository tracks them. The inventory must cover root docs, app/crate/tool READMEs, `docs/**/*.md`, audit registers, dated audit snapshots, checklists, generated compliance reports, snippets, release snapshots, tracked `seL4/**/*.md`, and tracked `third_party/**/*.md`. Each entry must be classified as one of: human-edited canonical source, live audit register, append-only audit evidence, generated report, generated snippet, release snapshot, vendored reference, or external reference mirror. Mermaid blocks inherit the disposition of their containing file unless the Mermaid inventory records a stricter update rule. ### Required Artifacts Task blocks below own the exact file changes, commands, checks, and deliverables. At milestone level, closure requires these artifact families: - Audit control: `docs/audit/M26C_AS_BUILT_BLOCKERS.md`, `M26C_AGENT_HANDOFFS.md`, `M26C_TARGET_RUNNER_BASELINE.md`, `M26C_REFACTOR_MAP.md`, `M26C_REFACTOR_RISK_RATCHET.csv`, `M26C_REFACTOR_OWNERSHIP.md`, `M26C_SIMPLICITY_SCORECARD.md`, `M26C_POST_BEHAVIOR_BASELINE.md`. - Documentation truth: `M26C_MARKDOWN_INVENTORY.{csv,md}`, `M26C_MERMAID_INVENTORY.csv`, `M26C_MERMAID_GITHUB_RENDER_AUDIT.md`, `M26C_DOCS_AS_BUILT_AUDIT.md`, `M26C_DOC_DRIFT_LEDGER.md`, `M26C_AI_FINGERPRINT_AUDIT.md`. - Runtime boundaries: `M26C_RUNTIME_BOUNDARY_AUDIT.md`, `M26C_NINEDOOR_PARITY_MATRIX.md`, VM-target dependency trees, generated manifest/snippet hashes, Pi 4 runtime/DMA proof classification, arch-counter timer-backend proof, and DMA protection profile evidence. - Worker/runtime implementation evidence: worker architecture tests, cap-backed endpoint negative tests, notification lifecycle tests, then-current scheduling evidence, isolated runtime ABI tests, and fresh-source provenance for staged Pi runtime artifacts. - Cleanup evidence: before/after characterization for each refactor wave, risk-ratchet review, no-std/HAL boundary evidence, simplification scorecard entries, and authoring cleanup decisions tied back to as-built facts. - Closure evidence: QEMU and Pi 4 state dirs with `stage_01.done` through `stage_05.done`, required target artifacts present before `stage_05.done`, no incomplete markers, due-diligence outputs, and a final planner reconciliation of all sub-agent handoffs. ### Commands - `git ls-files '*.md' | sort > out/audit/m26c_markdown_inventory.txt` - `cut -d, -f1 docs/audit/M26C_MARKDOWN_INVENTORY.csv | sed '1d' | sort > out/audit/m26c_markdown_inventory_checked_in.txt` - `diff -u out/audit/m26c_markdown_inventory.txt out/audit/m26c_markdown_inventory_checked_in.txt` - `scripts/ci/mermaid_inventory.py --markdown-list out/audit/m26c_markdown_inventory.txt --out docs/audit/M26C_MERMAID_INVENTORY.csv` - `scripts/ci/check_mermaid_github.sh --markdown-list out/audit/m26c_markdown_inventory.txt` - `scripts/ci/render_mermaid_github.sh --markdown-list out/audit/m26c_markdown_inventory.txt --out out/audit/m26c-mermaid-rendered` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/check-generated.sh` - `cargo fmt --all -- --check` - `cargo clippy --workspace --all-targets -- -D warnings` - `cargo check --workspace` - `cargo test --workspace` - `cargo audit` - `cargo deny check advisories` - `rg -n "unsafe|unwrap\\(|expect\\(|panic!" apps crates tools` - `rg -n "robust|flexible|seamless|world-class|comprehensive|easy to use|powerful|simple and intuitive|AI-generated|generated by" README.md CONTRIBUTING.md AGENTS.md docs apps crates tools` - `rg -n "Defines the|Provides the|CLI entry point|library surface|module for|This module" apps crates tools docs README.md CONTRIBUTING.md AGENTS.md` - `cargo test -p secure9p-core` - `cargo test -p nine-door --test integration` - `cargo test -p coh --features mock` - `cargo test -p cohsh` - `cargo test -p cohsh-core` - `cargo test -p host-ticket-agent` - `cargo test -p gpu-bridge-host` - `cargo test -p hive-gateway` - `python3 -m pytest tools/cohesix-py/tests -q` - `cargo test -p root-task --tests` - `cargo test -p root-task --lib` - `cargo test -p worker-heart` - `cargo test -p worker-gpu` - `cargo test -p worker-lora` - `cargo test -p pi4-driver-abi` - `cargo test -p pi4-driver-runtime` - `cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev"` - `cargo tree -p root-task --target aarch64-unknown-none -e normal --no-default-features --features "cohesix-dev" > out/audit/m26c_root_task_tree_qemu.txt` - `cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console"` - `cargo tree -p root-task --target aarch64-unknown-none -e normal --no-default-features --features "kernel bootstrap-trace serial-console net-console" > out/audit/m26c_root_task_tree_pi4.txt` - `cargo check -p pi4-driver-runtime --target aarch64-unknown-none` - `scripts/ci/check_test_plan.sh` - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26c-qemu` - `scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4` ### Closure Gates - Every task block below satisfies its own Commands, Checks, and Deliverables; any skipped command has a documented environment blocker and remediation owner in the 26c handoff log. - The target-qualified runner contract is implemented and checked before Phase 4 begins; `--target qemu|pi4` is not allowed to remain a milestone-closing TODO while cleanup is underway. - The blocker ledger is clear or explicitly deferred to named later milestones, and no deferred item is used as satisfied evidence. - Markdown, Mermaid, docs-as-built, AI-fingerprint, runtime-boundary, NineDoor parity, refactor-map, risk-ratchet, and sub-agent handoff artifacts all exist and agree with generated/source truth. - Pi 4 runtime/DMA evidence separates generated eligibility, target compile, QEMU proof, fresh hardware proof, 26b SDIO owner-state evidence, and full board closure; Pi 4 DMA wording remains `bounded_no_iommu` and never implies SMMU/IOMMU isolation. Milestone 26c does not reopen SDIO graduation. - Pi 4 performance evidence separates valid `DRIVER_TASK_COUNTER` snapshots, owner-state proof, same-harness benchmark evidence, and timer-backend proof; any missing or dummy timer backend keeps latency proof red even when runtime/DMA proof is otherwise present. - Worker-heart, worker-gpu, and worker-lora helper loops are model/build artifacts only. The Worker execution, badged endpoint invocation, notification delivery, and applied scheduling gates are reopened until a selected target loads and runs the declared child objects. - `docs/audit/M26C_POST_BEHAVIOR_BASELINE.md` preserves the accepted non-Worker behavior snapshot and explicitly supersedes the earlier Worker-execution interpretation. - Cleanup/refactor waves have before/after characterization, preserve console/Secure9P/manifest/telemetry/release behavior, keep HAL-only device authority, keep VM builds `no_std`, and do not increase non-test risk indicators without approved exceptions. - Each cleanup/refactor wave is small enough to revert independently and records owner, touched surface, preserved contracts, characterization artifact, targeted test subset, before/after result, and scorecard delta. - `M26C_SIMPLICITY_SCORECARD.md` records before/after evidence for touched high-value surfaces: boilerplate removed, duplicated logic collapsed, module/function boundaries improved, docs shortened or clarified, and any net complexity increase justified by required worker/runtime behavior or tests. - Workspace baseline checks (`fmt`, `clippy -D warnings`, `check`, `test`, `cargo audit`, and `cargo deny check advisories`) pass or have scoped blockers recorded before closure. - QEMU and Pi 4 staged Test Plan runs both pass through `stage_05.done`, contain required target artifacts, and contain no incomplete markers. - Final closure evidence includes representative before/after diffs, inventories, audits, generated-artifact proof, QEMU/Pi 4 state dirs, due-diligence outputs, and a planner reconciliation of every sub-agent lane. ### Compiler / docsystem touchpoints - `coh-rtc` generated snippets referenced by `docs/snippets/*.md` remain authoritative; 26c may only change their source schemas or generators, never hand-edit the derived snippet text. - `docs/nist/REPORT.md` remains generated from its source registry; 26c may only update it through the proper generator flow. - Mermaid diagrams inside generated, release-derived, vendored, or reference-only Markdown follow the same disposition rules as their containing file; 26c may audit and report them, but edits must occur through the proper source, release-cut, or provenance flow. - Tracked release-cut documentation under `releases/RELEASE_NOTES-*.md`, `releases/*/{README.md,QUICKSTART.md,RELEASE_NOTES.md}`, `releases/*/docs/**/*.md`, and `releases/*/python/**/README.md` remains derived from canonical docs and release packaging; if snapshot wording changes, the corresponding release-cut flow and notes must change in the same work. Release-local validation outputs under `releases/**/out/**`, embedded virtualenv content under `releases/**/.venv*/**`, and other untracked byproducts are provenance inputs only and are not part of the 26c inventory. - `docs/TEST_PLAN.md`, `scripts/ci/test_plan_run.sh`, `scripts/ci/check_test_plan.sh`, and the stage scripts become authoritative for both QEMU and Pi 4 `PASS` semantics. - Generated `root_task.driver_images` records, `crates/pi4-driver-abi`, isolated `pi4-driver-*` runtime image artifacts, and driver-runtime CPIO packaging are authoritative boundary artifacts for Pi 4 driver-task cleanup; 26c may audit, test, and refactor around them only without changing acceptance status or hand-editing generated descriptors. - Pi 4 runtime/DMA proof fields, descriptor resource totals, owner-state evidence, and source artifact freshness are 26c audit/test-plan surfaces; later operator tooling may project them only after this milestone defines the evidence semantics. - Pi 4 timer-backend fields are 26c audit/test-plan surfaces for performance claims. The accepted Pi profile uses read-only EL0 virtual-counter telemetry only when `KernelArmExportVCNTUser` / `CONFIG_EXPORT_VCNT_USER` is enabled, scales elapsed-time proof from `TIMER_CLOCK_HZ`, and rejects physical counter or EL0 timer-control exports for isolated runtime latency evidence. - DMA protection profile fields are compiler-owned surfaces. Pi 4 profiles must resolve to bounded no-IOMMU discipline, while SMMU-backed profiles are future hardware targets that require generated per-device DMA-domain state before code or docs may claim hardware-enforced isolation. - Any future shared semantic helpers introduced to reduce host/VM drift must remain explicitly `no_std`-safe, must not import host-side capabilities, transports, or provider crates into the VM build, and must be reviewed against the archived per-profile dependency trees. - Worker role manifests, ticket scopes, lease bindings, telemetry paths, and lifecycle-model gates are compiler-owned surfaces. Current generated roles are non-executable; any future implementation field must enter `coh-rtc` IR and generated docs before code depends on it. - Cap-backed Worker endpoint and notification fields remain compiler-owned but disabled. Reserved badge values are not minted caps or delivered events; enabling them requires the reopened target-execution task and matching negative/target evidence. - Worker and driver scheduling fields are compiler-owned and profile-qualified. Current Worker non-MCS values are metadata because no Worker TCB consumes them; driver-task applied scheduling evidence remains a separate implemented lane. Any MCS profile must generate and prove its budget/period, timeout, donation, and consumed-budget contract. - Refactor-generated module boundaries must not become new public interfaces unless `docs/INTERFACES.md`, `docs/HOST_TOOLS.md`, or the relevant canonical doc is updated in the same change. - HAL/network decompositions must retain generated manifest authority for boot policy defaults and must not hand-code policy values that already belong in `root_task.toml` or `coh-rtc` outputs. ### Task Breakdown ``` Title/ID: m26c-as-built-blocker-ledger Goal: Record and gate current as-built mismatches before 26c cleanup or downstream milestones claim alignment. Inputs: docs/BUILD_PLAN.md, AGENTS.md, docs/SECURE9P.md, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, docs/SECURITY_NIST_800_53.md, docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, configs/root_task_pi4_uboot_aarch64.toml, scripts/ci/test_plan_run.sh, apps/root-task/src/net/**, apps/root-task/src/drivers/**, apps/root-task/src/hal/**, apps/root-task/src/ninedoor.rs, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, apps/worker-heart/src/kernel.rs, apps/worker-gpu/src/kernel.rs, scripts/release_bundle.sh Changes: - docs/audit/M26C_AS_BUILT_BLOCKERS.md — checked-in blocker ledger with owner, severity, dependency impact, evidence command, and closure/defer decision for each initial blocker. - docs/BUILD_PLAN.md — keep 26c and later milestones synchronized with blocker disposition changes. - docs/TEST_PLAN.md — reference target-qualified evidence expectations once the runner is implemented. Commands: - rg -n "TCP_SMOKE_PORT|31339" apps/root-task scripts docs - rg -n "read_volatile|write_volatile|from_exposed_addr|phys|MMIO" apps/root-task/src/drivers apps/root-task/src/serial - cargo test -p secure9p-codec - scripts/ci/check_test_plan.sh Checks: - Initial blocker entries cover 26b evidence, isolated Pi 4 runtime-image acceptance gaps, Pi 4 network IR/docs validation drift, target-qualified runner, Secure9P path validation, non-console in-VM TCP, HAL MMIO ownership, generated-doc drift, fixture/default secrets, placeholder auth defaults, worker-task docs/implementation mismatch, and later-milestone as-built overclaims for persistence, `coh-status`, delegated REST identity, writer-epoch fencing, AI namespace roots, and AWS/ENA/IMDS support. - No structural cleanup task starts until blockers are fixed or explicitly deferred with dependency impact. Deliverables: - Auditable 26c blocker ledger that prevents downstream milestones from inheriting unresolved as-built drift silently. Title/ID: m26c-target-qualified-runner-baseline Goal: Make target-qualified staged-run semantics real before any cleanup or structural decomposition depends on them. Inputs: docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, scripts/ci/test_plan_run.sh, scripts/ci/test_plan_stage_*.sh, scripts/ci/check_test_plan.sh, scripts/pi4-image-build.sh, scripts/uboot/qemu-uboot-smoke.sh Changes: - scripts/ci/test_plan_run.sh — add explicit `--target qemu|pi4` selection, write target metadata into the shared state dir, pass the selected target to every stage, and reject unsupported target/stage combinations before a stage can write misleading evidence. - scripts/ci/test_plan_run.sh + scripts/ci/test_plan_common.sh — add explicit `--iteration` rerun semantics and per-stage input fingerprints so focused reruns cannot be mistaken for target-qualified PASS and stale earlier evidence is detected before later-stage reuse. - scripts/ci/test_plan_stage_*.sh — consume the selected target and write target-qualified stage markers, logs, iteration markers, input fingerprints, and incomplete records without treating QEMU artifacts as Pi 4 proof or Pi 4 hardware logs as QEMU proof. - scripts/ci/test_plan_stage_05_due_diligence.sh + scripts/ci/due_diligence_gate.sh — permit Stage 05 to validate and reuse fresh Stage 03 regression evidence from the same state dir while leaving standalone due-diligence exhaustive by default. - scripts/ci/check_test_plan.sh — enforce that docs, runner usage, stage scripts, and target matrix language agree. - docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md — document the QEMU/Pi 4 target matrix, target-specific prerequisites, allowed stage combinations, state-dir metadata, and PASS/INCOMPLETE interpretation. - docs/audit/M26C_TARGET_RUNNER_BASELINE.md — checked-in evidence for runner syntax, target matrix, smoke commands, intentionally unsupported combinations, and the rule that Phase 4 cleanup cannot start without this gate. Commands: - scripts/ci/test_plan_run.sh --list - scripts/ci/test_plan_run.sh --target qemu --stage 1 --state-dir out/test-plan/m26c-runner-qemu-smoke - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26c-runner-pi4-smoke - scripts/ci/check_test_plan.sh Checks: - `--target qemu|pi4` is accepted by the runner, recorded in the state dir, and visible to every stage script. - Unsupported target/stage combinations fail before producing `stage_*.done` or target-qualified PASS evidence. - Focused `--iteration` runs write only `stage_*.iteration` / `stage_*..iteration` plus input fingerprints, never PASS markers. - `COHSH_BATCH_GROUPS` subsets are iteration-only; final Stage 03 and due-diligence runs require the full regression batch or verified reuse of a fresh full Stage 03 batch. - The checker fails if docs mention runner commands, stage matrices, or closure criteria that the scripts do not implement. - No Phase 4 cleanup or structural decomposition task may start until this runner baseline is present and PASS. Deliverables: - Target-aware staged-runner contract and smoke evidence available early enough to guard all later cleanup. Title/ID: m26c-authoring-charter-and-header-rules Goal: Replace generic repository-wide authoring templates with explicit human-authored comment, header, and documentation rules. Inputs: AGENTS.md, CONTRIBUTING.md, README.md, docs/CODING_GUIDELINES.md, docs/API_GUIDELINES.md, docs/BUILD_PLAN.md Changes: - AGENTS.md — narrow file-header requirements to legal/provenance metadata plus rules for when comments are required. - CONTRIBUTING.md — codify review expectations for comment quality, diff shape, subtractive cleanup, and no-regression sequencing. - README.md — align contributor-facing quality language with the new authoring policy. - docs/CODING_GUIDELINES.md — define acceptable doc-comment content, prohibited template phrasing, when generic comments should be deleted rather than rewritten, and behavior-preserving cleanup rules. - docs/API_GUIDELINES.md — require interface docs to describe contracts, invariants, and failure modes instead of file/module summaries. Commands: - rg -n "Purpose:|Defines the|Provide(s)? the|CLI entry point|library and public module surface|module for" AGENTS.md CONTRIBUTING.md README.md docs/CODING_GUIDELINES.md docs/API_GUIDELINES.md - cargo fmt --all -- --check Checks: - Repository guidance no longer instructs contributors to write generic file-summary boilerplate. - Header and comment rules are internally consistent across canonical contributor documents. Deliverables: - Canonical authoring policy for human-readable code and docs without hidden behavior changes. Title/ID: m26c-ai-fingerprint-authorship-review Goal: Make authored code, docs, tests, and examples read as repository-native work rather than template or model-generated filler. Inputs: README.md, CONTRIBUTING.md, AGENTS.md, docs/**/*.md, apps/**/README.md, crates/**/README.md, tools/**/*.md, apps/**/src/**/*.rs, crates/**/src/**/*.rs, tools/**/*.rs, tools/cohesix-py/**/*.py, tests/**/*.rs, docs/audit/M26C_MARKDOWN_INVENTORY.csv, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_REFACTOR_MAP.md Changes: - docs/audit/M26C_AI_FINGERPRINT_AUDIT.md — checked-in audit of generic phrasing, template comments, repetitive cadence, inflated adjectives, placeholder examples, and non-specific test names, with delete/rewrite/defer decisions and evidence links. - docs/audit/M26C_AGENT_HANDOFFS.md — record the independent authorship-review lane, reviewer, inspected surfaces, commands, residual gaps, and PASS/FAIL decision. - README.md + CONTRIBUTING.md + docs/CODING_GUIDELINES.md + docs/API_GUIDELINES.md — document authorship expectations and the difference between required provenance metadata and low-value boilerplate. - Cohesix-authored docs, comments, tests, and examples classified as low-risk by `M26C_REFACTOR_MAP.md` — delete or rewrite AI-fingerprint findings without changing behavior, grammar, fixture outputs, generated snippets, release snapshots, vendored references, or append-only audit evidence. Commands: - rg -n "robust|flexible|seamless|world-class|comprehensive|easy to use|powerful|simple and intuitive|AI-generated|generated by" README.md CONTRIBUTING.md AGENTS.md docs apps crates tools - rg -n "Defines the|Provides the|CLI entry point|library surface|module for|This module" apps crates tools docs README.md CONTRIBUTING.md AGENTS.md - cargo fmt --all -- --check - scripts/check-generated.sh Checks: - Every finding is classified as delete, rewrite, acceptable-as-specific, generated/do-not-edit, release-derived, vendored/reference-only, append-only, or deferred with rationale. - Rewritten prose names the actual Cohesix contract, invariant, failure mode, evidence path, or operator-visible behavior instead of using generic praise or template structure. - Generated snippets, release snapshots, vendored references, and append-only audit evidence are not hand-edited to satisfy style. - An independent reviewer lane signs off in `docs/audit/M26C_AGENT_HANDOFFS.md` before low-risk cleanup or public documentation polish is marked complete. Deliverables: - Checked-in AI-fingerprint/authorship audit and cleanup evidence that make first-read code and documentation feel specific, technical, and maintained. Title/ID: m26c-markdown-inventory-and-disposition Goal: Inventory and disposition every tracked Markdown file in the main Cohesix repository so canonical, generated, release-derived, append-only, and vendored docs are handled correctly. Inputs: `git ls-files '*.md' | sort`, root/project docs, apps/**/README.md, crates/**/README.md, docs/**/*.md, tracked release-cut docs, seL4/**/*.md, tests/integration/README.md, tools/**/*.md, third_party/**/*.md Changes: - docs/audit/M26C_MARKDOWN_INVENTORY.csv — authoritative checked-in inventory/disposition source for every tracked Markdown file returned by `git ls-files '*.md'`. - docs/audit/M26C_MARKDOWN_INVENTORY.md — rendered human-readable report derived from the checked-in inventory source. - docs/BUILD_PLAN.md — record milestone scope, disposition rules, and inventory obligations. - docs/REPO_LAYOUT.md — document Markdown path classes and which ones are canonical, derived, or vendored. - docs/SECURITY.md — capture documentation provenance rules for generated, release, and vendored Markdown when they influence audit evidence. Commands: - git ls-files '*.md' | sort > out/audit/m26c_markdown_inventory.txt - cut -d, -f1 docs/audit/M26C_MARKDOWN_INVENTORY.csv | sed '1d' | sort > out/audit/m26c_markdown_inventory_checked_in.txt - diff -u out/audit/m26c_markdown_inventory.txt out/audit/m26c_markdown_inventory_checked_in.txt Checks: - Every tracked repository Markdown file is accounted for exactly once in the checked-in inventory. - Each entry has an explicit disposition and an update rule. - The rendered report is mechanically derived from the machine-readable source. Deliverables: - Auditable Markdown inventory and disposition source/report pair covering canonical docs, release snapshots, audit evidence, reference mirrors, and vendored material. Title/ID: m26c-mermaid-as-built-diagram-audit Goal: Inventory, validate, and refine every Mermaid diagram in tracked Markdown so Cohesix visual documentation is as-built, review-grade, and 100% GitHub-online compatible. Inputs: `git ls-files '*.md' | sort`, README.md, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/HOST_TOOLS.md, docs/USE_CASES.md, docs/FAILOVER.md, docs/GPU_NODES.md, docs/NETWORK_CONFIG.md, docs/SECURE9P.md, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md, docs/audit/M26C_MARKDOWN_INVENTORY.csv, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, apps/root-task/src/hal/**, apps/root-task/src/net/**, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/nine-door/src/host/**, configs/root_task*.toml Changes: - docs/audit/M26C_MERMAID_INVENTORY.csv — checked-in inventory of every Mermaid block in tracked Markdown with file, heading, diagram type, disposition, owner, as-built evidence source, GitHub compatibility status, and update rule. - docs/audit/M26C_MERMAID_GITHUB_RENDER_AUDIT.md — render evidence for every edited or newly added diagram, including GitHub-online proof or the exact compatibility check path used. - scripts/ci/mermaid_inventory.py — produce the Mermaid inventory from the tracked Markdown list without scanning ignored build outputs or local evidence directories. - scripts/ci/check_mermaid_github.sh + scripts/ci/render_mermaid_github.sh — fail on unsupported GitHub Mermaid syntax and render all accepted diagrams into 26c audit evidence. - README.md + docs/*.md + apps/**/README.md + crates/**/README.md + tools/**/*.md — refine stale or underspecified Mermaid diagrams; add new diagrams where canonical docs lack visual explanation of as-built contracts. - docs/ARCHITECTURE.md — add or refine a HAL architecture Mermaid diagram if the as-built audit shows HAL ownership, driver boundaries, or host/VM capability separation is not clear enough for external review. Commands: - git ls-files '*.md' | sort > out/audit/m26c_markdown_inventory.txt - scripts/ci/mermaid_inventory.py --markdown-list out/audit/m26c_markdown_inventory.txt --out docs/audit/M26C_MERMAID_INVENTORY.csv - scripts/ci/check_mermaid_github.sh --markdown-list out/audit/m26c_markdown_inventory.txt - scripts/ci/render_mermaid_github.sh --markdown-list out/audit/m26c_markdown_inventory.txt --out out/audit/m26c-mermaid-rendered Checks: - Every Mermaid block in tracked Markdown is inventoried exactly once and classified as canonical human-edited, generated/regenerate-only, release-derived, vendored/reference-only, append-only audit evidence, or external reference mirror. - Edited and newly added diagrams render correctly in GitHub online and avoid unsupported Mermaid features such as custom init directives, raw HTML labels, external assets, theme CSS, local renderer extensions, or experimental diagram syntax unless GitHub-online proof is archived. - Canonical diagrams describe the as-built system with enough detail to show authority boundaries, HAL ownership, host/VM separation, generated-manifest authority, Secure9P paths, worker roles, Pi 4 boot/network flows, and operator-visible control/data paths. - Diagram changes do not contradict generated snippets, manifests, fixtures, test-plan evidence, or the 26c blocker ledger. Deliverables: - Review-grade GitHub-renderable Mermaid diagram set with inventory, compatibility proof, and as-built traceability for every tracked Markdown diagram. Title/ID: m26c-refactor-map-and-risk-ratchet Goal: Freeze the aggressive refactor scope, ownership, preserved contracts, simplicity targets, and risk-ratchet baseline before structural edits begin. Inputs: docs/BUILD_PLAN.md, docs/audit/EXCEPTIONS.md, docs/audit/findings.csv, apps/**/src/**/*.rs, crates/**/src/**/*.rs, tools/**/src/**/*.rs, tools/cohesix-py/**/*.py, scripts/ci/*.sh Changes: - docs/audit/M26C_REFACTOR_MAP.md — classify each Cohesix-authored candidate as no-touch, low-risk cleanup, characterization-first refactor, boundary-sensitive refactor, or deferred, and assign each accepted wave a single owned surface, preserved-contract list, characterization artifact, target test subset, and rollback-sized scope. - docs/audit/M26C_SIMPLICITY_SCORECARD.md — record before/after simplification targets for high-value authored surfaces: duplicate branches/helpers to collapse, generic comments to delete, large modules/functions to split or explicitly defer, docs to shorten, abstractions that must justify their existence, and the post-wave scorecard delta. - docs/audit/M26C_REFACTOR_RISK_RATCHET.csv — record the non-test `unsafe`, `unwrap`, `expect`, and `panic!` baseline plus allowed exceptions and reviewer sign-off requirements. - docs/audit/M26C_REFACTOR_OWNERSHIP.md — assign disjoint ownership for host tools, root-task adapters, HAL/network, docs/audit, and staged-run plumbing. - docs/BUILD_PLAN.md — keep 26c scope synchronized with the checked-in map if refactor lanes are added or deferred. Commands: - rg -n "unsafe|unwrap\\(|expect\\(|panic!" apps crates tools - rg -n "Defines the|Provides the|CLI entry point|library surface|module for|This module|robust|flexible|seamless" apps crates tools docs README.md CONTRIBUTING.md AGENTS.md - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings Checks: - Every structural refactor target has a named owner, preserved external contracts, required characterization evidence, and an explicit rollback-sized scope. - Every accepted Phase 4 wave is independently reviewable and revertible, with its own target test subset and baseline comparison path. - Every cleanup/refactor target has a concrete simplicity target or a written deferral reason; "cleaned up" without before/after evidence is not acceptable closure. - New abstractions are accepted only when the scorecard shows they remove meaningful duplication, isolate authority, reduce module pressure, or make an invariant easier to audit. - Non-test risk indicators do not increase unless an approved exception is recorded before merge. - Deferred high-risk refactors have a concrete reason instead of being silently skipped. Deliverables: - Checked-in refactor map, simplicity scorecard, ownership plan, and risk-ratchet baseline that make aggressive cleanup auditable. Title/ID: m26c-docs-as-built-audit Goal: Audit canonical documentation against the actual generated and observed system before any humanizing prose cleanup lands. Inputs: docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/HOST_TOOLS.md, docs/SECURE9P.md, docs/SECURITY.md, docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, docs/USERLAND_AND_CLI.md, docs/BOOT_REFERENCE.md, docs/FAILURE_MODES.md, docs/OPERATOR_WALKTHROUGH.md, README.md, docs/snippets/*.md, apps/root-task/src/generated/*, configs/generated/root_task_resolved.json, tracked release-cut docs under releases/**, staged test evidence, scripts/ci/check_test_plan.sh Changes: - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md — trace each canonical doc surface to generated snippets, manifests, fixtures, release artifacts, or staged-run evidence. - docs/audit/M26C_DOC_DRIFT_LEDGER.md — record docs/script drift discovered during the audit and the closure evidence for each item. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/HOST_TOOLS.md + docs/SECURE9P.md + docs/SECURITY.md + docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md + docs/USERLAND_AND_CLI.md + docs/BOOT_REFERENCE.md + docs/FAILURE_MODES.md + docs/OPERATOR_WALKTHROUGH.md + README.md — correct any prose that does not match the current as-built system before tone cleanup begins. - docs/snippets/*.md + tracked release-cut docs under releases/** — verify provenance and regeneration paths; update only through the proper source or release-cut flow. - scripts/ci/check_test_plan.sh — update whenever 26c changes authoritative test-plan commands, stage semantics, or target-qualified PASS requirements. Commands: - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - scripts/ci/check_test_plan.sh Checks: - Canonical docs can be traced to current manifests, generated snippets, fixtures, release snapshots, script behavior, or staged-run evidence. - Any docs/script drift is corrected or explicitly deferred with scope-safe rationale before humanizing edits are accepted. Deliverables: - Auditable docs-as-built report and drift ledger proving documentation truth before presentation cleanup. Title/ID: m26c-readme-linked-doc-suite-remediation Milestone: Milestone 26c — Regression-Gated Refactor + Surface Audit / documentation-closure defects discovered during Milestone 26d Goal: Maintain the human-authored documents linked directly or transitively from `README.md` as one concise, production-grade, as-built suite without changing system behavior or generated truth. Inputs: README.md, its directly linked human-authored Markdown documents, historical glossary-bearing revisions of docs/HOST_TOOLS.md and docs/USERLAND_AND_CLI.md, AGENTS.md, docs/BUILD_PLAN.md, docs/HOST_API.md, resources/openapi/hive-gateway.yaml, docs/audit/M26C_MARKDOWN_INVENTORY.csv, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_DOC_DRIFT_LEDGER.md, docs/audit/M26C_MERMAID_INVENTORY.csv, configs/root_task*.toml, configs/generated/root_task_resolved.json, docs/snippets/*.md, current CLI help, source/tests, current target-qualified evidence, and the Milestone 26d Pi 4 proof boundary. Changes: - README.md — present current scope, evidence status, supported targets, safe getting-started paths, and a categorized documentation map without release or hardware overclaiming. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURE9P.md + docs/ROLES_AND_SCHEDULING.md + docs/DRIVERS.md — establish non-overlapping ownership for architecture, external contracts, protocol invariants, role/scheduling policy, and physical-driver methodology. - docs/USERLAND_AND_CLI.md + docs/HOST_TOOLS.md + docs/API_GUIDELINES.md + docs/PYTHON_SUPPORT.md + docs/FAILURE_MODES.md + docs/OPERATOR_WALKTHROUGH.md — establish one operator journey, one tool catalogue, and cross-referenced API, Python, and recovery guidance grounded in current command help and fixtures. - resources/openapi/hive-gateway.yaml + docs/HOST_API.md — correct the machine-readable placement of the existing optional `TAIL lines` query and replace the stale duplicated schema mirror with a concise link-backed operator reference, without changing gateway behavior. - docs/USE_CASES.md + docs/HARDWARE_BRINGUP.md + docs/BOOT_REFERENCE.md + docs/GPU_NODES.md + docs/BENCHMARKS.md — separate implemented capability, current proof, historical evidence, candidate deployment patterns, and planned work; keep flash, current-image boot, transport, and benchmark proof lanes distinct. - docs/BUILD_PLAN.md — record this restoration-only scope and return 26c to `Complete` only after every check below passes. - docs/OPERATOR_RECIPES.md — when needed, own task-oriented evidence, mount, lifecycle, PEFT, and federation workflows so the canonical walkthrough remains one ordered journey. - docs/GLOSSARY.md — own plain-language definitions for Cohesix-specific terms and the foundational OS, security, protocol, AI, hardware, and proof concepts needed to understand them; link to owning contract documents rather than restating full schemas or limits. - CONTRIBUTING.md + docs/QUICKSTART.md + docs/SECURITY.md + docs/TOOLCHAIN_MAC_ARM64.md — keep the transitive onboarding and project-governance perimeter consistent with current security, validation, release, and seL4 16 requirements. - Canonical Mermaid blocks — retain only diagrams that materially clarify an as-built boundary or sequence; validate both syntax and semantic ownership against code, manifests, and current evidence. - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md + docs/audit/M26C_DOC_DRIFT_LEDGER.md + docs/audit/M26C_MERMAID_INVENTORY.csv + docs/audit/M26C_MERMAID_GITHUB_RENDER_AUDIT.md + docs/audit/M26C_AGENT_HANDOFFS.md + docs/audit/M26C_SIMPLICITY_SCORECARD.md — refresh the live audit records with source anchors, before/after size and ownership evidence, lane handoffs, and the final Mermaid inventory/render result. Commands: - git ls-files '*.md' | sort > out/audit/m26c-doc-remediation-markdown.txt - scripts/ci/mermaid_inventory.py --markdown-list out/audit/m26c-doc-remediation-markdown.txt --out docs/audit/M26C_MERMAID_INVENTORY.csv - scripts/ci/check_mermaid_github.sh --markdown-list out/audit/m26c-doc-remediation-markdown.txt - scripts/ci/render_mermaid_github.sh --markdown-list out/audit/m26c-doc-remediation-markdown.txt --out out/audit/m26c-doc-remediation-mermaid-rendered - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --list - python3 scripts/ci/check_driver_test_coverage.py - cargo check --workspace - cargo test -p hive-gateway - git diff --check Checks: - Every directly linked canonical document has one stated purpose, an explicit as-built or planning boundary, retained 2026 Lukas Bower metadata, and useful cross-references instead of copied contracts. - Every transitive onboarding, contribution, security, and toolchain guide reached from the suite is current, secret-safe, reproducible, and consistent with the charter. - Durable public namespace, record, derivation, evidence-pack, driver-profile, and simulation contracts remain documented even when generated mirrors and historical debug prose are removed. - Every Cohesix-specific term used by the README documentation map is defined for a newcomer or points to a more specific canonical definition; collision-prone terms such as LoRA prose versus lowercase `lora` identifiers, NineDoor/NineDoorBridge, host/target, mock/QEMU/hardware, and source/resolved manifest are explicitly distinguished. - Selected-profile manifests, resolved output, generated snippets, current source/tests, and target-qualified evidence remain authoritative; generated snippets are linked or reproduced only through their generator and are not hand-edited. - Current QEMU evidence, accepted historical Pi 4 evidence, current-image Pi 4 revalidation, Wi-Fi research status, host-only integrations, and future milestones are never presented as interchangeable proof. - All local links and referenced anchors resolve, code fences are balanced, Markdown is structurally consistent, and every active Mermaid block passes the GitHub compatibility checker plus an available CLI render pass. - No runtime command, endpoint implementation, namespace, ACK/ERR/END behavior, authority path, release snapshot, or hardware acceptance state changes under the documentation rewrite; the OpenAPI correction describes existing handler behavior. Deliverables: - A reviewable README-linked documentation suite with clear information ownership, materially less repetition, complete GitHub-compatible diagrams, and validation evidence. Title/ID: m26c-runtime-boundary-and-semantic-parity-audit Goal: Document the intentional host `std` / VM `no_std` runtime split and prove overlapping NineDoor semantics remain aligned without runtime convergence. Inputs: apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/root-task/src/log_buffer.rs, apps/root-task/src/lib.rs, apps/root-task/src/net/**, apps/root-task/src/hal/**, apps/root-task/src/local_seat.rs, apps/root-task/tests/**, apps/nine-door/src/host/*.rs, apps/nine-door/tests/*.rs, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURE9P.md, docs/SECURITY.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_REFACTOR_MAP.md Changes: - docs/audit/M26C_RUNTIME_BOUNDARY_AUDIT.md — record VM TCB boundaries, forbidden host-side capabilities in the VM, and adapter ownership of host/VM surfaces. - docs/audit/M26C_NINEDOOR_PARITY_MATRIX.md — enumerate overlapping host/VM semantics, expected outputs, and evidence paths for each parity claim. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURE9P.md + docs/SECURITY.md — replace any ambiguous "eventual merge" language with explicit boundary language: separate adapters, shared contracts only. - apps/nine-door/tests/*.rs + apps/root-task/tests/** and host-mode root-task bridge tests — add or extend parity coverage for overlapping operator-visible surfaces without changing protocol grammar. Commands: - cargo test -p nine-door --test integration - cargo test -p root-task --tests - cargo test -p root-task --lib - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json Checks: - Checked-in audit artifacts state clearly that VM-side Cohesix remains `no_std` and that host `std` capability is not a valid convergence target. - Every overlapping host/VM semantic surface in the parity matrix has either passing test evidence from the relevant `apps/nine-door` and `root-task` test suites or an explicit host-only/VM-only disposition. - Canonical docs describe the runtime split as intentional architecture rather than an accidental temporary inconsistency. Deliverables: - Auditable runtime-boundary report and semantic-parity matrix that establish the proof surface required before boundary-sensitive runtime refactors. Title/ID: m26c-pi-runtime-dma-proof-closure Goal: Define and prove Pi 4 isolated runtime descriptor, DMA, owner-state, and artifact-freshness evidence before 26c cleanup or later operator tooling cites the runtime path as closed. Inputs: apps/root-task/src/hal/**, apps/root-task/src/local_seat.rs, apps/root-task/src/generated/**, apps/pi4-driver-runtime/src/**, crates/pi4-driver-abi/src/**, configs/root_task_pi4_uboot_aarch64.toml, scripts/pi4-image-build.sh, scripts/ci/test_plan_run.sh, docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md Changes: - crates/pi4-driver-abi/src/** — add or tighten descriptor-resource tests for runtime MMIO, DMA, shared-buffer, IRQ, bus-alias, and framebuffer ranges emitted by generated Pi 4 driver-image records. - apps/pi4-driver-runtime/src/** — add runtime tests that classify DMA reservation/allocation and owner-state evidence without relying on root-owned fallback paths. - apps/root-task/src/hal/** + apps/root-task/src/local_seat.rs — surface bounded evidence for DMA arena reservation, bus-address publication, cache maintenance, runtime-init descriptor delivery, and hardware-state handoff while preserving HAL-only authority. - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md + docs/TEST_PLAN.md + docs/HARDWARE_BRINGUP.md — define absent, stale, generated-only, target-build, QEMU, fresh Pi hardware proof, valid counter snapshot, and arch-counter timer-backend proof states and require source artifact provenance for each claim. - scripts/ci/test_plan_run.sh + stage checks where needed — fail 26c Pi closure if runtime/DMA proof is absent, stale, or inferred from generated eligibility alone. Commands: - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo test -p root-task --tests - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml - scripts/pi4_gate_proof.sh --require-driver-task-proof - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4 Checks: - Runtime-image eligibility, descriptor resource totals, DMA reservation/allocation evidence, owner-state fields, and source artifact freshness are reported separately. - Missing DMA proof is a blocking absent-evidence state, not inferred success from manifest generation, target compilation, QEMU smoke output, or stale serial logs. - Isolated runtime performance proof requires valid `DRIVER_TASK_COUNTER` evidence plus Pi arch-counter proof (`TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, `DUMMY_TIMER_SEEN=no`); counters alone remain diagnostic. - DMA ownership, cache maintenance, bus-address publication, runtime-init descriptor delivery, and hardware handoff remain behind HAL/generated interfaces with no direct MMIO or ad-hoc physical-address path. - Fresh Pi evidence, when claimed, names the exact serial log, manifest hash, image build, and test-plan state directory used for the claim. Deliverables: - 26c-owned Pi 4 runtime/DMA proof semantics and evidence gates strong enough for later operator tools to project read-only summaries without defining acceptance. Title/ID: m26c-dma-protection-profile-truth Goal: Add compiler-owned DMA protection profiles that state Pi 4 as bounded no-IOMMU DMA discipline and reserve SMMU-backed isolation claims for future hardware profiles. Inputs: tools/coh-rtc/src/ir.rs, tools/coh-rtc/src/validate.rs, configs/root_task_pi4_uboot_aarch64.toml, configs/root_task.toml, apps/root-task/src/hal/**, docs/ARCHITECTURE.md, docs/HARDWARE_BRINGUP.md, docs/SECURITY.md, docs/TEST_PLAN.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md Changes: - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/validate.rs — add a generated DMA protection profile enum such as `none`, `bounded_no_iommu`, `smmu_v2`, and `smmu_v3`, with Pi 4 profiles required to resolve to `bounded_no_iommu`. - configs/root_task_pi4_uboot_aarch64.toml + generated manifests/snippets — record Pi 4 DMA as HAL-mediated bounded DMA ownership, not hardware-enforced IOMMU/SMMU isolation. - apps/root-task/src/hal/** — expose profile-specific evidence fields for bounded arenas, descriptor validation, bus-address publication, cache maintenance, buffer quarantine, and absent SMMU capability. - docs/ARCHITECTURE.md + docs/HARDWARE_BRINGUP.md + docs/SECURITY.md + docs/TEST_PLAN.md — document the Pi 4 limitation, prohibit SMMU/IOMMU isolation wording for BCM2711, and define the future SMMU hardware contract separately. - docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md — add a docs-as-built check that rejects diagrams, prose, or evidence claims that imply Pi 4 malicious-device DMA confinement. Commands: - cargo test -p coh-rtc dma_protection - cargo test -p root-task --tests dma - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - rg -n "IOMMU|SMMU|hardware-enforced DMA|DMA isolation" docs README.md AGENTS.md Checks: - Pi 4 manifests and docs resolve to bounded no-IOMMU DMA discipline and explicitly refuse hardware-enforced SMMU/IOMMU isolation claims. - Bounded Pi 4 DMA evidence covers per-driver arenas, descriptor validation, bus-address publication, cache maintenance, quarantine/reuse policy, and fresh proof provenance. - Future `smmu_v2` or `smmu_v3` profiles cannot be enabled unless generated per-device DMA-domain state, StreamID/context-bank or equivalent IO-space mapping policy, fault evidence, and revoke/unmap semantics are present. - No public doc, Mermaid diagram, evidence pack, or operator output describes BCM2711/Pi 4 as providing malicious-device DMA confinement. Deliverables: - Review-grade DMA protection vocabulary that keeps Pi 4 claims honest while preserving a clean path to real SMMU-backed targets. Inactive historical proposal — superseded as active Milestone 26c work and not authorized by the truth-correction reopening: Title/ID: m26c-worker-architecture-implementation Status: Inactive and superseded as active 26c work; retained for historical traceability only. Goal: Replace placeholder kernel-side worker GPU/LoRA paths with real seL4 worker ticket, lease, telemetry, and revocation loops matching public Queen/Worker documentation. Inputs: apps/worker-heart/src/**, apps/worker-gpu/src/**, apps/worker-lora/src/**, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/lifecycle.rs, apps/root-task/src/generated/**, tools/coh-rtc/src/**, crates/cohesix-ticket/**, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/GPU_NODES.md, docs/WORKER_TICKETS.md, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/TEST_PLAN.md Changes: - apps/worker-heart/src/kernel.rs — implement the VM-side heartbeat worker loop that attaches with a scoped worker ticket, emits bounded telemetry to the documented worker path, observes lifecycle/revocation state, and exits deterministically on shutdown. - apps/worker-gpu/src/kernel.rs + apps/worker-gpu/src/lib.rs — replace placeholder spin/stub behavior with a no_std worker loop that consumes WorkerGpu tickets, reads lease/model pointers through the documented namespace, emits GPU lease/job telemetry receipts, and never touches CUDA/NVML or raw GPU hardware. - apps/worker-lora/src/lib.rs + apps/worker-lora/src/common.rs — implement the VM-side LoRA worker control/telemetry loop for ticket-scoped adapter/model lifecycle receipts while keeping training, TensorRT, CUDA, and PEFT execution host-side. - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** + apps/root-task/src/lifecycle.rs — publish worker namespace entries, ticket-gated attach state, lease/lifecycle revocation signals, and bounded telemetry paths needed by the VM workers without changing Secure9P grammar. - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/validate.rs + generated snippets — add worker-role implementation state, ticket scopes, lease paths, telemetry bounds, shutdown/revoke policy, and docs-as-built validation so public worker claims are compiler-aligned. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/GPU_NODES.md + docs/WORKER_TICKETS.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/TEST_PLAN.md — update public Queen/Worker behavior to match the implemented seL4 worker loops and host-only GPU/PEFT boundaries. Commands: - cargo test -p worker-heart - cargo test -p worker-gpu - cargo test -p worker-lora - cargo test -p root-task --tests worker - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - cargo check -p worker-heart --target aarch64-unknown-none - cargo check -p worker-gpu --target aarch64-unknown-none - cargo check -p worker-lora --target aarch64-unknown-none Checks: - Worker-heart, worker-gpu, and worker-lora no longer rely on placeholder kernel spin loops for public VM worker semantics. - Each worker loop uses scoped tickets and documented namespace paths, emits bounded telemetry/receipts, and handles lease expiry, lifecycle cut, revocation, and shutdown deterministically. - GPU and LoRA workers remain control-plane workers only: CUDA, NVML, TensorRT, PEFT training/import execution, and raw hardware access stay host-side. - Generated manifests and docs agree on which worker roles are implemented, which paths they may access, and which telemetry/lease bounds apply. - Existing console grammar, Secure9P framing, ACK/ERR/END behavior, and host-side worker helper APIs do not drift. Deliverables: - Real seL4 worker architecture matching public Queen/Worker docs, with host/VM boundaries and tests strong enough for 26c closure. Inactive historical proposal — superseded as active Milestone 26c work and not authorized by the truth-correction reopening: Title/ID: m26c-cap-backed-worker-endpoints Status: Inactive and superseded as active 26c work; retained for historical traceability only. Goal: Make first-phase VM worker tickets cap-backed by requiring badged seL4 endpoint capabilities for worker attach, telemetry, lease renewal, and revocation-sensitive paths. Inputs: apps/root-task/src/lifecycle.rs, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/generated/**, apps/worker-heart/src/**, apps/worker-gpu/src/**, apps/worker-lora/src/**, tools/coh-rtc/src/**, crates/cohesix-ticket/**, docs/WORKER_TICKETS.md, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/INTERFACES.md Changes: - apps/root-task/src/lifecycle.rs + apps/root-task/src/event/** — mint role/lease/epoch-badged endpoint caps for worker attach, control, telemetry, and revoke-sensitive receipt paths; retain the parent cap path needed to revoke derived lease caps. - apps/root-task/src/ninedoor.rs — reject worker attach, telemetry append, lease-renewal, and receipt paths when only ticket metadata is present and no matching badged endpoint cap was invoked. - apps/worker-heart/src/** + apps/worker-gpu/src/** + apps/worker-lora/src/** — replace metadata-only ticket presentation with endpoint-cap invocation in the worker loops while preserving bounded no_std behavior. - tools/coh-rtc/src/** + generated snippets — add the historical proposal's phase-1 cap-backed-ticket fields for endpoint badges, lease epochs, role scopes, revoke behavior, and explicit deferred full-cap-bundle status. This design was never accepted; Milestone 26e now owns the complete live Worker bundle and Milestone 27e only adds production ticket/lease ledger binding. - docs/WORKER_TICKETS.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md — document Cohesix tickets as audit records backed by badged endpoint caps for VM worker authority. Commands: - cargo test -p root-task --tests worker - cargo test -p worker-heart - cargo test -p worker-gpu - cargo test -p worker-lora - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - cargo check -p worker-heart --target aarch64-unknown-none - cargo check -p worker-gpu --target aarch64-unknown-none - cargo check -p worker-lora --target aarch64-unknown-none Checks: - Forged ticket strings or stale ticket metadata without the corresponding badged endpoint cap cannot attach as a worker, renew a lease, emit accepted telemetry, or publish a valid receipt. - Revocation deletes or invalidates the derived endpoint caps and late invocations from the old lease epoch fail deterministically. - Historical generated manifests and docs would have distinguished phase-1 endpoint-cap-backed tickets from later work; active planning instead requires complete live bundles in Milestone 26e and production ledger binding in Milestone 27e. - Existing Secure9P grammar, console ACK/ERR/END behavior, and host-ticket schemas do not drift. Deliverables: - First-phase cap-backed VM worker ticket authority with concrete seL4 endpoint caps and negative tests, without overclaiming full frame/notification/DMA cap-bundle isolation. Inactive historical proposal — superseded as active Milestone 26c work and not authorized by the truth-correction reopening: Title/ID: m26c-notification-backed-worker-lifecycle Status: Inactive and superseded as active 26c work; retained for historical traceability only. Goal: Replace lifecycle polling dependency with generated seL4 notification objects for worker revoke, shutdown, lease expiry, telemetry pressure, and driver IRQ wakeups. Inputs: apps/root-task/src/lifecycle.rs, apps/root-task/src/event/**, apps/root-task/src/hal/**, apps/root-task/src/generated/**, apps/worker-heart/src/**, apps/worker-gpu/src/**, apps/worker-lora/src/**, apps/pi4-driver-runtime/src/**, tools/coh-rtc/src/**, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/INTERFACES.md, docs/TEST_PLAN.md Changes: - tools/coh-rtc/src/** — add generated notification lifecycle fields and badge classes for revoke, shutdown, lease-expiry, telemetry-pressure, and IRQ events where applicable. - apps/root-task/src/lifecycle.rs + apps/root-task/src/event/** — publish notification caps/badges to worker loops and signal lifecycle changes without introducing new protocols or namespace grammar. - apps/root-task/src/hal/** + apps/pi4-driver-runtime/src/** — keep driver IRQ delivery notification-backed and expose bounded evidence for notification badges and acknowledgement behavior. - apps/worker-heart/src/** + apps/worker-gpu/src/** + apps/worker-lora/src/** — wait on endpoint IPC plus notification delivery for lifecycle changes, and remove unbounded lifecycle polling from worker loops. - docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md + docs/TEST_PLAN.md — document the historical notification-backed lifecycle proposal and badge meanings. This design was never accepted; Milestone 26e now owns complete lifecycle/completion notification authority and Milestone 27e only binds the accepted Worker bundle to production ticket/lease ledgers. Commands: - cargo test -p root-task --tests worker - cargo test -p root-task --tests notification - cargo test -p worker-heart - cargo test -p worker-gpu - cargo test -p worker-lora - cargo test -p pi4-driver-runtime - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh Checks: - Revoke, shutdown, lease-expiry, telemetry-pressure, and applicable IRQ events are delivered through generated notification caps/badges rather than unbounded lifecycle polling. - Worker loops block or yield deterministically while waiting for endpoint IPC or notification events and still handle lease expiry, revoke, telemetry backpressure, and shutdown. - Driver IRQ notification behavior remains HAL-owned and does not create a new polling path or direct IRQ bypass outside generated descriptors. - Historical generated docs would have distinguished the 26c notification proposal from later work; active planning instead requires complete lifecycle/completion notification authority in Milestone 26e and production ledger binding in Milestone 27e. Deliverables: - Event-driven worker and driver lifecycle signaling with seL4 notification objects, bounded tests, and no new Cohesix protocol surface. Inactive historical proposal — superseded as active Milestone 26c work and not authorized by the truth-correction reopening. Its future replacement is owned by the staged Milestone 26e MCS tasks and must satisfy `docs/audit/M26D_MCS_DECISION.md` first: Title/ID: m26c-worker-driver-mcs-budget-evidence Status: Inactive and superseded as active 26c work; retained for historical traceability only. Goal: Preserve the record of the rejected 26c dual-scheduler proposal without authorizing its fallback design. Inputs: docs/audit/M26D_MCS_DECISION.md, Milestone 26e `m26e-mcs-abi-foundation`, Milestone 26e `m26e-mcs-smp-target-acceptance`. Changes: - None authorized. Milestone 26e replaces this proposal with one SMP+MCS QEMU/Pi architecture and no compiled classic fallback. Commands: - None; this task is not executable. Checks: - No implementation or fallback-profile claim cites this historical proposal. Deliverables: - Traceability from the superseded proposal to the selected Milestone 26e SMP+MCS tasks. Title/ID: m26c-post-behavior-baseline-freeze Goal: Freeze the external behavior snapshot after the authorized 26c worker/runtime additions and before cleanup refactors begin. Inputs: docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_RUNTIME_BOUNDARY_AUDIT.md, docs/audit/M26C_NINEDOOR_PARITY_MATRIX.md, docs/audit/M26C_TARGET_RUNNER_BASELINE.md, docs/audit/M26C_REFACTOR_MAP.md, apps/root-task/tests/**, apps/nine-door/tests/**, worker test suites, generated snippets/manifests, scripts/ci/test_plan_run.sh, scripts/ci/check_test_plan.sh Changes: - docs/audit/M26C_POST_BEHAVIOR_BASELINE.md — record the post-Phase-2 external contract snapshot: console grammar, Secure9P/NineDoor namespace semantics, manifest and generated-snippet hashes, worker ticket/lease/telemetry/lifecycle behavior, cap-backed endpoint evidence, notification evidence, then-current scheduling evidence, Pi runtime/DMA evidence classifications, and known deferred blockers. - docs/audit/M26C_REFACTOR_MAP.md — link every Phase 4 cleanup candidate to the relevant post-behavior baseline section and preserved-contract list. - docs/audit/M26C_AGENT_HANDOFFS.md — record the freeze decision, commands, skipped commands, residual blockers, and PASS/FAIL status before any cleanup lane starts. - docs/TEST_PLAN.md — state that Phase 4 refactors compare against the post-behavior baseline rather than pre-26c placeholder worker behavior. Commands: - scripts/check-generated.sh - cargo test -p nine-door --test integration - cargo test -p root-task --tests - cargo test -p worker-heart - cargo test -p worker-gpu - cargo test -p worker-lora - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26c-post-behavior-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-post-behavior-pi4 Checks: - The baseline is recorded only after all authorized Phase 2 behavior-changing tasks are complete or explicitly deferred without being used as satisfied evidence. - Refactor waves use this post-behavior snapshot as their preserved external contract, so cleanup does not accidentally revert or mutate the new intended worker/cap/notification/MCS behavior. - Any remaining Pi 4 or runner blocker is recorded with dependency impact, and no Phase 4 task cites blocked evidence as proof. - The target-qualified QEMU/Pi 4 state dirs and command outputs named in the baseline match the runner contract from `m26c-target-qualified-runner-baseline`. Deliverables: - Hard baseline separating authorized 26c behavior changes from later behavior-preserving cleanup. Title/ID: m26c-characterization-gates-before-refactor Goal: Add characterization tests and merge gates around cleanup-sensitive crates before accepting structural refactors. Inputs: .github/workflows/ci.yml, scripts/ci/test_plan_run.sh, scripts/ci/test_plan_stage_*.sh, scripts/ci/check_test_plan.sh, apps/coh/src/mount.rs, apps/cohsh/src/**, crates/cohsh-core/**, apps/host-ticket-agent/src/*.rs, apps/gpu-bridge-host/src/**, apps/root-task/src/net/**, apps/root-task/src/hal/**, apps/root-task/src/local_seat.rs, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, apps/nine-door/tests/*.rs, docs/TEST_PLAN.md, docs/audit/M26C_REFACTOR_MAP.md Changes: - .github/workflows/ci.yml — stop excluding cleanup-sensitive crates without compensating gate coverage, or add explicit targeted jobs for `coh`, `cohsh`, `cohsh-core`, `host-ticket-agent`, `gpu-bridge-host`, `root-task`, `pi4-driver-abi`, `pi4-driver-runtime`, and `nine-door` parity surfaces. - scripts/ci/test_plan_stage_02_host_fast.sh — exercise `coh`, `cohsh`, `cohsh-core`, `host-ticket-agent`, `gpu-bridge-host`, `nine-door` integration coverage, `root-task --tests`, `root-task --lib`, `pi4-driver-abi`, `pi4-driver-runtime`, and VM-target boundary checks as first-class checks. - scripts/ci/check_test_plan.sh — enforce the updated target-aware staged-run contract and authoritative command matrix. - docs/TEST_PLAN.md — document the expanded cleanup-target coverage, VM boundary evidence, target-qualified artifacts, post-behavior baseline comparison, and required artifact retention. - apps/coh/src/mount.rs + apps/cohsh/src/** + crates/cohsh-core/** + apps/host-ticket-agent/src/*.rs + apps/gpu-bridge-host/src/** + selected apps/root-task/src/* helpers + selected `apps/nine-door` and root-task parity surfaces — add characterization tests for current outputs, errors, and state transitions before refactor. Commands: - cargo test -p coh --features mock - cargo test -p cohsh - cargo test -p cohsh-core - cargo test -p host-ticket-agent - cargo test -p gpu-bridge-host - cargo test -p nine-door --test integration - cargo test -p root-task --tests - cargo test -p root-task --lib - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - rg -n "unsafe|unwrap\\(|expect\\(|panic!" apps crates tools - scripts/ci/check_test_plan.sh Checks: - Cleanup-sensitive crates have deterministic tests that pin current operator-visible behavior. - Characterization artifacts name the post-behavior baseline section they preserve, so behavior-changing Phase 2 work and behavior-preserving Phase 4 cleanup cannot be conflated. - Driver runtime ABI descriptors, isolated runtime service turns, acceptance-eligibility fixtures, and board-proof boundaries remain pinned before cleanup touches driver-task code. - CI and staged test-plan coverage run those tests automatically and retain root-task VM-boundary evidence and target-qualified staged-run artifacts. - Risk-ratchet output is attached to refactor reviews and does not drift without an approved exception. Deliverables: - Regression safety net expanded ahead of structural cleanup. Title/ID: m26c-no-std-boundary-gates Goal: Add explicit CI and audit gates that fail if host-side capability leaks into the VM build across the closure profiles used by 26c. Inputs: .github/workflows/ci.yml, scripts/ci/test_plan_stage_02_host_fast.sh, apps/root-task/Cargo.toml, apps/nine-door/Cargo.toml, apps/pi4-driver-runtime/Cargo.toml, crates/pi4-driver-abi/Cargo.toml, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, docs/TEST_PLAN.md, docs/ARCHITECTURE.md Changes: - .github/workflows/ci.yml — add root-task VM-profile and `pi4-driver-runtime` `no_std` checks and archive dependency-tree artifacts for the QEMU `cohesix-dev` and Pi 4 U-Boot closure profiles at minimum. - scripts/ci/test_plan_stage_02_host_fast.sh — emit `out/audit/m26c_root_task_tree_qemu.txt`, `out/audit/m26c_root_task_tree_pi4.txt`, and driver-runtime VM-target dependency evidence (or equivalent state-dir artifacts) from the VM-target dependency tree as part of cleanup gating. - docs/TEST_PLAN.md + docs/ARCHITECTURE.md — document the VM boundary gate, expected artifacts, and interpretation rules per closure profile. - docs/BUILD_PLAN.md — record that shared semantic helpers are allowed only when they remain `no_std`-safe and do not drag host-side crates into the VM build. Commands: - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev" - cargo tree -p root-task --target aarch64-unknown-none -e normal --no-default-features --features "cohesix-dev" > out/audit/m26c_root_task_tree_qemu.txt - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console" - cargo tree -p root-task --target aarch64-unknown-none -e normal --no-default-features --features "kernel bootstrap-trace serial-console net-console" > out/audit/m26c_root_task_tree_pi4.txt - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - cargo tree -p pi4-driver-runtime --target aarch64-unknown-none -e normal > out/audit/m26c_pi4_driver_runtime_tree.txt - scripts/ci/check_test_plan.sh Checks: - The VM-target root-task build and Pi 4 isolated driver runtime build remain `no_std` and succeed without host-side operator/tooling dependencies across the closure profiles. - The dependency-tree artifacts are reviewed as part of 26c evidence and show no accidental pull-in of host-only surfaces. - Cleanup work cannot merge if boundary evidence is missing or contradicts the documented VM/host split. Deliverables: - Explicit per-profile `no_std` boundary gate for cleanup-era work, reducing drift risk without touching runtime behavior. Title/ID: m26c-low-risk-surface-cleanup Goal: Humanize the highest-visibility low-risk code and doc surfaces after docs-as-built, AI-fingerprint, characterization, and no-std gates cover the touched surface. Inputs: apps/*/README.md, crates/**/README.md, tools/cohesix-py/README.md, tests/integration/README.md, public crate roots under apps/*/src/lib.rs, tests/**/*.rs, docs/OPERATOR_WALKTHROUGH.md, docs/QUICKSTART.md, docs/QUICKSTART_ALPHA.md, docs/audit/M26C_DOCS_AS_BUILT_AUDIT.md, docs/audit/M26C_AI_FINGERPRINT_AUDIT.md Changes: - apps/*/README.md + crates/**/README.md + tools/cohesix-py/README.md + tests/integration/README.md — replace template summaries with role-specific descriptions, assumptions, and operator-facing boundaries. - apps/*/src/lib.rs + apps/*/src/main.rs + crates/**/src/lib.rs — remove generic module-surface comments and rewrite surviving doc comments around invariants or usage. - tests/**/*.rs — rename template-like test names/descriptions to scenario-driven names and tighten helper naming. - docs/OPERATOR_WALKTHROUGH.md + docs/QUICKSTART.md + docs/QUICKSTART_ALPHA.md — remove repetitive prose and keep operator sequences concrete. Commands: - cargo test -p secure9p-core - cargo test -p cohsh-core - cargo test -p tests --quiet Checks: - High-visibility surface files read as authored, file-specific documentation instead of generated scaffolding. - Humanized docs remain consistent with the audit evidence produced by `m26c-docs-as-built-audit`. - AI-fingerprint findings for touched low-risk surfaces are closed or explicitly deferred in `docs/audit/M26C_AI_FINGERPRINT_AUDIT.md`. - Each cleanup batch maps to one accepted wave in `M26C_REFACTOR_MAP.md`, with a preserved-contract list, targeted tests, and before/after scorecard evidence. - The simplicity scorecard shows net clarity improvement for touched surfaces; cleanup-only changes that add more prose, wrappers, or concepts than they remove require explicit reviewer justification. - Test names and doc comments describe behaviors and scenarios, not file names. Deliverables: - First-wave cleanup across low-risk surfaces with zero behavior changes and passing tests. Title/ID: m26c-host-tool-structural-cleanup Goal: Refactor repetitive host-side validation, transport, and ticket-processing flows once characterization tests are in place. Inputs: apps/coh/src/**, apps/cohsh/src/**, crates/cohsh-core/**, apps/host-ticket-agent/src/**, apps/gpu-bridge-host/src/**, apps/hive-gateway/src/**, tools/cohesix-py/cohesix/**, docs/ARCHITECTURE.md, docs/HOST_TOOLS.md, docs/INTERFACES.md, docs/API_GUIDELINES.md Changes: - apps/host-ticket-agent/src/** — factor manifest validation, ticket-processing branches, executor selection, and receipt handling into explicit invariant-bearing helpers without changing lifecycle semantics. - apps/coh/src/** + apps/cohsh/src/** + crates/cohsh-core/** — consolidate duplicated path, grammar, request-auth, mount, and transport validation while preserving ACK/ERR/END, FUSE, REST, and TCP behavior. - apps/gpu-bridge-host/src/** + apps/hive-gateway/src/** — tighten host-only boundary checks, error shaping, and telemetry/report formatting without changing documented host-side contracts. - tools/cohesix-py/cohesix/** — align Python-side validation and examples with the same documented host API contracts where characterization coverage exists. - docs/ARCHITECTURE.md + docs/HOST_TOOLS.md + docs/INTERFACES.md + docs/API_GUIDELINES.md — update any as-built explanations needed to reflect clearer code structure while preserving external contracts. Commands: - cargo test -p host-ticket-agent - cargo test -p coh --features mock - cargo test -p cohsh - cargo test -p cohsh-core - cargo test -p gpu-bridge-host - cargo test -p hive-gateway - python3 -m pytest tools/cohesix-py/tests -q - cargo clippy --workspace --all-targets -- -D warnings Checks: - Host-side cleanup reduces repetition and makes invariants explicit without protocol, file-layout, receipt, or request-auth drift. - Each host-tool refactor wave is independently reviewable and revertible, with one owner, one preserved-contract list, one characterization artifact, and one targeted test subset recorded before edits. - Characterization tests stay unchanged and passing across refactors. Deliverables: - Human-readable host-side control-plane code with preserved external behavior and tighter shared validation boundaries. Title/ID: m26c-root-task-runtime-decomposition Goal: Decompose root-task runtime adapter code into smaller invariant-bearing modules after parity and `no_std` gates pin behavior. Inputs: apps/root-task/src/lib.rs, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/root-task/src/log_buffer.rs, apps/root-task/src/audit/**, apps/root-task/src/bootstrap/**, apps/root-task/src/hal/driver_task.rs, apps/root-task/tests/**, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, configs/root_task*.toml, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURE9P.md, docs/TEST_PLAN.md, docs/audit/M26C_RUNTIME_BOUNDARY_AUDIT.md, docs/audit/M26C_NINEDOOR_PARITY_MATRIX.md Changes: - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** + apps/root-task/src/console/** — split parsing, dispatch, event pumping, completion formatting, and permission-denial paths into narrowly named modules without changing console grammar or Secure9P namespace semantics. - apps/root-task/src/log_buffer.rs + selected `/proc` emitters — extract append-only, cursor, and evidence formatting helpers while preserving current output fixtures. - apps/root-task/src/lib.rs + apps/root-task/src/bootstrap/** + apps/root-task/src/hal/driver_task.rs — clarify initialization sequencing, generated-manifest handoff boundaries, and manifest-declared isolated driver runtime descriptor ownership without moving authority out of compiler-generated artifacts. - apps/pi4-driver-runtime/** + crates/pi4-driver-abi/** — keep ABI and runtime changes behavior-preserving, pointer-free, and aligned with generated `root_task.driver_images` records. - apps/root-task/tests/** + apps/nine-door/tests/*.rs — preserve and extend parity fixtures before and after the decomposition. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURE9P.md + docs/TEST_PLAN.md — update as-built module ownership only when public contracts or evidence paths become clearer. Commands: - cargo test -p nine-door --test integration - cargo test -p root-task --tests - cargo test -p root-task --lib - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev" - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console" - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - cargo clippy --workspace --all-targets -- -D warnings Checks: - Root-task decomposition preserves ACK/ERR/END grammar, namespace layout, `/proc` output shapes, event ordering, append-only behavior, and generated-manifest authority. - Linked driver-runtime descriptor handling, fixed-ring command/completion ABI, and acceptance-eligibility classification remain unchanged unless a reopened 26a/26b acceptance task changes them with hardware evidence. - VM-target builds remain `no_std` across QEMU and Pi 4 closure profiles. - Each root-task decomposition wave has a baseline-linked preserved-contract list and can be reverted without undoing unrelated worker/runtime behavior. - No new `unsafe`, `unwrap`, `expect`, or `panic!` appears in non-test root-task code without an approved exception. Deliverables: - Smaller root-task runtime modules with preserved operator-visible behavior and explicit boundary evidence. Title/ID: m26c-hal-network-and-local-seat-decomposition Goal: Refactor Pi 4 HAL-facing network, Wi-Fi, and local-seat code into clearer bounded units and narrow SDIO/USB platform seams without changing boot policy, transcripts, or device authority. Inputs: apps/root-task/src/hal/**, apps/root-task/src/net/**, apps/root-task/src/drivers/**, apps/root-task/src/local_seat.rs, apps/root-task/src/generated/**, apps/pi4-driver-runtime/**, crates/pi4-driver-abi/**, configs/root_task_pi4_uboot_aarch64.toml, docs/HARDWARE_BRINGUP.md, docs/NETWORK_CONFIG.md, docs/BOOT_REFERENCE.md, docs/TEST_PLAN.md Changes: - apps/root-task/src/net/** — separate policy parsing, DHCP state, static IPv4 validation, active/standby interface selection, and evidence formatting while preserving manifest and DTB override semantics. - apps/root-task/src/hal/** + apps/root-task/src/drivers/** + apps/pi4-driver-runtime/** + crates/pi4-driver-abi/** — keep all device access behind HAL traits, split device-state and firmware/handoff bookkeeping from transcript emission, preserve isolated runtime command ownership, extract current-behavior-only SDIO host and USB platform/DMA seams after characterization tests exist, and remove duplicated bounds checks under the same evidence gate. - apps/root-task/src/local_seat.rs — isolate local-seat input/display policy from boot evidence and network policy handoff code without changing first-boot operator behavior. - docs/HARDWARE_BRINGUP.md + docs/NETWORK_CONFIG.md + docs/BOOT_REFERENCE.md + docs/TEST_PLAN.md — update as-built explanations and evidence commands for any clearer module boundaries. Commands: - cargo test -p root-task --tests - cargo test -p root-task --lib - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console" - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4 Checks: - HAL access remains centralized behind HAL traits; no direct MMIO, physical address, DMA publication, IRQ binding, or firmware-service shortcuts are introduced outside HAL. - New SDIO/USB seams are extraction-only, have before/after characterization evidence, and do not add new hardware support or generic future-driver behavior. - Each HAL/network/local-seat wave is isolated to one preserved behavior surface and records the exact tests plus Pi 4/QEMU evidence needed to prove no transcript or authority drift. - Isolated runtime acceptance eligibility and the separate fresh-Pi board-proof boundary remain explicit until owner-state proof and fresh Pi hardware evidence close them. - Boot transcripts, `netstats`, `netstatus`, DHCP/static policy evidence, Wi-Fi fallback semantics, and no-NIC compatibility remain unchanged unless a separately approved breaking-change path is followed. - Pi 4 staged evidence proves the refactor did not regress local-seat, network-policy, or U-Boot handoff behavior. Deliverables: - Clearer Pi 4 HAL/network/local-seat modules with preserved hardware bring-up semantics and explicit SDIO/USB platform seams ready for later milestone evaluation. Title/ID: m26c-full-test-plan-qemu-and-pi4 Goal: Make full staged Test Plan PASS on both QEMU and Pi 4 the explicit closure gate for 26c. Inputs: docs/TEST_PLAN.md, docs/HARDWARE_BRINGUP.md, docs/audit/M26C_TARGET_RUNNER_BASELINE.md, docs/audit/M26C_POST_BEHAVIOR_BASELINE.md, scripts/ci/test_plan_run.sh, scripts/ci/test_plan_stage_*.sh, scripts/ci/check_test_plan.sh, scripts/pi4-image-build.sh, scripts/uboot/qemu-uboot-smoke.sh Changes: - docs/TEST_PLAN.md — verify QEMU and Pi 4 execution matrices, evidence paths, PASS criteria, and target-qualified artifact requirements still match the early runner baseline and post-behavior baseline. - docs/HARDWARE_BRINGUP.md — verify Pi 4 hardware setup, log capture, and operator prerequisites remain sufficient to run the full Test Plan. - scripts/ci/test_plan_run.sh + scripts/ci/test_plan_stage_*.sh — use the already implemented `--target qemu|pi4` contract to archive final target-qualified evidence without pretending QEMU and Pi 4 evidence are identical. - scripts/ci/check_test_plan.sh — enforce final alignment between target-aware docs, stage scripts, baseline artifacts, and authoritative commands. - scripts/pi4-image-build.sh — produce deterministic artifacts consumed by Pi 4 staged test-plan runs. Commands: - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26c-qemu - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26c-pi4 Checks: - The staged runner produces `stage_01.done` through `stage_05.done` for both QEMU and Pi 4 state dirs. - Neither state dir contains `*.incomplete` markers. - Stage 05 verifies the required target-qualified artifacts exist before writing `stage_05.done`. - Pi 4 evidence includes serial logs, network or console validation, and due-diligence outputs matching the documented PASS contract. Deliverables: - Full Test Plan PASS on QEMU and Pi 4 as the hard milestone exit criterion, with archived evidence for both targets. ``` --- ## Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment [Milestones](#Milestones) **Status:** Complete. **Why now (kernel truth):** Milestone 26c makes the docs-as-built audit, target-qualified Test Plan, host/VM boundary evidence, and regression-gated refactor baseline explicit. Milestone 26d refreshes the external kernel baseline and canonical references to seL4 16.0.0, anchors manual alignment to the official seL4 Reference Manual v16.0.0 ([PDF](https://sel4.systems/Info/Docs/seL4-manual-16.0.0.pdf)), proves the reopened 26a/26b driver-task model still holds on QEMU and Pi 4, and closes kernel-version drift before later feature work builds on stale assumptions. Because a kernel refresh changes scheduler, syscall, timer, cache, and generated-artifact behavior that can move measured latency or throughput, 26d also owns a bounded benchmark revalidation and regression-tuning lane: compare historical-best, accepted 26b, accepted seL4 15, first seL4 16, and post-tuning seL4 16 evidence before later milestones rely on the refreshed baseline. Milestone 26b was subsequently reopened for the steady-data-plane and local-seat regressions and returned to Complete on exact image `7a10b8fd6acc` through the operator-approved matrix recorded above. Its `2668c34f76ff` transport matrix remains the performance/reliability baseline; the current-image record is final milestone closure. Urgent-only lease eligibility, bulk exclusion, normal deadline or hintless scheduling, and zero/no-ack fallback language retained inside the completed 26d task records below describes the superseded evidence baseline; it is not the current runtime contract. The accepted Milestone 26b contract is the `m26b-wifi-sdio-notification-dpc-closure` task above: every admitted current-generation post-Gate-8 op7 uses the same finite cadence, provenance affects only capacity and urgent-before-bulk ordering, child completion is durable before wake and rechecked before sleep, software-only drains are bounded to eight terminals per Network wake, and accepted ordinary or pressure traffic uses no deadline, hintless-watchdog, fallback, or second-owner lane. The seL4 16 capability audit also found three pre-existing assurance defects that must close before the refreshed-baseline claim is credible: isolated runtime mappings were not uniformly fail-closed for execute permission, QEMU kernel intent was not reproducible from one pinned upstream manifest/profile contract, and generated Worker declarations overstated target execution. Milestone 26d owns the bounded security and truth repairs below; it does not use those repairs to imply new product behavior or completed Pi 4 Wi-Fi evidence. **Non-negotiable constraints:** - No further system-model change beyond the reopened 26a/26b driver-task baseline, except the explicitly named W^X enforcement, canonical profile, generated/docs-as-built Worker truth repairs, and `m26d-smp-command-post-cutover-usability` compatibility correction in this milestone. Cohesix remains an upstream seL4, pure-Rust root-task authority system with hardware driver tasks; Microkit, CAmkES, and capDL loader adoption are explicitly out of scope for 26d. - CAmkES 3.13.0 is recorded only as the upstream component-framework release paired with seL4 16.0.0. A separate host smoke build may test that upstream pairing, but CAmkES, capDL component generation, and their Haskell/Python dependency closure must not enter Cohesix profiles, target artifacts, or TCB. - No new operator-visible protocol, namespace, ACK/ERR/END, telemetry, manifest, or release-behavior changes are permitted under a kernel-refresh label except the named `m26d-smp-command-post-cutover-usability` correction, which changes only command routing and preserves the existing activity and raw-dump payloads. - Concurrent CYW43/SDIO reliability, exact-image identity, operator-liveness, and Pi evidence files remain owned by the accepted 26b/26d closure record. Capability work must not rewrite driver timing/state-machine logic, evidence classification, image packaging, or hardware claims, and offline capability PASS results must not be counted as Wi-Fi or exact-image proof. - `rust-sel4` adoption is out of scope. Cohesix may audit upstream Rust support for compatibility reference, but 26d must preserve the current Cohesix-owned `sel4-sys` / `sel4-runtime` / root-task bootstrap stack unless a separate milestone authorizes replacement. - Canonical kernel/manual provenance must be updated with specific versions and, where available, upstream commit identifiers for QEMU, SMP, and Pi 4/U-Boot build flows. - Canonical fresh seL4 profile builds must be configured from the pinned official seL4 16.0.0 manifest through a source-controlled Cohesix profile wrapper. Hand-edited CMake caches, stripped generated settings, or unauthenticated copied external build trees cannot establish production, diagnostic, or proof-profile closure. The tracked `seL4/build_UBOOT` tree is the narrow Pi image exception: its completed causal stamp and every relocated artifact identity must validate before it can serve as immutable diagnostic composition input, and it still cannot establish fresh source-build, release, or hardware proof. - Older manual/reference mentions are known 26d blockers, not acceptable post-26d residue. Later milestones must not cite seL4 16 alignment until `m26d-kernel-provenance-refresh` updates or explicitly retires those references. - Any seL4 build configuration that still depends on legacy `KernelDomainSchedule` / `domain_schedule.c` handling must be either removed when semantically unused or migrated/documented consistently with seL4 16 behavior; one-domain configurations must not retain hidden schedule-file dependencies. - Generated Worker roles may be described as implemented, capability-backed, notification-backed, or live only when the selected target actually creates the declared TCB, CSpace, VSpace, IPC buffer, stack, endpoint badge, lifecycle notifications, and fault/revocation path. Model-only or in-process Worker behavior must be emitted and documented as such. - MCS activation and root-service decomposition remain explicit decisions, not implicit benefits of the version refresh. Milestone 26d keeps the accepted non-MCS scheduling model and current root-task service boundary. Pending Milestone 26e owns both the ordered root-service/Worker split and the SMP+MCS ABI, generated policy, and exact-target acceptance after 26d closes. - The seL4 16 refresh must preserve the Pi 4 hardware-counter contract used by isolated runtime performance proof: `release-pi4` / `timers-arch-counter` builds expose only the read-only EL0 virtual counter (`KernelArmExportVCNTUser` / `CONFIG_EXPORT_VCNT_USER`), keep physical counter and EL0 timer-control exports disabled, and derive elapsed-time proof from refreshed `TIMER_CLOCK_HZ=54000000` generated headers. Kernel refresh work must not reclassify dummy-timer or physical-counter captures as valid latency evidence. - Performance tuning is permitted in 26d only when tied to a measured same-harness regression, regression-risk, or drift exposed by the seL4 16 refresh. Allowed tuning includes bounded scheduler/budget constants, driver-runtime service-turn cadence, cache-maintenance batching thresholds, TCP/REST gateway timeout plumbing, harness provenance/reporting fixes, and comparator hygiene. Tuning must preserve Secure9P semantics, ACK/ERR/END grammar, manifest authority, HAL-only physical-device authority, root/driver-task ownership boundaries, no-retry benchmark accounting, and the documented Pi 4 wired/GENET versus Wi-Fi proof split. - 26d tuning must not become service-bucket/core-local redesign, new protocol work, new namespace or telemetry grammar, relaxed error budgets, retry masking, root-owned physical-driver shortcuts, larger unbounded queues, or a reclassification of Wi-Fi stress diagnostics as production parity. Those remain outside accepted 26b and belong only to 29b or later explicitly scoped work. - QEMU and Pi 4 target-qualified evidence must be regenerated on the refreshed kernel baseline before 26d can close. ### Prerequisite - The original Milestone **26c** runtime/refactor closure is accepted (target-qualified test-plan runner, docs-as-built audit, refactor map, risk-ratchet baseline, and no-std boundary evidence available). Its later documentation-only remediation may run concurrently and does not invalidate those accepted prerequisite artifacts. - At the accepted 26d closure, Milestones **26a** and **26b** were complete where their driver-task and benchmark artifacts were inputs to the kernel refresh. Milestone 26b was later reopened for the bounded evidence defects recorded above and returned to Complete on exact image `7a10b8fd6acc`; no isolated runtime performance assumption may be rewritten under the kernel-refresh label. - The root-service/Worker task-isolation claims in Milestone **25** and Worker capability/notification claims in Milestone **26c** are reopened to restore as-built truth in the first 26d phase. Root-service decomposition and actual general Worker TCB launch are routed to pending Milestone 26e after their compiler, bootstrap, event, image, and operator surfaces are available; neither can be inferred from driver-runtime TCB evidence or model tests. ### Goal Upgrade Cohesix's external seL4 baseline and normative references to seL4 16.0.0 while preserving root-task authority plus the accepted 26a/26b hardware driver-task model, prove zero operator-visible drift across QEMU and Pi 4, and preserve or recover the accepted 26b REST/driver-runtime benchmark envelope when the refreshed kernel baseline exposes a bounded performance regression. ### Deliverables - **Kernel baseline refresh** - Refresh external seL4 build inputs used by Cohesix bring-up, CI, and Pi 4 image flows to seL4 16.0.0. - Record the exact upstream seL4 version/commit accepted for Cohesix in canonical docs and test evidence. - Record refreshed Pi 4 counter-export evidence for `KernelArmExportVCNTUser` / `CONFIG_EXPORT_VCNT_USER`, forbidden physical-counter/timer-control exports, and `TIMER_CLOCK_HZ`. - **Reference-manual and docs realignment** - Update `docs/BUILD_PLAN.md`, `docs/TOOLCHAIN_MAC_ARM64.md`, `README.md`, and other canonical docs that currently describe the normative seL4 manual/baseline so they align with seL4 16.0.0 as built and link the official seL4 Reference Manual v16.0.0 PDF (`https://sel4.systems/Info/Docs/seL4-manual-16.0.0.pdf`). - Refresh the carried seL4 manual mirror under `seL4/` if the repo continues to store it as a tracked reference artifact. - Record any seL4 16 changes that are intentionally irrelevant to Cohesix today, especially domain-schedule features tied to Microkit/CAmkES/capDL workflows. - **Direct-API compatibility audit and fixes** - Audit `crates/sel4-sys`, `crates/sel4-runtime`, `crates/pi4-driver-abi`, profile-selected `apps/pi4-driver-runtime` images, generated `root_task.driver_images` descriptors, and root-task bootstrap code against seL4 16 headers and generated metadata. - Preserve Cohesix’s explicit TLS and IPC-buffer installation path unless a compatibility fix requires adjustment. - Keep SMP affinity, boot-info handling, CSpace assumptions, and debug-syscall guards aligned with seL4 16 generated headers for both single-core and SMP builds. - Keep root-task and linked-driver-runtime timer build guards aligned with seL4 16 generated `TIMER_CLOCK_HZ` and VCNT export truth; compatibility fixes may not introduce `CNTPCT_EL0`, EL0 timer-control register use, or raw CPU-speed spin loops for elapsed time. - **Domain-schedule debt removal** - Audit build caches and Pi 4/U-Boot kernel configuration for stale `KernelDomainSchedule` / `domain_schedule.c` assumptions. - For configurations with `KernelNumDomains=1`, remove or document any stale schedule-file dependency so Cohesix does not inherit `sel4test` domain-schedule defaults as an accidental build requirement. - If any Cohesix-owned configuration genuinely uses domains later, migrate that path to seL4 16 runtime/domain-schedule semantics in a scoped follow-on task before enabling it. - **Isolated-runtime W^X closure** - Reject malformed, unknown-flag, write-plus-execute, and effective page-level W+X ELF load plans before allocating child authority. - Map only validated read-only executable image pages with execute permission; map writable and read-only data, holes, stack, IPC buffer, rings, shared payloads, DMA, MMIO, and framebuffers execute-never in both root aliases and child VSpaces. - Preserve device/cache attributes while adding execute-never and retain the reviewed read-only executable trampoline exception. - **Canonical profile intent and validation** - Define pinned production, diagnostic, and proof profile contracts from the official seL4 16.0.0 manifest, including allowed debug/benchmark features and claim eligibility. - Make QEMU `aarch64/virt` GICv3 and one-domain/no-schedule-file intent explicit, then validate source provenance, cache settings, generated headers, DTB/launcher inputs, and forbidden settings as one contract. - Make the validated `qemu_smp_production` tree the default for QEMU build, release, regression, staged-test, and newcomer runbooks; explicit legacy trees remain diagnostic and claim-ineligible unless a named contract passes. - Treat proof-profile eligibility as a fail-closed evidence classification; a diagnostic build may exercise behavior but may not support production or performance claims. - **Worker execution truth repair** - Correct manifest IR, generated outputs, tests, and canonical docs so model-only Worker roles are not emitted as target-implemented, capability-backed, notification-backed, or live. - Reject `implemented=true` at manifest validation until compiler IR contains and validates the selected image, TCB, CSpace, VSpace, IPC buffer, stack, fault, and revocation contract needed to make that claim meaningful. - Preserve the existing host/session ticket and namespace behavior while separating it from seL4 target-execution claims. - Keep actual general Worker TCB creation, badged IPC, lifecycle notifications, fault suspension/revocation, and QEMU/Pi execution evidence as an explicit reopened phase rather than borrowing isolated driver-runtime proof. - **Capability, MCS, and root-TCB decision evidence** - Publish the seL4 16 capability-use matrix with implemented, partial/model-only, intentionally unused, and blocker classifications. - Record why non-MCS remains the accepted 26d baseline, compare classic SMP, single-core MCS, and SMP+MCS, identify MCS as the preferred Cohesix temporal architecture, and route staged implementation/admission to the exact 26e tasks without enabling it in 26d. - Record the current root-owned parsing/network/supervision surface and route the security-first split order to exact pending Milestone 26e tasks without claiming that decomposition has occurred. - **Regression and evidence refresh** - Re-run generated-artifact guards, root-task checks/tests, QEMU bring-up, Pi 4 image build, and the full target-qualified Test Plan on the seL4 16 baseline. - Publish refreshed audit artifacts proving that operator-visible semantics remain unchanged, that the VM build remains `no_std`, and that Pi 4 latency/performance proof still uses the virtual-counter backend rather than dummy timers or physical-counter exports. - **Benchmark revalidation and bounded tuning** - Archive a before/after benchmark ledger with five explicit lanes: historical top benchmark, accepted 26b baseline, accepted seL4 15 comparator, first seL4 16 baseline before tuning, and final seL4 16 evidence after any tuning. - Re-run the REST performance harness in the same-harness QEMU/Pi shape used by 26b, keeping raw direct `cohsh`/TCP proof, REST gateway overhead, QEMU semantic/capacity reference, wired/GENET production parity, and Wi-Fi research/diagnostic evidence separate. - Permit only bounded tuning that preserves existing authority and protocol semantics; every performance fix must identify the moved layer as kernel/generated-artifact drift, root-task scheduling cadence, isolated driver-runtime service cadence, gateway/harness behavior, physical-target variance, or pre-existing 26b debt. - Update `docs/BENCHMARKS.md` only for refreshed artifact indexes, verdict changes, or explicit non-blocking debt. Do not erase historical-best evidence or convert uncommitted local diagnostics into canonical proof without archived artifacts. ### Commands - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/check-generated.sh` - `cargo fmt --all -- --check` - `cargo clippy --workspace --all-targets -- -D warnings` - `cargo check --workspace` - `cargo test --workspace` - `cargo test -p pi4-driver-abi` - `cargo test -p pi4-driver-runtime` - `cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev"` - `cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console"` - `cargo check -p pi4-driver-runtime --target aarch64-unknown-none` - `out/toolchain/sel4-profile-venv/bin/python -m pytest -q tests/test_sel4_profile.py` - `out/toolchain/sel4-profile-venv/bin/python scripts/sel4_profile.py validate --all --require-source --require-artifacts --evidence out/audit/m26d-profile-v2-all.json` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::tests::runtime_` - `SEL4_BUILD_DIR="$PWD/seL4/build_UBOOT" cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4` - `scripts/cohesix-build-run.sh --sel4-build out/sel4/profile-v2/qemu-smp-production --no-run --cargo-target aarch64-unknown-none --profile release --root-task-features cohesix-dev` - `scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv` - `python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26d-qemu-sel4-16-initial` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m26d-pi4-sel4-16-initial` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26d-qemu-sel4-16-final` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m26d-pi4-sel4-16-final` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-qemu-sel4-16-gap-audit` - `scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26d-pi4` ### Checks (DoD) - Canonical docs link the official seL4 Reference Manual v16.0.0 PDF and explicitly align to the accepted seL4 16.0.0 baseline, remaining consistent with the refreshed as-built evidence. - `crates/sel4-sys`, `crates/sel4-runtime`, `crates/pi4-driver-abi`, `apps/pi4-driver-runtime`, generated driver-image descriptors, driver-runtime CPIO packaging, and root-task bootstrap code build cleanly against seL4 16 generated headers/artifacts for the QEMU baseline, SMP baseline, and Pi 4 U-Boot baseline used by Cohesix. - QEMU and Pi 4 target-qualified Test Plan runs pass on the refreshed kernel baseline with no `*.incomplete` markers and no undocumented operator-visible output drift. - Secure9P bounds, console grammar, manifest outputs, release semantics, and host/VM runtime boundaries remain unchanged unless separately documented as defects fixed in the same change. - Build artifacts and documentation no longer rely on an accidental `sel4test`-provided `domain_schedule.c` dependency for one-domain Cohesix configurations; any remaining dependency is explicit, justified, and documented. - Canonical QEMU configuration is reproducible from the pinned official seL4 16.0.0 manifest, official Arm GNU compiler archive, exact hash-locked Python closure, and DENX mkimage source provenance; selects GICv3 for `aarch64/virt`; omits the legacy domain-schedule input; and has matching source, cache, generated-header, parsed-DTB, launcher, strict executable-ELF, and causal build-stamp evidence. The aggregate closure gate requires all five fresh `out/sel4/profile-v2/*` source and artifact sets by default; configuration-only relaxation is explicit and claim-ineligible. Production, diagnostic, and proof profile contracts reject unknown evidence classes, class/eligibility mismatches, stale outputs, forbidden settings, shipping-artifact RWX, malformed/non-executable ELF inputs, and claim-ineligible settings rather than silently normalizing them, while upstream seL4Test RWX exceptions remain machine-recorded and non-shipping. Active QEMU build, release, regression, staged-test, and runbook defaults consume `out/sel4/profile-v2/qemu-smp-production` and validate it before runtime/release claims; explicit legacy trees remain diagnostic unless a named contract passes. - Every isolated child mapping is W^X by construction: only validated read-only executable image pages and the reviewed trampoline are executable; writable/data/hole/stack/IPC/ring/shared/DMA/MMIO/framebuffer mappings are execute-never; malformed, unknown, RWX, and page-colliding ELF segments are rejected before launch. - Generated outputs and canonical docs describe general Workers as model-only until target TCB/CSpace/VSpace/IPC/stack, badged endpoint, lifecycle notification, and fault/revocation evidence exists. Isolated driver-runtime execution and host/session ticket behavior do not satisfy that gate. - The accepted 26d scheduler remains non-MCS and the accepted service boundary remains root-owned exactly as recorded in the decision audits; neither is presented as an implemented isolation improvement. - Pi 4 refreshed evidence reports `TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, and `DUMMY_TIMER_SEEN=no`; any missing/mismatched counter export leaves isolated runtime latency proof red until fixed or explicitly scoped back to reopened 26a/26b acceptance. - 26d benchmark evidence includes the historical-best, accepted 26b, first seL4 16, and final seL4 16 lanes; any tuning is explained by layer, bounded by existing authority/protocol rules, and rechecked with the REST performance harness without retry masking or relaxed error budgets. - If final seL4 16 benchmark evidence remains below the accepted 26b envelope, the closure record classifies the gap as blocking regression, physical-target variance with evidence, pre-existing 26b debt, or explicitly deferred later-milestone work. Deferred work cannot be counted as 26d closure evidence for downstream milestones. - The carried seL4 manual/reference artifacts, if tracked in-repo, match the accepted kernel baseline or are explicitly relinked to the authoritative upstream 16.0.0 source. ### Compiler / docsystem touchpoints - `coh-rtc` outputs, docs snippets, and manifest fingerprints remain authoritative; 26d may update generators or schemas only when required by the seL4 16 baseline refresh, and any such change must be reflected in the same evidence set. - Pi 4 manifest-declared isolated driver runtime ABI/descriptors/images remain authoritative for driver-task bootstrap evidence during the kernel refresh; 26d may adapt them only for seL4 16 compatibility and must not reclassify runtime-spec acceptance or board-proof boundaries without reopened 26a/26b hardware acceptance evidence. - Root-task and linked-driver-runtime hardware-counter guards remain authoritative for performance proof during the kernel refresh. Generated seL4 headers and CMake/cache config must agree before `timers-arch-counter` evidence can satisfy 26d closure. - REST harness output, benchmark provenance fields, and `docs/BENCHMARKS.md` artifact indexes remain the source of truth for same-harness performance claims during the refresh. Any harness change made in 26d must improve provenance, strictness, or failure classification without changing the workload contract used for comparison. - `docs/TEST_PLAN.md`, `scripts/ci/test_plan_run.sh`, and target-qualified state-dir evidence remain the source of truth for QEMU/Pi 4 pass semantics during the kernel refresh. - `configs/sel4/profiles.toml`, the Cohesix seL4 profile wrapper, and its validator are the source of truth for profile intent and claim eligibility; build-directory caches are evidence to validate, not configuration authority. - Worker manifest IR and regenerated artifacts must disable executable-role capability/notification claims together. Prose, model tests, or host-side ticket flows may not override generated target truth. ### Atomic tasks ``` Title/ID: m26d-kernel-provenance-refresh Goal: Refresh Cohesix seL4 baseline inputs and record accepted seL4 16.0.0 provenance. Inputs: external seL4 source/build trees, seL4 16.0.0 release notes, official seL4 Reference Manual v16.0.0 PDF (`https://sel4.systems/Info/Docs/seL4-manual-16.0.0.pdf`), docs/TOOLCHAIN_MAC_ARM64.md, README.md. Changes: - docs/TOOLCHAIN_MAC_ARM64.md — record the accepted seL4 16.0.0 baseline and external-build expectations. - README.md — update high-level kernel/manual baseline references if they mention stale versions or assumptions. - seL4/ — refresh tracked manual/reference artifacts only if the repo continues carrying them as canonical mirrors. Commands: cargo check --workspace Checks: canonical docs and carried references identify the accepted seL4 16.0.0 baseline with no stale older-manual pin left in normative guidance. Deliverables: updated docs/reference provenance and a checked-in note of the accepted upstream version/commit. ``` ``` Title/ID: m26d-sel4-api-compat-audit Goal: Bring Cohesix-owned seL4 bindings/runtime/bootstrap code into clean alignment with seL4 16 generated artifacts. Inputs: crates/sel4-sys, crates/sel4-runtime, crates/pi4-driver-abi, apps/pi4-driver-runtime, apps/root-task, configs/root_task*.toml, out/sel4/profile-v2/qemu-smp-production, out/sel4/profile-v2/qemu-smp-diagnostic, out/sel4/profile-v2/pi4-production, out/sel4/profile-v2/pi4-diagnostic, and the repo-managed `seL4/{build,SMP_build,build_UBOOT}` v16 reference mirrors. Changes: - crates/sel4-sys — compatibility fixes required by seL4 16 headers/generated metadata. - crates/sel4-runtime — compatibility fixes required by seL4 16 root-task startup behavior. - crates/pi4-driver-abi + apps/pi4-driver-runtime — compatibility fixes required by seL4 16 runtime-init descriptor layout, pointer-free ring transport, or target build rules. - apps/root-task — bootstrap and generated driver-image handoff adjustments only where required by seL4 16 semantics. Commands: - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "cohesix-dev" - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo check -p pi4-driver-runtime --target aarch64-unknown-none Checks: direct-seL4 Cohesix builds compile on all supported kernel profiles, and manifest-declared isolated driver runtime ABI/build evidence stays green, without changing system model or operator-visible semantics. Deliverables: passing workspace/build-target checks and refreshed low-level compatibility evidence. ``` ``` Title/ID: m26d-pi4-counter-contract-refresh Goal: Reprove the Pi 4 virtual-counter timer contract on the seL4 16 baseline before accepting isolated runtime latency or performance evidence. Inputs: fresh-source Pi profile audit outputs, the repo-managed immutable `seL4/build_UBOOT` v16 diagnostic artifact input, apps/root-task/build.rs, apps/root-task/src/arch/aarch64/timer.rs, apps/pi4-driver-runtime/build.rs, apps/pi4-driver-runtime/src/lib.rs, scripts/pi4-image-build.sh, scripts/pi4_gate_proof.sh, scripts/pi4_trace_normalize.py, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md. Changes: - scripts/pi4-image-build.sh — keep seL4 16 Pi 4 staging blocked unless VCNT export is enabled, physical counter/timer-control exports are disabled, and generated `TIMER_CLOCK_HZ` matches the accepted Pi profile. - apps/root-task/build.rs + apps/root-task/src/arch/aarch64/timer.rs — preserve root-task build/runtime checks that use `CNTVCT_EL0` only under the `timers-arch-counter` profile and scale elapsed-time proof from generated frequency. - apps/pi4-driver-runtime/build.rs + apps/pi4-driver-runtime/src/lib.rs — preserve isolated runtime build/runtime checks and `RuntimeDeadline` conversion from legacy retry counts to counter-backed deadlines. - scripts/pi4_gate_proof.sh + scripts/pi4_trace_normalize.py + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — ensure refreshed Pi 4 proof gates require `TIMER_BACKEND=arch-counter`, `TIMER_CLOCK_HZ=54000000`, `TIMER_EL0_COUNTER=vct`, and `DUMMY_TIMER_SEEN=no` before latency proof is accepted. Commands: - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features "kernel bootstrap-trace serial-console net-console" - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - scripts/pi4_gate_proof.sh --require-driver-task-proof Checks: - Refreshed seL4 16 Pi 4 generated headers and cache expose only the accepted virtual-counter path for EL0 timing. - Root-task and isolated runtime builds fail on missing VCNT export, nonzero physical-counter/timer-control export, or missing/nonzero-invalid `TIMER_CLOCK_HZ`. - Runtime latency telemetry and proof normalizer output reject dummy-timer captures, stale logs, physical-counter exports, and missing timer frequency as performance evidence. Deliverables: - Checked-in 26d evidence tying seL4 16 provenance, Pi 4 counter configuration, isolated runtime deadline behavior, and target-qualified performance proof into one refreshed contract. ``` ``` Title/ID: m26d-benchmark-revalidation-and-tuning Goal: Revalidate and, where needed, recover the accepted 26b REST/driver-runtime benchmark envelope on the seL4 16 baseline. Inputs: scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, tests/test_pi4_compare_driver_models.py, tools/host-bootpd/{start-en8-bootpd.zsh,install-root-bootpd.zsh,com.lukasbower.cohesix.en8-bootpd.plist,README.md}, tests/test_host_bootpd_supervisor.py, apps/root-task/src/{event/mod.rs,drivers/driver_task_net.rs,hal/driver_task.rs}, apps/pi4-driver-runtime/src/lib.rs, docs/{BENCHMARKS.md,DRIVERS.md,HARDWARE_BRINGUP.md,TEST_PLAN.md}, out/bench/m26b-* artifacts, refreshed seL4 16 QEMU/Pi build artifacts, fresh Pi serial/pcap proof for the selected transport. Changes: - docs/BENCHMARKS.md — record refreshed artifact indexes, before/after verdicts, and any explicitly classified non-blocking debt. - scripts/rest_perf_harness.py + tests/test_rest_perf_harness.py — provenance/reporting or strictness fixes only when needed to compare the seL4 16 run against the accepted 26b workload without changing the workload contract. - tools/host-bootpd/{start-en8-bootpd.zsh,install-root-bootpd.zsh,com.lukasbower.cohesix.en8-bootpd.plist,README.md} + tests/test_host_bootpd_supervisor.py — keep the wired/GENET direct-link DHCP control deterministic when disposable runtime evidence is cleaned while the host supervisor remains alive; bind root LaunchDaemon state to `/Users/lukasbower/cohesix/host-bootpd`, migrate a sole legacy `out/host-bootpd` tree, and reject ambiguous dual runtime trees without writing new runtime state inside the repository. - apps/root-task/src/**, apps/pi4-driver-runtime/src/**, crates/pi4-driver-abi/src/**, or apps/hive-gateway/src/** — bounded tuning only where same-harness evidence points to a moved layer caused or exposed by the seL4 16 refresh. For CYW43, preserve one HAL/runtime issuer and the three exact authorities required by accepted Milestone 26b task `m26b-wifi-sdio-notification-dpc-closure`: persistent op11, the separate finite urgent-op7 lease, and the post-release event-sequence DPC lease. Ordinary non-op11 foreground commands alone retain recurrent exact grants. SDIO owns and joins IRQ158 and DMA4 IRQ116 into one immutable request terminal. Root admits at most one CYW43 parent per outer turn; an exact op11 commits and signals once, and its stable `Waiting` state masks only runtime-descriptor, logical-owner, and HAL-lease self-demand. Persistent op11, urgent op7, and DPC event service route from current durable conditions rather than snapshot novelty: deterministic private phases continue even on equal snapshots, while exact child, runtime-owned credit, queue, and peer waits block immediately even when newly observed. SDIO alone takes one live joined-controller sample after a changed steady cursor before blocking. Every helper remains bounded and each immutable hardware request issues at most once. Preserve commit-before-signal, condition-before-sleep, the post-f4 immutable descriptor requirement, issued-unknown reaping, and the exact recovery lane. Decouple smoltcp admission from the sole physical owner with one CYW43-only bounded aggregate of 16 TX frames and one committed RX batch parent carrying up to eight frames. Notifications only prompt a durable-state recheck; they carry no work history or authority. A sequence-last SDIO command always reaches matching owner dispatch or a typed zero-I/O missing/competing-seal terminal; it is never discarded as no intake. Ordinary TxTokens reserve 15 aggregate slots, copied RX reserves the final paired slot before dequeue, consumption remains queue-only, and EventPump is the sole production TX coordinator. ARP, EAPOL, DHCP, TCP SYN/FIN/RST, and payload-free TCP control preempt other payload-bearing TCP and bulk while preserving FIFO order within each class. Preserve any exact retained foreign HAL descriptor, including the one RX batch parent, before op7 admission. Once the lane is free, advance one active op7 or promote and advance one eligible FIFO head before copied-RX service so replenished RX cannot starve control TX. Copied RX precedes the coordinator's physical op only while no op7 is legally runnable; otherwise it remains preserved for the following smoltcp poll. When full, promotion removes one eligible head and restores a paired slot before at most one physical advance. A terminal never promotes a successor; that frame remains queued for a later coordinator turn. Neither `Device::receive` nor reservation failure services TX. The runtime is the sole SDPCM flow-control owner: it admits each exact op7 only while `sdpcm_seq` is within the dongle-advertised `tx_max` window and retains the same op7 in `WAIT_CREDIT` otherwise. A joined Function-2 terminal releases the root frame immediately and is never converted into a second root wait for a future RX credit observation. A stable committed terminal wins before lifetime policy; a terminal-absent `Waiting` op7 remains retained only while its exact generation, pair epoch, and physical-lifetime epoch are current, and an invalidated lifetime enters the sole pair-recovery lane without replay. An issued or otherwise ambiguous active op7 deadline remains fail-closed. Purge only never-issued queue entries at generation/reset boundaries, preserve active issued-unknown poisoning, and leave GENET unchanged. RX deadlines contain exact faults only and never create source probes, rescue transactions, or another physical action. - docs/DRIVERS.md + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — record the measured transport-specific baseline, the as-built bounded cadence correction, and a fresh-hardware acceptance target without promoting source or model evidence into Pi performance proof. Commands: - python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py - python3 -m pytest -q tests/test_host_bootpd_supervisor.py - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26d-qemu-sel4-16-initial - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m26d-pi4-sel4-16-initial - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26d-qemu-sel4-16-final - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m26d-pi4-sel4-16-final Checks: - Historical top, accepted 26b, first seL4 16, and final seL4 16 lanes are all recorded with artifact paths, workload parameters, tool version/provenance, selected seL4 build, gateway/auth mode, QEMU SMP topology, target transport, and error-budget policy. - QEMU/Pi comparisons reject stale or mismatched artifacts before any verdict; Pi evidence remains fresh, timer-qualified, and paired with raw TCP/cohsh proof for the selected transport. - The live direct-link DHCP supervisor recreates its disposable runtime directory before every service attempt, so an `out/` cleanup cannot silently strand the GENET control lane. - Tuning preserves Secure9P bounds, console grammar, manifest authority, no-retry failure accounting, HAL/driver-task ownership, and root-task no-std constraints. - CYW43 performance comparison retains the approximately 315-ms request-to-first-payload mean and 407-ms p95 / approximately 2.9-command-per-second baseline. The earlier proposed tenfold-improvement target of request-to-first-payload p95 at or below 40 ms and at least 29 successful requests per second, and the aggressive low-overhead target of p95 at or below 10 ms and at least 100 successful requests per second, remain non-blocking optimization targets rather than Milestone 26b closure gates. Accepted exact-image hardware proof is the usable, repeatable no-semantic-loss envelope established by the operator-approved `2668c34f76ff` candidate transport matrix above and required again from the repaired candidate, including honest bounded recovered retransmission accounting and an unchanged GENET control within its accepted envelope. - Wi-Fi remains a research/diagnostic lane with the documented worker envelope; production throughput parity still requires fresh wired/GENET evidence. Deliverables: - Benchmark ledger and refreshed artifacts that make the seL4 16 performance delta reviewable before later milestones depend on the refreshed baseline. ``` ``` Title/ID: m26d-domain-schedule-debt-removal Goal: Remove or explicitly resolve stale legacy domain-schedule dependencies from Cohesix seL4 build configurations. Inputs: fresh-source Pi profile audit outputs, the repo-managed immutable `seL4/build_UBOOT` v16 diagnostic artifact input, Pi 4 build scripts, seL4 16.0.0 upgrade notes. Changes: - scripts/pi4-image-build.sh and related build docs — ensure Cohesix-owned Pi 4 flows do not silently depend on stale `domain_schedule.c` defaults when domains are not in use. - docs/HARDWARE_BRINGUP.md and docs/BUILD_PLAN.md — document the resolved seL4 16 domain-schedule posture for Cohesix. Commands: scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv Checks: one-domain Cohesix builds no longer inherit accidental `sel4test` schedule-file assumptions. Deliverables: documented and verified domain-schedule posture for Cohesix seL4 16 builds. ``` ``` Title/ID: m26d-isolated-runtime-wx-closure Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / isolated-runtime W^X closure Goal: Make every isolated-runtime VSpace mapping fail-closed for execute permission without changing the driver-task ABI or CYW43 behavior. Inputs: apps/root-task/src/hal/mod.rs, apps/root-task/src/sel4.rs, seL4 16 AArch64 page attributes, profile-selected isolated runtime ELF images. Changes: - apps/root-task/src/hal/mod.rs — validate ELF load flags and checked ranges, reject W+X and effective page-level permission collisions, and derive executable-page intent before child allocation. - apps/root-task/src/hal/mod.rs + apps/root-task/src/sel4.rs — add execute-never while preserving cache/device attributes for every non-code root alias and child mapping; retain only validated read-only code and the reviewed trampoline as executable. - apps/root-task/src/hal/mod.rs tests — cover malformed headers, unknown flags, RWX segments, page collisions, read-only code, data, holes, shared resources, DMA, and MMIO attribute policy. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::tests::runtime_ - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hal::tests - SEL4_BUILD_DIR="$PWD/seL4/build_UBOOT" cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4 Checks: no writable child page is executable, no unvalidated ELF flag can create executable authority, cache/device policy is preserved, and the isolated-runtime ABI plus CYW43-owned state machine are unchanged. Deliverables: reviewed W^X implementation, focused regression tests, and Pi 4 target compile evidence. ``` ``` Title/ID: m26d-canonical-sel4-profile-closure Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / canonical seL4 profile closure Goal: Make the accepted seL4 16 production, diagnostic, and proof configurations reproducible and fail-closed from pinned upstream source, then make the validated production contract the operational QEMU default. Inputs: official seL4 16.0.0 manifest and project revisions, official Arm GNU Toolchain 15.2.Rel1 macOS ARM64 archive, official DENX U-Boot 2026.01 archive, configs/sel4/profiles.toml, configs/sel4/python-*.lock, toolchain/setup_macos_arm64.sh, tools/sel4-profile-project/CMakeLists.txt, scripts/sel4_profile.py, scripts/cohesix-build-run.sh, scripts/release_bundle.sh, scripts/qemu-run.sh, scripts/cohsh/run_regression_batch.sh, staged Test Plan scripts, seL4 build outputs, QEMU launch inputs. Changes: - configs/sel4/profiles.toml + configs/sel4/python-*.lock — pin official project revisions, the self-contained Arm compiler archive and executable identities, the exact Python distribution closure, the DENX mkimage source archive, and target, GIC, SMP, domain, debug, benchmark, counter-export, and claim-eligibility contracts for each supported profile. - toolchain/setup_macos_arm64.sh — provision the pinned compiler, isolated hash-locked Python environment, and mkimage build without using a rolling compiler formula or a dirty/incomplete repository source tree; emit provenance records bound to the setup script and profile contract. - tools/sel4-profile-project/CMakeLists.txt — configure upstream seL4 without inheriting the legacy sel4test domain-schedule assignment, regenerate the platform memory map required when fixed-address Pi elfloader images also load rootservers last, and add only the contract-selected bounded file-backed QEMU production placeholder reserve required for logical rootserver replacement. - scripts/sel4_profile.py — require fresh build directories, disable configure-time memoization, reject stale or pre-existing stamps and outputs, bind a causally fresh completed stamp to every input and output, reject unknown evidence classes or class/eligibility mismatches, and validate source provenance, compiler/Python/mkimage identities, caches, generated headers including the rootservers-last elfloader memory map, QEMU rootserver-archive capacity, independently parsed DTB/launcher agreement, strict executable ELF structure, shipping/RWX policy, forbidden settings, and proof eligibility without mutating evidence to make it pass. - scripts/cohesix-build-run.sh + scripts/release_bundle.sh + scripts/qemu-run.sh + scripts/tcp_*.sh + scripts/cohsh/run_regression_batch.sh + staged Test Plan scripts — default QEMU consumers to `out/sel4/profile-v2/qemu-smp-production`; validate runtime or release intent before consuming the canonical tree and classify explicit unvalidated alternatives as claim-ineligible. - README.md + docs/QUICKSTART.md + docs/HARDWARE_BRINGUP.md + docs/DRIVERS.md + docs/OPERATOR_WALKTHROUGH.md + docs/TEST_PLAN.md + apps/root-task/README.md — publish the same canonical default while preserving explicit diagnostic/historical qualifications. - docs/TOOLCHAIN_MAC_ARM64.md + docs/audit/M26D_SEL4_16_PROVENANCE.md — document the canonical workflow and distinguish accepted builds from legacy/diagnostic inputs. Commands: - toolchain/setup_macos_arm64.sh - out/toolchain/sel4-profile-venv/bin/python -m pytest -q tests/test_sel4_profile.py - out/toolchain/sel4-profile-venv/bin/python scripts/sel4_profile.py validate --all --require-source --require-artifacts --evidence out/audit/m26d-profile-v2-all.json - scripts/cohesix-build-run.sh --sel4-build out/sel4/profile-v2/qemu-smp-production --no-run --cargo-target aarch64-unknown-none Checks: QEMU uses GICv3 in both parsed DTBs; one-domain profiles have no schedule-file dependency; fixed-address Pi rootservers-last builds contain generated `memory_region` metadata; the QEMU production elfloader archive meets its declared minimum and accepts the current boot-minimized Cohesix root task without in-place ELF growth; source revisions and canonical Pi overlay digest match the official pin; compiler archive/version/target/binary identities, exact Python locks and installed-file digest, DENX source and mkimage provenance, caches, generated outputs, immutable input hashes/values, causal build times, and strict `ET_EXEC`/RX-entry ELF structure agree; aggregate closure requires all five fresh `out/sel4/profile-v2/*` source and artifact sets unless explicitly diagnostic-relaxed; evidence classes have fixed release/runtime eligibility; upstream wrapper artifacts remain machine-classified non-shipping; shipping artifacts reject RWX; diagnostic settings cannot earn proof claims; all active QEMU build/release/regression/test defaults consume the canonical production path and revalidate it before claims; validation fails on drift. A fresh target-qualified run at `out/test-plan/m26d-qemu-sel4-16-gap-audit` must pass linked GICv3 boot, authenticated TCP regression, REST parity, and due diligence before replacing the retained seL4 15 comparator. Deliverables: source-controlled profile contract, wrapper, validator, operational/release adoption, tests, runbook alignment, and provenance record. ``` ``` Title/ID: m26d-worker-execution-truth-repair Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / reopened Milestone 25 task-isolation and 26c Worker execution truth Goal: Make generated and documented Worker execution claims match the currently launched target objects while preserving existing host/session behavior. Inputs: configs/root_task*.toml, tools/coh-rtc, generated root-task artifacts, apps/root-task/src/worker_authority.rs, canonical Worker/security/interface docs, Milestone 25/26c audit ledgers. Changes: - configs/root_task*.toml + tools/coh-rtc — emit model-only general Worker roles as not target-implemented, disable executable-role capability/notification claims consistently, and reject `implemented=true` until a generated task-object contract exists. - generated artifacts + focused tests — regenerate all profile outputs and reject manifests that claim executable-role authority or lifecycle notifications without an executable role contract. - canonical docs + audit ledgers — distinguish host/session tickets and in-process models from target TCB execution, and record the reopened closure phase for real Worker objects, badged IPC, lifecycle notifications, fault handling, and revocation. Commands: - cargo test -p coh-rtc - cargo test -p root-task --lib worker_authority - scripts/check-generated.sh Checks: generated truth, tests, and prose agree; no model-only role is called live or capability/notification-backed; existing namespace/ticket semantics remain unchanged; driver-runtime TCB proof is not reused as general Worker proof. Deliverables: regenerated as-built Worker truth plus an explicit, separately gated target-execution closure phase. ``` ``` Title/ID: m26d-sel4-capability-utilization-audit Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / capability, scheduling, and TCB decision closure Goal: Bound what Cohesix uses from seL4 16 today and prevent unused features or model-only code from becoming product claims. Inputs: seL4 Reference Manual v16.0.0, generated kernel headers, root-task/HAL/Worker code, docs/audit/M26D_SEL4_16_CAPABILITY_AUDIT.md, docs/audit/M26D_MCS_DECISION.md, docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md. Changes: - docs/audit/M26D_SEL4_16_CAPABILITY_AUDIT.md — classify each relevant kernel capability as implemented, partial/model-only, intentionally unused, or blocked, with direct evidence and closure routing. - docs/audit/M26D_MCS_DECISION.md — retain non-MCS for 26d, record the strong architectural-fit verdict and selected SMP+MCS successor, compare classic SMP/single-core MCS/SMP+MCS, define bindings, scheduling-contract, WCET/budget, fault, target-evidence, and atomic-reversion gates, and route implementation to `m26e-mcs-abi-foundation` and `m26e-mcs-smp-target-acceptance`. - docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md — record current root-owned parsers, networking, supervision, policy, and audit surfaces plus the exact ordered Milestone 26e split tasks and required evidence. Commands: - scripts/check-generated.sh - cargo test -p root-task --lib Checks: no audit entry confuses API availability with Cohesix use; no live Worker or MCS claim lacks target evidence; root-owned services are named rather than implied isolated; every deferred capability has an explicit milestone route or rationale. Deliverables: capability matrix and accepted MCS/root-TCB boundary decisions tied to as-built evidence. ``` ``` Title/ID: m26d-smp-command-post-cutover-usability Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / linked-UART SMP diagnostic defect correction Goal: Make bare `smp` useful after linked-UART cutover by routing it to the existing bounded activity report while preserving the raw scheduler snapshot as explicit debug-only `smp dump`. Inputs: crates/cohsh-core/src/{command.rs,verb.rs,help.rs}, apps/root-task/src/{console/mod.rs,event/mod.rs,affinity.rs}, docs/USERLAND_AND_CLI.md, docs/HARDWARE_BRINGUP.md, docs/snippets/cohsh_grammar.md, current seL4 16 QEMU/Pi diagnostic profiles, and linked-UART Pi evidence. Changes: - crates/cohsh-core/src/command.rs + crates/cohsh-core/src/verb.rs + crates/cohsh-core/src/help.rs — map bare `smp` and compatibility spelling `smp activity` to `SmpMode::Activity`, retain raw `SmpMode::Snapshot` only behind explicit `smp dump`, reject unknown/extra arguments, and align shared help/grammar. - apps/root-task/src/console/mod.rs + apps/root-task/src/event/mod.rs — route both activity spellings through the existing bounded userspace report; keep the raw scheduler helper available only for explicit debug dumps and reject it after linked-UART cutover without reclaiming UART ownership. - docs/USERLAND_AND_CLI.md + docs/HARDWARE_BRINGUP.md + generated grammar snippets — make bare `smp` the normal operator instruction, retain `smp activity` for compatibility, and describe the narrow pre-cutover/QEMU diagnostic use and UART restriction of `smp dump`. Commands: - cargo test -p cohsh-core smp - cargo test -p cohsh-core --test doc_snippets - cargo test -p root-task smp_ - cargo test -p root-task --features net-console smp_ - cargo fmt --all -- --check - scripts/check-generated.sh Checks: - `smp` and `smp activity` emit the same bounded userspace activity records and terminate with `OK SMP mode=activity`. - `smp dump` is the only operator route to the existing raw scheduler snapshot; non-debug builds and post-cutover linked-UART profiles reject it deterministically without touching UART MMIO. - The correction adds no telemetry fields, authority path, namespace, manifest field, kernel benchmark dependency, or root-owned steady-state UART fallback. - Shared help, generated grammar, canonical operator docs, parser tests, root-task tests, and generated-artifact drift checks agree. Deliverables: One safe default SMP diagnostic, one explicit debug-only raw snapshot spelling, and aligned tests/operator instructions. ``` ``` Title/ID: m26d-repository-gate-closure Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / repository-wide regression gate closure Goal: Restore every mandatory repository-wide source, dependency, packaging, and staged-regression gate exposed while preparing the refreshed QEMU and Pi 4 evidence, without changing operator-visible semantics or hardware authority. Inputs: Cargo.toml, Cargo.lock, deny.toml, apps/root-task/build.rs, apps/root-task/build_support.rs, apps/root-task/sel4.ld, apps/root-task/src, scripts/cohesix-build-run.sh, scripts/pi4-image-build.sh, scripts/pi4_image_identity.py, scripts/pi4_wifi_repeatability.py, scripts/pi4_trace_normalize.py, scripts/ci/test_plan_*.sh, scripts/ci/due_diligence_gate.sh, .github/workflows/*.yml, README.md, docs/TEST_PLAN.md, docs/audit risk registers, current M26b/M26d source and build evidence. Changes: - Cargo.toml + Cargo.lock + CI — update vulnerable or yanked transitive dependency selections to supported compatible versions without widening VM dependency closure, track the lockfile, and reject stale resolution before build/test commands. - apps/root-task/build.rs + apps/root-task/build_support.rs + apps/root-task/src — correct fresh-checkout generated-artifact validation, deterministic test-contract drift, and strict lint failures exposed by the canonical Pi 4 Stage 02 feature set. - apps/root-task/src/hal + apps/root-task/src/sel4.rs + configs/sel4/profiles.toml + tools/sel4-profile-project/CMakeLists.txt — admit the complete selected linked-runtime capability inventory before creating any child, retain bounded post-bootstrap CSpace headroom, transfer child-only code/stack/framebuffer mappings without permanent root aliases, and establish the then-required 14-bit Pi root-CNode minimum so runtime-image growth fails in deterministic build/bootstrap gates instead of panicking during shared HDMI setup. Milestone 26e later supersedes that minimum with the 16-bit full-Worker profile. - apps/root-task/sel4.ld + scripts/pi4-image-build.sh + scripts/pi4_image_identity.py + scripts/pi4_wifi_repeatability.py — place one fixed-width marker in a dedicated file-backed root-task load section, keep the tracked `seL4/build_UBOOT` profile artifact tree immutable, reproduce its baseline elfloader byte-for-byte as a relink-tool oracle, compose the new rootserver/CPIO/wrapper only in disposable output, bind the canonical tree, tool identities, oracle, and derived tuple in provenance, seal the wrapper with the domain-separated normalized digest of the complete legacy Pi image, repair and revalidate U-Boot CRCs, and require staged/read-back bytes plus every UART slice to agree on that content-derived identity. - scripts/pi4-image-build.sh + focused host tests/docs — make routine Pi media refresh a single exact-child in-place synchronization on an already provisioned MBR/FAT32 `COHESIX` card, reject locked macOS sessions before mutation, keep the host awake through the critical section, preserve and verify the private policy, compare every staged file, and unmount only that child. Whole-disk initialization remains an explicit operation and is never an automatic fallback; normal reflash must not repartition, reformat, force-unmount the whole medium, or select another same-label volume after AppleSDXC re-enumeration. - scripts/cohesix-build-run.sh and focused tests/docs — keep the QEMU rootfs below the 4 MiB guard while preserving all manifest-declared runtime artifact names, bytes, and isolated-runtime lookup semantics. - scripts/ci, tools/rust-risk-audit, README.md, and canonical docs — make Python selection exact and recoverable, count cfg-test Rust separately from production risk, record the real linked-runtime unsafe delta, and align as-built packaging explanations with the canonical QEMU path. - .github/workflows/*.yml — keep one required per-change `ci` job as a small non-claiming health signal: locked dependency resolution, generated-contract integrity, one default workspace check/test pass, host compilation of the QEMU/Pi root-task feature test binaries, and the bare-metal Pi runtime target check. Keep fresh advisory checks weekly/manual, use least-privilege permissions and deterministic pins, rely on native job logs, and leave complete feature behavior, Python, UI, risk/lint, target, performance, and release qualification in focused developer validation or the canonical Test Plan instead of repeating them on every push. Stage 02 target compilation and QEMU packaging remain in the provisioned macOS ARM64 evidence lane because their canonical external seL4 build trees are intentionally not vendored. - CI compatibility review — the hosted-policy reduction and corrected eight-millisecond QEMU guard oracle change no host-tool, `tools/cohesix-py`, benchmark implementation, report schema, external interface, or target authority. The NIST documentation smoke uses base-system `grep -E`, and the seL4 syscall-routing guard scans Rust sources in-process, so a clean hosted runner does not require a separately installed search tool. Those surfaces remain catalogued for focused and staged validation and require no implementation change here. Commands: - actionlint .github/workflows/*.yml - cargo metadata --locked --no-deps - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo test --workspace -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu --lib --no-run - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib --no-run - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - cargo test -p rust-risk-audit - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml - cargo audit - cargo deny check advisories - scripts/check-generated.sh - PATH=/usr/bin:/bin bash tests/security/nist_evidence_smoke.sh - cargo test -p root-task --test sel4_syscall_guard -- --test-threads=1 - python3 -m pytest -q tests/test_pi4_image_identity.py tests/test_pi4_wifi_repeatability.py tests/test_pi4_trace_normalize.py - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-repository-gates-qemu - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26d-repository-gates-pi4 - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m26d-repository-gates-pi4 Checks: mandatory lint, workspace, dependency, generated-artifact, QEMU packaging, cfg-aware risk-ratchet, and offline staged-regression gates pass with no newly ignored advisory, forged or duplicated image marker, invalid U-Boot envelope/CRC, staged/read-back alias, truncated supervisor record, skipped stage, rootfs-size exception, operator grammar drift, or loss of manifest-declared driver-runtime artifact identity; ordinary Pi reflash proves exact whole/child ownership, refuses locked-session mutation, performs no whole-disk topology change or global label fallback, preserves the bounded private policy, and verifies every staged file before exact-child unmount; accepted production unsafe growth is explicit and expiry-bounded; live Pi stages remain separately hardware-gated; the required hosted check reports only material source-contract, compile, target-compile, and default-test failures, its NIST and syscall-routing guards need no separately installed search tool, and it cannot be cited as staged or target acceptance; every retained workflow parses cleanly, references only tracked commands, preserves required event coverage, and has no redundant or no-op job. Deliverables: reviewable dependency resolution and risk register, deterministic root-task/Python regression coverage, sub-4-MiB QEMU payload, clean QEMU plus offline Pi target-qualified gate evidence, and one coherent GitHub Actions surface consisting of the small required `ci` signal plus separately scheduled/manual dependency visibility. ``` ``` Title/ID: m26d-cyw43-hardware-free-closure Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / hardware-free CYW43 reliability closure; Reopened Milestone 26b / m26b-wifi-sdio-notification-dpc-closure and m26b-net-control-priority Goal: Make the Pi 4 CYW43/SDIO linked-runtime design software-complete, deterministic, event-pump-driven, adversarially tested, artifact-bound, and repository-green without claiming unavailable repeatability proof from physical hardware. Inputs: AGENTS.md, docs/BUILD_PLAN.md, docs/DRIVERS.md, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md, /Users/lukasbower/REBOOT.md, newest non-empty Pi serial logs and boot-paired pcaps, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, configs/generated/root_task_resolved.json, tools/coh-rtc, generated bootstrap/profile outputs, crates/pi4-driver-abi/src/lib.rs, apps/pi4-driver-runtime/src/lib.rs, apps/root-task/Cargo.toml, apps/root-task/src/{drivers/driver_task_net.rs,event,hal,net/{mod.rs,queue.rs,stack.rs},serial,userland}, scripts/pi4-image-build.sh, scripts/pi4_image_identity.py, scripts/pi4_wifi_repeatability.py, scripts/pi4_trace_normalize.py, and focused/runtime/repository gate suites. Changes: - crates/pi4-driver-abi/src/lib.rs — use reserved shared owner-ring bytes for one fixed 24-byte sequence-last `DriverRuntimeContinuationGrant` containing magic, request sequence, complete action fingerprint, authoritative owner generation, monotonic nonzero grant id, and consumer-published consumed id. Define the 24-byte sequence-last `DriverRuntimeCyw43RxQueueState` at local-ring offset 192 and the 128-byte `DriverRuntimeCyw43RxBatchRecord` at shared offset 36,864. Its one through eight entries address fixed 1,536-byte payload slots starting at offset 36,992; `committed_parent_sequence` at byte 124 is the final batch commit. Define the disjoint cache-line-aligned 64-byte `DriverRuntimeCyw43RxBatchAck` at shared offset 49,280 with generation, parent sequence, queue commit, count, and `committed_queue_commit_sequence` last. Define the 20-byte `DriverRuntimeSdioDeadlineArm` in SDIO owner-ring bytes 2,028 through 2,047 with physical-lifetime epoch, request sequence, expiry ticks low/high, and `committed_request_sequence` last. - configs/root_task*.toml + tools/coh-rtc + generated outputs + crates/pi4-driver-abi/src/lib.rs — declare and validate the sole physical SDIO owner with SDHCI IRQ 158, DMA channel-4 IRQ 116, three MMIO pages, ten DMA pages, 32 shared pages, and one exact 32-KiB CYW43-SDIO aperture; reject split IRQ ownership or under- or over-provisioned geometry instead of selecting another launch lane. - apps/pi4-driver-runtime/src/lib.rs — preserve endpoint rendezvous only for non-CYW43 root-to-runtime retained commands. Non-op11 CYW43 foreground commands keep their acknowledged exact shared-grant authority plus send-only reserved-root-badge hint with no endpoint fallback. Exact op11 instead uses one HAL-derived persistent parent marker and paired child markers with no recurrent root or delegated grant. Urgent op7 keeps its separate finite steady-service identity and budget. EAPOL-Start and ordinary control remain on the ordinary retained cadence; only a completely intake-sealed current-generation EAPOL-Key M2, M4, or group-key response may use the existing paired finite-op7 marker, with one frame, four owner operations, 1,536 bytes, and a Function-2 pre-TX DPC fence. Its exact request retains CYW43-plus-SDIO priority and durable terminal authority after one notification, with no later grant or signal; deadline expiry is recovery-only. Ordinary post-Gate-8 TCP retains its O(1) finite-op7 classification and does not run the EAPOL-Key parser. From the first post-release event, production DPC binds its exact event sequence and physical generation to the finite steady-service child marker; mutable Gate 8 state cannot select the ordinary recurrent-grant mode. Replace the remaining lossy delegated endpoint `NBSend` with one generated send-only badge-256 cap to the SDIO owner's bound notification. Notifications are coalescing prompts only; immutable command identity, generation, selected grant/marker/event lease, sequence-last ring state, and current fault flags remain authoritative. The SDIO owner joins SDHCI IRQ158, DMA4 IRQ116 when applicable, and durable CARD_INT/controller state into exactly one terminal for each immutable request. SDIO alone takes one live joined-controller sample after a changed steady cursor before it may block; that hardware-sample exception does not make snapshot novelty transaction authority. Once a sequence-last SDIO command is committed, missing or competing pre-admission seal state cannot erase it after the prompt is consumed: owner dispatch performs zero physical I/O and publishes the typed terminal. Every helper is bounded and each immutable hardware request issues at most once. Persistent op11, urgent op7, and DPC event service route from current durable conditions rather than snapshot novelty: deterministic private phases continue locally even on equal snapshots, while exact child, credit, queue, and peer waits block immediately even when newly observed. EVENT/DATA discovered while op11 awaits its exact BCDC reply is committed as sideband RX state; CYW43 preserves the op11 parent until root copies the batch and commits the exact disjoint ACK. Completion body/cache clean/barrier precede sequence-last commit and any signal. A recovered IRQ acknowledgement leaves `ack_failures` as per-pair history but clears current pending/fault state; that historical count cannot revoke op11, steady TX, RX batching, or DPC urgency. Issued-unknown containment preserves the exact transaction and cannot fall back or replay. Retain Linux-ordered power sequencing, inhibit/preflight, register programming, indivisible COMMAND-plus-DMA-start issue, request snapshots, containment, host configuration, DPC activation, generation publication, and Function 2 ready/window service under the sole SDIO owner. At condition-before-sleep, every active autonomous phase that can remain blocked publishes its exact counter deadline commit last: pre-issue inhibit/status-clear, issued poll, containment/reset polls, and host-clock polls are covered, while containment clock settle selects the earlier settle/overall expiry. Terminal/reset clears the arm before its publication. An unchanged expired arm may prompt one existing root-to-CYW43-to-SDIO fault hint, after stable identity checks at each hop; SDIO alone rechecks terminal-before-deadline and contains the request. One physical interrupt episode completes the active transfer, drains bounded RX, applies SDPCM credits, admits an already-ready urgent TX, and rechecks the durable condition before blocking. CYW43 publishes queue state by clearing its commit, writing and cleaning the body, barriering, and writing a new nonzero commit sequence last. One immutable parent similarly commits one through eight batch payloads and entries; op8 then publishes its single terminal, while op11 waits for the separate root ACK and remains active. Missing, coalesced, or repeated hints change no authority or progress. Each DPC event's immutable source/frame-length condition is applied only on first sequence admission; an overlapping sequence poisons the generation. Keep both the complete retained trace and an explicitly invalid `MaybeUninit` full-baseline slot in loader-zeroed storage. The former raw non-descriptor service shape is rejected before card access. - apps/pi4-driver-runtime/src/lib.rs target-warning closure — remove orphaned synchronous SDIO/CYW43 wrappers and disconnected policy oracles superseded by the retained exact-grant/DPC lane, and compile retained host-compatibility RX models only for unit tests. Keep the bare-metal build featureless and warning-clean without a second physical path or a crate-wide lint allowance. - apps/pi4-driver-runtime/src/lib.rs + apps/root-task/src/{local_seat.rs,event/mod.rs} — restore the reopened 26b local-seat liveness contract without changing CYW43 authority: keep one Linux-usbhid-shaped interrupt-IN transfer active for the keyboard lifetime and rearm one successor after each completion instead of expanding from one to 32 active TRBs after the first idle report. Treat one armed idle transfer as command-ready but not physical-input proof. At each declared CYW43 fairness stride, preserve the exact parent and pair-priority lease while running one bounded `Serial -> LocalSeat -> Dispatch -> pending Display` checkpoint with zero NIC operations; a CYW43 notification may prompt a later queue-state read but cannot latch admission or rewrite an already-scheduled physical-console phase. GENET scheduling remains unchanged. - apps/root-task/Cargo.toml + apps/root-task/src/net/{mod.rs,queue.rs,stack.rs} + apps/root-task/src/event/mod.rs — replace smoltcp's transient automatic ICMPv4 echo response with one common fixed-capacity raw IPv4/ICMP socket owner. From its two-frame full-MTU RX queue, the service admits only checksum-valid Echo Requests from a unicast source to the exact assigned local IPv4 address and constructs at most one reply per NetStack service turn. Its one-frame full-MTU TX queue preserves identifier, sequence, and payload while ordinary smoltcp neighbor resolution is pending, then emits exactly one reply. Drop malformed, nonlocal, non-Echo, saturated, or competing work; expire unresolved reply state after three virtual-counter seconds; and purge/recreate both queues on Wi-Fi connection-generation change, DHCP address change, and explicit stack reset so no reply crosses a network lifetime. Keep this lane above both physical drivers: it creates no CYW43 source probe or packet issuer and does not change GENET scheduling. - apps/root-task/src/drivers/driver_task_net.rs + apps/root-task/src/hal/{mod.rs,driver_task.rs} + apps/root-task/src/event/mod.rs + apps/root-task/src/net/{mod.rs,stack.rs} + apps/root-task/src/userland/mod.rs — retain the no-allocation bootstrap/recovery owner under the ordinary EventPump, stage all published shared-page aliases, clear cached progress identity when transport ownership is cleared, and mint the CYW43-only root scheduling cap only after fallible construction. Enforce at most one root CYW43 parent admission per outer turn. Ordinary non-op11 foreground commands retain their bounded `Stage`, priority transition, sequence-last `CommitRing`, exact `PublishGrant`, signal-last `NotifyRing`, and later `PollRing` phases. Exact op11 instead crosses its sequence-zero `Stage`, sequence-last `CommitRing`, and sole signal inside the same already-admitted producer call, remains `Issued` through misses, and publishes no recurrent grant or signal. EventPump evaluates NetStack's side-effect-free exact association-owner predicate and opens the outer pair lease before the first association poll can allocate Join, even when rendered status is stale; presentation text is not scheduling authority. The ordinary Join then crosses `Stage`, `CommitRing`, `Issued`, and its sole signal under that already-open lease; it performs zero request-bound boost/restore actions. A stable exact Join terminal remains canonically admissible while the outer pair episode enters its bounded Closing path, restores CYW43, restores SDIO, and completes, one bounded HAL step per later EventPump turn and with no new signal or request. Driver-runtime ABI v8 overlays one typed `DriverRuntimePersistentWaitReceipt` on the existing mutually exclusive 24-byte grant/progress slot. After sequence-last issue and before that exact same-request receipt or terminal is stable, root retains the open Network lease for ordinary association. The only named request-bound paired lifetime is the intake-sealed current-generation EAPOL-Key M2, M4, or group-key finite-op7 class; this closes the notify/wake scheduling handoff without granting, signalling, issuing, or creating a completion poll clock. CYW43 commits the exact request/fingerprint/logical-generation/wait-epoch receipt last only after its final durable-condition and child-terminal checks, retains it only while armed on the generated local notification, and clears it before wake re-entry or terminal publication. Publication or clear failure poisons the exact transaction and uses the existing fail-closed pair path. Once the receipt proves the external wait and HAL reports the exact issued op11 as `Waiting`, root masks only its runtime-descriptor, logical-owner, and HAL-lease self-demand; it performs no CYW43/SDIO poll but retains both outer pair reservations while required operator phases rotate. Committed DPC/RX, urgent TX, sideband consumption, deadline containment, terminal-drain, and recovery remain schedulable, and `TerminalVisible` resumes the exact consumer inside the same episode. Recovery, stale, reservation-mismatched, and GENET requests retain their fail-closed paths. Root stable-reads `DriverRuntimeCyw43RxQueueState`, then accepts a `DriverRuntimeCyw43RxBatchRecord` only when its generation, queue commit, parent sequence, one-through-eight count, remaining depth, and entry bounds match. It copies the fixed payload slots and re-reads the batch header; an authority-bearing change rejects the batch, while a change confined to the passive packed timing word preserves the payload and exact ACK and degrades both split halves to UNKNOWN. An op8 detail `0x5803` represents the entire terminal parent, not one frame. For an active op11, the same batch is nonterminal sideband: root delivers it once and commits the exact cache-line-disjoint ACK last. A notification only prompts these reads. Root also observes the stable deadline arm in its existing service loop and sends at most one fault-only reserved-root hint for an unchanged expired identity; it never issues, polls, retries, or directly signals SDIO. Visible committed depth retains Network service; exact committed empty state ends it. No root wake bit, hit epoch, clear/recheck history, or per-frame terminal authorizes work. - current CYW43 lifetime correction to the preceding receive rule — EventPump alone coordinates the generation-scoped two-class, aggregate-capacity-16 TX queue and its sole active op7 owner. TxToken consumption remains queue-only. An exact retained foreign HAL owner, including the immutable RX batch op8 parent, remains non-revocable and leaves op7 queued/requestless until that parent terminal. Once the lane is free, EventPump advances one active op7 or promotes and advances one eligible FIFO head before copied-RX service, so sustained RX cannot starve urgent DHCP/control TX. The runtime alone gates physical issue with `sdpcm_seq` and `tx_max`; a closed window retains that promoted exact op7 in `WAIT_CREDIT`. The joined Function-2 terminal releases root immediately and is not converted into a later RX-credit acknowledgement wait. The finite host-EAPOL key-response parent suppresses only its own waiting root cursor after issue; DPC/RX/recovery remain runnable and its committed terminal re-enables the exact consumer. The post-release activation is generation-long: healthy control work reuses it, and one exact already-committed pre-TX event is consumed without admitting an unbounded later-event stream. Only activation-absent or mask-skewed state, plus exact ACK debt bound to an already-submitted immutable activation frontier, creates an activation-repair child; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed. The persistent CYW43 transaction services physical progress to bounded quiescence: joined IRQ completion, bounded RX drain, SDPCM-credit update, already-ready urgent TX admission, and a final durable-condition recheck. Queue state is committed before any optional signal, and one op8 parent commits up to eight frames before its one optional root signal. SDIO also re-reads its sequence-last ring-only command intake immediately before idle receive, so a fresh child re-enters arbitration without notification history. Deadlines only fence or poison an exact active autonomous phase or ambiguous owner; normal ingress has zero timer-created source polls or watchdog rescue. These are one-lane liveness corrections, add no fallback or poller, preserve post-Gate-8 TCP's O(1) lane, and do not apply to GENET. - persistent-op11 sideband and physical-deadline closure — while op11 remains the sole immutable control parent, commit preceding EVENT/DATA as one batch and let root publish the exact cache-line-disjoint ACK after stable delivery; only the exact CONTROL reply terminalizes the parent. At condition-before-sleep, commit `DriverRuntimeSdioDeadlineArm` for every blockable active autonomous SDIO phase, including pre-issue inhibit/status-clear; use the exact phase counter expiry and the earlier settle/overall expiry during containment clock settle, and clear the arm before terminal/reset publication. Ordinary traffic requires `sdio_deadline_hints=0`; one unchanged expired exact arm may produce at most one fault-only hint over the existing root-to-CYW43-to-SDIO chain, with SDIO retaining sole containment authority. Current DPC flags/pending state govern work; per-pair `ack_failures` is historical telemetry and cannot disable healthy work after exact retry recovery. - retained-parent time-cap validation — let elapsed time defer only to a HAL-validated open root-continuation parent whose nonzero immutable fingerprint, request, logical generation, pair epoch, priority reservations, and restart-free state remain current across the EventPump check. Simultaneous hard-turn and elapsed bounds report the hard turn-cap yield. - recovery policy — run exactly one outer boot episode as `attempt=1`, with one initial physical pair, zero pre-service pair restarts, and no automatic whole-bootstrap backoff, reset, or attempts 2 through 5. A pre-service typed fault drains/fences its exact owner, terminates the boot episode, quarantines network service, and restores bounded diagnostics, authentication, reboot, serial, local-seat, and HDMI service. Atomic Gate 8 commit opens DHCP but remains nonterminal; the unique bootstrap Ready requires exact-generation bound DHCP plus the admitted TCP listener, and the original deadline terminates missing service readiness. Gate-local association, DHCP, and protocol retries remain bounded and do not create outer attempts. Exact service readiness authorizes one later consumed-once steady-state pair repair; duplicate Ready cannot replenish it, and restored service uses a distinct runtime Ready marker before one later episode can be armed. Gate 10 remains downstream acceptance proof rather than recovery authority. Pre-issue contention that issued nothing and changed no scheduler state clears locally; issued or scheduler-mutating uncertainty requires the ordered runtime repair. - scripts/pi4_image_identity.py + scripts/pi4_wifi_repeatability.py + scripts/pi4_trace_normalize.py and tests — bind evidence to one clean expected commit/build/image, reject duplicate or aliased run/log/image inputs, validate stable single-descriptor log reads, parse exact rootserver archive membership, expose separately bounded current-episode, boot-cumulative transition/fault, immutable first-pre-fence scheduler, and split root-grant records, reject impossible phases/masks/widths, and preserve honest separation between deterministic offline proof and later physical repeatability evidence. - docs/DRIVERS.md + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — record the as-built split between non-CYW43 root endpoint authority, root-to-CYW43 exact-grant plus hint-only reserved-root notification, delegated exact-grant plus hint-only owner notification, joined SDHCI/DMA IRQ completion, durable sequence-last RX queue state, one-parent bounded RX batches, the exact association claim and retained-open Join episode, and the complete passive priority/recovery/root-grant grammar; record the July 24 failure as reliance on a consumable scheduling edge rather than absence of a rescue watchdog; and retain the July 10 all-gates/DHCP/TCP boot only as a compatibility oracle for the upper Linux-shaped path. Commands: - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo test --workspace -- --test-threads=1 - cargo test -p pi4-driver-abi -- --test-threads=1 - cargo test -p pi4-driver-runtime --lib -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib -- --test-threads=1 - cargo test -p root-task --lib --no-default-features --features net-console icmp_echo -- --test-threads=1 - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - cargo rustc --locked --release -p pi4-driver-runtime --lib --target aarch64-unknown-none -- -D warnings - .venv/bin/python -m pytest -q tests/test_pi4_image_identity.py tests/test_pi4_wifi_repeatability.py tests/test_pi4_trace_normalize.py - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml - scripts/ci/due_diligence_gate.sh - scripts/ci/test_plan_run.sh --list - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-cyw43-hardware-free-qemu - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26d-cyw43-hardware-free-pi4 - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m26d-cyw43-hardware-free-pi4 - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --venv .venv Checks: every outer EventPump turn admits at most one root CYW43 parent. Ordinary foreground publication preserves bounded `Stage`, `CommitRing`, `PublishGrant`, `NotifyRing`, and `PollRing` phases with signal last, while exact op11 crosses Stage, sequence-last commit, and its sole signal inside the same admitted producer call and remains persistent to terminal. Focused EventPump/root-admission models cover both an already-open pair lease and an initially inactive outer lease with no test pre-open. The inactive case must prove exact association claim -> EventPump outer lease open -> NetStack Join `Stage -> CommitRing -> Issued -> one signal`, with zero request-bound boost/restore actions; the already-open case must reuse its pair reservations without duplicate boosts. Both retain the outer lease `Open` across the exact persistent wait receipt without polling, then resume the same episode for the durable terminal and deterministic close/restore, with no second signal, request, grant, completion poll clock, idle scheduling gap, or unrelated policy admission; sideband ACK admission remains `Issued`-only and rejects every terminal-restore phase without signalling. A stable receipt permits the ordinary waiting park, and a later exact terminal resumes and retires the same parent. These warm seam models are necessary but cannot qualify a hardware candidate. Qualification additionally requires one bounded composition starting at cold `Cyw43BootstrapSupervisor::new` and using the production EventPump, HAL admission, root client, CYW43 runtime, and SDIO runtime dispatch through the prior `q=0x408` DPC/RX frontier, Gates 1 through 10, and the raw-TCP software consumer; only post-issue card/AP boundary responses may be scripted. Production DPC uses one event-sequence lease from the first post-release event and never selects recurrent grants from mutable Gate 8 state; urgent op7 retains its separate finite identity and budget. EAPOL-Start and ordinary control prove the ordinary retained cadence. Valid sealed current-generation M2, M4, and group-key replies alone prove the existing paired finite-op7 marker, exact one-frame/four-operation/1,536-byte bounds, request-bound CYW43-plus-SDIO priority, one notification, no later grant or signal, durable matching-terminal resume, and recovery-only expiry. Their Function-2 data child does not inherit persistent control's pre-TX fence; a concurrent source-bearing event remains durable DPC work. Steady parent identity remains exact through both committed-source and ACK-before-source publication states; only the committed event is DPC service authority, and neither state can select an ordinary grant. Malformed, untagged, stale, wrong-message, and ordinary Ethernet inputs fail before issue. Ordinary post-Gate-8 TCP proves its O(1) path without the EAPOL-Key parser, poller, or fallback. Current durable conditions—not snapshot novelty—route persistent op11, urgent op7, and DPC event service: deterministic private phases continue locally even when equal, while exact child, credit, queue, and peer waits block immediately even when first observed. The post-release activation remains live for the physical generation; healthy owner-active empty/unmasked control state skips `DPC_ACTIVATE`, and one exact visible event is consumed before TX. Only activation-absent or mask-skewed state, plus exact ACK debt bound to an already-submitted immutable activation frontier, uses the activation-repair child; invalid, wrong-generation, poisoned, overrun, or lost-authority state fails closed. SDIO alone takes one live joined-controller sample after a changed steady cursor before blocking. Every helper is bounded and every immutable hardware request issues at most once. Before blocking, CYW43 rechecks its selected marker/event lease, parent/child terminal, event frontier, and queue/batch/ACK condition. SDIO separately rechecks its selected persistent marker or ordinary grant, active child/completion, joined IRQ/CARD_INT, deadline arm, owner health, and—immediately before idle receive—its own sequence-last one-way command ring. A fresh child re-enters SDIO arbitration; unchanged owner-local conditions may block. A committed sequence-last SDIO command reaches owner dispatch and either the validated physical path or a typed zero-I/O missing/competing-seal terminal; it is never discarded as no intake. Production-chain coverage proves both healthy activation reuse with no child and the separate activation-absent or mask-skewed `DPC_ACTIVATE` repair, plus exact ACK debt retained by an already-submitted immutable activation frontier, through production SDIO, a sequence-last terminal, coalesced notification, and hintless exact-parent replay. ACK failure performs zero I/O; after exact ACK retry succeeds, cleared current fault/mask flags plus durable `OWNER_ACTIVE` re-admit healthy work even though the per-pair historical count remains nonzero. Once an exact wait receipt proves the child is blocked, root exact-op11 `Waiting` masking cannot suppress independent DPC/RX/sideband/deadline/terminal work. Immutable generation-bound descriptors cannot fall back to endpoint authority, and issued-unknown reaping preserves the exact continuation until its late terminal or canonical restart. SDIO alone owns IRQ 158 and IRQ 116. Tests deliver them in both orders, coalesce them, and withhold each independently; exactly one terminal appears only after the immutable request's SDHCI and DMA conditions join. The RX producer clears the queue commit before mutation, writes the body, cleans/barriers, and writes a new nonzero commit last. One parent writes one through eight payloads and batch entries, cleans/barriers, and writes `committed_parent_sequence` last. Op8 then publishes one detail-`0x5803` completion with `result=count`; op11 instead remains active while root copies the batch, post-copy rechecks the header, and commits an exact disjoint ACK body then `committed_queue_commit_sequence` last. CYW43 must not mutate or reuse the batch until that ACK matches. Missing, coalesced, and repeated notification hints produce identical delivery. A full 256-frame software backlog uses 32 full batch handoffs, not 256 root grants, terminals, or notification signals. SDIO arms every blockable active autonomous phase with its exact counter expiry, including pre-issue inhibit/status-clear, and selects the earlier settle/overall expiry during containment clock settle; a blockable phase without a counter deadline fails closed. Terminal/reset clears the arm before publication. Normal traffic completes from physical IRQs and durable levels with zero root fault hints; a stable expired arm produces at most one hint across the existing root-to-CYW43-to-SDIO chain, and terminal/arm races resolve by SDIO's final recheck without a rescue poll or synthetic receive progress. DPC overrun and ACK-attempt counts reset at pair replacement; current flags/pending state are authority, while final acceptance still requires zero errors in every fresh pair. For the ABI v8 receipt check, `contiguous` means one externally uninterrupted same-parent bus-service episode across HAL admission, CYW43 protocol ownership, and SDIO physical ownership. Open, bounded Closing, and the exact handoff boundary may include required Serial/LocalSeat/Dispatch fairness checkpoints, but no idle gap or unrelated policy/NIC owner. The receipt is the distinct-magic 24-byte record at auxiliary offset 40; CYW43 uses a producer-monotonic nonzero epoch and fails closed on exhaustion, and root accepts only a stable exact-field double-read. Receipt or terminal proves the handoff, never both as concurrent authority. The exact ordinary-traffic diagnostic requirement is `sdio_deadline_hints=0`. The TX aggregate proves total capacity 16, urgent-control-before-bulk FIFO selection, the ordinary 15-slot boundary, the final paired-RX reservation, queue-only TxToken consumption, EventPump-only physical coordination, preservation of an exact foreign owner before op7 admission, active-op7 terminal priority, and committed copied/DPC/runtime RX before fresh or requestless op7 promotion. The real firmware parent crosses the retained SDIO controller as `511 * 64 + 1 * 64`; normal control and EAPOL-Start use the ordinary cached-window F2 child, while sealed M2/M4/group-key responses use the bounded request-bound finite parent without inheriting persistent control's F2 fence. A cold miss uses exact LOW/MID/HIGH/F2 children, and the post-F2 release culminates in the generation's one DPC activation. No test may fabricate child completions, mailbox readiness, terminal streams, or per-frame op8 handoffs. Stale, torn, mutated, wrong-generation, replayed, exhausted-id, issued-unknown, and replacement-generation cuts fail closed. The sole boot episode cannot produce attempt 2; only exact-generation bound DHCP plus an admitted TCP listener authorizes the later consumed-once runtime repair. Operator surfaces remain bounded after quarantine, GENET remains unchanged, deterministic repository gates pass, and the exact image remains commit-bound. The common raw-ICMP owner retains the cold-neighbor ARP/reply and warm one-request/one-reply checks without creating CYW43 source work. The root notify boundary additionally accepts only the exact legal `unconsumed -> current-id` acknowledgement race: if it occurs between poll and notify, root commits `Issued`, sends no redundant signal, and polls on the next turn. A matching late completion before replacement publication likewise wins without publishing or signalling. Deliverables: retained linked-runtime implementation, production-chain adversarial tests, aligned canonical docs, exact-image identity metadata, deterministic gate records, and a Pi-ready exact image. This task's closure was hardware-free only. Its original 10-cold plus 10-warm proposal was superseded for final physical Milestone 26b acceptance by the operator-approved matrices recorded above. Exact image `7a10b8fd6acc` completed one settled cold Wi-Fi boot, five reboot attempts, and one same-image GENET control with raw TCP, first-attempt `.coh`, no-retry pressure, and boot-paired pcap evidence. W04 remains an explicitly excluded RF-affected sample; cold, W01-W03, W05, and G01 form the accepted closure set. No fresh USB key was typed, so the current-image record claims only repeated Gate 10, one-deep idle-report, command-ready, recovery-free, and HDMI-complete evidence plus exact restoration of the previously board-proven path under the operator-approved image-specific exception. ``` ``` Title/ID: m26d-linked-runtime-unsafe-exception-remediation Milestone: Milestone 26d — seL4 16 Baseline Refresh + Reference/Performance Realignment / repository-wide regression gate closure; reopened Milestone 26b / m26b-wifi-sdio-notification-dpc-closure defect remediation Goal: Remove the accepted linked-runtime Rust unsafe delta by enforcing shared-state exclusivity and concentrating fixed mapped-memory and seL4 operations behind bounded reviewed abstractions without changing the CYW43/SDIO protocol or hardware authority. Inputs: Cargo.toml, Cargo.lock, rust-toolchain.toml, apps/pi4-driver-runtime/src/lib.rs, apps/pi4-driver-runtime/build.rs, apps/root-task/build.rs, apps/root-task/src/hal, apps/root-task/src/drivers/driver_task_net.rs, crates/pi4-driver-abi/src, crates/cargo-build-directive, crates/sel4-sys/build.rs, tools/rust-risk-audit, scripts/ci/rust_risk_gate.sh, scripts/ci/test_rust_risk_gate.py, scripts/ci/due_diligence_gate.sh, scripts/ci/test_due_diligence_lifecycle.py, docs/audit/rust_risk_baseline.toml, docs/audit/findings.csv, docs/audit/EXCEPTIONS.md, docs/audit/BLOCKERS.md, docs/audit/CONTROL_TRACEABILITY.md, docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md, the `cf8f9ee30` Milestone 26c baseline, and current repository-gate evidence. Changes: - apps/pi4-driver-runtime/src/lib.rs — replace convention-only shared mutation with mechanically enforced exclusivity, keep volatile and syscall operations inside narrow fixed-resource helpers, and preserve sequence-last publication, reciprocal notification, DPC, MMIO, and bounded-yield behavior. - apps/root-task/src/hal/driver_task.rs — consume completion and DPC commit words with acquire-before-body ordering, stable commit rechecks, and focused access-order tests. - crates/cargo-build-directive + the three consuming build scripts — centralize control-character rejection for dynamic Cargo directives and tested Rust-string-literal escaping; bind the helper source, manifest, dependency wiring, and historical absence into the exact scanner contract. - tools/rust-risk-audit + docs/audit/rust_risk_baseline.toml + scripts/ci/rust_risk_gate.sh + scripts/ci/test_rust_risk_gate.py — retain the global production ratchet and add linked-runtime/HAL plus outside-component budgets replayed from exact commit `cf8f9ee30` only after every scanner-input path matches its raw `HEAD` blob and mode and the attested path set has no additions or omissions; count qualified/UFCS, raw-identifier, macro-indirected, and conditional unsafe-attribute syntax across repository-authored `apps/`, `crates/`, and `tools/` production sources; pin exact active and historical tuples; execute the scanner directly on the host after a hash-checked build in a fresh private target directory and Cargo home that re-extracts checksum-verified registry archives; resolve the exact repository-selected tools from the canonical OS-account Rustup home by named-toolchain lookup so directory overrides cannot supersede the pin; reject component relocation, baseline inflation, broad test-path hiding, workspace/package/Cargo target/dependency escapes, nested-package test relabeling, local proc-macro synthesis, source redirects, symlink/non-Rust includes, shadowable generated includes, unreviewed generated Rust, uncontracted build scripts/compiler wrappers or inputs, repository-controlled `cfg(test)` injection, Cargo runner/compiler/Rustup selectors, external Cargo configuration, inherited or redirected Git repository binding, replacement refs, clean filters, ignored extra sources, caller-supplied scanner artifacts, malformed metadata, and duplicate TOML keys. - scripts/ci/due_diligence_gate.sh + scripts/ci/test_due_diligence_lifecycle.py — enforce a one-to-one finding/exception lifecycle, exact CSV/table schemas and arity, known severities/states, non-expired complete policy metadata, and cover fail-closed mismatches with focused fixtures. - docs/audit/findings.csv + docs/audit/EXCEPTIONS.md + docs/audit/BLOCKERS.md + docs/audit/CONTROL_TRACEABILITY.md + docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md — reconcile superseded `DD-2026-0016`/`DD-2026-0017` lifecycle drift and close `DD-2026-0018`/`EX-2026-0018` only after current global, linked-runtime/HAL, and outside-component counts are at or below their replay-derived budgets, focused concurrency/bounds/order tests pass, and clean detached-worktree evidence is bound to the immutable remediation commit. Commands: - cargo test -p pi4-driver-runtime -- --test-threads=1 - cargo check -p pi4-driver-runtime --target aarch64-unknown-none - cargo test -p root-task --lib --features driver-tests-pi4 -- --test-threads=1 - cargo test -p pi4-driver-abi - cargo test -p cargo-build-directive - cargo test -p rust-risk-audit - scripts/ci/rust_risk_gate.sh --baseline docs/audit/rust_risk_baseline.toml - scripts/ci/rust_risk_gate.sh --root --historical-replay - python3 scripts/ci/test_due_diligence_lifecycle.py - python3 scripts/ci/test_rust_risk_gate.py - bash scripts/ci/due_diligence_gate.sh --check-exceptions-register docs/audit/findings.csv docs/audit/EXCEPTIONS.md - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo test --workspace -- --test-threads=1 - cargo audit - cargo deny check advisories - scripts/ci/check_test_plan.sh - go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml - scripts/check-generated.sh - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-unsafe-remediation-qemu - scripts/ci/test_plan_run.sh --target pi4 --stage 1 --state-dir out/test-plan/m26d-unsafe-remediation-pi4 - scripts/ci/test_plan_run.sh --target pi4 --stage 2 --state-dir out/test-plan/m26d-unsafe-remediation-pi4 Checks: scanner v4 replays exact commit `cf8f9ee30` only after raw scanner-input attestation, yielding global `unsafe=693`, `unwrap=38`, `expect=240`, `panic=96`, linked-runtime/HAL `unsafe=146`, `unwrap=0`, `expect=2`, `panic=0`, and outside-component `unsafe=547`, `unwrap=38`, `expect=238`, `panic=96`; immutable remediation-commit ceilings are global `unsafe=691`, `unwrap=38`, `expect=240`, `panic=96`, linked-runtime/HAL `unsafe=144`, `unwrap=0`, `expect=2`, `panic=0`, and outside-component `unsafe=547`, `unwrap=38`, `expect=238`, `panic=96`; every dynamic generated-Rust include has one source/output/generator/hash contract; no active P2 exception remains; shared-state concurrency, mapped-range bounds/alignment, sequence-last publication/consumption, DPC ownership, reciprocal notification, and exception-lifecycle tests pass; offline evidence is not represented as live Pi Wi-Fi proof. Deliverables: mechanically enforced linked-runtime state ownership, concentrated and documented hardware/ABI boundaries, global/component/outside risk-ratchet evidence, reconciled and closed P2 finding/exception records, and refreshed repository-wide offline gates. ``` ``` Title/ID: m26d-full-regression-refresh Goal: Prove the seL4 16 baseline refresh preserves operator-visible behavior and accepted benchmark envelopes across QEMU and Pi 4. Inputs: refreshed generated artifacts, seL4 16 build trees, docs/TEST_PLAN.md, scripts/ci/test_plan_run.sh, m26d benchmark ledger. Changes: - docs/TEST_PLAN.md — update kernel-baseline references only where needed to match the refreshed evidence. - out/test-plan/m26d-qemu-sel4-16-gap-audit and out/test-plan/m26d-pi4 — fresh target-qualified PASS evidence required on the refreshed baseline; QEMU is build/runtime-gated and the Pi path remains hardware-gated. Commands: - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26d-qemu-sel4-16-gap-audit - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26d-pi4 Checks: QEMU and Pi 4 staged Test Plan runs are PASS with no undocumented drift, and benchmark revalidation has either recovered the accepted 26b envelope or recorded a scoped blocker/defer decision that downstream milestones cannot count as satisfied evidence. Deliverables: target-qualified refreshed evidence proving seL4 16 upgrade safety and performance continuity for Cohesix. ``` --- ## Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation [Milestones](#Milestones) **Status:** Complete — release-owner-approved closure for 1.0.0-beta on 2026-09-14. The Stage 05 decision remains `PASS_WITH_RESIDUAL_RISK` under the approved [evidence carry-forward](audit/RELEASE_1_0_0_BETA_CARRY_FORWARD.toml) and [DD30 release waiver](audit/DD30_RELEASE_WAIVER.toml), preserving the original source/target evidence identities and accepted residual risks. **Why now (userspace TCB reduction):** Milestone 26d establishes honest seL4 16 kernel/profile truth and records that NineDoor parsing, TCP/smoltcp, provider dispatch, policy, supervision, and Worker model state still execute in the principal root-task authority domain. It also corrects the former claim that general Workers already run as isolated target tasks. Once the refreshed QEMU/Pi baseline and CYW43 evidence are stable, Cohesix can reduce that userspace TCB in the security-first order recorded by `docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md` without mixing a system-model change into hardware bring-up. The same audit found a second trust-boundary problem that must close before the split can be accepted. Selected code can currently reach dummy time, a null serial backend, preseeded target `/host` state (`systemd=active`, NVIDIA `ok`/`42C`), mock 4090/4060 GPU entries, a spinning target `nine-door` binary, and bootstrap commands that answer with `stub`/`not implemented`. The host GPU bridge can also replace a missing or invalid live model registry with fixture models and an implicit active model. Those paths are useful only as explicit tests or developer simulations. They are prohibited from the 26e operational QEMU/Pi dependency closure and from all target, Worker, integration, release, and use-case evidence. MCS is the preferred Cohesix temporal-isolation architecture, not a feature checkbox or a throughput shortcut. Capability-controlled CPU time, enforced budget/period ceilings, timeout faults, explicit Reply objects, and consumed time evidence match Cohesix's mixed-criticality shape: root/Queen policy, emergency serial, and fault supervision must remain live beside untrusted parsers, network ingress, Workers, drivers, telemetry, and display work. The split must therefore establish the MCS task/IPC contract before child ABIs freeze. seL4 16 still describes SMP+MCS as less explored and experimental, so exact QEMU/Pi acceptance is a hard evidence gate. Cohesix nevertheless selects one architecture: accepted 26e operational profiles use SMP+MCS on both targets. There is no compiled classic-SMP fallback; an unforeseen blocker requires reverting the atomic 26e scheduler change set before another architecture can be planned. ### Prerequisites - Milestone **26d** complete for the selected QEMU and Pi 4 profiles, including the accepted linked GICv3 QEMU run, exact-image Pi proof, operator-liveness, and benchmark evidence. Static profile PASS alone is insufficient. - Reopened Milestones **25** and **26c** accepted for truth correction: current root-owned services and model-only Workers remain documented honestly until this milestone produces target evidence. - Milestone **26b** is complete for CYW43/SDIO reliability and current-image evidence. No 26e task may rewrite its accepted CYW43 timing, restart, packaging, or proof-classification logic. The 26e Pi component, full-system, and release gates still require the accepted exact-image CYW43 closure and a matching MCS coexistence record. ### Goal Move untrusted namespace parsing, TCP/network parsing, and executable Worker loops into compiler-declared restricted seL4 child tasks; establish the version-pinned MCS ABI and generated temporal-authority contract before those child ABIs freeze; and make exact SMP+MCS builds the sole accepted operational architecture on QEMU and Pi 4 while keeping Queen policy, HAL admission, emergency serial, authoritative ordering, and every existing protocol and operator-visible contract explicit. ### Non-negotiable constraints - No new VM transport, Secure9P verb, namespace root, authority path, or ACK/ERR/END shape. The one authorized grammar extension is a manifest-gated `lora` target for the existing `/queen/ctl`/`cohsh spawn` operation so the mandatory WorkerLora task can project existing PEFT lifecycle receipts. It requires the normal schema-version, generated grammar, docs, and fixture updates; it does not create a new verb or VM-side PEFT executor. The same change adds `peft.export` to the existing generated host-ticket action allowlist beside import/activate/rollback so all four PEFT use cases share one bounded result-to-WorkerLora receipt path; that adds no VM path or transport. Every split uses a bounded compiler-generated internal ABI. - Every child is pure Rust `no_std`, separately packaged, W^X-loaded, and given only generated TCB/CSpace/VSpace/IPC-buffer/stack/endpoint/notification/fault authority. There is no ambient root CSpace, catch-all namespace cap, or undeclared shared-memory shortcut. - Queen policy and authoritative mutation ordering remain serialized. Parser and transport children may validate, prepare, and project requests but may not make policy decisions or mutate authoritative state directly. - HAL remains the only resource-admission path. Physical driver ownership and the fixed driver-task ABI do not move into the namespace or network child. - Emergency serial and fatal reporting remain root-owned. The TCP child must preserve the sole-listener exception and cannot starve serial/local-seat input or deterministic response flushing. - The Milestone 26d accepted scheduler remains classic non-MCS only until the atomic 26e transition. Milestone 26e owns the mandatory MCS ABI, generated policy, and exact SMP+MCS target acceptance. Accepted QEMU and Pi 4 operational profiles may not retain a non-MCS scheduler switch, compatibility mode, fallback profile, or runtime branch. If acceptance fails, 26e does not close and the scheduler change set is reverted as a whole. - Operational kernel contracts remain four-node, one-domain, non-hypervisor AArch64 profiles with MCS enabled. Milestone 26e does not introduce domain scheduling, VCPU/hypervisor support, or a second placement mechanism. - The root/Queen authority path, emergency serial, fault supervisor, Worker supervisor, and driver supervisor retain independent active scheduling contexts and reserved admitted CPU time. A child never receives `SchedControl` authority. - Dedicated active scheduling contexts are the default for asynchronous network ingress, periodic/event-driven Workers, IRQ/DPC work, locality-bound drivers, and authoritative mutation. Passive-server donation is allowed only for compiler-allowlisted, short, synchronous request/reply paths with bounded call depth, explicit Reply-object cardinality, timeout/revoke recovery, and proof that the donated scheduling context always returns. Cross-core donation is prohibited for IRQ- or locality-bound paths unless separately admitted. - MCS budgets do not replace max-operations, max-bytes, max-completions, queue, backpressure, cancellation, or replay bounds; both kernel temporal authority and application service-turn bounds remain mandatory. - MCS work may change only the shared driver scheduler/IPC/runtime-init scaffolding needed to make every accepted linked driver execute under MCS. It may not change CYW43/SDIO ownership, protocol state machine, hardware timing, deadlines, retries, recovery order, ring semantics, or error policy. The accepted classic artifact is retained as an immutable behavioral comparator; 26e emits a new MCS driver-runtime hash and reruns exact-image CYW43 coexistence without reclassifying the separate CYW43 proof. - Every capability, mapping, scheduling context, Reply object, fault route, and kernel object actually used by a 26e service, Worker, or linked driver belongs to a complete 26e instance bundle and teardown/containment path. No live 26e child may depend on Milestone 28b to become safely revocable. Milestone 28b binds these already complete Worker bundles to production ticket/lease ledgers, projects the already complete driver authority inventory into production ledgers, and adds structured quarantine/evidence plus fresh-ticket Worker restart; it does not finish basic Worker or driver isolation, authority, or revocation. - Static executable configuration and operational acceptance are distinct. `implemented = true` means a selected manifest has a complete compiler-valid executable task contract; it does not assert that later QEMU or Pi evidence has passed. Release claims require a separate exact-image acceptance record keyed by target, kernel configuration, resolved manifest, root image, MCS driver archive and manifest, CYW43 coexistence record, Worker archive, Worker image manifest, Worker image, role, ABI version, and evidence-pack identity. - Host/model tests, QEMU execution, fresh Pi execution, transport proof, and benchmark evidence remain separate classes. - Every workspace binary, library surface, feature/profile fallback, generated namespace, host/provider adapter, example, playbook, proof source, package, release asset, and tracked README is recorded in one generated implementation inventory. Implementation class and observed mode are separate. The allowed classes are `production_live`, `model_only`, `host_model`, `test_fixture`, `diagnostic`, `contract_only`, `not_enabled`, `deferred`, and `retired`; observed modes remain `unknown|missing|disabled|fixture|mock|dry-run|live`. Only `worker-bus` may be `model_only` in a selected Cohesix profile. An explicit test fixture may remain in source, but no operational build may select it or fall back to it after a live-path error. - Operational QEMU and Pi profiles require generated virtual-counter truth, real serial/emergency output, and typed service/provider state. Dummy or read-count clocks, hard-coded timer-frequency fallback, inert timer bypass, null/no-op serial, compiled spin-stub entrypoints, fabricated host/GPU/model state, client-authored receipts, and synthetic evidence are fatal selection errors rather than degraded operation. ### Selected MCS topology - Root/Queen authoritative mutation, fault/fatal supervision, and emergency serial execute on distinct generated TCBs with distinct active SCs and per-core reserves; assigning several SC records to the current single event pump is invalid. A dedicated Worker-supervisor TCB/SC owns Worker IPC and lifecycle progress, and a separate driver-supervisor TCB/SC owns linked-driver command-Reply recovery, containment anchors, and restart admission, so Queen policy, the fault supervisor, and emergency serial never block on or donate time to a Worker or faulted driver. - Root-control and root-fault hand work to the Worker supervisor through two separate generated bounded single-producer/single-consumer record sets plus one supervisor-bound wake notification. The supervisor also owns the only Read cap to the Worker telemetry endpoint. Root-control request, root-fault teardown, and per-slot durable-completion signal caps use distinct one-hot bits from a reserved notification-badge range that cannot overlap endpoint identity badges. The supervisor decodes coalesced bitsets, drains every indicated record to its sequence watermark, and returns bounded busy/refusal rather than blocking a critical producer. Fault handoff has one reserved mailbox per admitted child and cannot be dropped. - Root-fault hands each linked-driver fault to the driver supervisor through a separate per-runtime reserved record plus a driver-supervisor-bound wake notification. The driver supervisor owns the retained origin/recovery caps, per-runtime command-Reply record, and least authority needed to suspend, reply-fail, revoke, contain, and readmit that runtime; it receives no SchedControl or device-policy authority. Worker and driver supervisor badge, record, and notification domains are disjoint. - Standard and timeout fault send caps share one generated root-fault endpoint and retain disjoint exact-identity badges. Root-fault owns its sole Read cap and one Reply object, blocks in `Recv`, and resolves class through the sealed registry after receive; no `NBRecv`/yield poller or second class lane is permitted. For a linked-driver fault, root-fault keeps that Reply association serialized after publishing the containment record and waits on the existing root-fault wake notification. Only the independently scheduled driver supervisor's exact generated release-badge signal, emitted after command failure and containment release the association, permits another fault receive. The notification carries no fault identity or policy authority. - The critical-TCB fault graph is generated and acyclic: service, Worker, driver, root-control, Worker-supervisor, and driver-supervisor faults route to root-fault; root-fault failure routes to the minimal root-emergency terminal handler; and root-emergency itself has no self/cyclic handler and fails stop if it faults. Faulting a handler can never recurse into the same TCB or strand the only critical scheduling reserve. - The synchronous NineDoor parser/provider child is steady-state passive and caller-funded. Manifest `root_task.schema = "1.14"` retains one root-retained, one-shot bootstrap SC candidate (8 object bits, `3000 us / 10000 us`, `max_refills = 2`) outside the steady temporal topology. After root-fault is active, root must perform the frozen `Resume -> validated empty Log prepare -> atomic ReplyRecv queued -> unbind` transition before ordinary Calls may donate the `root-control` SC. The child receives no SC or SchedControl cap and no `TCB.SetAffinity` call. Its allowed steady donors, Reply objects, call depth, timeout path, and SC return are generated. Any autonomous provider drain uses a separate admitted active SC. The bootstrap candidate remains QEMU-unqualified. - TCP/smoltcp owns an active SC because receive, retransmission, and protocol timers require autonomous progress. A separately isolated pure request parser may be passive only if its donation chain is compiler-validated. - Serial, USB, and every physical driver runtime retain generated dedicated active SCs during 26e. The shared driver command/Reply and runtime-init paths are ported explicitly to the seL4 16 MCS ABI, but passive driver donation and CYW43/SDIO behavioral changes are prohibited. IRQ/DPC and other autonomous work is notification-woken and always executes on the active SC bound to the driver TCB, never to a notification; locality-bound paths may not accept cross-core donation. Root command caps are exact `Write + GrantReply` capabilities with no `Grant`; driver receive caps are Read-only. Driver IRQ wait caps are Read-only, root/software signal caps are Write-only, and IRQ, command, completion, and fault badges occupy generated disjoint domains. - Every 26e general Worker uses one small dedicated active SC bound directly to its TCB. `worker-heart` blocks on generated timer/lifecycle wakeups; `worker-gpu` and `worker-lora` block when no receipt or lifecycle work is pending. General Worker IPC uses no SC donation in 26e. The former passive-receipt plus active notification-SC proposal is rejected because it did not define a realizable one-TCB SC receive/return state machine. - Telemetry/persistence drains use capped low-priority active SCs. HDMI draws may be caller-funded; autonomous refresh, if enabled, uses a separate capped background SC. - Every executable path is classified as active/periodic, notification-woken, or synchronous caller-funded IPC, with one generated owner for its time authority. A plain nonblocking send does not imply donation, and `seL4_NBSendRecv` is prohibited from the Worker ABI because it can donate an SC. ### Worker execution contract #### Required role matrix and capacity - 26e closure requires at least one executable `worker-heartbeat`, one executable receipt-only `worker-gpu`, and one executable receipt-only `worker-lora` on both four-core QEMU and fresh Pi 4. `worker-gpu` receives no CUDA, NVML, MMIO, DMA, or raw GPU authority; hardware access remains in `gpu-bridge-host`. - `worker-lora` projects bounded receipts for the existing PEFT export, import, activate, and rollback lifecycle and `/queen/export/lora_jobs` references. It never trains, imports adapter bytes, loads a model, executes inference, owns a registry, or becomes the PEFT source of truth; those actions remain host-side. - Receipt-bearing GPU and PEFT actions continue to use the existing `/host/tickets/spec` and `/host/tickets/status|deadletter` paths. The generated bounded `host-ticket/v2` request adds required `operation_id`, `subject_ref`, `receipt_worker_role`, `receipt_worker_id`, and opaque `receipt_supervisor_generation` and `receipt_cap_generation` fields; the matching `host-ticket-result/v2` echoes those fields, adds root-authoritative `resolved_worker_slot` and `resolved_lease_epoch`, and adds a required canonical `result_digest`, defined as SHA-256 over the generated canonical serialization of every result field except `result_digest` itself. The echoed public binding plus the resolved fields names the same immutable five-part Worker identity used by the supervisor; no host consumer infers slot or epoch from a public id string. Version 1 remains valid for host actions that request no VM Worker receipt, but a receipt-bearing action must use version 2 and unknown, omitted, cross-role, or oversized fields fail closed. The compiler emits accepted request/result schema sets and an `(action, receipt_mode) -> required schema` matrix: `receipt_mode=none` uses version 1; `receipt_mode=worker` is permitted only for the three GPU lease and four PEFT actions and requires version 2. Receipt-bearing version 2 is local-hive-only in 26e: federation/relay fields are rejected, while the existing version-1 federated key and relay behavior remain unchanged. Before ticket execution, the host client must explicitly select a matching READY Worker or spawn one through the existing `/queen/ctl` path and wait for READY; the ticket agent never chooses a generic or merely configured Worker implicitly. When the version-2 spec is appended, root independently validates READY, resolves the public binding to the exact live `(role, slot, logical lease epoch, supervisor generation, cap generation)` tuple, and pins that immutable tuple in the admitted ticket record before the host executor may claim it. Caller-supplied bytes never become executable input directly: root's existing read-only `/host/tickets/spec.snapshot` projection emits the canonical admitted version-2 record with an admission sequence, exact validated action args, and root-only resolved slot/lease-epoch fields. The agent claims only that normalized root-owned projection and rejects a raw, unadmitted, missing-sequence, or caller-forged enrichment. Version-1 compatibility remains separately classified and cannot be mistaken for an admitted Worker receipt action. - `worker-gpu` has one concrete receipt contract for existing `gpu.lease.grant`, `gpu.lease.renew`, and `gpu.lease.release` terminal results. Root maps the action code, confirmed/rejected outcome, receipt sequence, exact Worker identity, and SHA-256 digests of the idempotency key, operation id, lease/device `subject_ref`, and canonical result into the fixed-size `GPU_LEASE_RECEIPT` supervisor record. `succeeded` maps to `confirmed`, `failed` maps to `rejected`, and `expired` maps to `stale`; nonterminal states produce no Worker completion. WorkerGpu publishes the matching durable completion and bounded `worker-gpu-receipt/v1` record through `/shard//worker//telemetry`, but never receives a lease credential or GPU cap. Version-2 lease actions never use the current compatibility executor's implicit `/queen/ctl` spawn-on-grant or kill-on-release behavior: the host client selects/spawns and waits for the receipt Worker before the ticket, while grant/renew/release map only to the existing lease-control operation (`release` uses the generated release/preempt form). The terminal lease result reaches the still-live Worker before any separately authorized Worker teardown. Version-1 compatibility behavior is classified separately and cannot satisfy this receipt contract. - The generated host-action allowlist adds `peft.export` beside existing `peft.import`, `peft.activate`, and `peft.rollback`. Root maps those four terminal version-2 results through the same fixed digest/identity envelope and the `PEFT_RECEIPT` label; WorkerLora publishes the corresponding durable confirmed/rejected completion and bounded `worker-lora-receipt/v1` record through `/shard//worker//telemetry`. This is an additive action/schema version on existing paths, not a new VM verb, transport, namespace, or execution plane. - The supervisor retains each immutable terminal receipt result for one generated bounded idempotency window keyed by role, supervisor generation, cap generation, ticket-id digest, operation-id digest, and idempotency-key digest. Same-key/same-result replay for the same still-live Worker returns the same receipt sequence. Divergent duplicates fail; after Worker teardown the cached version-2 result remains readable as `stale` host evidence on the existing `/host/tickets/status|deadletter` projections and in evidence timelines, but is never republished under a removed Worker path, rebound, or delivered to a new generation. A new Worker requires a newly bound operation. Disconnected/direct-local GPU or PEFT work remains host-only and emits no VM receipt. - For the seven receipt-bearing version-2 actions, `host-ticket-agent` holds a local single-agent lock/fence and durably writes a bounded pre-execution journal containing the accepted schema/action, full root-resolved Worker tuple, action fingerprint, idempotency key, and provider fence before any side effect. It persists `prepared`, `executing`, canonical provider result, result-published, and terminal/cursor state in crash-safe order. Recovery never blindly repeats an ambiguous side effect: it uses the action's generated provider idempotency key or bounded observe/reconcile operation and dead-letters an action whose outcome cannot be established. Crash injection before and after every journal, provider, result, Worker-receipt, and cursor boundary proves same-operation recovery cannot mint a second GPU lease, apply a PEFT transition twice, or deliver divergent Worker receipts. This is narrow local version-2 safety, not exactly-once federation; general version-1 provider durability and relay recovery remain Milestones 27a/27b work. - Only `worker-bus` remains explicitly model/session-only in 26e. It may not be packaged, marked `implemented = true`, or counted toward executable-role closure without a later, separately named BUILD_PLAN task that supplies its target binary, interface contract, and QEMU/Pi evidence. - Namespace/model capacity and executable kernel-object capacity are separate generated bounds. The manifest declares per-role executable slot counts and a maximum simultaneous role mix; generation fails if the worst-case mix exceeds admitted TCB, CNode, VSpace/page-table, ASID, frame, endpoint, notification, fault/timeout, Reply, SC, CSpace-slot, untyped-memory, or per-core CPU budgets. Fault-registry capacity is generated from every admitted TCB, and registration failure is fatal rather than silently ignored. - Executable slots use compiler-bounded supervisor-owned resource pools. A spawn fails closed when no admitted role slot remains; the much larger namespace model capacity does not imply that the kernel can launch that many tasks. #### Worker task ABI v1, identity, and notifications - A shared `worker-task-abi/v1` is versioned, pointer-free, fixed-size, and `no_std`. Its generated matrix names every endpoint/notification object, holder, CSpace slot, rights mask, permitted syscall, message label, word/frame bound, direction, maximum one in-flight control operation per slot, memory ordering rule, timeout, cancellation, replay, and late-completion outcome. `extraCaps` is zero and unexpected labels, lengths, caps, sequences, epochs, generations, or child-produced values fail closed. - The ABI is only an internal typed projection of existing mounted namespace/file-and-event semantics. It introduces no host RPC or parallel policy plane: root/NineDoor validates child output, Queen retains policy and authoritative ordering, and no authoritative transaction is held open across Worker IPC. - Each live instance has an immutable compiler-generated identity tuple `(role, slot, lease_epoch, supervisor_generation, cap_generation)`. In 26e, `lease_epoch` is logical lifecycle/session metadata used for stale-instance rejection; it is not yet a claim that a production ticket is bound one-to-one to the live cap bundle. Milestone 28b adds that production ledger binding. A Worker-to-supervisor endpoint cap is minted once with a badge that uniquely resolves that tuple; ABI action is carried by a validated message label, never by synthesizing a new badge at send time. Standard-fault and timeout-fault badges also identify the complete tuple and fault class. Hard-coded CPtrs, badge bases, instances, epochs, generations, clocks, or synthetic identities are prohibited. - Badge fields and generations fail closed on overflow. A slot cannot reuse an identity until admission is closed, every old descendant is revoked, all mappings, notification state, completion records, and fault/Reply/SC relationships are gone, and the supervisor proves zero old-generation activity. Normal Worker IPC has no blocking endpoint send queue to cancel; generation gates every durable record and droppable `NBSend`. Exhausted generation space quarantines the slot until a full reset or a wider generated format is deployed. - Each slot owns a lifecycle notification. Signal-cap badges are distinct one-hot event bits; the generator rejects zero, overlapping, multi-bit, or OR-aliasing values. Receivers decode a bitset because seL4 ORs and coalesces pending signals. Generated precedence is `revoke > shutdown > lease-expired > pressure > timer-wake`. - Notifications are wakeups only. Lease epoch, TTL, timestamp, pressure, sequence, generation, and command data live in a bounded generation-stamped control record published with release/acquire ordering. Repeated, combined, coalesced, and missing-signal tests are mandatory. - Normal Worker ABI v1 control does not use `Send`, `Call`, `NBSendRecv`, Reply objects, or SC donation. Root publishes one bounded control record and signals the per-slot lifecycle notification. Required READY, operation, and receipt results use a per-slot generation-stamped durable completion record published release/consumed acquire, followed by the slot's one-hot signal on the supervisor-bound wake notification. Coalescence is safe because only one control operation is in flight per slot and the supervisor drains through the published sequence. The identity-badged output endpoint is Write-only in the Worker and carries only bounded `NBSend` telemetry that is explicitly droppable and counted; the supervisor endpoint cap is Read-only, and neither cap has `Grant` or `GrantReply`. - The Worker lifecycle-notification cap is Read-only in the Worker; every supervisor signal cap is Write-only. The Worker active SC is bound only to its TCB, never to a notification. The generator rejects broader rights, wrong-direction caps, notification-bound SCs, overlapping endpoint/ notification badge domains, any normal Worker Reply object, or any blocking Worker send syscall. - Standard and timeout fault caps installed for a child are exact-identity badged `Write + GrantReply` caps to one generated root-fault receive endpoint; root-fault holds the only Read cap and supplies its one serialized Reply object to blocking `Recv` before decoding the fault. The registry fixes receive-endpoint and receive-Reply cardinality at one; the Reply cannot be reused while associated. Ordinary Worker faults are terminal: root-fault suspends the TCB, relies on the version-pinned MCS Suspend association-clear contract, never invokes Reply, verifies the Reply is reusable, and signals the reserved supervisor teardown mailbox. A linked driver fault instead retains the association until the driver supervisor has completed faulted-Call failure and containment and signals the exact generated release badge on root-fault's wake notification. Only a generated allowlisted recoverable timeout may apply its bounded budget/replenishment policy and issue exactly one typed reply; every other timeout is terminal. Success, terminal, recoverable, driver-release, handler-fault, and concurrent-fault tests prove Reply/SC ownership and the acyclic fault graph. #### Image, readiness, lifecycle, and teardown - Worker images build first. The build validates ELF class/machine, entrypoint, relocation policy, load bounds, W^X segments, stack guard, IPC-buffer alignment, initial registers/TLS, and content digest before compiling root's generated expectations. QEMU and Pi package a deterministic additive `cohesix-worker-images.cpio`, including Heartbeat, GPU, and LoRA; it is not appended to or substituted for the CYW43/SDIO `cohesix-driver-runtimes.cpio` and is bound separately into exact image identity and the `< 4 MiB` rootfs gate. - A sealed runtime-init descriptor supplies role, slot, epoch, supervisor generation, cap generation, image digest, CPtr table, mapped-frame inventory, virtual addresses, SC/core/ budget/period, notification bits, and fault identities. Each target entrypoint consumes that descriptor and blocks in real seL4 IPC/wait paths; hard-coded CPtr `1`, synthetic time, and busy-spin lifecycle loops do not qualify. - Spawn is transactional: `free -> allocated -> image-verified -> mapped -> configured -> admitted -> resumed -> ready`. A successful `/queen/ctl` write acknowledges admission to the bounded supervisor queue, not `ready`; the reserved Worker id may expose a non-authoritative starting state, but namespace and telemetry publication begin only after a valid READY record from the exact role, slot, epoch, supervisor generation, cap generation, and image. `ATTACH` remains session authority and never creates a task. - Kill, shutdown, fault, and construction failure use one idempotent teardown: close admission; publish and signal generation-stamped shutdown; wait only the generated grace bound; suspend the TCB; clear durable records/notification state; resolve fault Reply state; unbind notification and SC; unmap and invalidate every private/shared frame; revoke every derived endpoint, notification, fault/timeout, Reply, SC, frame, CSpace, and VSpace cap from supervisor-owned anchors; delete final child caps and objects; verify zero old-generation caps, mappings, pending records/signals, Replies, SC bindings, blocking send queues, or execution; then reclaim the slot and advance generation. - Fresh supervisor-generation recreation repeats full allocation, image verification, configuration, admission, and READY. It never resumes a faulted TCB or reuses stale caps. Milestone 28b later adds fresh-ticket/lease binding; it is not required to make this 26e teardown safe. ### Host integration and use-case acceptance contract Executable Worker tasks are necessary but not sufficient for a usable Cohesix system. The repository already contains real host implementations for CUDA/NVML inventory, direct and REST-backed FUSE, basic systemd/Docker/Kubernetes observation and ticket actions, GPU leases, PEFT file lifecycle, gateway/REST, Python, SwarmUI, federation, evidence, and release tooling. That does **not** make the complete integration set production-proven: current coverage mixes live adapters with mock/dry-run fixtures; host-ticket PEFT export and live Worker receipt correlation are absent; PEFT transactions and provenance are incomplete; and production provider conformance, identity mapping, deployment profiles, Prometheus/OpenTelemetry, broader industry bridges, NeMo, MCP, and A2A remain later work. Milestone 26e therefore freezes a compiler-owned `host-integration-dependency/v1` graph before host tools are updated for real Workers. It is dependency metadata over existing generated paths, actions, and schemas, not a second provider-action registry or a new authority plane. Every record names the integration id and implementation owner, host OS/architecture and deployment profile, dependent Worker roles and documented use cases, existing namespace/action/schema references, allowed/required modes and observed `unknown`, `missing`, `disabled`, `fixture`, `mock`, `dry-run`, or `live` state, plus explicit unavailable/future ownership, auth/secret-reference posture, timeouts/retries/cancellation/idempotency/fencing, readiness and degraded-state semantics, required package/artifact hashes, evidence lane, and owning milestone. Milestone 27b extends these same records into the complete provider action and production coexistence registry; it may not create a parallel catalogue. Each selected dependency has exactly one acceptance obligation: - `role_required`: failure prevents the dependent executable Worker role from being accepted. Mock, dry-run, skipped, or inferred readiness never satisfies it. - `release_required`: failure prevents a release from advertising or packaging that host surface, but does not turn a healthy Worker task into a faulted task. - `use_case_required`: failure prevents only the named use case or built-in playbook from being promoted beyond its proven support level. - `optional` or `future`: the integration must return a deterministic `unavailable`, `not_enabled`, or `future_milestone` state and cannot be used implicitly as acceptance evidence. The 26e dependency floor separates a live Worker runtime path from the external provider and product projections that later use it: | Integration family | 26e acceptance obligation | Dependent role or release claim | Later production ownership | | --- | --- | --- | --- | | Direct `cohsh` control/observation, root Worker supervisor, shared evidence validator, and release verification | `role_required` with `live` QEMU and Pi target modes | Heartbeat, GPU, and LoRA runtime acceptance | Milestone 28b later binds production ticket/lease ledgers to the already accepted task bundle. | | `host-ticket-agent` v2 result-to-root-to-Worker receipt path | `role_required` with a bounded fixture provider result for each generated GPU and PEFT action; this proves the live VM path, not the external side effect | WorkerGpu and WorkerLora runtime acceptance | Milestones 27a/27b add crash-safe production execution, writer fencing, and live provider conformance. | | `coh`, console/direct transport, `hive-gateway`, REST/OpenAPI, Python, SwarmUI, and the `coh-status` library/offline fixtures | `release_required` compatibility and false-promotion tests; optional projections preserve or lower the source claim and cannot block otherwise valid direct runtime proof | Packaged host projections of all three roles | Milestone 27a adds delegated multi-caller hardening; 27b adds production identity/read-visibility and deployment profiles; Milestone 30 adds the standalone `coh-status` CLI. | | `gpu-bridge-host`, real NVML/CUDA inventory, GPU executor/device-isolation behavior, telemetry, and lease side effects | `use_case_required`; 26e proves only all three result labels through the live receipt path and classifies mock/dry-run/live provider availability separately | GPU Flight Deck and GPU-backed playbooks | Milestone 27b supplies live provider/version/package and external-executor conformance; 27d adds governed inference-provider run contracts, not GPU authority to the VM. | | PEFT/model-registry export/import/activate/rollback provider transactions, training/evaluation/scanning, runtime reload, and canary health | `use_case_required`; 26e proves all four action/result shapes through WorkerLora but cannot promote a real PEFT data plane from fixture results | Model rollout, Private LoRA Foundry, and PEFT-backed playbooks | Milestone 27d owns transactional host lifecycle, provenance, framework/training/evaluation adapters, runtime-reload receipts, and production AI-use-case acceptance. | | `coh mount` direct and REST FUSE, including Linux FUSE and packaged macOS MacFUSE where advertised | `release_required` compatibility for canonical `/shard` paths and `use_case_required` for live mounted-namespace workflows; never a Worker readiness source | Host filesystem clients | Milestone 27b adds live package/deployment conformance and delegated read visibility. | | systemd, Docker, and Kubernetes status plus the currently generated allowlisted ticket actions | `use_case_required`; 26e preserves compatibility and classifies the current primitive, but cannot promote action-airlock/self-healing/playbook claims from mocks or basic command adapters | Agent Action Airlock, Self-Healing Edge Swarm, and selected built-in playbooks | Milestones 27a/27b add delegated identity, writer fencing, live-safe and negative conformance, rollback/fail-safe policy, and packaging before production promotion. | | Evidence packs/timelines, SIEM NDJSON, CAS/model-artifact refs, and release bundles | `release_required` schema/projection compatibility; Worker and integration evidence stays distinct from target task evidence and secrets remain redacted | All release and audit claims | Milestone 27b adds live package conformance, Prometheus/OpenTelemetry, and provider-wide evidence reconstruction. | | Host-ticket federation and fleet fan-in | `use_case_required`; version-2 Worker receipts remain local-hive-only in 26e and cannot be relayed or rebound | Multi-Hive Mission Control | Milestones 27a/27b provide production delegated identity, provider conformance, and deployment posture. | | MODBUS/DNP3/other sidecars and WorkerBus session/model state | Regression-only in 26e; no provider `ready` record may parse as executable Worker readiness | No executable 26e Worker role; WorkerBus remains model-only | Reopened Milestone 18 supplies real MODBUS/DNP3 host protocol I/O and durable acknowledgement; Milestone 27b registers, packages, and proves it while later industry providers remain explicitly unavailable until implemented. | | Semantic extractors/stores, general CUDA jobs, model training/inference runtime adapters, NeMo, MCP, A2A, Prometheus/OpenTelemetry, and not-yet-built industry providers | `future`; the matrix must name the owning milestone and reject production claims now | Use-case-specific host data planes, not the VM Worker task contract | Milestones 27b, 27c, 27d, 27e, 28c, and 30b as explicitly assigned. | The generated graph covers all six scenarios in `docs/USE_CASES.md`, every built-in `cohesix-playbook` id, and every host integration or host-facing binary advertised by canonical docs or release manifests. A selected role, release surface, use case, or playbook with an unclassified or unsatisfied transitive dependency fails generation or promotion. Host availability never promotes a Worker to READY, and Worker task evidence never promotes an external provider to live or production-conformant. Integration evidence uses `cohesix-worker-integration-evidence/v1` with `record_kind=worker-integration`, exactly one dependency row, and an observed mode from `unknown|missing|disabled|fixture|mock|dry-run|live`. Each bounded record names its target session when applicable, dependency-graph and selected-manifest hashes, host profile/OS/architecture, component/provider and package versions, action/observation/receipt outcomes, artifact hashes, redacted raw-evidence hashes, PASS/FAIL, and blockers. Only exact `live` satisfies a row whose required mode is live. QEMU and Pi Worker component records contain a sorted bounded list of only the exact role-required integration records they consume; optional projection and later use-case rows remain separate and cannot block or promote runtime acceptance. The six-record Worker-runtime release graph remains top-level-stable, but validation recursively checks its required integration rows and rejects a wrong-mode, wrong-host, stale, missing, or mismatched dependency. It is not general use-case release acceptance; Milestone 27b emits that only after joining every required live provider, authority, package, recovery, and evidence row. ### Definition of done - The selected manifest and generated outputs enumerate every service/Worker image, object, cap, shared frame, bound, fault badge, and revoke rule. Every live TCB also has an MCS scheduling record declaring either a bound active SC or an allowlisted passive donation chain. Active records contain SC object/size, SchedControl core, budget, period, refill/max-refill policy, priority/MCP, timeout/overrun policy, consumed-time evidence, and WCET/admission provenance; passive records contain allowed donor SCs/cores, Reply-object cardinality, timeout/recovery policy, and maximum donation depth. Invalid or incomplete executable-task declarations fail closed. - Manifest `root_task.schema = "1.14"` accounts for the root-retained NineDoor bootstrap SC exactly once, producing aggregate scheduling-context totals of 18 on QEMU and 25 on Pi. It proves the validated empty bootstrap exchange and SC unbind before the child is admitted as passive, without placing an SC or SchedControl cap in the child CSpace or invoking `TCB.SetAffinity` for NineDoor. - The exact heartbeat/GPU/LoRA role matrix is executable on both targets; zero-role or host/model-only closure is impossible. Static executable-contract state and exact-target acceptance records remain distinct, and public/release wording never promotes a candidate image from host tests alone. - Host tools consume one generated Worker state contract with independent transport/action, declaration, lifecycle, artifact, receipt, and proof axes. No shared `status` or `accepted` boolean may collapse request admission, `implemented = true`, READY, receipt confirmation, artifact verification, host-model evidence, QEMU evidence, fresh-Pi evidence, or release acceptance. Rust host consumers share one bounded validator; Python and UI consumers use the same generated schemas and conformance vectors. - The generated host-integration dependency graph contains every documented use case, built-in playbook, advertised host surface, and host-facing release binary with no unowned dependency. Heartbeat has a live control/telemetry/ evidence path; GPU has a live three-action result-to-Worker receipt path; and LoRA has a live four-action result-to-Worker receipt path. External CUDA/NVML, PEFT/training/runtime-reload, FUSE, systemd, Docker, Kubernetes, federation, SIEM, sidecar, and optional provider rows retain their independent observed modes and milestone owners. A fixture may prove only the 26e VM receipt path; mock/dry-run/fixture evidence cannot satisfy a later live provider or production use-case row. - NineDoor parser/provider, TCP/smoltcp, and enabled Worker execution occur in restricted child VSpaces in the required order, with the superseded root implementation path removed or profile-disabled rather than duplicated. - Injected child faults are attributed to role/slot/epoch/supervisor-generation/ cap-generation, handled by the independent fault-supervisor TCB, and followed by complete bounded instance teardown. Old generations cannot mutate authoritative state, retain a mapping, strand a Reply/SC, or publish late telemetry. - Four-core QEMU transcripts preserve deterministic authority order and existing protocol fixtures. Fresh Pi proof preserves serial, local-seat, TCP, driver, and fatal-status liveness with boot/image identity. - The retired 26d classic-SMP baseline, four-core QEMU SMP+MCS, and fresh Pi SMP+MCS remain separate evidence classes. Both operational targets must pass SMP+MCS scheduling, fault, liveness, and performance gates; a boot or throughput win alone is insufficient. Failure blocks 26e and triggers whole-change reversion rather than a shipped fallback. - Before/after TCB inventory, mapped authority, latency, pressure, and full same-harness benchmark evidence are archived with the atomic change-set and pre-change baseline identities. A split that increases authority, creates duplicate policy, or regresses bounded operator behavior is rejected and reverted as a whole. ### Task Breakdown ``` Title/ID: m26e-mcs-abi-foundation Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / MCS ABI and generated temporal-authority foundation Goal: Establish the seL4 16 SMP+MCS syscall, object, IPC, profile, and compiler contract and prove it with minimal four-core QEMU and fresh Pi scheduler probes before service-child ABIs freeze. Inputs: seL4 Reference Manual v16.0.0, tag-pinned seL4 16 headers/caveats, configs/sel4/profiles.toml, crates/sel4-sys/**, crates/sel4-runtime/**, apps/root-task/src/sel4/**, tools/coh-rtc/src/**, selected QEMU/Pi kernel builds, docs/audit/M26D_MCS_DECISION.md. Changes: - crates/sel4-sys/** + crates/sel4-runtime/** — add version-pinned SchedContext, SchedControl, Reply, timeout-fault, `Consumed`, `YieldTo`, TCB setup, receive, call, reply, and reply-receive bindings with ABI/negative tests; remove classic reply/scheduling behavior from the QEMU/Pi operational VM closure. - configs/sel4/profiles.toml + profile tooling — make the four-node QEMU and Pi production/diagnostic runtime contracts MCS-only, validate `KernelIsMCS`, object sizes, cores, and generated headers, and provide no non-MCS runtime-eligible counterpart. - configs/sel4/profiles.toml + tools/sel4-profile-project/** + scripts/{sel4_profile.py,cohesix-build-run.sh,qemu-run.sh,release_bundle.sh} — restore the canonical macOS QEMU execution envelope to HVF and bind it as generated truth rather than a host heuristic. The QEMU profiles use `virt,gic-version=3,virtualization=off`, QEMU-native PSCI `method = "hvc"`, `cortex-a57`, and the host-visible 24,000,000 Hz virtual-counter frequency; the root console-network descriptor must carry the same frequency. Because upstream seL4 16 rejects HVC for SMP and implements only SMC `CPU_ON`, the wrapper owns a narrow DTB-selected HVC conduit while preserving the upstream SMC path for SMC-selected platforms. The wrapper also applies `-mgeneral-regs-only` to the elfloader-linked `cpio` target before the MMU/FP context exists. The profile validator rejects a mismatched DTB, timer header, CPU, machine, or compile command; it also requires exactly one wrapper dispatch object, exactly one HVC conduit object, no upstream duplicate PSCI driver, and the scalar libcpio compile-edge flag. Explicit TCG remains a claim-ineligible diagnostic comparator; it is not a performance fallback. - selected seL4 profiles + apps/root-task/src/{arch/aarch64/timer.rs,kernel.rs,userland/mod.rs} — require `KernelArmExportVCNTUser`/`CONFIG_EXPORT_VCNT_USER` and generated `TIMER_CLOCK_HZ` for both operational targets, include the architected-counter backend in `release-qemu` as well as Pi, remove the hard-coded frequency default, and make missing/zero counter truth or timer initialization fatal. `DummySoftTimer`, `bypass-timers`, and `bypass-timers-ipc` remain explicit host/bring-up fixtures only and are rejected from runtime-eligible feature closures and evidence. - tools/coh-rtc/src/** + generated artifacts — require each live TCB to declare either a bound active scheduling context or a compiler-validated passive donation chain. Active records carry SC object/size, SchedControl core, budget, period, refill/max-refill policy, priority/MCP, timeout/overrun policy, consumed-time evidence, and WCET/admission provenance; passive records carry allowed donor SCs/cores, Reply-object cardinality, timeout policy, and maximum donation depth. - apps/root-task/src/sel4/** + focused probe child — allocate/bind MCS objects only through BootInfo/untyped authority and prove active execution, passive donation and return, timeout-fault routing, Reply ownership, budget exhaustion/replenishment, consumed time, and four-core SC placement before broad extraction begins. - docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md + docs/TOOLCHAIN_MAC_ARM64.md — define the selected MCS topology, offline admission calculation, exact accelerator/timer/DTB execution envelope, evidence schema, and explicit whole-change-reversion rule. The compatibility review records no console grammar, Secure9P, `.coh`, Hive REST, `coh`, `cohsh`, SwarmUI, or `tools/cohesix-py` schema change; launch/evidence tooling and performance methodology must consume the corrected profile atomically. Commands: - cargo test -p sel4-sys -p sel4-runtime - cargo test -p coh-rtc - cargo test -p root-task --test schedule - python3 scripts/sel4_profile.py validate --profile qemu_smp_production --build-dir out/sel4/profile-v2/qemu-smp-production --require-source --require-artifacts --for-runtime - python3 scripts/sel4_profile.py validate --profile pi4_production --build-dir out/sel4/profile-v2/pi4-production --require-source --require-artifacts --for-runtime - scripts/check-generated.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-mcs-foundation-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-mcs-foundation-pi4 Checks: both operational contracts are four-node MCS with no runtime-eligible classic profile; each uses the selected build's exported virtual counter and exact generated frequency with no dummy, bypass, read-count, or hard-coded fallback; every active probe TCB has an admitted SC/core/budget/period and every passive probe has an allowlisted donor/Reply/timeout chain; Reply/donation ownership returns on success, timeout, cancellation, and fault; root emergency/fault work retains independent time; a failed QEMU or Pi gate stops 26e and requires atomic source/configuration reversion. Deliverables: One MCS-only QEMU/Pi scheduling ABI and compiler contract, minimal target evidence, and a stable foundation for every later 26e child. The QEMU execution-envelope repair above is evidence-bound to the first systemic failure behind the v6-v23 canaries, not a new leaf split. The exact V23 root `e3d757a79f2fa186a405e3199d8b62633dbf22fb9c12462341f8344e94c04731` failed under ordinary wall-clock TCG at moving boundaries across unrelated owners. The same immutable image under instruction-counted TCG completed AUTH and the write/read portion of `9p_batch.coh`, proving path reachability but not acceptance. Its first HVF exception was EC `0x07` at `cpio_get_file+28` on `ldr q25`, before seL4, because the release libcpio object was auto-vectorized without `-mgeneral-regs-only`; its generated DTB and 62.5 MHz timer truth were also TCG-shaped while this Mac exposes a 24 MHz counter under HVF. Conversely, the historical 0.4 macOS release reached seL4 and root bootstrap under HVF on this host. The repaired profile must therefore be rebuilt once and pass boot, AUTH, focused `.coh`, REST core/parity/Python smoke, and Conditional B2's no-retry exact-three executable QEMU pressure before any QEMU acceptance or target benchmark claim. Conditional D is a separately retained host-model gateway comparator and supplies no QEMU or Pi target evidence. Neither `-icount` nor an artificial CNTFRQ override is admissible evidence. Title/ID: m26e-production-surface-truth-and-stub-retirement Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / production surface truth and mock-stub retirement Goal: Inventory every reachable implementation surface, retain useful mocks only as explicit fixtures, and make the selected QEMU/Pi/runtime-release closure free of silent mock, stub, no-op, dummy, synthetic, or placeholder behavior. Inputs: `m26e-mcs-abi-foundation`, Cargo.toml and all workspace Cargo metadata/targets/features, apps/**, crates/**, tools/**, configs/**, scripts/**, all tracked README/docs/generated snippets, release manifests/assets, current build/package scripts, and the frozen CYW43 source/artifact boundary. Changes: - tools/coh-rtc/src/** + configs/implementation_surfaces.toml + configs/generated/implementation_surface_inventory.json — generate and validate `cohesix-implementation-surface-inventory/v1`. Each workspace member, binary, feature/profile, selected entrypoint, namespace seed, provider/action, host adapter, Python/example/playbook, proof source, package/release asset, and public claim has exactly one implementation class, owner, milestone, production reachability, selection source, package disposition, evidence requirement, and current observed mode. Only WorkerBus may be `model_only`; unclassified, duplicate, or production-reachable fixture/stub entries fail generation. - scripts/ci/check_implementation_surfaces.py + tests — scan source/config/build/release/docs for compiled spin stubs, `Ok(())` no-op provider success, dummy/null/bypass fallbacks, mock/default fixture selection, fabricated identities/state, placeholder credentials/private keys, client-authored proof, and public claims missing an inventory row. The scanner is an inventory/drift guard, not a keyword-only assertion; explicitly registered test fixtures remain legal. - apps/root-task/src/{kernel.rs,userland/mod.rs,serial/**,console/**,uart/**,trace.rs} — make missing operational serial or real time a fatal profile/construction error; keep emergency serial live; remove/profile-exclude the null serial and dummy/bypass clock from target closures; ensure early help exposes only implemented pre-auth diagnostics; return a typed authorization/unavailable refusal for pre-auth reboot instead of a stub; eliminate duplicate legacy bootstrap entrypoints from selected artifacts; and remove the unused `TraceSink::Ipc` alias unless it is wired to the generated bounded service IPC and proven as such. - apps/root-task/src/ninedoor.rs + generated host/GPU contracts — operational target state starts `unavailable source=none`, with no predefined units, nodes, temperatures, GPUs, models, lease, or active model. Populate it only from authenticated, versioned, sequence/epoch/time/TTL/manifest-bound host snapshots; atomically replace a provider generation, reject stale/forged snapshots, and withdraw expired data. Explicit dev-virt/mock profiles may retain clearly labelled fixture topology that never produces live evidence. - apps/gpu-bridge-host/** — live mode requires a validated real registry/CAS source or publishes an explicit empty/unavailable registry; invalid/missing state never installs fixture models or selects the first model as active. Model/source identity, sequence, epoch, observation time, TTL, manifest/CAS/base-adapter compatibility, activation generation, and receipt are explicit. Placeholder auth fails before connection outside explicit fixture mode. - binary/workspace disposition — stop building or staging the current spinning target `nine-door` binary; the later `nine-door-runtime` child is the only selected target namespace-service image. Make the host NineDoor crate library-only unless 27b supplies a real bounded host-service use case. Remove the unused all-mock `domain-intents` crate from the Cohesix workspace/release (optionally preserving deterministic records under test fixtures) rather than inventing media/finance authority. Label `coh-status` deferred to Milestone 30, not implemented. - packaging/release gate — replace non-empty-directory and wildcard-copy acceptance with the inventory's exact expected-artifact set for 26e runtime releases; reject unexpected/missing/wrong-kind/wrong-architecture/wrong-hash binaries, compiled stubs, mock-only configuration, placeholder tokens, private fixture signing keys, synthetic proof, and historical assets presented as current. Linux ARM64 host tools and the final Linux tarball are built on one explicitly selected remote ARM64 builder whose host, user, authentication, cargo, build, release, GLIBC ceiling, and local output locations are command-line inputs; release tooling never embeds a site-specific host, user, home, or NVMe path. The exact canonical Pi 4 SD staging file set is compiler-selected and converted into a peer `-Pi4` bundle containing a compact raw MBR/FAT32 image, hash, layout/provenance metadata, documentation, and exact bundle manifest. Image size derives from the payload, and the metadata declares the minimum target byte capacity so the image works on any sufficiently large SD card without inheriting a build card's geometry. Packaging remains build proof only and cannot promote media, boot, network, performance, or Pi acceptance. Historical releases remain immutable and receive errata only. - Release-readiness closure for 1.0.0-beta — bind each host bundle to its native Mac/HVF or Linux/KVM accepted artifact and TCP result; retain source/profile/tool/image identities in BUILD_PROVENANCE.json; include all generated compile-time contracts in remote source transfer; require the executable Conditional G three-archive installation gate, exact Pi raw-image readback and observed fresh provisioning before publication. The complete host suite, target-neutral Python package and benchmark contracts receive the same-change compatibility review recorded in HOST_TOOLS.md. Historical release snapshots are unchanged. - Release source-identity repair — the staged runner's metadata-only source hash differs from the standalone artifact/factory hash for the same clean commit, rejecting passing native TCP evidence at assembly. Use the existing complete checkout/Git/mode/submodule digest for staged context v2 as well; retain the original metadata fingerprint as a separate source-state binding and bind the shared helper in the action digest. Preserve historical evidence without translation or relabeling. An end-to-end producer/factory regression must accept unchanged source and reject changed bytes or executable modes before fresh qualification; dirty submodule state must still invalidate staged resume. - Release quickstart — ship the maintained Mac/Linux/Pi guide at every archive root, preserve its first-boot and authentication instructions, and relocate its local documentation links. Include the referenced Pi network-policy runbook; native CLI, Python and benchmark contracts remain unchanged. - Release 1.0.0-beta publication preparation — update README, status, quickstart, failover and layout guidance, and document changes since v0.9.0-beta. Retain 0.9.0-beta and remove earlier superseded distribution files from the current tree while preserving their original Git tags and the build inputs, fixtures and audit records still required by this release. Review all eight host executables, tools/cohesix-py, generated contracts and performance scripts; this documentation and historical-package cleanup changes no runtime, protocol, policy, scheduling or workload contract. The owner explicitly directs this preparation to reuse qualification from the separate release-qualification task and run no tests. Retain every reused result at its original source/artifact identity; packaging must not create a new target PASS. The owner separately approves an explicit publication-only factory mode: compare two clean commits, reject every runtime or generated-contract change, preserve original qualified artifacts/results and Pi identity, and record the allowed documentation, retired-distribution and factory delta with before/after hashes. Additive publication metadata must be understood by the release collector without promoting the packaging commit to a staged or target PASS. The subsequent owner instruction authorizes fresh canonical builds without tests, explicit build-only factory provenance, completion and push to main, and a v1.0.0-beta lightweight tag following v0.9.0-beta. All built artifacts retain current-source identity and NOT_RUN status; the separate Stage 5 acceptance remains bound to 5be3ca588. The canonical Linux source transfer includes the pinned third_party/fuser Cargo patch so clean native builds retain the working FUSE implementation. Native host tools regenerate the complete selected KVM policy/default set from a full hash-checked Git tree, preventing Mac timer/manifest identities from leaking into the Linux host binaries. - Release-candidate host validation — restrict Pi handoff ring publication to the bare-metal runtime and its explicit unit-test buffer. Preserve the target publication path and align feature guards with their implementations. Give the Pi host library its compiler-generated Pi tables while retaining the QEMU partition tests in the QEMU suite; select SDIO fixture IRQs by owner rather than global list position. Restore stale sharding, temporal admission, NineDoor timeout, diagnostic counter, CLI grammar, SwarmUI transcript, artifact and toolchain fixtures to the canonical manifests and documented contracts. Align QEMU preflight timers with native Mac HVF and Linux KVM profiles. Bind QEMU Worker GDB fault tests to the current passive Worker ABI v2 and verify all three role bindings against the generated topology; reject old or unknown layouts before debugger attachment. The quarantine defect discovered here is restored under `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` below. - QEMU release-pressure isolation — allow the canonical clean-build runner to use an explicitly selected disposable Git checkout with `--clean-root`. Preserve its exact-root, output ownership, no-writer, profile, pressure and five-stage acceptance checks; the development checkout's retained output is outside that clean boundary. Exercise hostile path admission in an explicitly selected clean test checkout, independent of the developer's path or uncommitted work. The bench-specific bootpd template test retains the installed host path even when read from a disposable checkout. Queue and verify one single-use `/queen/ctl` approval before each setup spawn/kill over direct TCP or REST, including capacity/model refusal probes and stale-generation recreation. Preserve the control result without retries or a policy bypass. - Release fleet discovery — restore SwarmUI direct/REST/Secure9P discovery and the executable benchmark census when the real population occupies more than one 64-entry aggregate directory reply. Enumerate only compiler-declared shard addresses and read actual per-shard Workers and structured state. Restore the target aggregate listing to a bounded view of up to 64 distinct active shard labels, consistent with the host model, instead of failing once that view fills. Retain read refusals, placement/identity validation, target buffers, quotas, workloads and thresholds. Record the complete host-suite and Python compatibility review in HOST_TOOLS.md; verify the failing 256-Worker native Jetson scenario before reporting closure. - Release-candidate compatibility review — reviewed `cohsh`, `coh` (including doctor), `hive-gateway`, `swarmui`, `gpu-bridge-host`, `host-sidecar-bridge`, `cas-tool`, `host-ticket-agent`, `tools/cohesix-py`, raw TCP and REST/Worker benchmark workloads and report schemas. Existing shared 256-shard and bounded timeout contracts require fixture/document synchronization; public commands, credentials, wire ABI, Python APIs, workload definitions and performance thresholds remain unchanged. Native QEMU, Jetson/Pi benchmarks, and Mac SwarmUI direct/gateway multi-Worker checks must retain separate evidence before release construction. - Provisioned component selection — build Stage 02 console-network images with the selected QEMU `direct-virtio` or canonical Pi `direct-genet` and optimization settings before checking exact root bindings. The normal QEMU production build selects its direct transport independently of optional diagnostic tracing. Keep exact generated page admission and image identity checks; no target budget, protocol, or benchmark threshold changes. - docs — correct nested crate READMEs and all current docs to distinguish `production_live`, fixture, host-model, diagnostic, deferred, and retired surfaces; current code/package state, not milestone prose, determines the initial row. Commands: - cargo test -p coh-rtc implementation_surface - python3 scripts/ci/check_implementation_surfaces.py --inventory configs/generated/implementation_surface_inventory.json - cargo test -p root-task --tests production_fallbacks - cargo test -p gpu-bridge-host - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none - scripts/release_bundle.sh --check-manifest --pi4-stage-dir out/pi4-sd --macos-artifact --macos-result - scripts/check-generated.sh Checks: operational QEMU/Pi feature and package closures contain real time/serial and no null, dummy, bypass, spin-stub, preseeded host/GPU/model state, implicit active model, fixture key/token, client-authored proof, or automatic live-to-mock fallback; expired provider state becomes unavailable; explicit fixtures still pass isolated tests; WorkerBus is the only model-only role; every other non-live surface is fixture/diagnostic/contract/not-enabled/deferred/retired with an exact owner and cannot satisfy target, integration, release, attestation, or use-case evidence; no CYW43 source, timing, state machine, or proof classification changes. Deliverables: Compiler-owned production-surface inventory, fail-closed operational profiles, truthful target namespace state, exact release selection, and no ambiguous mock/stub functionality. Title/ID: m26e-worker-resource-admission-critical-tcbs Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / executable-slot admission and critical root TCB reserves Goal: Prove the complete kernel-object, memory, CSpace, and per-core time budget for every executable slot while creating independent root-control, fault, emergency, Worker-supervisor, and driver-supervisor progress domains. Inputs: `m26e-mcs-abi-foundation`, `m26e-production-surface-truth-and-stub-retirement`, selected seL4 16 generated headers/object sizes, BootInfo/untyped inventory, apps/root-task/src/hal/**, apps/root-task/src/kernel.rs, apps/root-task/src/sel4/**, tools/coh-rtc/src/**, configs/root_task*.toml, docs/ROLES_AND_SCHEDULING.md, docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md. Changes: - Release critical reservation exhaustion restoration — discovered by `m26e-mcs-smp-target-acceptance` on exact native KVM source `9b1bf2eaa057a268851d068a9b4372f37e692217`. A hardware breakpoint at the emitted seL4 `endTimeslice` timeout branch, before fault IPC, captured the LoRA executor at its blocking Wait with an empty request queue, one published completion, no pending root fault, and no fatal state. Its charged SC retained a 5,196-us head due in 2,000 us and a 2,804-us later refill. Earlier exact-source failures separately identify GPU-executor, Worker-supervisor, and root-fault timeouts; cumulative consumed fields do not establish single-operation WCET or distinguish guest execution from host scheduling delay. Select existing NaturalPostpone for the five resumable critical service loops (root-fault, both supervisors, both executors) in QEMU, regression, and Pi manifests, and reject terminal policy drift in the compiler. Preserve budgets, periods, refills, priorities, core placement, WCET/admission checks, standard-fault endpoints, emergency fail-stop, passive Worker timeout containment, and NineDoor recovery. Keep timeout capabilities reserved and accounted. Review the complete host-tool suite, Python library, and performance scripts: regenerated profile/hash bindings change; public protocols, workloads, thresholds, receipt requirements, and report schemas do not. Require focused generated/fault contracts, exact Mac/KVM/Pi builds, fresh target fault and pressure evidence, and all applicable staged gates before acceptance. - Pi exact-4c future-anchor collision restoration — image `b24b3eac1794570ba2b0c64b16570e7f92102437a545822d7ff8694faf7909c2` reaches console-network construction with ordinary root slots ending at `0x3f09`, the generated NineDoor anchor. The subsequent exact reservation fails with `seL4_DeleteFirst` before NineDoor construction or the registry seal. Exclude all enabled compiler-declared service, Worker and critical-retention anchors from ordinary allocation from the outset; retain one-time exact claims and rejection of occupied, duplicate, kernel-reserved, out-of-window or previously allocated ordinary slots. Preserve generated slot addresses, resource counts, constructors, revoke ownership, MCS contracts and physical-driver behavior. This restores executable-slot admission after the defect was discovered under `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`; focused allocator contracts, a narrow QEMU activation canary and a fresh exact-image Pi boot are distinct proof requirements. - Pi exact-4c repeated Worker service scan restoration — ordinary linked-runtime phases repeatedly inspect all 256 projection slots even with no claimed Workers. Maintain a bounded claimed-slot bitmap in the same existing admission/checkpoint transaction and snapshot it after immediate fault/policy work, then enforce every claimed deadline with the unchanged call time and manifest order. Preserve terminal claims, fault-mailbox precedence and QEMU service quantum; skip an empty pending-operation scan only after validating population bounds. This removes source-proven repeated lock/lookup work while the measured 4c GENET raw latency bands and remaining pressure dispatch-to-stage delay remain unassigned to actual SC consumption. Pure set/order/failure-atomicity tests, exact target compilation, QEMU canary and fresh physical performance must remain distinct. - tools/coh-rtc/src/** + configs/root_task*.toml — separate namespace/model capacity from per-role executable slots; declare allowed role mixes, fixed core placement, TCB/CNode/VSpace/page-table/ASID/frame/endpoint/notification/fault/timeout/Reply/SC/CSpace-slot/untyped costs, budget/period/deadline/refill/priority/MCP/blocking/jitter/WCET inputs, and fail-closed per-core response-time/admission results. The V26-era QEMU root-control repair candidate remains on core 0 with `5500 us / 10000 us`, `5000 us` per-phase WCET, `m26e-qemu-root-disconnect-single-issue-candidate-v26` provenance, and a derived `7600 us` per-phase response bound rather than an end-to-end host/TCP latency claim. Only the QEMU console-network task, matching service config, and SchedControl selection move from core 0 to core 2; its `3000 us / 10000 us` budget and `2400 us` WCET stay fixed while its response becomes `2400 us`; V26-era child provenance was `m26e-qemu-console-peer-close-timewait-relisten-candidate-v13`. The two same-priority core-2 GPU/LoRA Worker responses become `3000 us`; core-0 demand is `8750 us` and core-2 demand is `3800 us`, each within `9000 us` usable after the unchanged `1000 us` reserve. Pi root-control retains V23 provenance, placement, timing, response, and admission truth; its child at that chronology point advanced only to V13 provenance under schema 1.12, with timing and placement unchanged. Root-fault is `3000 us / 10000 us`, with `2400 us` per admitted containment unit, `2600 us` per-unit response, and `m26e-qemu-root-fault-service-units-candidate-v6` provenance. Root-fault V6 preserves `PrimeReceive -> Receive -> Classify`; service records then advance `ResolveService -> SuspendService -> RecoverPassiveService -> PublishService -> Receive`, with active console skipping `RecoverPassiveService`, while the legacy critical branch remains `SuspendCritical -> SignalEmergency -> Receive`. Resolution is one fixed generated lookup plus a nonblocking registry-lock/scalar-snapshot attempt with lossless retry, suspension is one quiet bounded syscall, passive recovery issues at most one Reply while active console issues zero, and publication is one mailbox action that retains its snapshot on backpressure. Terminal-critical and service containment span distinct admitted units, so `2600 us` is not an end-to-end terminal-fault latency claim. Root-fault numerics remain unchanged; V26 retained every V25 timing and placement value and changes only the QEMU root's successful Disconnect transaction from repeatable to per-connection single-issue. The v2 whole-turn interpretation and v3 combined Network/runtime-IPC phase are live-falsified; source `00bf02540` timed out `root-control` at the console-network control poll. Source `4d1a47b89` timed out in `VirtioTxToken::consume` after queue notify, falsifying v4's multi-unit Network turn. The following live v5 run raised child timeout badge `0x26ee0007` at `Send` after `publish_exchange` with exactly `3000 us` consumed, then raised root timeout badge `0x26ee0001` at the sole outer yield after containment/quarantine with exactly `2750 us` consumed, falsifying a multi-material child turn and whole-containment Recovery turn. The canonical v6 root ELF `0059fd675b476106888d6ca62c8bba21f9b340b9aa607e000fbf96997fd29900` then raised root badge `0x26ee0001` at the outer yield after a single Network visit composed empty ObserveChild, no-op StageOutput and Disconnect, and committed/signalled 60-byte ARP ingress sequence 1. The child was healthy and no Recovery ran, so v6 falsifies composition of no-op lower units rather than child or containment progress. None is qualification evidence. - apps/root-task/src/hal/** + generated records — reserve compiler-bounded per-slot untyped/CSpace pools and supervisor-owned revoke anchors without changing the existing isolated driver-runtime constructor or allocator contract. On the QEMU VirtIO profile, the ordinary root-control phase also suppresses the Pi/GENET-only synchronous raw-UART idle-input trace in live and quarantined adapter states; the pre-gate v3 run exhausted at the following outer yield after emitting that complete nonessential line. - apps/root-task/src/kernel.rs + apps/root-task/src/sel4/** — create distinct `root-control`, `root-fault`, `root-emergency`, `root-worker-supervisor`, and `root-driver-supervisor` TCBs with distinct active SCs and least-authority CSpace views; no reserve is a Worker or driver donor. - apps/root-task/src/kernel.rs + tools/coh-rtc/src/** — generate the bounded root-control-to-Worker-supervisor queue, per-admitted-Worker root-fault teardown mailboxes, Worker-supervisor wake notification, per-runtime root-fault-to-driver-supervisor records, driver-supervisor wake notification, reserved disjoint notification-badge ranges, exact Read/Write rights, one-hot signal caps, backpressure/refusal policy, and coalesced drain precedence. Critical producers never block on a supervisor and fault handoff cannot be dropped. - apps/root-task/src/sel4/** + tools/coh-rtc/src/** — generate one acyclic critical-TCB fault graph and exactly one blocking MCS fault receive endpoint with one serialized Reply: standard and timeout child fault caps are disjointly badged `Write + GrantReply` caps to that endpoint, root-fault's receive cap is Read-only, ordinary Worker faults suspend/terminate without Reply, only allowlisted timeout faults may reply once, and linked-driver faults retain the association while root-fault waits for the independent driver supervisor's exact release-badge notification after command-Reply failure and containment; root-fault failure routes to root-emergency, and root-emergency failure is fail-stop rather than self/cyclic recovery. - apps/root-task/src/kernel.rs + tools/coh-rtc/src/** — size the fault registry from every admitted service, Worker, driver, and critical root TCB and propagate duplicate/overflow registration as a fatal construction error. - docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md — publish executable-slot/resource arithmetic, per-core reserves, response-time inputs, and allocation-failure gates separately from model capacity. Commands: - cargo test -p coh-rtc worker_admission - cargo test -p root-task --test worker_resource_admission - cargo test -p root-task --test worker_fault_registry - cargo test -p root-task --test critical_tcb_reserves - cargo test -p root-task --test critical_tcb_handoff - cargo test -p root-task --test driver_supervisor_handoff - cargo test -p root-task --test mcs_fault_lanes - scripts/check-generated.sh Checks: the maximum generated role mix fits exact selected-kernel object/untyped/CSpace/page and per-core time bounds; every critical duty runs on the named TCB/SC; Worker and driver handoff queues, mailboxes, badge ranges, cap rights, Reply cardinality, terminal/recoverable fault transitions, and the acyclic fault graph match generated truth under coalescence, saturation, simultaneous faults, handler fault, and allocation failure; no registration or construction error is ignored; model capacity cannot overcommit executable slots. This admission task does not edit driver-runtime or CYW43 behavior; the following driver-port task owns the required MCS rebuild. Deliverables: Compiler-proven executable resource pools, generated fault capacity, and independent temporal reserves required before any 26e child is trusted to run. Title/ID: m26e-driver-runtime-mcs-port-and-cyw43-coexistence Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / linked-driver MCS port and behavioral coexistence proof Goal: Replace the current MCS driver stubs with the real seL4 16 MCS command, Reply, notification, fault, active-SC, and faulted-call recovery paths for every linked Pi driver while preserving CYW43/SDIO behavior and re-proving it under the new binary identity. Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, crates/pi4-driver-abi/**, apps/pi4-driver-runtime/**, apps/root-task/src/kernel.rs, apps/root-task/src/hal/driver_task.rs, apps/root-task/src/sel4/**, tools/coh-rtc/src/**, configs/root_task_pi4_uboot_aarch64.toml, scripts/cohesix-build-run.sh, scripts/pi4-image-build.sh, scripts/pi4_gate_proof.sh, the accepted classic driver archive/hash and exact CYW43 evidence, and selected QEMU/Pi MCS generated headers. Changes: - Stage 05 syscall IPC ownership restoration — independent review under `m26e-mcs-smp-target-acceptance` finds that restricted critical TCB notification waits and kernel-error cleanup can write through the process-global root IPC pointer. Safe badge wrappers also accept arbitrary raw output addresses, and binding a child IPC address incorrectly returns a caller memory view. Require borrowed badge outputs, a kernel-only child bind result, private fast registers or the explicitly borrowed caller buffer throughout restricted cleanup, and no implicit IPC-buffer access for zero-length Send/NBSend or MCS Wait/NBWait returns. Preserve nonempty endpoint payloads, generic libsel4 error-word behavior, capability checks, fault/Reply ordering, scheduling bounds and every operator surface. Retain selected-kernel and exact-image evidence separately from any unproved physical-fault attribution. Review the complete host-tool suite, Python SDK and benchmarks; these internal Rust ownership contracts change no public wire or generated schema. Focused ABI/storage contracts, exact QEMU/Pi compilation, independent review, fresh target fault/wake evidence and applicable staged gates precede DD-2026-0030 closure. The canonical Worker convergence script must publish and acknowledge a distinct `/actions/queue` approval before each create/kill/create write, preserving the selected single-use `/queen/ctl` policy gate. Observe bounded authenticated READY/terminal telemetry before dependent lifecycle operations, and validate complete retained Queen-log records for two increasing generations around terminal containment; nonessential UART mirroring cannot own this proof. - Release 1.0.0-beta DD30 owner decision — on 2026-09-13 Lukas Bower explicitly accepts the remaining dynamic fault/wake evidence gap after source, selected ABI, pure-test and emitted-code verification of the IPC ownership repair. This supersedes the unconditional pre-closure fault/wake requirement above only for this release and this finding. Keep DD30 at P1 / ACCEPTED_RISK under EX-2026-0030; the unexecuted target test is not PASS. The machine-readable docs/audit/DD30_RELEASE_WAIVER.toml binds the exact owner statement and ten reviewed production-file hashes, with a conservative administrative expiry of 2026-10-13. Require explicit DD_RELEASE_ID=1.0.0-beta selection and fail closed for changed source, mismatched records, expired or withdrawn approval. All other findings, target evidence, staged source bindings and acceptance checks remain mandatory; no VM fault-injection authority is introduced. - Release 1.0.0-beta approved evidence carry-forward and host-model restoration — on 2026-09-13 Lukas Bower approved the exact two-file host repair and reuse of authentic prior Stage 01–04 records plus later scoped fix evidence without duplicate stages. Restore typed host Suspend/Delete/Revoke/Consumed models at the object-only boundary while keeping target fast-register IPC and endpoint echo unchanged; assert the deadline fixture's existing admitted/outer-turn invariant during each iteration. Bind the approved Rust patch, original four attestations and exact successor source in docs/audit/RELEASE_1_0_0_BETA_CARRY_FORWARD.toml. The dedicated release Stage 05 entry point may issue PASS_WITH_RESIDUAL_RISK only after immutable evidence, owner authority, exact source continuity and unique governance checks pass. Preserve old source/target identities, the failed fresh-run attempt and DD30's UNEXECUTED dynamic test; never create replacement Stage 01–04 markers or relax ordinary resume checks. Release-bundle source/integrity and other target requirements remain separate and unchanged. - Stage 05 independent-review restoration — discovery under `m26e-mcs-smp-target-acceptance` identifies two remaining PCIe admission defects: USB and SDIO consumers can accept partial link/MSI flags before endpoint/firmware completion, and physical settle intervals are expressed as CPU spin counts. Require one complete owner proof before either consumer proceeds, revoke it before reset and on failure, and measure the existing hardware intervals using exported CNTVCT and generated timer frequency. Retain the existing root-text and bounded reset/readback/firmware observations without requiring an admitted UART sink. Three fixed private slots preserve the original early root-entry, IPC-installation and fault-receiver measurements through bulk child admission; publish those captured values once at the common pre-PCIe boundary without re-sampling. The exact 25dc WiFi boot exposed ordinary-log eviction of every audit receipt after longer firmware startup. Add an explicit trusted boot reserve for at most 63 complete 256-byte original records plus one reserved sticky failure receipt, preserving the ordinary 2048-line ring. Admit saved and ordinary copies atomically under the existing nonblocking lock; user prefixes cannot claim trusted slots. Full export merges original sequence identities without duplicate copies, freezes the exact union byte count and end sequence, preserves unread saved records across ordinary eviction between batches, and keeps latest-N tail semantics. Materialize capture failure at its actual later export sequence before freezing the cursor; never resample text or reissue hardware. Nonblocking capture/publication failures remain explicit and collectors must require the actual exact-ELF checksum cuts and complete ordered receipts. Preserve sole device ownership, MMIO barriers, protocol/ABI, scheduling bounds, operator service and raw/pressure thresholds. Review every host tool, Python SDK, generated contract and benchmark consumer; these private HAL/boot diagnostics require no consumer or workload changes. Meaningful publication/failure/timer/sink tests, exact Pi compilation, independent review and fresh dual-mode Pi evidence precede audit closure; canonical final-source Stages 01–05 remain required. - Release partial-input liveness restoration — discovered by `m26e-mcs-smp-target-acceptance` on exact Pi source `2be878d8d1645718d9420a7144a10fd4003bd4b2`, W02 image `ce4b681f72a435a7305b4553a7c51ba9e4fe7709538a7b6fd59a269773b52f31`: a two-byte unfinished serial line excludes TCP for the entire bounded 20-second probe; clearing the line restores it in 0.325 seconds on the same boot. Distinguish queued bytes and active parser chunks from retained partial text at the physical-operator fence. Preserve serial-first dispatch, every partial byte, response-tail priority, immutable CYW43 ownership, input echo and bounded USB/HDMI service. The existing partial-USB presentation shortcut is earned only by newly consumed bytes, so a stationary line cannot perpetually re-enter it. This supersedes only the older partial-line fence wording below; it changes no owner, timer, SC numeric, ABI, protocol or generated contract. Review coh/cohsh, SwarmUI, Hive Gateway, host bridges/agent, CAS, Python SDK and performance scripts: no consumer or workload changes are required. Require independent parser/fence contracts, exact Pi and QEMU builds, a fresh physical partial-input/TCP control, raw and pressure reruns, and the applicable staged gates before acceptance. - Release-candidate quarantine restoration — retain the network attachment class before failure and reject response-lane inspection before touching a quarantined adapter. The cached VirtIO class preserves its bounded rotor through containment; direct GENET and CYW43 selectors cannot inspect a poisoned driver. A failed CYW43 runtime must leave serial/local operator service live. The existing terminal-quarantine tests require zero poisoned-adapter reads; host tests do not replace the requested fresh target checks. Discovery: `m26e-production-surface-truth-and-stub-retirement`. - Release-candidate unsafe-boundary repair — use the existing checked HAL register window for continuation-grant publication and parked-child acknowledgement, preserving every volatile store and cache publication order. Reuse the uncached DMA word writer for zeroing and a typed fixed-peer NBSendWait wrapper for root/SDIO/CYW43 handoffs. This removes four duplicate raw-access sites; canonical counts are global 827 and linked-runtime/HAL 173, within the unchanged approved limits. Existing sequence/receipt/zeroing tests, explicit fixed-slot and invalid-address checks, and exact target compilation precede fresh performance evidence. - Pi exact-bed6 overlapping-command ACK progress restoration — host windows on unchanged GENET G04/G05 stall with a full direct RX ring and root awaiting the previous response drain, while serialized 400-request/s controls complete on G06. A later command publication fences transport until new root control, but root cannot stage that control until the preceding TCP response is acknowledged. Preserve already-retained transport work and permit peer-triggered progress under the existing three-unit command-wait bound while the previous exact output control remains pending. Pending output alone cannot mint polling; a no-progress cycle ending at the bound must quiesce. Keep the command latch, OutputDrained plus ControlCompleted retirement, publication credit, sole device owner, ABI v13, SC numerics, WiFi path and qualified QEMU behavior. Focused permission/quiescence contracts, exact Pi compilation and a narrow QEMU console-network canary precede fresh raw64 and the failed overlapping host scenario. This restores a defect discovered under `m26e-console-network-service-isolation`; it does not establish the cause of every raw or REST tail. Review all host tools, tools/cohesix-py, generated contracts and raw/REST benchmarks: protocol, workloads, retries and report schemas require no changes. Hardware improvement and repeatability remain unproven until measured. - Pi MCS source-pass reservation candidate — the exact ae6f1029b two-WiFi/two-comparable-GENET matrix remains below performance targets; WiFi DPC child timing contains 9,911 us publication-to-intake and 7,871 us issue-to-terminal waits, without proving whether individual gaps are voluntary Yield or kernel postponement. Generic CYW43/SDIO source-return paths unconditionally yielded by role, including rejected/quiescent sources. Under selected MCS, retire that bounded source arbitration pass and re-enter ordinary immutable intake/grant/recovery checks without charging the remaining head refill. Preserve classic cooperative behavior, retained-grant failure/recovery yields, GENET DPC policy, CPU allocations, all physical operation/deadline bounds and operator/Worker functionality. Focused terminal-baton and source-priority tests plus exact target compilation protect the code contract; fresh Pi timing and pressure remain required. Host-tool catalog, Python SDK and every benchmark entry point retain their command, schema, workload, target and retry contracts; no consumer change is needed for this scheduling-only behavior. - Pi exact-1c5165 idle and scheduling attribution — seal the 138-artifact unchanged four-boot matrix before edits. Successful WiFi raw64 reaches 18.0104 requests/s; GENET p95 is 5.659959/5.946875 ms. G00 stalls in Signal while G01 stalls in IRQ completion without a signal due; neither wall interval identifies the competing CPU owner. Add the existing serial, USB, HDMI and PCIe SCs to session CPU receipts, sampled by their current supervisor authority. Permit ready WiFi to enter the existing root fan-in receive only with an Idle one-way owner and every existing operator, output, child, fault and recovery fence empty. Recheck all levels after the existing one-time PCIe timer enable. No scheduling numbers, device ownership, GENET issue path or benchmark bounds change. Keep all CPU rows and the end marker within the Pi SMP output envelope; detailed network rows remain available through NETSTATS. - Pi exact-5750 copied publication and response-stage attribution — the sealed 175-artifact two-WiFi/two-GENET headless matrix misses WiFi throughput and GENET p95. WiFi wire request-to-ACK averages 42.5–47.8 ms while GENET averages 0.61–0.67 ms with its tail mostly after ACK. The child serializes already-ready command and copied egress pages across separate publication credits. Permit one copied command plus one prepared packet under the existing credit: packet commit precedes command event barrier, one event/fan-in notification pair, and root validates and retains both before ACK. Watermark-only wakes cannot consume partial bundles; direct paths and lifecycle events cannot pair. Use existing CommandBatch nested timestamps to separate creation from publication start on Pi, correcting the prior mislabeled creation-to-root metric. Add seven bounded schema-v2 seam rows with fixed age histograms and accepted-pair count; preserve per-command policy timestamps, QEMU representation, physical owner boundaries, protocol, packet workload, MCS budgets and guards. Regress barrier/identity/credit exclusion, batch timestamps, histogram bounds and complete serial/TCP diagnostic tails; compile exact Pi and run the shared root-MCS QEMU canary. Discovery also belongs to `m26e-console-network-service-isolation`. Compatibility review covers coh/cohsh, coh-status, Hive Gateway/REST, SwarmUI, GPU bridge, host-ticket agent, sidecar/bus, CAS tool, all .coh scripts, tools/cohesix-py, generated contracts, trace/evidence tools and performance workloads/report schemas: they do not parse the old seam row or depend on internal command encoding; no consumer implementation or generated schema changes are required. USERLAND_AND_CLI owns the explicitly versioned operator-row change. Hardware scheduling effect and performance remain unproven until fresh exact-image raw TCP and repeatability evidence. - Pi exact-5750 display-disconnected scheduling restoration — the unchanged two-WiFi/two-GENET matrix seals 175 artifacts before edits. The operator confirms HDMI was disconnected; HAL therefore has no bootloader framebuffer, while queued display bytes fence every GENET raw idle cut and passive HDMI status labels completed faults ready. Treat new HDMI output and startup milestones as non-runnable without boot framebuffer authority, preserving bounded buffers, any already-retained completion, serial and USB service. Skip futile engine attachment and nonessential network mirroring to that absent display. Report unavailable framebuffer or unproven owner independently of completion counts. Keep connected-display rendering, generated budgets, wake and driver protocols, benchmark workloads and QEMU scheduling unchanged. Regress missing/present framebuffer scheduling, retained output, and truthful status; compile the exact Pi profile and protect shared EventPump behavior with the root-MCS QEMU canary. Discovery also belongs to `m26e-console-network-service-isolation`; review the host-tool suite, Python library, generated contracts and benchmark parsers. No performance success is claimed until a fresh exact-image Pi run. - Pi exact-80 GENET private control-copy reduction — sealed four-boot matrix `out/bench/80c3d8c03-four-boot-matrix.json` keeps GENET p95 above target with substantial console-network CPU. Exact-image disassembly proves each direct ring sample clears and returns a 4-KiB scratch page for 320 bytes of header/cursor state. Add an exact private-prefix codec and retain strict full-page admission through the existing API; use the compact copy in both isolated peers, preserving every identity, poison, cursor, final reconciliation and wake check. Mapped pages, wire ABI/version, scheduling, DMA, IRQ, packet workloads and WiFi behavior stay unchanged. Test exact bytes, length rejection, tail preservation and reciprocal publication/poison contracts, compile both selected profiles and compare emitted code. Source proves reduced copying; fresh Pi CPU, raw latency and repeatability must determine its effect. Discovery also belongs to `m26e-console-network-service-isolation`. Review the complete host-tool catalog, Python package, generated contracts and benchmark consumers; no external grammar, report, workload or generated schema changes are required. - Pi exact-80 startup background takeover — the unchanged `80c3d8c03b8924da89d0ec43cfb5a4525f1bd5b4` two-WiFi/two-GENET matrix seals 193 artifacts before edits. User observation requires clearing U-Boot at the first startup banner instead of ordinary-console takeover. Retain the existing immutable HDMI init command after its bounded tile write, then clear the surrounding framebuffer with the existing format/budget row bound while preserving the tile. Publish init completion only after every background row is cleared. Keep pre-banner boot video, the child counter, sole framebuffer ownership, normal terminal takeover and USB/serial priority. Regress full-background coverage, tile preservation, immutable-command mismatch and each turn's write bound alongside existing compositor cases. No manifest, SC values, protocol, benchmark or QEMU path changes. Review host-tool/Python/benchmark compatibility as unchanged. Exact Pi build and fresh visible hardware proof remain required; source tests do not establish immediate physical display behavior or network closure. Discovery also belongs to `m26e-console-network-service-isolation`. - Pi 8af diagnostic delivery and boot-video restoration — unchanged `8af555da207a726617304db9b243fe31af944a38` completes two WiFi and two GENET boots before edits, sealed with 169 artifacts. All raw64, focused scripts, Worker32 and canonical pressure workloads complete, but WiFi throughput and GENET p95 remain below target. All four `smp mcs` bodies lose owner CPU rows and their end marker at the 69-line physical limit; TCP capture is limited to 64 lines. Pair adjacent copied non-Worker registrations, preserve all generations/validity/counters, and document the two static legends instead of repeating them, so the selected Pi WiFi body fits both existing bounds. Regress the actual selected-Pi registry and complete physical/TCP body. User feedback confirms timer, arrows and help, but reports premature blanking: remove the boot script's pre-kernel clear and retain vidconsole through bootm until child-only HDMI takeover. Restore canonical docs atomically; no SC numerics, physical protocols, queue bounds, workloads, thresholds or QEMU output change. Fresh CPU and display receipts remain required; this delivery repair alone does not establish a performance cause or acceptance. - Pi exact-493 CPU-accounting discriminator — the unchanged two-WiFi/two-GENET set on `493caa7f8a84b3ed40a576aa772552fe8ea13cc0`, image `20c06aa6a8869623571edbd2cba6e354a13cf41dc11cbb1076087329cc2eefca`, passes raw64, representative scripts, Worker32 and medium/high pressure on every boot but fails one raw performance metric per lane. GENET G01 has 7.412 ms p95 with a 173 us maximum driver slice and no elapsed-guard flag; wall receipts cannot establish consumed CPU. Sample the selected root-control, console-network and network-driver SCs at observed TCP lifecycle edges through their existing owners. Preserve intermediate root Consumed drains in a cumulative evidence sum; driver-supervisor samples only its moved SC caps, one selected driver per wake, after fault work. Keep capability generation, syscall time brackets, missing/error validity and latest-session identity explicit in bounded `smp mcs` rows. No budget, period, refill, priority, core, physical protocol, benchmark workload or QEMU scheduling change is authorized by this diagnostic. Discovery also belongs to `m26e-console-network-service-isolation`. Fresh Pi evidence must distinguish CPU demand from blocking before a performance repair. - Pi exact-0783 lost evidence at teardown and Yield — unchanged source `0783c5aa10b1879623f3be748f7deef7901fa0f5`, image `d1d7e73e8de472dc0387b6cb51017af5f344e50a8a2124425f51ff909ac3c26c`, completes two WiFi and two GENET evidence boots before edits. WiFi W00 fails a TAIL terminal after nine host pure ACKs but six root-dequeued/staged/completed ACK increments; the final receipt describes teardown, so it cannot locate the absent body ACKs. W01 passes scripts/pressure at 12.909 requests/s, 88.195 ms p95 and 47.408-second ready. GENET passes scripts/pressure at 263.184/217.319 requests/s but 7.036/9.428 ms p95; one exact wire tuple binds a 34.037-ms Signal interval, while the other boot's raw maximum physical slice is only 110.704 microseconds. Retain the latest same-flow ACK admission at an exact received FIN and the latest TCP session's first maximum valid Yield with pre-Yield work counters, phase and observed child publication. Preserve identity/generation fences, fixed row capacity, every existing scheduling/driver contract and QEMU behavior. Update additive-row documentation and the host parser fixture; review the complete host/Python/benchmark suite without changing workloads or acceptance. These are diagnostic retention repairs, not a performance fix or proof of SC consumption. Discovery also belongs to `m26e-console-network-service-isolation`; fresh exact-image hardware must resolve the remaining causal interval. - Pi exact-e11b initial-wake restoration — two WiFi and two GENET boots on `e11b3fb677e7fc57f7e728bc71c7a122d95b9f52`, image `81e76dab2ab78e347f6271b77eb3a5c0796f4d3c853459741892206bc8ac2ae0`, pass scripts and mid/high pressure but miss raw targets. GENET G01 repeats HDMI command60/completion59 with fresh previous-idle child progress and absent DROW/DROA. Reconcile only that unbound initial endpoint rendezvous under the exact retained identity and existing generated wake-period gate; current admission, continuation, terminal or changed identity prevents another hint. Preserve the binding guard, one action per slice, Reply/SC ownership, physical driver protocols and QEMU behavior. Carry the two-second child startup counter across serial cutover using one ordinary retained Display slice per operator rotation until normal-frame takeover, without delaying readiness. Review all host tools, Python and benchmarks with no API/workload/schema changes. Focused admission/clock checks, exact Pi compilation and the root-MCS QEMU canary qualify the candidate; fresh Pi display/input and transport performance/repeatability remain required. Discovery also belongs to `m26e-console-network-service-isolation`. - Pi exact-a176 four-boot admission discriminator — WiFi W00/W01 and GENET G00/G01 all pass representative scripts and medium/high functional pressure, but raw TCP misses targets; GENET G01 repeatedly ACKs in about0.2ms while command publication waits up to10ms for root. Cumulative idle masks include subsequent paced UART diagnostic typing and cannot prove the raw operator fence. Retain one bounded latest nonzero TCP generation/connection record for existing idle cuts, six independent operator predicates and exact Yield wall intervals; preserve it across disconnect and reset only at a newly observed nonzero identity. Emit seven additive rows only in explicit Pi smp mcs; no admission predicate, scheduling syscall/number, driver authority, physical protocol, QEMU route or benchmark workload changes. Cover identity retention/reset, invalid clocks, independent counts, saturation and complete output; update operator/host contracts and passive trace fixtures. Fresh raw-first Pi evidence must decide whether absent wake-friendly idle or another admission boundary dominates; do not call this telemetry a performance repair or infer consumed CPU/refill exhaustion from elapsed time. Discovery also belongs to m26e-console-network-service-isolation. - Pi exact-a0efe bounded RX root episode — source `a0efeecded25c946e14c91495380e987e813261b`, image `b883a92de767f183f52d1748b5e4439c67863d61555866c43f182097ff21dd4f`, WiFi W01 passes raw64 at 12.147632 requests/s and 91.073916 ms p95, three representative scripts and medium16/high32 pressure; ready is 45.025658 seconds after reset. Its 12.137 ms mean queue-to-publication and 7.376 ms publication-to-root intervals motivate composing the existing MCS root bookkeeping for the exact queue-only NetData op8. Bound first admission to six existing calls ending at its first notification; separately bound already-stable terminal retirement to four calls. Preserve strict request/fingerprint/generation identity, reservations, all producer/lifetime/recovery guards, the child grant and batch-ACK protocol, operator rotation and the outer 64-turn bound. Source proves the MCS boost/restore steps make no scheduling syscall; eliminating these intervening outer turns is a candidate latency repair, not measured savings. GENET G01 remains 232.580571 requests/s and 7.076542 ms p95: v6 proves 37.931667 ms inside Signal and 0.481481 microseconds in retirement, but does not distinguish kernel execution from descheduling. GENET behavior is unchanged pending that discriminator. Review the complete host suite, Python library, workloads and report consumers in the same change; run focused identity/phase invariants, exact-profile compilation and the narrow QEMU canary. Fresh Pi targets and qualifying reboot proof remain open under this task and `m26e-console-network-service-isolation`. - Pi exact-d7fab continuation and RX-tail discriminator — source `d7fab675f0814e1af11bdd32aff050c06ae00bd0`, image `8e19922926731d86d020a67bd8e68e0b46697dd7ed07e3481d9ca80ad719d3cd` passes WiFi W00/W01 raw TCP and representative scripts, including W01's first TCP without prior nettest; W00 passes medium16/high32 pressure. WiFi remains near 12 requests/s and 83 ms p95, with substantial queue-to-publication delay. Complete the exact op8 frontier relation over observable HAL calls: admit initialization that performs its first operation and coalesced retirement of an already-visible terminal, while rejecting unrelated phase/grant jumps even when a terminal appears. Preserve identities, consumer monotonicity, one-take accounting, operator rotation, the 64-turn cap and physical authority. GENET G00 passes 232.449 requests/s, scripts and pressure but misses p95 at 6.679 ms; an exact prior-response ACK tuple binds 36.453 ms between confirmed RX publication and packet completion. Extend only the separate diagnostic to v6, retaining its 320-byte layout and adding bounded Signal entry/return and RX retirement timestamps within the existing maximum-slice receipt. Preserve Signal placement, DMA/ring ordering, scheduling and IRQ behavior until fresh hardware distinguishes kernel time from retirement. Recurrent GENET response delays are not attributed to the maximum slice or to aggregate SC CPU use. Same-change host-suite and Python/benchmark compatibility review, focused invariants, exact builds and the QEMU root-MCS canary qualify the candidate only; fresh dual-transport physical proof and qualifying reboots remain required. - Pi exact-0feb receive and firmware convergence — source `0feb46e3e556afed1ca6392a23b58dadc1e8f93b`, image `f2725455836f0212e90b8088cc3d1154281ee61b8af5f15bebea4291895c003d`, WiFi W00/W01 and GENET G00 provide the hardware comparator. WiFi W01 resets to ready in 54.210080 seconds, including a 14.469793-second firmware interval; both first cold TCP attempts fail, while delivered W00 packets show substantial runtime queue-to-publication delay. Recognize exact already-queued DATA and retain strictly advancing same-request op8 admission through existing bounded arbitration and owed-signal waits, without reporting unfinished admission as material ingress. Batch firmware transaction borrowing and validated volatile payload stores while preserving every baseline restore, sealed byte, overlay, replay, physical command and recovery boundary. Under this task and `m26e-console-network-service-isolation`, extend only the separately versioned GENET observational diagnostic to v5: retain one bounded maximum-slice receipt with stage timestamps and optional exact TCP header identity, because G00's 193.070 requests/s meets throughput but 7.502 ms p95 includes approximately 39 ms before-ACK stalls whose physical cause is unproven. Preserve MCS reservations, priorities, refills, active SC/Reply ownership, physical ring semantics, QEMU behavior and all host workloads. Focused invariant checks and exact compilation qualify the candidate; fresh dual-transport Pi boot, raw TCP, scripts, pressure, operator and repeatability evidence must establish any improvement. The cold WiFi loss is not claimed repaired by these source changes. - Pi exact-4c retained DPC peer-wait follow-up — both source-Service exits preserve retained intake and CheckGrant while using the existing exact steady-lease peer wait for an outstanding healthy CYW43 DPC child. Require the existing no-Reply/no-in-flight-grant boundary, no foreground transaction or watermark fault, exact current event/child identity and the existing AwaitExactPeer classification/final condition-before-block checks. Childless, RXBOUND, queue-capacity, recovery and ambiguous states retain Yield; cold-successor bounds and all physical authority remain unchanged. The source proves a redundant refill-forfeiting boundary in this exact waiting state; its frequency and contribution to WiFi performance are unproven until a fresh boot passes the separately repaired bootstrap anchor collision. No firmware/SDIO protocol, deadline, ring, owner, MCS numeric or QEMU path changes. - Pi exact-eed4 causal performance correction — baseline image `15695c455ad673c9a0d23ea1d4299d641f7e9a002b037ad21d9ac812132aebe0` measures WiFi 10.888 req/s with 108.686 ms terminal p95 and GENET 90.870 req/s with 10.214 ms p95. The suspended PCIe timer PC resolves to Yield entry, whose selected-kernel minimum-budget check runs before nonfaulting retirement. Keep the existing completed-IRQ blocking receive and sole command Reply; remove only that post-IRQ Yield and declare four PCIe refills for the two 5 ms fragments, active head and enable/call carry-in, preserving the 400/10000 us budget/period, priority and terminal timeout policy. For exact copied CYW43 service, choose already retained egress, admitted output, exact disconnect/publication or passive current-generation copied RX ahead of empty lower probes; retain one separately charged unit, child-signal observation, response bounds, operator rotation and every physical admission/recovery gate. Productive child input/control still executes the retained three-phase service cycle with current hardware time; idle probes retain observation, ingress and ServiceTick. Direct QEMU/GENET paths and physical driver authority remain unchanged. Focused pure invariants, generated profile checks, exact-profile builds and the root-MCS QEMU canary qualify the candidate only; fresh image-bound WiFi/GENET raw TCP, representative scripts, medium/high REST and physical operator stress remain necessary, followed by two qualifying reboots per transport. See DRIVERS and ROLES_AND_SCHEDULING for the current contract and `~/cohesix/26e.md` for exact per-boot evidence and falsified hypotheses. - Pi exact-132a admission follow-up — GENET retains an 8.899 ms mean command-publication gap despite zero timer rejections; a completed response may retire its token and admit one fresh durable-publication recheck through the full ordinary rotor, preserving the clock, causal-wait count, 64-quantum cap, SC and every lane/operator/recovery fence. A failed recheck cannot rearm; an executed empty turn consumes one quantum. CYW43 association admission and its runtime body now use one fresh timer sample, with the prelude included in active Network accounting, so a due retry cannot appear only after the outer lease decision. Keep the typed inactive-outer Join rejection and all physical deadlines, protocols and recovery unchanged. Focused bounds/identity/time-order tests and the QEMU root-MCS canary qualify source; fresh Pi evidence must establish performance and reliability. - Pi exact-132a retained cold-service and receive evidence follow-up — both retained source-Service exits may reach the existing cold command body only after the existing exact terminal helper proves an immutable cold parent with remaining 64-successor allowance, no Reply, no in-flight grant and no watermark fault. Retire the gate without falling through to its inactive Yield; all failed guards retain that boundary. Add only bounded root-dequeue timing from the existing first-DATA timestamp tuple and one slow TCP header tuple, with missing, saturated and invalid samples kept separate. Firmware timing improvement and the WiFi receive bottleneck remain unproven until the next exact Pi image; change no physical protocol, deadline, recovery, ABI, owner or MCS reservation. - crates/pi4-driver-abi/** + tools/coh-rtc/src/** — add/version the scheduler-specific runtime-init fields and generated cap/slot inventory required for active SCs, per-runtime command Reply objects, standard/timeout fault caps sharing root-fault's single receive endpoint and Reply, command endpoints, IRQ/DPC notifications, one-way completion wakes, containment anchors, the generated driver-supervisor-to-root-fault release signal, and at most one in-flight root command per runtime without changing device command/completion ring semantics. Root command caps are `Write + GrantReply` with no `Grant`; driver receive and IRQ-wait caps are Read-only; software signal/completion caps are Write-only; SCs bind only to driver TCBs; and command, IRQ, completion, fault, and release badge domains are disjoint. - apps/root-task/src/hal/driver_task.rs + apps/root-task/src/sel4/** — replace the MCS `wfe`/unsupported trampoline with generated construction and dispatch. Every linked runtime gets one admitted active SC on its generated core; synchronous root commands use the active server's MCS `Recv` with the exact supervisor-owned command Reply object and reply exactly once, while existing one-way bootstrap/background turns remain nonblocking ring/notification operations with no Reply or donated SC. - apps/pi4-driver-runtime/** — implement the MCS receive/Reply loop for serial, USB, HDMI, GENET, CYW43, SDIO, and PCIe images; keep the active SC bound to the TCB rather than a notification, make IRQ/DPC work notification-woken on that same admitted SC, validate runtime-init identity/cap rights, and remove `RuntimeWake::None`/unsupported MCS paths. No runtime receives SchedControl or ticket material. - apps/root-task/src/event/** + apps/root-task/src/local_seat.rs — on the physical Pi profile with required local-seat, finish the retained PCIe-to-USB controller owner-publication chain through ordinary one-operation EventPump turns before the deferred CYW43/SDIO supervisor can take its first driver turn. USB keyboard command admission remains an independent gate rather than a Wi-Fi prerequisite; QEMU VirtIO scheduling is unchanged. - apps/root-task/src/kernel.rs + apps/root-task/src/hal/driver_task.rs — make `root-driver-supervisor` the sole driver-containment and command-Reply recovery owner. It retains least-authority origin/recovery/TCB caps and per-runtime in-flight command state. If a driver faults during `Call`, root-fault only publishes the separate fault record, wakes the driver supervisor, and waits with its sole fault Reply still serialized. The supervisor closes command admission, uses the retained command Reply cap to return exactly one typed failure to the blocked caller, verifies that command association is clear, suspends the driver TCB to clear the independent fault Reply association, verifies both associations are clear, revokes the old runtime generation, signals root-fault's exact generated release badge, and only then permits reconstruction. The normal driver and recovery paths are mutually exclusive, so neither Reply object can be reused or answered twice. - CYW43/SDIO behavioral guard — freeze ownership, register/wire ordering, DPC/foreground fairness, deadlines, virtual-counter timing, retry ceilings, pair-restart cuts, completion-ring layout, IRQ ack/mask rules, and error classification. Compare generated constants and normalized state-machine traces against the accepted classic artifact; any semantic delta is a blocker rather than an MCS adaptation. - scripts/cohesix-build-run.sh + scripts/pi4-image-build.sh + evidence identity — build a new deterministic MCS `cohesix-driver-runtimes.cpio`, record every component hash plus the immutable classic comparator hash, and bind the new archive to exact QEMU/Pi image identity. Do not merge the Worker archive or reclassify historical/current CYW43 evidence. - docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md + docs/audit/M26D_MCS_DECISION.md — document the MCS driver command/Reply ownership, behavior-freeze boundary, new artifact identity, and separate exact-image coexistence gate. - bounded USB/Wi-Fi diagnostic correction — fix the Pi-only USB startup table so `device-addressed` is Gate 6 under a host-tested ordered gate contract; render invalid USB queue companions as `unknown`; keep the 48-byte non-network cadence slot while versioning it to report separate previous-entry `gap` and in-episode `run`; split compact causal `wifi diag` from verbose `wifi dump-state`; preflight the causal batch to eight body lines/2,048 bytes; retain exact CYW43/SDIO episode, child timing, grant, wake, and fault identity without adding device work or scheduling authority; and update normalization plus guarded live command sequencing. This is diagnostic/evidence correctness under the active coexistence task, not a CYW43 transport repair or physical acceptance claim. - Pi retained-runtime refill correction — exact Pi image `4db449bbc605728eef70d4c1671d1a84344921caf30f3042300f10906c76eaab` proves USB request 2 completing individually bounded roughly 100 us DMA slices until the installed terminal timeout endpoint converts current-refill exhaustion into terminal containment at Gate 5; HDMI request 3 and SDIO request 2 retain the corresponding command-entered/no-terminal shape. Select `NaturalPostpone` only for the Pi serial, USB, HDMI, CYW43, and SDIO active runtimes so their bounded resumable physical lifetimes cross ordinary MCS refill boundaries without a false driver fault. Exact follow-up image `136aa611f22832498352332d3ac37efd2354eba87d354cf122d34ea540993fb8` proves that manifest selection alone is insufficient: the driver TCB constructor still installed timeout badge `0x26ee000c` unconditionally and reproduced the same USB containment. Make the constructor consume each generated driver's timeout policy, omit only a `NaturalPostpone` TCB timeout endpoint, and emit the selected policy plus installed/omitted state in the existing bounded MCS construction line. Keep their exact SC budgets, periods, deadlines, refill counts, priorities, cores, standard fault endpoints, generated timeout identities/resources, explicit device deadlines, command/Reply ownership, and protocol state machines unchanged. PCIe and dormant GENET retain their existing terminal timeout policy; QEMU manifests and the validated QEMU behavior remain unchanged. The next exact Pi boot must prove forward progress beyond all three recorded frontiers, absence of unexpected target faults, operator liveness, and bounded cadence before this candidate can be promoted. - Pi local-operator cadence correction — exact image `3a44087b6ad2bfa5acd9bbaa8d95974671150de6d1589ebf70dd6afa572a7f7e` proves the constructor-policy correction: USB reaches Gate 10 with functional HID/parser/HDMI input, HDMI requests complete, no driver fault occurs, and serial/USB/HDMI remain lossless. The same boot also proves a common approximately 80 ms retained-runtime entry gap despite 10 ms generated periods; USB controller/enumeration/command startup takes 30.51 seconds, serial and HDMI feedback are correspondingly slow, and SDIO request 2 reaches `sdio-hw-entry` without first MMIO before the parent deadline. The physical preflight path had serialized Serial, LocalSeat, Dispatch, and Display across four root-control periods; terminal Wi-Fi quarantine additionally retained a hardware-free Network cursor. On the physical Pi path only, compose at most one complete four-phase preflight rotation or one complete post-quarantine local rotation before root-control's explicit cooperative yield, with hard caps of four and five existing one-operation polls respectively. Stop on reboot, containment, or return to the starting phase. The compiler-generated per-driver period gate remains the sole child-wake admission authority, so composition cannot wake one runtime twice inside its period. Keep active Network ownership, QEMU, non-MCS profiles, SC budgets/periods, Reply/fault behavior, device deadlines, USB/HDMI/CYW43/SDIO protocol logic, and generated contracts unchanged. The next exact Pi boot must materially reduce same-driver gaps and USB startup/command latency without drops, faults, or no-reply growth, retain HDMI completion, and determine whether SDIO advances beyond phase 157 before any device-specific repair is authorized. - Pi MCS pair-recovery command-cap identity correction — exact image `1199991dc6bc4da9f2f349251169f6326035b6f709c22ff2bda530a77d055ae6` restores USB Gate 10 and terminal HDMI receipts under conservative retained-wake admission, then isolates SDIO request 2 at phase 157 `sdio-hw-entry`: the sequence-last shared ring admits the first engine slice, but no later power-sequence phase, MMIO, or terminal appears despite repeated root replay turns. Source authority proves the recovery-only root cap was copied unbadged from the endpoint origin, while the MCS runtime accepts each retained endpoint continuation only with `driver_runtime_command_badge(task_key)`. Mint both ordinary and recovery MCS command caps through one helper with identical task-key badge and `Write + GrantReply` rights; retain the classic non-MCS recovery copy. Do not change the endpoint object, Reply cap, recovery ownership, pair ordering, SDIO/CYW43 protocol, MMIO, retries, deadlines, budgets/periods, USB/HDMI, or QEMU behavior. The next exact Pi boot must advance request 2 from phase 157 into the bounded Wi-Fi power sequence and either complete SDIO engine initialization or expose the first later physical terminal; absence of that continuation is a capability-path failure, not evidence for changing SDHCI registers. - Pi 256-Worker pair-restart and operator-throughput correction — exact source `f4fa54161bc959427eaeb805841fc8962c5c186a` and image `2e74eff228fea5fb2125856774d8e9d922ac81070d44221dc398526fe959bdb9` prove the 16-bit-CNode, 256-executable-Worker Pi profile sealing its exact 272/272 fault registry, USB reaching all ten gates with a valid linked-runtime queue and no drop/no-reply/recovery growth, and HDMI requests completing without a driver fault. That same Wi-Fi boot terminates at supervisor turn 103 in `replay-sdio-engine` with `aggregate-deadline-expired`: one Operator turn for every Driver turn spends the unchanged 3,000,000 us whole-attempt deadline before the finite physical pair-restart cursor can retire, while the earlier four-Driver-turn diagnostic cadence crossed this exact edge. Grant up to four consecutive Driver turns only while the exact `cyw43-cold-physical-lifetime` or `cyw43-pair-restart` cursor is active; retain an Operator reconciliation before every bounded burst and immediately discard any unused burst tail on complete or superseded state. Descriptor publication, firmware/control, association, EAPOL, DHCP, attached recovery, and steady service remain one Operator turn per Driver turn. Suppress only routine per-Worker successful fault-registration UART rows after each registration succeeds; the exact expected/registered seal, every service/driver/critical-root registration, and every missing/failed record remain mandatory, removing 36,180 bytes of redundant boot UART output in the observed 256-Worker boot without changing construction. Synchronize the authenticated serial root prompt after Queen attachment before issuing `reboot`, preventing a retained attach prompt from consuming the reboot command. Do not change the manifest, executable population, CNode size, capability authority, generated profile, MCS budget/period/deadline/refill/priority/core, device deadline, command/Reply/fault semantics, driver ownership, or QEMU scheduler behavior. Deterministic Pi- and QEMU-feature tests prove burst scoping, successor non-leakage, exact seal policy, and the serial command barrier; fresh exact-image Pi Wi-Fi, GENET, USB, HDMI, serial, and TCP evidence remains required before promotion. - Pi post-handoff network and display convergence correction — exact source `8492c379f7c8f8b9f8de27613c9879a3da554551` physically proves Wi-Fi failing before radio emission after CYW43 publishes high-bit child identity `0xeff090d9`, while the recovery fence scrubs the delegated SDIO ring before later diagnostics can distinguish coherent publication from a missed wake/final-prewait observation. Capture one immutable, passive stable-double-read of the delegated SDIO command/completion records inside the existing first-recovery cut before scrub; perform no wake, retry, consume, owner transition, or protocol action. The same exact source proves GENET receiving two DHCP frames and then freezing all hardware RX after `NetStack` hands its copied queue to the isolated console adapter. Preserve the existing sole GENET physical pre-poll lane at the wrapper after handoff in ordinary poll, budgeted poll, TCP flush, and console-response poll, charging the existing operation/frame/byte bounds. HDMI is functionally correct but cadence-bound: for aligned XRGB8888 only, pair two pixels through the existing 64-bit framebuffer writer so 16 clear rows preserve the prior eight-row worst-case store count, and unroll bounded forward/backward scroll copies without changing memmove semantics; RGB888, unaligned, and unknown formats retain the conservative path. Do not change any manifest, CNode, executable population, capability, driver owner, MCS timing/refill/priority/core, device deadline, IRQ/DPC rule, Reply/fault semantics, USB protocol, serial transport, CYW43 retry, or QEMU scheduler. A fresh exact Pi boot must classify the SDIO ring boundary, prove GENET ARP/ICMP/TCP/cohsh and scripts, materially improve HDMI first draw/scroll, and remeasure USB/serial without loss before any physical fix claim. - Pi MCS command-receive and active physical-rotation correction — selected seL4 MCS maps `seL4_Poll` to nonblocking Wait, which supplies no Reply object. A queued root `Call` consumed through that spelling can therefore leave the caller inactive without the compiler-declared reply association. Centralize the runtime nonblocking command receive: classic seL4 retains `seL4_Poll`, while MCS uses `seL4_NBRecv` with the runtime's sole generated Reply slot 6. Once either kernel has a retained Call, do not receive from the endpoint again: selected MCS would cancel the blocked caller when the associated Reply object is reused, while classic receive would replace its implicit reply state. Retained arbitration samples only the generated bound local notification in slot 3; a defensive blocking retained state waits only there. An ordinary synchronous multi-turn command instead preserves the Reply association and yields between its existing bounded service phases because its blocked caller cannot publish an endpoint continuation. Generation-bound continuation lanes remain one-way and reject a Reply-bearing form. This corrects the synchronous command path only; sequence-last one-way ring admission remains prior to the endpoint receive and the exact `80aab1322` passive CYW43 ring discriminator must still run before a causal Wi-Fi transport edit. Extend the existing physical-owner plus linked-serial local quantum to active GENET without changing its five-poll hard cap: stop on reboot, containment, any self-retained phase, or return to the starting phase, so one useful rotation may compose Network, bounded HDMI, serial, USB/local-seat, and Dispatch but can never repeat the NIC or a retained display/command action before Yield. On the physical Pi only, collapse exact duplicate bootstrap rows to the ownership-aware forced-log sink; non-Pi debug-console behavior is retained. Do not change baud, queues, MCS timing/resources, driver periods, manifest, protocol, retry, device deadline, capability, ownership, QEMU scheduling, or generated contracts. Host and target tests prove the Reply selection and retained-association preservation, five-turn bound, active-GENET single-NIC rule, quarantine/display-debt rule, and Pi single-sink selector; fresh exact-image Pi evidence must still prove GENET/USB/serial/HDMI cadence and no loss. - Pi retained-recovery, console-network parity, and contention correction — exact source `c4c784bae3e777ff6a3eac9c2a3e6c41ecd62564` and its bound WiFi/GENET boots prove three independent frontiers. First, a linked serial RX completion with activity can consume its grant before rearming the combined mini-UART IRQ; admitting TX immediately then emits exactly one eight-byte FIFO prefix and strands both directions. Retain one subsequent empty RX owner turn before the next TX chunk without changing baud, FIFO width, queues, budget, timeout, or owner. Second, a linked CYW43 turn can discover `cyw43-canonical-parent-retirement-fenced` after its exact parent is issued; classify that as `cyw43-pair-recovery-signalled`, retain the immutable request, and enter the existing terminal-drain/pair-restart path without replay. Before the existing first-recovery scrub, passively stable-double-read the exact shared SDIO completion and its version-3 116-byte fault frame; accept only an aligned in-ring cursor, Fault completion, exact length and containment disposition, matching magic/version/result, then retain all 29 words for bounded SDHCI/DMA4 diagnostic rows. This observation performs no wake, consume, retry, reset, or owner transition. Third, post-DHCP 26e gives the isolated console child sole TCP/IP ownership, so the old root self-test is inactive: implement a bounded generation-tagged peer-assisted test at the adapter, require an exact child response drain plus physical-NIC TX completion (or direct-VirtIO drain), RX/TCP progress, authenticated identity, and listener readiness, and enable the child's native ICMPv4 echo response without adding a second socket or root TCP/IP path. Emit bounded isolated turn/queue/drain/backpressure counters through `netstats`. Suppress only routine WiFi, GENET, and HDMI call tracing in steady/nonblocking/prompt-slice/retained modes; retain init, non-acceptance, fault, budget-exhaustion, and non-quiet timeout evidence. The bound USB boot is already Gate 10 clean, and HDMI remains functionally correct but cadence-bound, so do not change XHCI/HID/display protocol, framebuffer batch size, MCS budget, or allocation without a fresh physical discriminator. Fresh exact-image WiFi and GENET boots must prove complete serial responses, pair recovery or expose exact pre-scrub DMA4 cause, ICMP/nettest/TCP/cohsh, sustained oversized-input recovery, and HDMI/USB responsiveness before any target-fix or acceptance claim. - Pi HDMI damage-compositor and admitted burst correction — the operator-authorized follow-up to the preceding physical discriminator addresses the proven 1920x1080 XRGB8888 display cost rather than treating completion as performance closure. Replace physical-framebuffer-as-terminal-state with a compact child-private cell plane, logical row ring, dirty-cell/row tracking, and write-only glyph-band rasterization inside the existing isolated HDMI runtime. Retain a parser cursor across turns so each immutable input byte is consumed at most once and no later byte is admitted until the current byte's bounded clear, scroll, tab, or other multi-cell effect is completely staged; a tab advances to the next eight-column stop by exactly 1 through 8 cells, including 8 when already aligned. Coalesce final visible state, never read live scanout during scroll, and preserve exact terminal cursor/CSI behavior plus the existing RGB888, alignment, geometry, bounds, and first-takeover behavior. Retain one physical framebuffer owner and the existing pointer-free command/Reply generation; a command completes only after every parser/plane cursor is retired and every dirty band for its exact generation is visible. Bind every parser, wide-plane, clear, and raster turn to the shared exact 1,280-operation, 4,096-byte-envelope, 80-display-row HAL grant, reject any narrower or broader grant before state or scanout mutation, and retain the same cursor rather than replaying a prefix when a turn reaches its bound. The existing pointer-free frame transport still admits at most 1,536 payload bytes, so 4,096 is a parser/grant ceiling for pure bound proof, not a newly accepted single command or widened ABI. Raise only the generated Pi HDMI reservation from 400 us to a statically admitted 2,000 us per unchanged 10,000 us period, using 1,800 us only as the candidate WCET input to static response analysis; neither value is hardware timing evidence. Keep core 2, priority, refill, deadline, timeout policy, PCIe allocation, and the passive GPU executor unchanged. Core-2 admitted demand must remain at or below the generated 9,000 us usable bound with at least the mandatory 1,000 us reserve. Do not add BCM DMA, mailbox/HVS authority, a framebuffer alias, cacheable live-scanout mapping, fallback owner, unbounded clear, or QEMU scheduling change in this correction. Focused host tests must prove resumable row-ring/parser semantics, exact 1-through-8 tab expansion, no scanout reads, no duplicated prefix or scroll effect, bounded wide clear and raster progress, exact final raster state, invalid geometry failure, exact grant enforcement, and unchanged terminal grammar. Fresh exact-image Pi evidence must time first takeover, printable text, one-row and ten-row scroll, prove bounded serial/USB liveness under display pressure, and is required before any polished-performance or 60 Hz claim; cache-cleaned double buffering and vblank page flipping remain a separately governed follow-up after explicit alias/coherency and display-authority proof. - Pi bounded serial, SDIO/CYW43, and GENET transport correction — reuse the serial runtime's existing four shared pages as two exact two-page, 8,128-byte, generation-bound SPSC rings, one root-to-runtime and one runtime-to-root. Map only those CPU-to-CPU ring pages as identically cacheable, execute-never, coherent Normal memory in root and child so AArch64 atomic acquire/release cursors never operate on seL4's Device-nGnRnE `Page_Uncached` mapping; physical DMA, MMIO, and every other driver payload keep their existing uncached attributes. Publish and consume commit-paired cursors with final post-commit state/epoch rechecks so empty/full boundary races cannot lose a wake; poison invalid or discontinuous cursors; and retain a pending combined mini-UART handler acknowledgement across software continuations after root drains a full RX ring. Root observes the rings through existing cooperative EventPump polling, so this change makes no unsupported direct interrupt-wake claim and changes no baud, UART owner, FIFO, IRQ, budget, period, or timeout policy. At the SDIO/CYW43 shared/private boundary, replace byte-at-a-time movement only with an alignment-safe bounded prefix/`u64`-body/tail copy between the existing shared payload and the existing private uncached DMA4 bounce region. Validate both complete ranges before copying and retain the exact pre-scrub DMA4 discriminator, sole owners, register ordering, retries, pair-restart cuts, and device/aggregate deadlines. For Pi GENET only, admit the exact first-line DTS interrupt as seL4 IRQ 189 with badge 1024 for default queue 16. The child masks and services that owned source through a bounded DPC, drains at most 16 frames and 24,576 bytes per quantum into a fixed 16-frame private queue, preserves bounded control/data fairness, and performs device-store/unmask readback plus a final source/ring recheck before handler acknowledgement; remaining work retains one durable continuation. QEMU keeps its exact three-entry driver-runtime IRQ topology with no GENET IRQ, and GENET keeps `1000 us / 10000 us`, core 3, owner, descriptor DMA, deadline, and terminal timeout policy. Do not generate direct GENET-to-console rings in this correction: no reciprocal link authority/cacheable shared-frame topology safely bridges the pre-DHCP GENET and post-DHCP console lifetimes, their revoke generations are independent, and a nine-page proposal exceeds the current eight-page generated export helper. That redesign requires one atomic authority, cacheability, bootstrap, and containment contract rather than a shortcut around root mediation. - Pi early HDMI pre-cutover progress restoration — exact a1766887f/image1518e7bb completes two WiFi and two GENET evidence boots before source changes; the operator confirms the two-line startup tile but requires a status update every five seconds before serial cutover. Preserve child-exclusive framebuffer authority and the existing static admission tile. At quiescent bootstrap page/driver boundaries, then separate pre-release serial-cutover turns with physical input/response priority, root may submit one canonical empty HDMI frame every five elapsed seconds through the existing command/Reply transport. The display child independently checks exported CNTVCT elapsed time and rewrites only the fixed second-row span as bounded elapsed startup status, coalescing missed periods. Invalid geometry stores nothing, failure disables optional root polls, and first ordinary-frame admission permanently stops the tile refresh before retained clear/terminal takeover. Do not add a timer owner, framebuffer alias, opcode, payload, scheduling change, prompt or ready claim. Review all host/Python/benchmark consumers, test clock arithmetic, exact raster bounds and takeover, compile exact profiles, and require fresh visible hardware cadence plus preserved input and network evidence. This supersedes the preceding static-only restriction within this active restoration task; network performance and qualifying repeatability remain open. - Pi 55fc diagnostic delivery and two-second progress follow-up — unchanged source `55fc7125eb82cea3b0c43efdaef8fe565c7eb8fe` completes two WiFi and two GENET evidence boots before edits. GENET raw throughput 502.169/508.023 requests/s exceeds target, but p95 6.589/7.731 ms fails; WiFi raw 3.066/10.849 requests/s and p95 1067.466/89.212 ms fail, with repeated missing response terminals. W01 functional failure withholds dependent pressure. Physical `smp mcs` loses six session rows and its end marker because its synchronous body exceeds the 69-line ordinary backlog. Move all seven existing session rows to Pi `netstats`, preserving the complete 27-row detailed MCS batch in `smp mcs`, every existing queue bound and QEMU output. Reuse the bounded WiFi RX recorder for one exact latest ACK-only header and root-dequeue/copied-page/child-ingress receipts independent of missing DPC timing; do not label ingress acceptance TCP retirement. The operator confirms working keyboard/arrows and one initial counter update, then requests two-second updates: use that cadence at both existing safe root and child clock guards, preserving raster and takeover contracts. This supersedes only the preceding five-second display cadence. No MCS numerical, physical-driver, ABI, protocol, recovery or QEMU scheduling change is authorized by these receipts; fresh exact Pi evidence is required for definitive network fixes and performance acceptance. - Pi ec3b display-stall causal restoration — unchanged `ec3b81e669df6a540f6f24cc4ecc8998ca1766e7` completes the requested two WiFi and two GENET evidence boots before edits. G01 retains HDMI request58/completion57 for minutes and pending display work fences every later raw-session idle check; the missing consumer boundary remains unproven. Preserve initial endpoint/notification selection and the early-binding guard. For a generic one-way runtime with no physical notification source, consume only an already durable exact DROW-to-DROA acknowledgement before blocking, retaining the existing one-action-per-slice identity and all physical-source arbitration. Explicit USB diagnostics stable-read fresh child progress and pending DROW/DROA state alongside root command, completion, issued edge and notification binding; absent records are unknown, never recovery authority. The repeated3.7second early PCIe preparation gap also requires bounded display checkpoints within existing flushed HAL waits: preserve every settle iteration, use the existing two-second CNTVCT guard and child-only tile, and stop at serial cutover. Test exact ACK identity/retirement and physical-source exclusions, preserved waits and maximum-width diagnostic lines; compile exact Pi and protect QEMU with the narrow root-MCS canary. WiFi W01 failed TAIL and99.622second readiness remain open, as do both transports' performance targets. This task and discovery task `m26e-console-network-service-isolation` authorize only this bounded causal restoration, not changed MCS numerics or driver protocols. - Pi MCS notification-intake and mini-UART contract correction — exact source `092d192053818b649e511422998b201e700f121e`, image SHA-256 `69a7892e2d05af7332a5572661bf45ec6968a0bcc77f61726d174f7b64bf0828`, and its boot-paired WiFi/GENET evidence expose one shared runtime seam plus one serial-specific register defect. The WiFi boot reaches linked-serial cutover and emits only 16 bytes before losing console liveness; the GENET boot transmits DHCP Discovers while hundreds of checksum-valid, matching Offers reach the host-facing Pi link, but the child reports no hardware RX progress and never advances to Request. A TCB-bound notification may win the initial Reply-bearing MCS `seL4_NBRecv` as a zero-length, nonzero-badge result; discarding that badge leaves the physical handler unacknowledged across serial, GENET, SDIO, and CYW43. Preserve and validate the exact generated badge, service one bounded persistent owner quantum, then re-read the durable command on a later turn without consuming, replacing, or replaying its Reply association. For serial, retain the hardware-validated BCM2711 mini-UART IER assignment of RX bit 0 and TX-empty bit 1, and derive the exact zero-through-eight-byte write capacity from `MU_STAT[27:24]`; `MU_LSR` bit 5 proves only one admissible byte and cannot authorize an eight-byte cursor advance. An impossible status level consumes and writes zero, retains the pending handler, and fails closed. Keep the existing baud, rings, FIFO width, owner, caps, Reply/fault semantics, IRQ identity, MCS resources, device deadlines, USB/XHCI logic, HDMI compositor, SDIO/CYW43 protocol, GENET descriptors/registers, QEMU scheduling, manifest, and generated contracts unchanged. The matching host regressions prove badge preservation/routing, exact Reply-slot selection, IER numerics, capacity bounds, invalid-level cursor retention, and byte order across later wakes; fresh exact-image WiFi and GENET boots remain required to prove serial/USB cadence, GENET ingress/DHCP/TCP, and SDIO/CYW43 association rather than converting the source repair into hardware acceptance. - Pi serial durable-TX notification-lifetime correction — exact source `5d8d4ffa7b5bce4e922eb7e188cc101909199d10`, image SHA-256 `79f367bb390b0dd7b49816ff785a29a1f8be2fb6bf9cf8a4d9559f56d33ed049`, image ID `7d6ad6e42c910dd47bd196a4898bf769c27df7c28366a9c8d2f4a609019e4d16`, and its boot-paired WiFi evidence reach a complete four-core, 16-bit-CNode, 272-task MCS construction and linked serial takeover, then emit exactly 16 bytes—one root-doorbell FIFO fill plus one zero-badge prewait fill—before TX and RX stop. The SPSC transition had rejected the former retained-command direct-wait lifetime but still sent later TX-empty work through the combined endpoint receive. While the exact live TX ring has committed nonzero occupancy, block on generated local-notification slot 3, admit only the exact root, serial-IRQ, or coalesced badge, service one bounded FIFO quantum, and return to the outer `seL4_NBRecv` opportunity before re-reading durable occupancy; at zero, resume the ordinary combined blocking receive. A missing, poisoned, discontinuous, or over-capacity cursor poisons TX and disables TX-empty rather than polling, replaying, or selecting a fallback. Order takeover and steady IRQ completion as device writes, DSB, same-aperture IER/`MU_STAT` readback, DSB, then handler ACK; a readback or ACK failure retains evidence, fences TX, and becomes an exact TX-idle `FAULT_DEVICE_UNAVAILABLE`. Keep baud, FIFO, rings, sole UART owner, IRQ identity, Reply/fault objects, MCS numerics, USB/XHCI, HDMI, SDIO/CYW43, GENET, manifest/schema, generated contracts, QEMU scheduling, and benchmark interfaces unchanged. Host and target compile regressions prove only route, badge, cursor, readback, ordering, and containment contracts; fresh exact-image WiFi and GENET boots remain required to prove serial and USB operator liveness, CYW43 association, GENET DHCP/TCP/cohsh, HDMI cadence, and benchmark performance. - Pi source-polled serial rearm, SDIO host-config cadence, and GENET durable-RX correction — exact source `ed06c28e5970b7c511fc0d44a1915ac4e4e0f6ff`, image ID `83e880be9a387e17476d28be2b9e3e12c258cad33b9fe1a57ebf4a7affad7fb4`, image SHA-256 `6366924ffe02b6b2c2462773895c254c1b211370be30c7e14230d9f58e66ead0`, and its boot-paired WiFi/GENET evidence isolate three independent regressions. Both boots end after serial parses `help` and transmits exactly the first eight response bytes `Commands`; the USB keyboard remains clean and its later input is blocked only by the shared physical-response barrier. Make every source-polled/root-doorbell RX or TX turn establish and retire the combined IRQ handler-rearm obligation before waiting, re-enter one bounded owner turn when durable TX plus current `MU_STAT` capacity exists, and retain slot-3 blocking only while the FIFO is full. WiFi reaches the initial SDIO `HOST_CONFIG` child terminal `0x5104` under CYW43 parent `0x5310` before CMD0, firmware, radio, association, or DHCP; batch only deterministic containment and host-config transitions under exact 24/18-step bounds, stop at real DMA/reset/clock/time waits, preserve condition-before-deadline ordering and no replay, and retain the immutable first stage-9 subphase plus a controller/DMA snapshot captured before abort, W1C, reset, or clock mutation. A successful speculative host-config snapshot is discarded so only an actual first terminal can publish it. The GENET capture contains 96 Pi DHCP Discovers and 96 matching checksum-valid Offers, but zero Pi Requests and `genet_rx_hw=0`: the MCS IRQ/DPC port had removed the August 10 same-owner command check of the durable RDMA producer. Restore that check inside the existing RX command operation/frame/byte grant without creating an IRQ lifetime, poller, retry, second consumer, or shared DMA alias. Refine compact WiFi diagnosis only from a current result-bearing ring transaction correlated to the immutable nonzero parent sequence, matching nonzero physical epoch and child sequence, exact child completion/result, matching episode exit/result, and concrete causal fault. Early schema-v2 rows without a ring, unknown rings, and exact historical seven-field rings remain parseable evidence but cannot refine the blocker. Current USB queue/HID counters and HDMI completion/redraw health expose no independent protocol fault, so keep XHCI/HID and display mechanics unchanged. Do not change the manifest, 16-bit CNode, 256-Worker population, caps, Reply/fault semantics, MCS budgets/periods/deadlines/refills/priorities/cores, device timeouts, firmware, association, retry ceilings, network grammar, or QEMU scheduling. Host regressions and target compilation can reject this candidate but cannot establish physical recovery; fresh exact-image WiFi and GENET boots must prove complete serial/USB commands, SDIO host-config through firmware/Gate 8, DHCP, ARP/ICMP, authenticated `cohsh`, focused `.coh` scripts, HDMI polish, and benchmark cadence before any Pi or performance claim. - compatibility review — `apps/cohsh/**`, `apps/coh/**`, all `.coh` scripts, `apps/hive-gateway/**` and its REST surface, `tools/cohesix-py/**`, generated-profile consumers, and benchmark scripts were reviewed for the HDMI, serial, SDIO/CYW43, and GENET corrections. No console verb, command-line grammar, namespace, authentication/authority rule, REST request or response, `.coh` operation, benchmark workload, or report schema changes. `cohsh`, `coh`, scripts, Hive Gateway/REST, `tools/cohesix-py`, generated-profile consumers, and benchmark implementations therefore need no hand-authored change except the additive GENET `netstats` capture fixture recorded immediately below. The compact diagnostic's private schema-v2 `causal_progress ring` field now emits the completion result. Its normalizer keeps early schema-v2 rows without a ring, `ring=u`, the exact historical seven-field tuple, and the exact current eight-field tuple parseable without reinterpreting any form. Only a current eight-field result correlated with the immutable nonzero parent sequence, matching nonzero physical epoch and child sequence, exact Fault completion/result, matching bus-episode exit/result, and concrete causal fault can refine the containment blocker. `scripts/pi4_trace_normalize.py`, its fixtures/tests, and the owning driver/test documentation change atomically; this backward-compatible additive field does not require a schema bump. The earlier schema-v2 command split changed `scripts/pi4_serial_reboot.py`, `scripts/pi4_gate_proof.sh`, their tests, and console/docs fixtures atomically. Additive `scheduler_sdio` and exact pre-scrub SDIO rows remain bounded passive triage: wrappers retain them as ordinary payload and the normalizer grants them no Gate 7/8/DPC/network authority. Isolated `nettest` retains the existing command, admission ACK, canonical asynchronous result grammar, terminal status schema, 15-second bound, and already-supported `peer-assisted-pass`; native ICMP echo and additive `netstats: isolated_*` rows add no host API or workload field. The canonical serial helper remains peer-neutral. The SPSC and DMA copy contracts are private driver/HAL mechanics using already-declared Pi page inventories; the HDMI compositor changes selected Pi temporal values and private renderer mechanics; and the added GENET IRQ uses the existing generic IRQ array. `coh-rtc` validation/profile oracles and regenerated Pi projections must reflect those exact selected values, while downstream generated-profile consumers already iterate generic temporal/resource fields and need no parser or schema change. Canonical QEMU outputs must retain their three-entry driver-runtime IRQ topology with no GENET IRQ and unchanged scheduling. Historical verbose Wi-Fi logs remain parseable; no new host, QEMU, construction, or static-admission result can satisfy Pi acceptance. - GENET route-discriminator compatibility clarification — use previously unallocated packed-completion bit 30 as the cumulative passive `command_rx_drain_seen` proof, set only after the admitted same-owner command lane successfully queues at least one durable frame and projected as `runtime_cmd_drain_seen=0|1` on the existing bounded `netstats: genet_rxq` row. Legacy packed results decode zero; the packed marker, ABI version, existing field layout, all work bounds, and IRQ/DPC/ACK/DMA authority remain unchanged. The captured `apps/cohsh/tests/tcp_cli_script.rs` netstats row is the sole hand-authored host fixture updated for this additive field. `coh`, `cohsh` implementation, Hive Gateway/REST, `.coh` scripts, `tools/cohesix-py`, generated-profile consumers, trace normalization, benchmark implementations/workloads, and report schemas require no change and derive no authority or acceptance from this field. - fail-closed evidence and operator-liveness clarification — a terminal linked-serial generation poison records one bounded Queen-log `SERIAL_TRANSPORT status=failed` row, retires only output targeting the failed owner and its physical-response barrier, preserves later serial RX and USB/local-seat parsing plus HDMI mirroring, and never restores root UART MMIO ownership. The current Wi-Fi normalizer additionally requires nonzero unsigned-32-bit publication, episode, physical, parent, child, command, completion, and ring-epoch identities; logical generation alone may be zero but must remain unsigned-32-bit. Every stage-9 containment subphase 1 through 12 and the unknown case has an independent literal blocker regression. These are additive private diagnostic and failure-containment contracts, not console response grammar, host API, network acceptance, or physical recovery evidence. - exact `2c64fe73ad54794f46249df72c731dcf25aa1cf7` and `786e52b3636667804a004e35e0abb37e55ace864` physical follow-up plus bounded convergence correction — both guarded-readback images boot both selected network lanes. A separately paced pyserial transaction proves the isolated UART command path; the boots retain clean ten-gate USB with no HID drop and bounded HDMI raster work, so no new serial, USB, or HDMI protocol change is authorized. WiFi fails before CMD0, firmware, radio, association, DHCP, or packet work: the first `HOST_CONFIG` terminal is `0x5104/0x09000005`, stage 9 subphase 5. The later exact image proves the immutable parent/child episode ages 362,893,456 counter ticks, or 6.720249 seconds at 54 MHz, after `HostConfigStart` arms the unchanged 220-millisecond deadline but before deterministic containment begins. Enter the existing bounded containment helper directly from `HostConfigStart` inside the already-admitted 1,500-microsecond SDIO owner SC, consume at most the two exact timer-only settles using exported `CNTVCT_EL0`, and prohibit the pre-containment outer-owner boundary. For the observed initial differing-clock, quiescent request, the first post-containment boundary is `HostConfigClock1Disable`; an equal-clock request resumes at `HostConfigControl`, and genuine DMA/reset/inhibit waits remain legal internal persistence boundaries. Preserve condition-before-outer-deadline ordering, with no SDHCI condition poll, card-command or DMA-transfer/descriptor issue, retry, timeout/budget extension, or new owner; an unarmed or invalid retained cursor fails through the existing typed path. GENET proves DHCP, bidirectional ICMP, raw TCP, authenticated `cohsh`, and three focused `.coh` scripts, but a strict five-unit isolated rotor revisits one class only about every 50 milliseconds. An exact retained authenticated response flush may select one useful response unit under the same one-op/two-frame/fixed-byte charge; ordinary service retains its rotor and no multi-unit burst is permitted because prior target evidence falsified composed lower work under the root MCS budget. Correct GENET reclaim telemetry by accumulating IRQ/DPC deltas until one eligible command completion consumes them, preserving them across a zero-reclaim poll or budget-exhausted completion without a reclaim field, and never reporting one twice. This changes values only, not the existing completion ABI or `netstats` grammar. The complete `coh`/`cohsh` host suite, Hive Gateway/REST, all `.coh` scripts, `tools/cohesix-py`, generated profile consumers, `scripts/m26e_qemu_pressure.sh`, `scripts/rest_perf_harness.py`, benchmark workloads, and report schemas were reviewed and require no change. No manifest, 16-bit CNode, 256-Worker population, capability, Reply/fault rule, MCS timing/refill/priority/core, physical-input priority, device deadline, retry ceiling, driver placement, network grammar, or QEMU scheduling value changes. Host tests and rebuilt Pi/QEMU artifacts can reject the candidate but cannot prove WiFi recovery or Pi performance; fresh exact-image WiFi and GENET boots remain mandatory. - Pi GENET direct-data-plane performance restoration — cite the same exact physical follow-up under this reopened driver/coexistence task and `m26e-console-network-service-isolation`. The roughly 200-millisecond SYN response and 50-millisecond service-class staircase are structural root packet-mediation costs, not a GENET line-rate limit. After the root stack has obtained the production DHCP lease and every root GENET command/RX/TX cursor is quiescent, perform one generation-bound, zero-payload `DGHO` transfer with an exact typed terminal and no fallback. Reuse the existing 32 GENET shared pages only after that cut: page 0 is an aligned sequence-last control page, pages 1 through 15 are GENET-to-console RX slots, and pages 16 through 31 are console-to-GENET TX slots. Map those pages cacheable Normal/XN into only the GENET and console children; classify the range CPU-only with no device-visible, DMA, or physical-address authority. Give each peer one send-only, fixed-slot, fixed-badge notification hint. Durable monotonic cursors, not notifications, carry work; both consumers perform a final recheck before sleeping, validate generation/sequence/length, and poison discontinuity or corruption. GENET remains the sole MMIO/DMA/IRQ owner and copies between its private DMA rings and the CPU link; console-network remains the sole smoltcp/TCP/auth owner. Root retains lifecycle, fault, and control-event supervision but performs no steady packet copy, poll, or GENET packet command after handoff. A failed handoff, peer fault, invalid cursor, stale generation, containment error, or descriptor drift fails closed and never revives root packet mediation. Version the private driver-init and console-network ABIs, consume representation padding as explicit zero-validated fields, and contain every external console frame mapping before its revoke anchor. Retain the Pi console-network child's bounded `3000 us / 10000 us` SC and priority/MCP 180/200 below priority-200 root-control so unauthenticated serial and local-seat input remain first; the direct data plane and bounded authenticated-response selection, not an unsafe static priority inversion, remove steady root packet mediation. Retain the existing budget, period, core, refill count, fault/Reply semantics, emergency/fault priorities, and every QEMU value. The compiler must re-prove the unchanged priority ordering, resulting response bounds, and exact 32-slot external-page CSpace increase. The current linked direct-GENET child footprint is 66 image pages rather than the common 60-page child; admit its six additional immutable executable frame caps only on the derived Pi GENET profile, producing service totals of 104 frames and 161 retained root slots without changing the one-MiB child untyped, data-plane or scheduling budgets, or any QEMU inventory. This is an architecture intended to remove the measured root staircase; neither host checks nor the rebuilt image may claim a 100-times improvement, line rate, QEMU parity, or Pi acceptance before a fresh exact-image GENET benchmark. `coh`, `cohsh`, Hive Gateway/REST, `.coh` scripts, `tools/cohesix-py`, generated-profile consumers, benchmark workloads, and report schemas retain their external contracts; build/package selection, generated temporal/resource projections, private ABIs, tests, and driver/performance documentation change atomically. - Pi exact-e046 post-boot convergence correction — exact source `e046a7eb470ae0dee9601749508e4248cce51c80`, image ID `33cc8a0e21de62a7738587b83b695daea41884b169f16c12dad8f23f39b82fcc`, and image SHA-256 `d650bbc29ff6bf28bea468d788c5a2cfcd3be8242173a91ac07f1f94c9ff5e4c` bind the WiFi boot beginning at line 23805 and GENET boot beginning at line 24816 of `/Users/lukasbower/pi4-serial-20260822-134045-cont.log`, plus `/Users/lukasbower/pi4-serial-20260828-e046-genet-G02-pyserial.log` and the boot-paired `/Users/lukasbower/tcpdump-wifi-20260828-072409.pcap`/`/Users/lukasbower/tcpdump-usb-eth-20260828-072409.pcap` captures. WiFi completes cold SDIO/CYW43, firmware, control, association, EAPOL, all eight Gate 8 subgates, and a captured DHCP DORA plus following Pi ARP, but misses `CONSOLE_NETWORK_HANDOFF phase=dhcp-bound` and reaches `service-readiness-deadline` quarantine before the child listener can become ready. Make exact DHCP/address truth expose a side-effect-free pending predicate, then select one exclusive `ConsoleHandoff` root-control turn before readiness evaluation: it alone borrows HAL, finalizes and resumes the already registered child, yields, and leaves child Ready consumption to a later Network turn. Recovery/canonical-owner work still preempts handoff, an error retains the existing failed state, and no root-owned TCP fallback, deadline renewal, new retry, or mixed CYW43/HAL turn is admitted. The same boots show roughly 8,565 retained WiFi turns and approximately 171 seconds of bootstrap latency. For only the retained CYW43/SDIO exact-grant lanes, fuse at most three pure `CheckWake`/`CheckGrant`/condition-before-sleep bookkeeping states inside one admission turn: `Service` is a hard stop before any grant read, `Empty` permits exactly one recheck, `Inactive` fails closed without a recheck, and `Ready` must revalidate and ACK the exact immutable grant before returning authority for exactly one existing bounded physical quantum. ACK failure restores the complete pre-grant gate and performs zero device I/O. This removes scheduler edges between pure local states only; it changes no physical-operation/postphysical boundary, owner, grant cardinality, device deadline, retry, fault/Reply rule, MCS budget/period/refill/priority/core, manifest, CNode, Worker population, 54 MHz timer truth, or QEMU behavior. - Pi direct-GENET causal-observation correction — the same exact wired boots prove DHCP and direct cutover but then freeze at two RX/two TX packets with zero direct ingress, ICMP reply, or port-31337 reachability. Extend only the formerly reserved portion of direct-link control page 0 with an optional aligned 192-byte diagnostic-v2 record at bytes `[320,512)`, committing its publication sequence last at record offset 184. Version 2 assigns record offset 108 to cumulative `dpc_level_adoptions`, the number of badge-zero or peer-turn joins of durable physical work to the same sole-owner direct IRQ episode; all other reserved fields retain zero validation. GENET is the sole writer; root accepts only a stable exact-generation record. One operator `netstats` may issue one exact idempotent generation-bound DGHO replay and reports the pre-replay plus pre-idle-service snapshots as ten ordered `genet_direct*` rows. This is a causal probe: waking the owner may let its normal post-command idle path drain durable RX, so it is neither passive telemetry nor performance/acceptance evidence and cannot form a recurring poll, fallback, retry, IRQ-ack, packet-service, or recovery path. Bytes `[512,4096)` remain reserved. ABI/layout, stable/torn/stale/wrong-generation, maximum-width rendering, host fixture, and trace-normalizer regressions change atomically. The complete `coh`/`cohsh` implementations, `coh-status`, Hive Gateway/REST, SwarmUI, GPU bridge, host-ticket agent, sidecar and sidecar bus, CAS tool, every `.coh` script, `tools/cohesix-py`, generated-profile consumers, build/manifest contracts, benchmark workloads, and report schemas were reviewed and require no hand-authored change beyond the focused `cohsh` capture fixture and Pi trace normalizer/tests. Source tests, QEMU packaging, Pi staging, or a rebuilt image may reject this candidate but cannot establish WiFi recovery, GENET packet correctness or performance, QEMU parity, or Pi acceptance; a fresh exact-image Pi boot and benchmark remain mandatory. - Pi exact-5a post-handoff convergence correction — exact source `5a8917b09d7f2bda2c5fbe18a08340e0fbae5d58`, image ID `ce2dbbc0ed8b4c613caec554ce729815f090e015a82b94e0b16dec8ea74d6d71`, and image SHA-256 `4d64fb29a38e58103d3d1d80b8a2718ac39bf85d93384f0a12b390aa9431b230` bind the WiFi and GENET boots in `/Users/lukasbower/pi4-serial-20260822-134045-cont.log`, the guarded GENET diagnostic in `/Users/lukasbower/pi4-serial-20260828-5a8917-genet-live-diagnostics.log`, and boot-paired `20260828-093745` WiFi/USB captures. WiFi completes cold SDIO/CYW43, firmware, association, EAPOL, Gate 8, and DHCP, then runs the isolated child for 518 turns at child generation 1 while its projected device counters retain generation 0. Seed the isolated adapter from the complete device-owned snapshot before moving the NIC, project the live CYW43 generation only for the exact WiFi contract, and use the same projection for every refresh while preserving child-owned protocol counters. A DHCP-producing NetworkControl turn may authorize one exclusive handoff only when it began strictly before the original Gate 8 deadline and the exact committed generation remains operational; recovery, raw DHCP truth alone, proof drift, an at-deadline or late start, or missing/zero/inactive/non-admitted generated authority cannot select the handoff. Revalidate immediately before and after activation, then start the separately derived child-plus-root Ready window from the post-activation clock sample; every invalid phase, generation, authority, or clock transition fails closed without an intervening child poll, retry, fallback, deadline renewal, or budget change. GENET still completes DORA through the root-polled legacy path but stalls after DGHO with no ARP/ICMP/TCP progress; delegate `refresh_direct_genet_diagnostics` through the selected GENET wrapper only so the already-declared ten causal rows can distinguish IRQ delivery, owner drain, peer publication, and child consumption on the next physical boot. `OK NETTEST detail=started run_generation=` remains command admission only; the same-generation terminal `netstats` verdict is authoritative. Isolated physical `tcp_ready` now additionally requires current-generation accept/auth proof, the gate wrapper waits through the fixed terminal window and accepts only the exact admitted successful generation, and REST benchmark preflight accepts only terminal `OK AUTH`. Both canonical Pi diagnostic helpers bracket connectivity work with two `smp activity` samples so the second yields target-owned counter deltas instead of another unusable first sample. The serial helper also validates a clean canonical identity sidecar before opening the UART and admits the boot only after its exact full sealed marker, preventing stale or wrong-image diagnostics from being attributed to the current candidate. Identity-v2 canonicalizes equivalent image-path spellings to the resolved staged path, while the benchmark validator runs the canonical verifier against the original exact files and rechecks both bytes and the image's recorded device/inode/size/mtime/ctime after validation. The complete `coh`, `cohsh`, `coh-status`, Hive Gateway/REST, SwarmUI, GPU bridge, host-ticket agent, sidecar/sidecar bus, CAS tool, all `.coh` scripts, `tools/cohesix-py`, generated profile consumers/contracts, trace normalizer, benchmark workloads, and report schemas were reviewed; only `scripts/pi4_gate_proof.sh`, `scripts/pi4_serial_reboot.py`, `scripts/pi4_image_identity.py`, and `scripts/rest_perf_harness.py` require the bounded evidence-truth changes just described, with no generated contract or report-schema change. No manifest, 16-bit CNode, 256-Worker population, device owner, capability, MCS budget/period/deadline/refill/priority/core, Reply/fault rule, retry ceiling, hardware configuration, network grammar, or QEMU scheduling value changes. Host tests, QEMU packaging, Pi staging, or a rebuilt image can reject the candidate but cannot prove WiFi, GENET TCP, `cohsh`, performance, or Pi acceptance; those require fresh exact-image boots and benchmarks. - Pi exact-24e handoff, cutover, and physical-operator performance correction — exact source `24e1c1c7778a3dc7ad8460c9ef644992814e41a5`, image ID `33298abaa8751693f6fcc5c05655d5837a32a9c2c710dc64907a4a61cab03061`, and image SHA-256 `f0c2aaa840b6d88948bf938837c5ae6ed538b37862c937a59f05ab2c5e0965d7` bind the two boots in `/Users/lukasbower/pi4-serial-20260822-134045-cont.log`, the guarded wired snapshot in `/Users/lukasbower/pi4-serial-20260828-24e-genet-live-diagnostics.log`, and boot-paired `20260828-125527` WiFi/USB captures. WiFi completes association, EAPOL, Gate 8, and DORA, but root tests the child-Ready deadline before consuming an already durable publication. The child timestamp is absolute CNTVCT milliseconds, so root must sample that same domain immediately before and after resume, require identical nonzero generated/runtime counter frequency and a nondecreasing cursor, retain the pre-resume sample as the inclusive publication lower bound, and derive the exclusive deadline from the post-resume sample plus the generated 15 ms response bound. This admits Ready published between resume and root return. At or after the deadline permit exactly one child-publication-only shared-page observation that performs no NIC work, policy advance, retry, wake, or composed Network unit; zero, pre-resume, at-boundary, late, missing, replayed, generation/identity/sequence-drifted, backwards, overflowed, or frequency-invalid evidence fails closed. The same boot performs 6,324 productive CYW43 supervisor Driver turns at an approximately 20 ms MCS-yield cadence. On the deferred physical WiFi supervisor only, replace the per-productive-subturn replenishment tax with one counter-guarded activation: alternate exactly one Operator and one Driver turn, check CNTVCT before every fresh logical unit, and stop at the generated root-control `budget_us - wcet_us` reserve or 64 productive units. The selected Pi values make the strict elapsed-time cut 250 us (`2,750 - 2,500`), leaving one complete declared 2,500 us WCET for the newly admitted logical unit plus yield/epilogue. After service readiness, an attached Network unit may retain the same window only when EventPump proves actual CYW43 activity, exactly one service-unit advance, an immediate Network successor, durable schedulable work, and no operator rotation, recovery, quarantine, or reboot. Invalid configuration/timing, wait, idle/no progress, backpressure, handoff, terminal, fault, or reboot yields and resets; invalid evidence admits only one legacy logical turn. This retains one physical operation and finalizer per Driver turn, removes the prior Driver-to-Driver restart burst, and changes no QEMU or generic scheduler path. GENET completes DORA and legacy ARP, then DGHO exposes asserted raw/active sources `0x00012000`, zero IRQ wakes/DPC turns, and RDMA producer/consumer divergence. Before READY, the sole GENET child must drain every durable legacy RX/TX frontier, mask and clear retained raw sources, perform the existing store barrier and unmask readback, and recheck raw/active sources plus RDMA/TDMA indices; any source retains QUIESCING for a later clean pass, and unmask failure faults closed. DGHO neither fabricates an IRQ lifetime nor acknowledges one. HDMI may render one bounded child-owned `Cohesix starting...` tile only after exact framebuffer resource and geometry admission; the first ordinary frame clears and replaces it. Ordinary scroll rotates the private row ring only after bounded old/new nonblank-column union damage is retained, clears only newly exposed rows, and reserves full redraw for takeover/recovery. USB HID decoding, arrow mapping/repeat, queues, and ownership remain unchanged because the bound boots prove lossless accepted/drained/echoed input; the apparent down-arrow hang is display redraw debt. The complete host-tool suite, `tools/cohesix-py`, generated profile consumers/contracts, `.coh` workloads, benchmark scripts, evidence records, and report schemas are reviewed and require no behavior or schema change. No manifest, CNode, Worker population, capability, owner, MCS budget/period/deadline/refill/priority/core, device deadline, retry ceiling, network grammar, or QEMU value changes. Source tests, target builds, QEMU packaging, and Pi staging may reject this candidate but cannot prove TCP, `cohsh`, `.coh`, visible HDMI polish, performance parity, repeatability, or Pi acceptance; all remain fresh exact-image hardware gates. - Pi exact-24e GENET finite-cutover and MCS latency candidate — the same exact wired failure oracle proves PHY/MAC, legacy DMA, DHCP, and ARP before the old quiet-wire DGHO fence: raw/active source `0x00012000`, RDMA producer/consumer `27/2`, and zero IRQ wakes/DPC turns isolate the ownership transition rather than link configuration. Replace quiet-wire retry with one generation-bound finite state machine: mask the exact source; stop MAC RX with readback; wait 10 ms in generated CNTVCT time; clear only RDMA `DMA_EN` while retaining the default-ring enable/configuration; require DMA status bit 0 within 5 ms; snapshot a producer no more than 32 descriptors ahead; drain only that frozen legacy frontier and retained handler/TX state; publish direct ownership while ingress remains stopped; resume RDMA, MAC RX, then the source. A queued exact seL4 IRQ after READY belongs to the same sole owner and is direct-epoch work. Status timeout, frozen-producer or cursor movement, generation/token drift, ACK failure, or stop/unmask/readback failure stops MAC RX/TX plus RDMA/TDMA, masks the source, poisons the direct link, signals the peer, and raises the standard terminal fault; no root packet fallback is admitted. Move only Pi `bcmgenet-v5`/`driver-genet` to core 1 and raise its active SC from `1,000` to `3,000 us / 10,000 us`, retaining priority 160, two refills, 800 us WCET, terminal timeout, IRQ/DMA ownership, 16-frame material quantum, and all WiFi values. The compiler must derive a 3,400 us GENET response, core-1 demand `6,250/9,000 us`, core-3 demand `8,000/9,000 us`, and the LoRA executor's reduced 7,400 us response. Update manifest/profile, gate-proof, trace-normalizer, scheduling, and adverse-order regressions atomically. The complete `coh`/`cohsh`, Hive Gateway/REST, every `.coh` workload, `tools/cohesix-py`, benchmark implementation/workload/report schema, console ABI, Worker/CNode population, QEMU values, and CYW43/SDIO scheduling were reviewed and require no behavior change; only the Pi affinity-aware proof/normalization expectations change. Static admission, source tests, QEMU packaging, and Pi staging cannot establish wired TCP, authenticated `cohsh`, `.coh`, consumed time, latency, throughput, August 10 parity, or Pi acceptance; all require a fresh exact-image GENET boot and canonical benchmark. - Pi exact-a7 MCS work-conserving WiFi/GENET and operator correction — exact source `a7dfa38b42beddfe5fa353ed8b5cbd0803212635`, sealed image ID `ac42859d4aa14b7b0d4894b077dd3b8bb85b37fc397a6fab0e3a763a8d0de9c8`, image SHA-256 `ae43686674df7e01f25f12b7e693f535f8ebe8f943ea025c04ceb801e928396e`, and manifest SHA-256 `4231476a82e8cef643a26ac5fa126d1c6cae06d76fba09693af8dd2964d1195b` bind the WiFi lifetime at lines 30478-31372 and GENET lifetime at lines 31374-32015 of `/Users/lukasbower/pi4-serial-20260822-134045-cont.log` plus the boot-paired `/Users/lukasbower/tcpdump-wifi-20260828-192427.pcap` and `/Users/lukasbower/tcpdump-usb-eth-20260828-192427.pcap`. WiFi proves seven authenticated TCP sessions and all focused `.coh` scripts without loss, reset, retransmission, SACK, zero-window, queue drop, or quarantine, but SYN-to-SYN/ACK is 118.198-166.825 ms, commands 237.421-290.250 ms, bulk output about 3.2 KiB/s, CYW43 maximum quantum 570,927 us with 732 time-cap exits, accepted-to-issue 23,067 us average/1,169,052 us maximum, issue-to-terminal 21,870 us average/60,984 us maximum, and TCP post-flush exhaustion 20. USB conserves 30/30 accepted/drained/echoed bytes yet the physical WiFi display shows no timely echo while the same-image GENET control does. The selected MCS kernel charges a Yield caller's complete remaining head refill, so the former unconditional postphysical `seL4_Yield` turns sub-millisecond generation-bound CYW43/SDIO phases into repeated 10 ms period edges. Intentionally supersede only that source-level Yield boundary: after one bounded operation/finalizer, re-enter the existing maximum-three pure-state exact-grant admission; a consumed old grant blocks with no ACK or I/O, a fresh immutable grant authorizes exactly one next operation, and missing work blocks on the already-declared local notification. Producer/root reconciliation, one grant/one operation, sole CYW43/SDIO owners, external-condition waits, deadlines, retry ceilings, Reply/fault rules, and every generated SC value remain mandatory; rejected, ambiguous, dual-admitted, Reply-bearing, unsupported, GENET, serial, HDMI, USB, PCIe, and QEMU routes cannot enter this lane. Retain the root's strict 250 us pre-admission reserve and 64-unit cap. An exact active/authenticated response cursor may retain only the next separately charged root Network turn after actual activity and one service-turn advance; containment, quarantine, recovery, reboot, stale or zero identity, no progress, or operator rotation stops it. The isolated child's ordinary `ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick` rotor remains one unit per visit and never bursts. A partial local-seat line routes one bounded `Dispatch -> Display -> Serial` successor before Network with the exact CYW43 fence/parent retained; reboot ACK and physical response tails keep immediate Serial priority. For direct GENET, an admitted owner/peer turn or final pre-sleep cut may join a raw owned interrupt level or advanced DMA index to the existing sole-owner IRQ episode, then uses the existing mask/clear/drain/unmask/recheck/rearm sequence; no software state, badge zero alone, periodic poll, synthetic wake, fallback owner, or retry creates work. Advance the optional 192-byte causal record in place to diagnostic v2 and expose cumulative `dpc_level_adoptions` at record offset 108 without changing its size, commit offset, page topology, or authority. The complete `coh`/`cohsh` host suite, Hive Gateway/REST, all `.coh` scripts, `tools/cohesix-py`, generated-profile consumers/contracts, build/manifest paths, benchmark workloads, evidence records, and report schemas were reviewed; only the focused `cohsh`/trace fixtures for the additive GENET field require change. Source tests, QEMU packaging, Pi staging, or an image build can reject this candidate but cannot prove Pi recovery, latency, throughput, visible echo, August parity, or acceptance; fresh exact-image WiFi and GENET boots with same-boot captures remain mandatory. - Pi exact-069 MCS seam oracle and productive-micro-unit correction — exact source `0696803f55d215721b4e750825a5c25daf2cac05`, build ID `5d81a2134d073df9893fe13c01f212c65d86708c0d44e8e86b2ba44eec33bc99`, image ID `c49407add0cf15cb68f4cafa23970a41610f098e08ef9c4c4e8536282b89ca58`, image SHA-256 `34734ec86f6d0b560bee8d716c51bc3fc5e8b4b25d6826660641aece06911721`, retained Pi manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273`, and topology SHA-256 `33e2eea4a77712025248ac021438cb73b1dfc3740f26c4552265c0cccf82d607` bind the WiFi logs `pi4-serial-20260830-192134-0696803-wifi-diagnostics.log` and `pi4-serial-20260830-192701-0696803-wifi-postpressure.log`, GENET logs `pi4-serial-20260830-192935-0696803-genet-reboot-diagnostics.log`, `pi4-serial-20260830-193501-0696803-genet-postpressure.log`, and `pi4-serial-20260830-193726-0696803-genet-postrest.log`, and the boot-paired `20260830-183559` WiFi/USB captures. WiFi passes Gate 8, DORA, generation-bound diagnostics, three first-attempt `.coh` scripts, and 64/64 raw requests at 7.196 requests/s and 159.456-ms p95 without fault, quarantine, loss, overflow, or queue debt, but remains at 26.6% of August throughput and 3.16 times August p95. GENET passes DORA, the same scripts, and 64/64 at 47.167 requests/s and 20.052-ms p95. Its request-to-target-ACK 0.545-ms median/0.634-ms p95 is effectively at the August 0.542/0.575-ms hardware-ingress comparator, while ACK-to-response remains 19.307/19.360 ms and response spacing is phase-locked near 20.002 ms. These paired observations locate the remaining common failure after physical ingress in root/isolated-console MCS composition. Consume the qualified QEMU design as a temporal oracle, not target proof: direct GENET quiesces the child after an exact `Command`/`CommandBatch` publication and releases it only when a newly sequenced, exact-identity `StageOutput` control is applied; root may compose only the adapter's bounded response stage, never NIC work or a generic child burst. Copied WiFi may mint one non-transferable transient publication credit only when one Network poll advances exactly one material isolated-child unit with unchanged lifetime, response cursor, authenticated identity, command count, and service accounting. The next composer must cross the ordinary `Serial -> LocalSeat? -> Dispatch` operator cut, revalidate the complete snapshot again immediately before one Network poll, and revoke the credit on Yield, identity/cursor drift, operator work, passive admission, recovery, containment, quarantine, reboot, or handoff. Add only bounded Pi-private causal telemetry. The detailed 22-row batch is emitted only by explicit `smp mcs`: raw 54 MHz CNTVCT composer-quantum periods and run ticks are distinct from the exact one-block `CNTVCT -> svc -> CNTVCT` Yield hiatus, fixed progress/pending legends and one-hot Yield triggers retain causal state, and WiFi reserve rejection retains cut and reason. These measurements are composer and explicit-Yield observations, not kernel activation, refill, or consumed-time proof. Pi `netstats` retains five fast-path rows for WiFi per-cut transient-publication rejection, typed GENET response composition, and one-hot aggregate compact-Deferred classification, plus five isolated publication/control/drain seam ages when available. Every aggregate compact Deferred increments exactly one `genet_defer` counter; `compose_open` corresponds to typed `NotSealed`. The control watermark has no timestamp, so `stage-control-observe` intentionally combines child consumption with root observation. All aggregates saturate and count invalid/backwards evidence separately; the recorder never reads `SchedContext_Consumed`, emits a routine hot-path log, mints a wake/credit/retry, or influences admission. QEMU release builds retain their existing hot path and output without these accounting writes or rows. The full host-tool suite, `tools/cohesix-py`, generated contracts/profile consumers, `.coh` scripts, benchmark workloads/arithmetic, evidence records, and report schemas were reviewed and need no behavior change; additive target diagnostics are ignored by key-based parsers until explicitly consumed. Host tests, QEMU, compilation, packaging, image creation, or flashing can reject this candidate but cannot claim Pi correctness, latency, throughput, WiFi/GENET parity, or acceptance. A fresh exact-candidate dual-mode Pi run with boot-paired captures, first-attempt scripts, raw TCP, medium/high REST pressure, causal `netstats`, and pre/post-workload `smp mcs` remains mandatory. Commands: - cargo test -p pi4-driver-abi -p pi4-driver-runtime - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_attached_wifi_continuation_requires_one_productive_network_successor - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib linked_cyw43_rx_admission_honors_input_and_clears_on_guards - cargo test -p console-network-abi - cargo test -p root-task --tests driver_task - cargo test -p root-task --test driver_task_mcs - cargo test -p root-task --test driver_faulted_call_recovery - cargo test -p root-task --test mcs_activation_order - cargo test -p root-task --test direct_genet_network_phasing - cargo test -p cohsh --features tcp --test tcp_cli_script - python3 -m pytest -q tests/test_pi4_trace_normalize.py - cargo test -p coh-rtc --test pi4_profile - cargo test -p coh-rtc --test python_profile - cargo test -p coh-rtc resource_admission - .venv/bin/python -m pytest -q tools/cohesix-py/tests - cargo build --locked --release --target aarch64-unknown-none -p pi4-driver-runtime - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-driver-mcs-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-driver-mcs-pi4 - scripts/check-generated.sh Checks: focused regressions prove exact two-by-two-page/8,128-byte serial SPSC layout, coherent cacheable Normal-memory mappings only for compiler-declared CPU rings, uncached DMA/MMIO retention, generation and cursor rejection, wrap/order isolation, both final wake-race rechecks, and pending UART IRQ-ACK continuation after full-ring drain; every HDMI parse, multi-cell clear/scroll/tab, and raster turn remains at or below 1,280 operations with no replay, an aligned tab advances eight cells, and only the final visible raster completes; SDIO bulk copies match bytewise truth at every source/destination alignment and reject zero-page, overflow, range, and discontinuity violations without altering the pre-scrub discriminator; Pi profile generation requires only IRQ 189/badge 1024 for GENET default queue 16, while QEMU retains exactly three driver-runtime IRQ entries and no GENET IRQ; GENET queue/DPC tests prove the 16-frame/24,576-byte quantum, overflow preservation, bounded control/data fairness, exact badge, store-completion/unmask readback, final source/ring recheck, and durable continuation before handler acknowledgement. Direct GENET tests prove the exact CPU-only 32-page split, no DMA/device-visible/paddr authority, reciprocal least-right notifications, generation and handoff identity, sequence-last publication, final sleep-race rechecks, corruption poison, one-way root mediation cut, and complete external-frame teardown. Direct-diagnostic tests additionally prove the `[320,512)` optional diagnostic-v3 record, record-relative commit 184, stable exact-generation read, still-reserved `[512,4096)` tail, raw notification receipts/rejections/32-bit badge union counted exactly once before filtering with no service authority, eleven ordered nontruncating rows, one-shot causal replay, legacy-normalizer compatibility, and no traffic or acceptance authority. Deferred WiFi tests prove exact bound DHCP selects one exclusive handoff turn before readiness evaluation, while retained-grant tests prove max-three pure bookkeeping, Service/Empty/Inactive/Ready and ACK-failure behavior, one physical quantum, and unchanged postphysical boundaries. Every linked runtime reaches real MCS Recv/service/Reply or IRQ/notification progress with the generated TCB-bound active SC/core and no unsupported stub; exact endpoint/notification rights and disjoint badge domains match generated truth; installed terminal policies retain timeout-fault coverage, while each selected Pi natural-postpone runtime proves current-refill exhaustion postponement plus explicit device-deadline and standard-fault containment; synchronous, one-way, IRQ/DPC, fault-before/during/after-command, caller-cancellation, restart, and command-versus-fault Reply tests return one normal or typed-failure result, preserve ownership, and leave no blocked caller, SC, Reply association, stale recovery cap, old-generation authority, or root packet fallback; the new archive differs only within the authorized shared MCS scheduler/IPC/runtime-init surface; normalized CYW43/SDIO traces, constants, ordering, timing, retries, rings, error outcomes, DHCP/raw TCP/cohsh behavior, and operator-liveness gates match the accepted contract on the new exact Pi image; an accepted CYW43 blocker permits preparatory work only and cannot produce this task's Pi PASS; classic comparator, new MCS driver, Worker, QEMU, Pi, and CYW43 evidence remain distinct. Deliverables: Real active-SC MCS linked drivers, a newly hash-bound driver archive, immutable classic comparison evidence, and exact-image CYW43 coexistence proof with no behavioral rewrite. Title/ID: m26e-ninedoor-service-isolation Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / NineDoor parser-provider isolation Goal: Move untrusted target namespace parsing and provider projection behind a bounded restricted seL4 child without moving Queen policy authority. Inputs: `m26e-mcs-abi-foundation`, `m26e-production-surface-truth-and-stub-retirement`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, apps/root-task/src/ninedoor.rs, apps/root-task/src/event/**, apps/root-task/src/console/**, apps/nine-door/src/**, crates/secure9p-transport/**, tools/coh-rtc/src/**, configs/root_task*.toml, scripts/worker_task_evidence.py, scripts/m26e_qemu_pressure.sh, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md. Changes: - Release-candidate recovered-Call containment ordering — discovered by `m26e-mcs-smp-target-acceptance`: a RecoveryFault reply can return before root-fault publishes the durable service record. Keep each Recovery turn bounded and yield while that promised record is absent; consume it before teardown instead of treating the recovered standard fault as a manual revoke and abandoning its mailbox generation. The same ordering applies to terminal RecoveryTimeout; ordinary local transport revocation remains immediate. Test the stage contract and repeat exact QEMU fault/revoke evidence plus both affected target builds. Review coh/cohsh, SwarmUI, gateway, host bridges/agent, CAS, Python and benchmark surfaces: no public grammar, provider operation, generated contract or report-schema changes are needed. - Pi exact-1c5165 bounded passive timeout restoration — the unchanged two-WiFi/two-GENET matrix captures a donated root-control timeout during G00 medium16 discovery, with badge `0x26ee0001` and resettable SC consumed accounting of 121 us. Yield retires the current head, so elapsed time after Yield cannot prove a full reservation. Schema 1.17 introduces `resume-once-return-error` only for the exact local passive NineDoor donation contract. Root-fault resumes the first well-formed timeout of each armed Call with a zero-label, zero-length kernel Reply. It preserves the original request and donated SC; a second timeout, wrong donor, malformed payload, or standard fault retains typed terminal containment. QEMU keeps `return-error`. This is a candidate restoration, requiring exact target build and fresh physical pressure evidence. - Cross-surface review for the same candidate covers coh, cohsh, SwarmUI, Hive Gateway, host-side bridge/provider tools, tools/cohesix-py, all .coh scripts, and the raw/REST/pressure benchmark entry points. Their command, namespace, authority, request, timeout, retry, workload and report contracts remain unchanged. Compiler-owned policy, Python profiles and schema fixtures regenerate together. The Pi trace normalizer gains the passive timeout receipt; USERLAND_AND_CLI documents that row and the expanded CPU-owner rows. Host adapters need no hand-authored change. - Pi exact-fabc fault operand retention — the same unchanged four-boot matrix captures a NineDoor Timeout during G00 high32 discovery at LS /shard/dd/worker, followed by terminal teardown and refused later ATTACH/reboot admissions. G01 completes the same workload, so functional repeatability remains open. Retain the kernel fault label, exact length and two message registers already copied into the bounded fault mailbox, and render them after the existing diagnostic prefix in the ordinary output turn. No extra syscall, admission policy, restart, retry, timeout, budget or teardown change is authorized by this retention repair. Test maximum-width exact rendering and host evidence-prefix compatibility; interpret Timeout Data/Consumed only against the selected kernel ABI, without calling it remaining refill budget or per-call CPU cost. - tools/coh-rtc/src/** + configs/root_task*.toml — under selected `root_task.schema = "1.14"`, retain the compiler-owned NineDoor service-image, TCB, CSpace, VSpace, IPC-buffer, stack, endpoint, shared-frame, MCS Reply/donation/timeout, fault-badge, revoke records, one root-retained one-shot bootstrap SC (8 object bits, `3000 us / 10000 us`, `max_refills = 2`), and the profile-scoped root VirtIO Operator serial-I/O bound introduced by schema 1.11. Account for that fixed SC exactly once so aggregate QEMU/Pi SC totals are 18/25; schema 1.14 retains the console publication-ACK and ABI v3 SendBatch/response-lane contracts and owns `NaturalPostpone` for the active console child and the selected QEMU V35/Pi V24 root-control records, without changing NineDoor resources. - apps/nine-door-runtime/** — add a pure-Rust `no_std` child image that parses bounded namespace requests, returns typed prepared operations over the generated internal ABI, receives once for bootstrap, and uses atomic `seL4_ReplyRecv` for every reply-and-next-receive transition. - crates/secure9p-transport/** — replace the empty scaffold with the bounded transport-neutral request/response, partial-frame, close, backpressure, and cancellation traits actually consumed by the in-process host adapter and the generated seL4 endpoint/shared-frame adapter. It provides no target TCP listener. Migrate named consumers and prove revoke/short-frame/queue-full behavior; if the final child ABI cannot use this layer without duplicating semantics, remove the crate and its public claim atomically instead of retaining contract-only scaffolding. - apps/nine-door/src/{main.rs,kernel.rs,lib.rs} + scripts/cohesix-build-run.sh — remove/profile-exclude the host print-and-exit and target spin-loop binaries from selected packages; stage `nine-door-runtime` under its generated image identity. Keep `apps/nine-door` as the host library/fixture provider unless a later registered host-service use case owns a real executable. - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** — retain policy and authoritative mutation in root, replace in-root untrusted parsing for enabled profiles with bounded child IPC, and delete/profile-disable the duplicate parser path. Configure and bind only the root-retained bootstrap SC while the child is suspended and before registry seal; after root-fault activation perform `Resume -> validated empty Log prepare -> atomic ReplyRecv queued -> unbind -> steady passive donation`. Install no SC or SchedControl cap in the child, issue no NineDoor `TCB.SetAffinity`, and revoke the boundary on activation, probe, or unbind failure while suspending where possible. - apps/root-task/src/{ninedoor.rs,ninedoor_service.rs,event/**,hal/ninedoor_service.rs} + focused root-task tests — make terminal NineDoor containment resumable on the common MCS QEMU/Pi root-control path. The first exclusive Recovery turn only consumes the durable fault record, fences new Calls, retains the four mappings, initializes `SuspendTcb`, and returns `InProgress`. Later turns execute exactly one of 18 successor-committed units: `SuspendTcb`; request 0 `ScrubCleanRequestFrame`, `UnmapRequestFrame`; request 1 `ScrubCleanRequestFrame`, `UnmapRequestFrame`; response 0 `UnmapResponseRead`, `MapResponseWritable`, `ScrubCleanResponseWritable`, `UnmapResponseWritable`; response 1 with the same four units; `RevokeRecoveryReply`; `DeleteFaultCap(0)`; `DeleteFaultCap(1)`; `RevokeAnchor`; and pure `Finalize`. Scrub/clean uses the bounded lock-free cache path, each response `MapResponseWritable` performs exactly one `Page_Map`, and Reply/fault-cap deletion uses quiet bounded kernel operations. Every material unit exposes its successor before work and restores only that exact selected unit after a synchronous error. `Finalize` advances to `Complete` without removal; the next idempotent `Complete` turn publishes the five-field proof, and only that complete proof permits the old runtime record to be removed. `InProgress`, an incomplete proof, and every error fence the ordinary EventPump for the complete refill. This changes common MCS containment behavior, not ordinary Pi scheduling; fresh Pi containment evidence remains pending, and no QEMU result may substitute for it. Preserve schema, provenance, generated artifacts, capabilities, temporal numerics, and all external NineDoor semantics. - scripts/worker_task_evidence.py + scripts/m26e_qemu_pressure.sh — require one prior exact-artifact non-claiming `ninedoor` convergence PASS with a live authenticated-cohsh UART record, then run the donated-Call standard fault and root-local between-Calls transport revoke in distinct fresh terminal-service boots. Bind the exact emitted four-file target-session bundle, launch record/artifact bytes, observation/UART bytes, service ELF, and root ELF. The between-Calls hook may only request local boundary revoke after two successful post-prepare hits; it adds no command grammar, target authority, child fault, or replacement path. Collect the two NineDoor UART/GDB pairs separately so no same-boot reconstruction or fabricated between-Calls standard fault can satisfy the gate. For console-network, collect a fresh standard-fault terminal-containment boot and a distinct budget-exhaustion natural-postponement liveness/isolation boot; V18 retains V17's timeout contract and does not install or expect a console Timeout teardown. - compatibility review — `apps/cohsh/**`, `apps/coh/**`, `.coh` scripts, `apps/hive-gateway/**`, `tools/cohesix-py/**`, and the REST/performance harnesses retain their command grammar, ACK/ERR/END behavior, namespace and authority contracts, retry/timeout policy, workloads, evidence records, and report schemas. The bounded containment cursor is internal target recovery behavior and requires no host, script, Hive Gateway, Python, or performance-schema implementation change. Existing target regressions must still be rerun against the new exact image after QEMU containment qualifies; fresh Pi containment proof remains separate. - docs/ARCHITECTURE.md + docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md + docs/BUILD_PLAN.md + docs/INTERFACES.md + docs/SECURITY.md — document the target child separately from host NineDoor, the frozen bootstrap/passive transition, and the no in-VM 9P/TCP-listener rule. Commands: - cargo test -p coh-rtc - cargo test -p root-task --tests ninedoor - cargo test -p nine-door - cargo check -p nine-door-runtime --target aarch64-unknown-none - .venv/bin/python -m pytest -q tests/test_worker_task_evidence.py - bash -n scripts/m26e_qemu_pressure.sh - scripts/check-generated.sh Checks: selected schema 1.14, including rejection of immediate predecessor 1.13, the profile-scoped serial-I/O bound, and any bootstrap-candidate drift fail closed; the exact root-retained SC is accounted once and raises QEMU/Pi SC totals to 18/25; source tests prove construction-time configure/bind while suspended before seal, one initial `seL4_Recv`, validated empty `Log` preparation, atomic `seL4_ReplyRecv` queueing, unbind before passive admission, repeated calls, and boundary revoke plus suspension where possible on activation/probe/unbind failure. Recovery tests prove the latch-only first turn; the exact 18-unit order and count; one unit per later refill; successor-before-action; exact-unit restoration on synchronous failure; bounded lock-free cache cleaning; one `Page_Map` per response remap; quiet Reply/fault-cap deletion; pure `Finalize`; the distinct idempotent `Complete` proof/removal turn; and zero ordinary EventPump work on `InProgress`, incomplete proof, or error. Malformed and over-limit requests are contained in the child; root receives only typed bounded operations; the passive donor/Reply/timeout chain returns its SC on success, denial, timeout, cancellation, and child fault; partial-frame, backpressure, close, and revoke behavior passes through the real shared transport boundary; the selected archive contains `nine-door-runtime` and no print-and-exit/spin stub; namespace, Secure9P, console, replay, error, host-tool, `.coh`, Hive Gateway, Python, and performance schemas do not drift; no broad namespace, target TCP listener, child SC/SchedControl cap, NineDoor `TCB.SetAffinity`, or root CSpace authority reaches the child. Four-core GICv3 QEMU must first pass one exact-artifact authenticated `ninedoor` convergence boot, then use separate fresh boots for a live standard fault during a donated Call and a root-local transport revoke after two completed Calls. The latter must begin with no outstanding Reply association and cannot be labeled a child standard fault. Both paths must complete every bounded containment turn without root-control timeout or pump fallthrough; exact artifact/session/observation hashes and bytes must match. The common MCS source applies to QEMU and Pi, but ordinary Pi scheduling is unchanged and fresh Pi containment evidence remains pending. A marker, successful boot, or QEMU result alone does not satisfy the Pi gate. Deliverables: Executable target namespace service with generated least-authority objects, bounded IPC, fault containment, and unchanged external semantics. Title/ID: m26e-console-network-service-isolation Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / TCP console-network isolation Goal: Move TCP framing, authentication parsing, and smoltcp packet handling into a restricted child while preserving root-owned operator policy and emergency surfaces. Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-ninedoor-service-isolation`, crates/console-network-abi/**, apps/root-task/src/console_network_service.rs, apps/root-task/src/net/**, apps/root-task/src/console/**, apps/root-task/src/event/**, apps/root-task/src/serial/**, apps/root-task/src/hal/**, tools/coh-rtc/src/**, configs/generated/cohsh_policy.toml, scripts/cohsh/run_regression_batch.sh, scripts/ci/test_run_regression_batch.py, docs/ARCHITECTURE.md, docs/ROLES_AND_SCHEDULING.md, docs/SECURITY.md, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md. Changes: - Pi complete MCS report restoration — ae6f1029b's four successful network cohorts retain CPU rows but expose an output-routing regression: the twenty lifetime MCS records were removed from SMP and were never emitted by NETSTATS. Restore every lifetime value to SMP: combine pending/stalled with quantum exits, combine the two Yield-cause rows, and combine budget totals/pending into version-2 records, giving seventeen lifetime rows. Compact the sixteen global u64 idle-fence counters into two version-2 eight-counter rows plus their existing header; all three remain in SMP. Preserve the existing 64-line TCP capture and 69-line physical body without larger queues or omitted evidence. Add six saturating valid-sample cause counts to the existing latest-session Yield row so raw-session scheduling delays can be separated from lifetime boot activity. Preserve all grammar terminals, runtime scheduling, budgets, profile identity and device ownership. The exact selected-Pi renderer must retain 64 SMP rows including every CPU row and end marker, maximum-width causes, all NETSTATS batches and both TCP/physical terminals. Complete host-tool, Python SDK and benchmark compatibility review: the compact records are explicitly versioned passive text evidence, session causes are additive, and no suite consumer parses the changed lifetime records; raw workloads/thresholds/report schemas remain unchanged. Record the failed 95763116b initial-SC enlargement as reverted: root-control reuses the fixed 7-bit initial kernel cap, and the compiler must retain that exact bound. - Pi exact-fabc four-boot ACK handoff repair — unchanged fabc657cbee920fd827e72ba218035892cfbc71a, image c9f5c4da0e22afefca3ed461b2ac481f3ede9a82a7287f478db0322ec4e57bba, completes two WiFi and two GENET cohorts before edits. WiFi reports 13.306/16.523 requests/s and 108.305/61.955 ms p95; GENET reports 390.690/315.902 requests/s and 5.666/8.921 ms p95. Both WiFi command/egress pair counts remain zero: immediate transport ACK egress precedes Session command creation and consumes the copied publication credit first. Retain the pinned smoltcp 10 ms ACK timer and Nagle-disabled Pi socket so a prompt response can carry the ACK without that separate handoff. Real two-stack tests must prove piggybacked prompt reply, bounded ACK on absent root reply, and small-response progress before the prior peer ACK. While direct GENET waits for root control, admit a due child-owned timer or peer-ready retained egress through both service-entry cuts with at most three existing units, preserving the command latch and blocked-TX peer wait. Preserve child unit bounds, device/IPC ownership, QEMU TCP policy, MCS settings, and benchmark workload. This is an unmeasured candidate until fresh exact-image Pi evidence; the four-boot matrix remains failed. - tools/coh-rtc/src/** + generated artifacts — add the console/network service image, object inventory, endpoint/notification badges, bounded packet/request frames, active MCS scheduling context, Reply/timeout records, fault, shutdown, and revoke policy. The V26-era child repair candidate binds the 59-page target ELF plus 32 stack pages, one IPC page, one init page, and four shared pages into an exact 97-frame inventory with 122 retained root slots, a 32-page stack at `0x72030000..0x72050000`, and `3000 us / 10000 us` active-SC budget with `2400 us` WCET and `m26e-qemu-console-peer-close-timewait-relisten-candidate-v13` provenance. QEMU V25 places it on core 2 with `2400 us` response; Pi retains core 0 with `7500 us` response. Schema 1.12 and console-network ABI v2 add one compiler-declared publication-ACK badge and a fifth root Write-only mint on the existing root-to-child notification; the child slot and the two Notification objects are unchanged. The derived QEMU fixed/maximum frame-slot totals are `2017/4057` and `2065/4249`; the Pi totals are `4065/8961` and `4113/9153`. Maximum admitted totals are `2577/6297` for QEMU and `4625/11201` for Pi. These values are not target-qualified until a fresh four-core GICv3 QEMU run passes raw session-1 AUTH, host close, same-boot raw session-2 AUTH, two sequential direct `cohsh` sessions, and standard/timeout injection without stack or budget failure. - crates/console-network-abi/** + apps/console-network-runtime/** — advance the console-network contract to ABI v2 while retaining the four fixed 4096-byte page layouts. Add required descriptor flag `INIT_FLAG_PUBLICATION_ACK`, root wake badge `WAKE_PUBLICATION_ACK = 64`, and Ready identity `console-network-service/v2`; compact 40-byte packet and 64-byte control/event scalar headers plus active-payload copies remain unchanged. Publish sequence-last by clearing commit, release-fencing, writing the validated header/body, release-fencing, then publishing the final commit before notification; validate scalar reserved header fields as zero and treat reserved page-tail bytes plus inactive payload suffixes as non-authoritative outside construction zeroing and containment scrub. - apps/console-network-runtime/src/kernel.rs — close at most one logical unit per active-MCS refill in retained-first order: completion publication, service-event publication, egress publication, service-poll continuation, new ingress, then new control. Commit or retain that unit and execute one `seL4_Yield` before any successor. Internal `PollService`, `IngestPacket`, and `ApplyControl` units may Poll after replenishment without publication credit because they mutate only private queues. Ready begins with no credit; only the distinct root Observe ACK grants one global publication credit, internal units preserve it, and exactly one `Publish*` consumes it before touching retained state or a shared page. Ordinary packet, control, shutdown, and revoke wakes never grant credit. A stable empty packet/control hint retires before requesting one separate service cycle, preventing a self-Poll loop while preserving later sequence-and-signal authority. Immediate revoke parks without publication; graceful shutdown retains its intent until one ACK credit can be consumed by `ShutdownComplete`, then parks. - apps/root-task/src/hal/console_network.rs + apps/root-task/src/net/isolated_console.rs — retain a root `publication_ack_owed` latch. `poll_turn` refuses another observation while owed and sets the latch only after every indicated event/egress record validates and copies. ObserveChild returns after event handling and egress retention both succeed, leaving the latch owed without signalling. A later QEMU Network visit selects the distinct `AcknowledgePublication` unit ahead of diagnostic, retained-egress, and lower-cursor work; that unit clears the latch before Release+Signal, and a successful ACK forces the following lower unit to ObserveChild. Duplicate or late ACK, malformed/stale output, adapter retention failure, containment, and revoke fail closed without granting credit. A valid `ShutdownComplete` retires the latch without ACK, starts the existing bounded containment cursor, and marks the adapter terminal only after the complete teardown proof; terminal plus egress coalescing fails closed. Coalesced nonterminal event+egress is durably retained before one global credit is granted. - scripts/cohsh/run_regression_batch.sh + scripts/ci/test_run_regression_batch.py — make the Stage03 wrapper copy and export the canonical `configs/generated/cohsh_policy.toml` that matches the current `cohsh` binary and resolved-manifest fingerprint; reject the legacy stale `out/cohsh_policy.toml` path in both implementation and regression fixtures so a pre-transport policy mismatch cannot masquerade as a QEMU script failure. - apps/root-task/src/console_network_service.rs + apps/root-task/src/net/** + apps/root-task/src/event/** + apps/root-task/src/hal/** — replace enabled-profile packet/parser ownership with bounded child exchanges while retaining sole-listener admission, Queen policy decisions, response ordering, emergency serial, and fatal output in root. Give the child read-only mappings for root-produced packet ingress and control, and read-write mappings only for child-produced packet egress and events. For the isolated VirtIO path, retain the exclusive outer EventPump order Operator/Dispatch -> Runtime/IPC -> Network -> Operator/Dispatch. Operator alone owns root policy and command dispatch, and Network alone owns VirtIO/NIC service. Runtime/IPC owns a persistent internal cursor in the exact order Worker -> ControlEndpoint -> BootstrapDrain -> StreamFlush -> RebootTail; each Runtime visit attempts exactly one selected unit, including an idle Worker check or another no-op, commits the cursor successor, and executes only the compact isolated-VirtIO prelude before the selected unit. That prelude reads HAL timebase and polls the timer once; an observed tick updates `now_ms`, increments timer metrics, publishes HAL timebase, and runs the existing conditional trace, while no tick refreshes `now_ms` from the read timebase. It then reconciles CYW43 network-ready HDMI state. The visit returns to the sole recurring outer yield and does not execute the generic Runtime-without-control tail. The MCS fault-endpoint poll is a compile-time no-op and consumes no Runtime unit. StreamFlush emits at most one retained line per selected visit; after the retained final-line visit, a later selected no-line visit performs cursor/bandwidth finalization only and the following selected visit emits END only. Legacy Pi/non-VirtIO Runtime retains its existing 48-line/16-KiB behavior. Persist the exact lower Network cursor ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick -> ObserveChild and attempt exactly one selected unit per Network visit, including a no-op. A no-op advances; any successful child-signal unit forces the next lower attempt to ObserveChild. If a compact normal-success diagnostic is pending, emit at most that one record on a non-publish visit and return; otherwise retained egress receives at most two bounded reclaim checks and exactly one atomic TX publication attempt plus any required notify before returning on success or backpressure. Both preemptions preserve the lower cursor and forced-observe state. The bounded gate samples successful attempt sequences 0 through 63 and every 64th eligible success thereafter rather than imposing a diagnostic visit after every TX; counters remain continuous. ObserveChild may copy and retain one coalesced event/egress result but returns without TX. For a sampled success, preserve Observe -> TX -> DeferredDiagnostic before resuming the preserved lower state so a second publication cannot overwrite or merge the pending record; anomalies remain immediate. Preserve pending egress across backpressure, initialize the descriptor-bounded device-owned range before publication, perform no post-notify buffer write or completion wait, and retain in-flight identity until bounded reclaim. Commit the outer successor before early return and use the existing outer yield as the sole recurring replenishment boundary; the universal one-time post-activation yield is the separate startup boundary described below. Preserve Network -> Operator adjacency for buffered TCP dispatch and Operator -> Runtime/IPC outer adjacency for newly published control work. Before every ordinary phase, probe console-network's durable fault mailbox first and NineDoor only when the console probe reports no work. Each pending owner advances at most one material containment unit in fixed order per exclusive Recovery refill, persists its cursor, skips and preserves the selected ordinary phase plus both retained Runtime- and Network-unit cursors, and reaches the same sole outer yield without pump fallthrough. Mailbox contention returns `Retry` without fencing authority. The first latched console turn performs only its value/resource latch and a lock-free scalar authority fence. Later Recovery turns execute exactly one of fourteen material units: suspend; unbind; separate scrub/clean and unmap units for each shared-frame index 0 through 3; two indexed fault-cap deletes; anchor revoke/reset; and pure `Finalize`. `Finalize` commits `Complete`; the following idempotent `Complete` turn alone publishes the proof and permits quarantine. Console-network retains precedence across turns until no console work remains; only then may NineDoor advance. Ordinary retained-output turns then execute exactly one state of the quiet cleanup cursor `RootSessionTicket -> RootTicketUsage -> NineDoorSessionTicket -> NineDoorSessionScope -> NineDoorSessionBinds -> PendingStreamCursor -> PendingStream -> Finalize -> Complete`, committing each successor before moving heap owners into reboot-lifetime tombstones. Cleanup precedes its conditional reboot/parser/serial/local-seat/tail/detach diagnostics. Service fault/failure/teardown records precede cleanup diagnostics; console precedes NineDoor; admission commits before record removal, never evicts older output, retains on backpressure, and flushes on a later distinct turn. This adds no authority, SC, budget, refill, or root inner yield. Retain all three exclusive ordinary phases after console-network quarantine, with Runtime and Network preserving their retained unit state and Network fencing NIC polls rather than falling back to a combined Operator+Runtime/IPC turn; leave non-VirtIO and Pi outer-runtime behavior unchanged. - apps/root-task/src/event/** + apps/root-task/src/serial/** + tools/coh-rtc/src/** + configs/root_task*.toml + focused root-task/compiler tests — under the isolated VirtIO Operator only, create one compiler-owned serial-I/O credit from `virtio_operator_serial_io_bytes_per_turn = 64` and share it across every root-context RX poll and TX flush in that turn. Re-entry into a helper must not reset credit; exhausted bytes remain queued for a later Operator. If TX backlog exists at Operator entry, reserve exactly `32` bytes for TX and permit at most `32` bytes of RX; without entry backlog RX may consume all `64`. Set every non-root row and Pi/non-VirtIO root-control row to zero, retain the physical linked-runtime `max_bytes=1024` contract, and change no Pi event ordering, temporal budget, capability, or external grammar. This runtime, compiler, generated-artifact, and test scope is authorized by this active console-isolation task because the v7 exact-image timeout occurred inside the first steady Operator serial flush while the UART-visible lifecycle marker remained queued, before Network, Recovery, or authentication. - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused root-task/compiler tests — when the generated VirtIO serial-I/O bound is nonzero, permit at most one retained output-record attempt in the complete Operator turn and leave all later FIFO and response-tail records ordered for later Operators. Preserve the existing two-record attempt limit and phasing for Pi/non-VirtIO profiles, schema 1.11, the exact `64`/`32` serial admission, every numeric temporal field and constant, and every external grammar and authority boundary. Advance root provenance to `m26e-qemu-root-bounded-output-record-attempt-candidate-v9`. This scope is authorized because canonical v8 root ELF `5052e7a5070987c252d3c1f5cf6f27172bd5ece1836a8f6c2a5c329c789a0a61` exhausted the full `2750 us` root-control refill and raised current-fault `Timeout`, badge `0x26ee0001`, at PC `0xede84` immediately after `emit_prompt_now`, falsifying v8's remaining multi-record Operator composition. - apps/root-task/src/userland/** + apps/root-task/tests/mcs_activation_order.rs + configs/root_task*.toml + tools/coh-rtc/src/** — after the generated root-control SC and timeout endpoint are installed, execute exactly one universal MCS `seL4_Yield` before either containment mailbox probe or the first EventPump phase. This one-time activation seam sacrifices the partially consumed initial refill and waits for the next replenishment; it is distinct from the sole recurring outer yield after every Recovery or ordinary phase. Preserve the queued startup marker and prompt for the first steady Operator rather than draining them under bootstrap authority. Apply the seam to QEMU and Pi so both profiles have truthful per-phase WCET accounting; Pi gains one startup-period wait but no phase, driver, serial, capability, grammar, or numeric contract changes. Keep schema 1.11, all `2750/10000`, `2500`, `5100`, `64/32`, one-record, two-record, and physical `1024` values unchanged, and advance root provenance to `m26e-qemu-root-post-activation-refill-boundary-candidate-v10`. This scope is authorized because canonical v9 root ELF `fa488c9367136f0eadef7182a18691664c3ae51c2ac2974e12000ff5d27f38ed` with CPIO `aca549e99e0d86299e9f98348d896b730259277654544ebd22a74595b61e9bfb` exhausted the complete first post-bind `2750 us` refill and raised current-fault `Timeout`, badge `0x26ee0001`, at PC `0x13a798`, the first `compiler_builtins` `memmove` instruction reached from `heapless::Vec::remove(0)` (LR `0x79ccc`, prospective `x2 = 0x110`). Zero bytes were copied, the one-record cursor remained full, serial was idle, and the marker plus prompt remained queued, so this is aggregate first-post-bind refill exhaustion rather than copy-cost or one-record-bound failure. - apps/root-task/src/event/** + apps/root-task/src/kernel.rs + apps/console-network-runtime/src/kernel.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain the v10 activation seam and every serial/output bound, but advance root provenance to `m26e-qemu-root-bounded-runtime-unit-candidate-v11` and child provenance to `m26e-qemu-console-one-unit-per-refill-candidate-v4`. This scope is authorized by canonical v10 root ELF SHA-256 `022908395c954f73a67136f70fe4404d96e0cf1ff16f4531fa95eae7a6f57cb5`: UART crossed the retained startup marker and prompt, proving the post-activation boundary and two one-record Operator visits completed, but the second fresh Runtime consumed the full `2750 us` and raised root timeout badge `0x26ee0001` at PC `0xce98c`, the `seL4_NBWait`/nonblocking receive on root endpoint `0x0a70`. The same run recorded console timeout sequence 1, badge `0x26ee0007`, Terminal policy, with the child saved at `seL4_Wait` while `service_pending=1` and `control_pending=1`; one logical unit had completed, but the pending successor composed on the residual child SC. Recovery reached Complete with TCB suspended, SC unbound, mappings scrubbed, capabilities revoked, objects deleted, and generation fenced; NineDoor remained healthy. Give QEMU Runtime the persistent Worker -> ControlEndpoint -> BootstrapDrain -> StreamFlush -> RebootTail cursor described above, and make the active-MCS child execute Yield then Wait after Ready and each later logical unit. Recovery preserves all ordinary cursors. Keep schema 1.11, every numeric timing/resource field, `64/32` serial admission, one-record/two-record output admission, capability, ABI, grammar, and authority unchanged; Pi/non-VirtIO outer runtime remains unchanged. Neither candidate is qualified until fresh canonical QEMU passes. - apps/root-task/src/event/** + apps/console-network-runtime/src/{kernel.rs,lib.rs} + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain the v10 activation seam, the complete v11 Runtime cursor, every Network/Recovery/serial/output bound, and the child Yield-then-Wait seam, but advance root provenance to `m26e-qemu-root-empty-operator-cut-candidate-v12` and child provenance to `m26e-qemu-console-resumable-poll-service-candidate-v5`. This scope is authorized by the exact canonical v11/v4 artifacts: root ELF SHA-256 `44971429e4941d751248c216082256f01e187930d9a6d40028e5c89d8611b597`, console child ELF SHA-256 `af08f817191cc51c9354b61f09f3eeb50c8cdf875c660c7231987a426886666d`, and CPIO SHA-256 `9fbb58e1dc6dc508361f37ce0c24219e3e9029dae101e2be789df1bcb1a5b11d`. There were four TCP connects: the first three completed authentication attempts each wrote 18 bytes and read zero, while the fourth connect had no completed authentication record. The child consumed exactly `3000 us`, raised timeout badge `0x26ee0007`, and stopped at PC `0x213458`, the `seL4_Yield` immediately after the composite `PollService` completed and cleared; saved retained state identified `PollService` as that completed unit. Root completed console containment through cursor discriminant `Complete(6)`, then consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at PC `0xf5fbc`, the sole outer `seL4_Yield` after an empty Operator; the committed successors were ordinary phase `Runtime` and Runtime unit `ControlEndpoint`, and root output was empty. V11/v4 therefore fail the live bound and are not qualification evidence; Stage 03 and pressure were withheld. On isolated QEMU VirtIO only, v12 snapshots serviceable Operator work after the first bounded priority pass and returns before the repeated tail when empty. V5 retains `ChildTurnUnit::PollService` but commits a private `ServicePollUnit::StackPoll -> Session` successor before work; `ServicePollOutcome::Continuation` retains `service_pending` across the existing Yield-then-Wait seam, and only `Complete` clears it. Keep schema 1.11, every numeric timing/resource field, `64/32` serial admission, one-record/two-record output admission, capability, ABI, grammar, and authority unchanged; Pi/non-VirtIO outer behavior is unchanged. Neither candidate is qualified until fresh canonical QEMU passes authentication and standard/timeout injection. - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain every v12 empty-Operator and v5 child boundary but advance root provenance to `m26e-qemu-root-compact-runtime-prelude-candidate-v13`; child provenance remains `m26e-qemu-console-resumable-poll-service-candidate-v5`. This scope is authorized by non-claiming run `out/test-plan-convergence/v12-v5-auth-20260812T010200Z`: root ELF SHA-256 `7cec5bd582d063adc73830af8cc62e0ec8dbbb33d91bd4701db09ca69e32e6ca`, console child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO SHA-256 `dc36495a5de0df13bfb853ffa33fdc6e7ccc3bbf3a1a3c8c4cd74c8551160c16`. All four authentication attempts wrote 18 bytes and read zero. Root-control was the only timeout: badge `0x26ee0001`, exactly `2750 us`, outer-Yield PC `0xf612c`; stored ordinary successor `Network(2)`, Runtime successor `StreamFlush(3)`, and staged bootstrap `Option = None` prove the prior Runtime selected empty `BootstrapDrain`. Fault sequence 2 and the child healthy at Yield-then-Wait prove no prior child fault or Recovery. The run embedded dirty commit `a533290ffe264f0a2bf0af3db4bb4c45d1a4a278` and HEAD later advanced to `84934dda6`, so it is immutable diagnostic/failure evidence only. Replace only the split isolated-VirtIO Runtime's generic Runtime-without-control prelude with the compact timebase/timer/conditional-trace plus CYW43 network-ready HDMI reconciliation described above, then execute the already-selected cursor unit. Preserve schema 1.11, all timing/resource/serial/output numerics, capability, ABI, grammar, authority, Pi/non-VirtIO Runtime, and child v5 unchanged. V13/v5 remain unqualified until fresh canonical QEMU passes authentication and standard/timeout injection. - apps/root-task/src/event/** + apps/root-task/src/net/** + apps/root-task/src/kernel.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior tests — retain every v13 Runtime and v5 child boundary but advance root-control provenance to `m26e-qemu-root-compact-network-turn-candidate-v14` and root-fault provenance to `m26e-qemu-root-fault-resumable-containment-candidate-v3`; child provenance remains `m26e-qemu-console-resumable-poll-service-candidate-v5`. This scope is authorized by non-claiming run `out/test-plan-convergence/v13-v5-auth-20260812T014607Z`, bound to dirty source commit `84934dda6fcffbfa536d4e437cc1904c7fdeb0b1`, root ELF SHA-256 `0275cd7d701263cc1731ca3301d9aeab8a0393651745659f192106a0d558d78f`, console child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO SHA-256 `142e2aec64662888a9872ff77ff85d1f5f7c351b7aaa478ded8cf99ba9e64f29`. All four authentication attempts wrote 18 bytes and read zero, so the run failed at `real-target-operation`. Exact live state identified the initiating root-control timeout, badge `0x26ee0001`, at `sel4::poll` SVC PC `0xce98c` with caller `0x108910` immediately after the child-notification poll inside `IsolatedVirtioConsole::poll`; committed ordinary successor `Operator` and lower successor `StageOutput` identify selected unit `ObserveChild`. The child remained healthy at `seL4_Wait`. Root-fault then timed out with badge `0x26ee0002` at `suspend_tcb` SVC PC `0xce0cc` while targeting root-control TCB cap `0x10`, and root-emergency fail-stop followed. This falsifies v13's generic Network prelude plus compiler-expanded all-unit adapter closure and v2 root-fault's composed receive/classify/suspend handling; it does not falsify child v5. V14 executes the already-selected isolated Network unit through a compact Network-only turn and direct bounded unit adapters; v3 makes terminal-critical receive/classify, suspend, and emergency signal distinct successor-before-work admitted units while retaining the single Reply association until the terminal signal. Preserve schema 1.11, every numeric timing/resource/serial/output field, capability, ABI, grammar, authority, nonterminal Worker/driver/service fault paths, Pi/non-VirtIO behavior, and child v5. V14/v3/v5 remain unqualified until fresh canonical QEMU passes authentication and standard/timeout injection. - configs/root_task.toml + tools/coh-rtc/src/** + exact compiler fixtures — advance only QEMU `root-worker-supervisor` and `root-driver-supervisor` cold-activation admission to v15. The exact v14 artifact set binds root ELF `4265ee26a8a23b38851167aa046f4adce50764715131d044059b4e08211b9361`, system CPIO `85a1e211f5cb83ad8ace277d0a4cfe89c22317ffa148e0aeae64611f1bd315d6`, kernel `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`, driver archive `88a3a9f1df93cb560501ac13275efb20b52985db8878b54372e29a397539474d`, and driver manifest `ef168c902062ff1c9f08208bc1eadf92773991ee2ce297a28da5ee26e2cfa385`. `root-worker-supervisor` first exhausted its complete `750 us` refill at entry PC `0x1143dc`, timeout badge `0x26ee0004`; root-fault received that record, then `root-driver-supervisor` exhausted its complete `1000 us` refill at entry PC `0x113d98`, current timeout badge `0x26ee0005`. Both generated tasks select core 1. The core-specific SchedControl ConfigureFlags call precedes SC binding, and the MCS bind migrates the TCB to its SC core; do not add the invalid direct `TCB.SetAffinity` path. Use the proven core-1 NineDoor bootstrap envelope plus 20 percent margin: each supervisor becomes `3000 us / 10000 us` with `2400 us` WCET; Worker response is `4800 us` with `m26e-qemu-root-worker-supervisor-cold-activation-candidate-v15`, and driver response is `2400 us` with `m26e-qemu-root-driver-supervisor-cold-activation-candidate-v15`. Preserve every core, priority, period, deadline, refill, cap, and runtime value. Their steady active demand is `6000 us`; with the root-retained `3000 us` NineDoor bootstrap envelope at priority 128 below both supervisors, transient demand equals the exact `9000 us` usable core-1 capacity and leaves the `1000 us` reserve. Keep the Pi manifest's supervisor and driver values/provenance unchanged and unqualified pending its required checkpoint. The exact v15 QEMU image later proved both supervisors reached their healthy blocking waits; broader v16 target acceptance and the Pi checkpoint remain pending. - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v14 Network, v13 Runtime, v12 empty-Operator, v5 child, v3 root-fault, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-exclusive-retained-output-candidate-v16`. The exact v15 non-claiming run bound dirty source HEAD `84934dda6`, root ELF SHA-256 `6c145a1d81bd57e791781a052f62dfc6dd5d34c7c7ca0aa4e3311a9b5696018c`, system CPIO SHA-256 `07b84ff5dc2a40e2b9039d49b1e37bb88824909fe2fd902c9dd0165b4a643529`, and resolved-manifest SHA-256 `46f3264e862944b84188064941bd581e60a78d80d9a7590dfe4b42fcfa3e7482`. Root-control consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at the outer yield after the second retained-output Operator emitted and cleared the initial prompt; saved successors `Runtime` and `ControlEndpoint` prove the prior Runtime selected `Worker`, while the cleared output state proves that entry-time TX history—not remaining work—admitted the generic Runtime tail. Root-fault then consumed exactly `3000 us` at the `SignalEmergency` send return, emergency delivery and fail-stop completed, and both v15 supervisors remained healthy at `seL4_Wait`. Make only the isolated QEMU VirtIO retained-output Operator exclusive after its bounded output service; it must return before generic Runtime-tail work. Preserve every timing, schema, capability, ABI, grammar, authority, Pi/non-VirtIO behavior, child v5, root-fault v3, and supervisor v15 value. Keep QEMU and Pi root provenance consistent with the existing universal root candidate convention; v16 remains pending fresh QEMU authentication and standard/timeout injection. - apps/root-task/src/event/** + apps/root-task/src/hal/critical_tcb.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain the v16 output ordering, v14 Network, v13 Runtime, v5 child, and v15 supervisor contracts, but advance root-control provenance to `m26e-qemu-root-compact-event-dispatch-candidate-v17` and root-fault provenance to `m26e-qemu-root-fault-classify-boundary-candidate-v4`. The exact v16 image bound root ELF SHA-256 `4fab7abc8707b9829ba66ac525efdfc7afefa812df4bab9abb8cb67d504a76a6` and system CPIO SHA-256 `456558cac05e4d136d3cbc18d1290cc48bebf619ba5459cd623b667dbfff3e96`. The startup prompt reached serial and the retained output completed, but root-control still consumed the full `2750 us` and raised timeout badge `0x26ee0001` at outer-Yield PC `0xf61c4`; saved successors `Runtime` and `ControlEndpoint` identify the completed phase as Operator and the earlier Runtime unit as Worker. Target-ELF disassembly shows the supposedly exclusive path still entered an approximately `0x42c0`-byte generic EventPump frame and an approximately `0x12a0`-byte generic Operator frame before the output leaf. Root-fault then consumed the full `3000 us` at the first post-classification Yield, PC `0x113938`, before critical suspension or emergency signalling. V17 therefore dispatches the exact isolated QEMU VirtIO contract through a tiny noinline split entry before allocating the generic EventPump frame; that path commits the outer successor and admits at most one material Operator leaf in strict priority: SerialIo/SerialDispatch, LocalSeat, response-ordered RetainedOutput, NetEvent, NetLine, background/high-impact RetainedOutput, then DisplayAttach. Each material leaf is noinline, commits its successor before work, and cannot call the generic Operator or Runtime bodies. Runtime and Network retain their existing compact one-unit paths. Root-fault v4 uses `Receive -> Classify -> SuspendCritical -> SignalEmergency`: Receive commits Classify before blocking receive and yields after copying only label/badge; Released classifications yield before another Receive; RetainedByDriver waits for and validates the exact release then yields; Critical commits SuspendCritical then yields; SuspendCritical commits SignalEmergency, suspends, and yields; SignalEmergency commits Receive, signals, and yields. The serialized Reply association and all noncritical fault semantics remain unchanged. Pi/non-VirtIO EventPump dispatch stays on the generic path. Preserve schema 1.11, every numeric timing/resource/serial/output field, capability, ABI, grammar, authority, child v5, and supervisor v15 values. V17/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection. - apps/root-task/src/event/** + apps/root-task/src/serial/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain the complete v17 compact dispatcher, v14 Network, v13 Runtime, v4 root-fault, v5 child, and v15 supervisor contracts, but advance root-control provenance to `m26e-qemu-root-split-serial-io-candidate-v18`. The exact v17 non-claiming run `out/test-plan-convergence/v17-v4-auth-20260812T041428Z` bound root ELF SHA-256 `3d0641bac42d21ce383c47f38628a05db0d2474fab69fc6e14b67ba39a71bd47`, unchanged child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO SHA-256 `fa478638d6d2b93b654a2615e4dcd1e1d7f666d0945d4e012adcf28da2292af1`. All four authentication attempts wrote 18 bytes and read zero, so the first failed proof layer remained `real-target-operation`. Exact fault state identified current root-control timeout `.1` at outer-Yield PC `0xf6624`; committed successors were ordinary phase `Runtime`, Runtime unit `Worker`, and Operator unit `SerialDispatch`. This proves the compact dispatcher and successor-before-work attribution ran, but falsifies v17 `SerialIo`, which still composed generic `SerialPort::poll_io` driver admission/RX work with TX flushing in one selected leaf. V18 keeps `OrdinaryOperatorUnit::{SerialIo, SerialDispatch, RetainedOutput, NetEvent, NetLine, LocalSeat, DisplayAttach}` but makes `SerialIo` RX-only: it performs exactly one bounded `poll_rx_only`, admits no TX/dispatch/flush, and retains `SerialDispatch` when entry TX or admitted input exists. A later Operator selects retained `SerialDispatch` first, commits `RetainedOutput` before work, performs bounded serial consume/echo and TX flush, and returns without another RX probe or another material leaf. The existing raw-UART RX trace is suppressed only while this admitted ordinary root-control turn is active, so trace formatting cannot become a hidden part of the selected RX unit; generic/Pi tracing is unchanged. An idle RX-only probe restores `SerialIo` eligibility and continues the unchanged strict-priority selector. Preserve schema 1.11, every `64/32` serial admission and one-record/two-record output value, every temporal/resource numeric, capability, ABI, grammar, external operator ordering, Pi/non-VirtIO behavior, root-fault v4, child v5, and supervisor v15 value. V18/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection. - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v18 Operator, v13 Runtime, v14 one-unit Network, v4 root-fault, v5 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-virtio-network-prelude-candidate-v19`. The exact v18 non-claiming artifact bound root ELF SHA-256 `e7d34f018ff308c575fedb79ca7cef5542a7da8e753c09ddb9d55cf9daa79d4e` and system CPIO SHA-256 `0dca41cc6fdd9a877144dcd2db610beaeafef95423a81ce6896b01bb9b8f5cf5`. All four authentication attempts wrote 18 bytes and read zero. Root-control consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at outer-Yield FaultIP `0xf66e4` after a completed Network phase. The ordinary successor was `Operator(0)`; isolated lower successor `Disconnect(2)` proves the selected lower unit was `StageOutput(1)`. Pending egress was zero, deferred diagnostic state was `2`, and no child signal occurred. Root-fault timeout `.2` was downstream at `suspend_tcb` SVC PC `0xce1f4` with its retained cursor already `SignalEmergency`; root-fault v4 and child v5 are not the initiating failure. V19 changes only the true isolated-QEMU split Network prelude: `poll_split_ordinary_virtio_network_prelude` calls exactly `poll_runtime_timer_prelude`, then `poll_split_ordinary_virtio_network_turn` invokes exactly one retained `poll_one_split_ordinary_virtio_network_unit`. It does not call `reconcile_cyw43_network_ready_hdmi`. The split Runtime prelude retains timer plus CYW43/HDMI reconciliation, and generic/Pi Network and Runtime paths remain unchanged. Preserve schema 1.11, every timing/resource/serial/output numeric, capability, ABI, grammar, authority, root-fault v4, child v5, and supervisor v15 value. V19/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection. - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v19 split-Network prelude, v18 Operator, v13 Runtime, v14 one-unit Network, v4 root-fault, v5 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-virtio-netdiag-postlude-candidate-v20`. The exact clean v19 non-claiming artifact bound root ELF SHA-256 `0737a6f008197fd5b931af104c95164ddcd925fa04a8440439895c1e76b26fca` and system CPIO SHA-256 `51e7b955b449b42b7a0cad569aa187e19a0f71464ffb81080d29733a589e7ed0`. All four authentication attempts wrote 18 bytes and read zero. Root-control exhausted its refill at outer-Yield FaultIP `0xf66dc` after a completed Network phase. The lower successor `Ingress(3)` proves selected `Disconnect(2)` was a no-op and did not signal the child; pending egress was empty, the child remained healthy at Wait PC `0x21343c`, and root `smoltcp_polls` was `250098`. This falsifies the post-leaf composition of counter refresh, NETDIAG, and NineDoor ingest aggregation, not the timer prelude, selected NIC unit, child v5, or root-fault v4. V20 changes only the true isolated-QEMU VirtIO Network path. A NIC visit performs the timer prelude and exactly one selected NIC unit, then retains one compact diagnostic observation containing the telemetry snapshot, originating `now_ms`, and last-RX-progress horizon. The next Network visit takes that observation before any timer or NIC work, runs only NETDIAG, and returns. Immediate flush accounting, connection identity, and NineDoor ingest accounting remain in the originating NIC visit unchanged; quarantine clears the retained observation. Generic and Pi paths remain unchanged. This intentional postlude boundary halves NIC service cadence per Network visit and therefore requires fresh Hive Gateway REST performance measurement after functional target gates. Preserve schema 1.11, every timing/resource/serial/output numeric, capability, ABI, grammar, authority, root-fault v4, child v5, and supervisor v15 value. V20/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection. - apps/root-task/src/event/** + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v20 exclusive diagnostic-postlude, v19 split-Network prelude, v18 Operator, v13 Runtime, v14 one-unit NIC, v4 root-fault, v5 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-virtio-network-timer-nic-split-candidate-v21`. The exact immutable v20 launch set `out/cohesix-v20-final-qemu-20260812T062442Z` bound root ELF SHA-256 `ed5cb9f587d0d63e6121f8b00b083e68f5a0a7dd23dd6d2bbf0c899e1e85e80f`, system CPIO SHA-256 `ca2a52038eb0814a17c8609f03bec32ff357fdd524edee3e7080ac69ceb7823b`, kernel SHA-256 `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`, and resolved-manifest SHA-256 `6dd92e0015a1ec7c14af5321fc35ebc9143673dbe71b09766a83bf3b77a36e0a`. The non-claiming authentication canary bound dirty commit `bf77d71946e958c5a4671db1c4f5bd9edd959aae` and source digest `sha256:bdb2411efaf5b8e50d57ff8673605b7798cd7a6638801f77546ba347f77541c8`; all four attempts wrote 18 bytes and read zero. A same-artifact no-input run reached `[mark] root-console.start.ok` and the prompt before root-emergency fail-stop. Exact GDB state found root timeout `.1` at outer-Yield FaultIP `0xf680c`, ordinary successor `Operator`, and retained NETDIAG `Some`. That proves the originating normal Network visit completed both its timer prelude and NIC unit and retained its diagnostic, while the diagnostic-only successor had not run. Exact v20 lower-cursor, pending-egress, and child state are unconfirmed and must not be inferred from stale layout offsets. This falsifies only timer-plus-NIC composition, not the selected NIC/lower unit, exclusive diagnostic visit, child v5, root-fault v4, or v15 supervisors. V21 adds a QEMU-only persistent `OrdinaryVirtioNetworkUnit::{Timer, Nic}` cursor. When no retained diagnostic exists, the Network visit reads the cursor, commits `unit.next()` before work, and performs only the selected unit: Timer calls `poll_runtime_timer_prelude`; Nic calls one unchanged `poll_one_split_ordinary_virtio_network_unit`, retains the compact v20 diagnostic observation, and preserves immediate flush, connection-id, and NineDoor ingest accounting. A retained diagnostic still preempts first, runs only NETDIAG, returns without advancing the Timer/Nic cursor, and leaves the next ordinary visit at Timer. The recurring featured sequence is therefore Timer -> Nic -> DeferredDiagnostic -> Timer. Quarantine clears retained diagnostics but preserves the Timer/Nic cursor; generic and Pi paths neither use nor mutate it. Preserve schema 1.11, every timing/resource/serial/output numeric, capability, ABI, grammar, authority, root-fault v4, child v5, and supervisor v15 value. V21/v4/v5 remain pending fresh canonical QEMU authentication and standard/timeout injection. - apps/console-network-runtime/src/{lib.rs,kernel.rs} + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — the v22 repair slice retains root-control provenance `m26e-qemu-root-virtio-network-timer-nic-split-candidate-v21`, root-fault v4, supervisor v15, and every v21 root boundary, but advances child provenance to `m26e-qemu-console-bounded-stack-steps-candidate-v6`. This scope is authorized by the exact immutable v21 launch set `out/cohesix-v21-qemu-20260812T070200Z`: root ELF SHA-256 `c3d45ee5650373ed6064de1a7d13691d9473f300ac5ffec11d0f1719ab877de2`, system CPIO SHA-256 `4d164fcc7c9a3605d3d5ca7430895e3cf911f4a294ddb0432d8afafb0966ed64`, console child ELF SHA-256 `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and kernel SHA-256 `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`. The non-claiming official convergence run `out/test-plan-convergence/v21-v4-auth-20260812T070901Z` bound dirty commit `bf77d71946e958c5a4671db1c4f5bd9edd959aae` and source digest `sha256:1b9cbf5125e24c9e36741bfc558d9d5a50cf5f193a4840158a007ab00ac11251`; it and the controlled exact-image run `out/live-diag/v21-20260812T071219Z` each completed four authentication attempts that wrote 18 bytes and read zero. The controlled run stayed healthy at the prompt without TCP input, then AUTH reproduced terminal child timeout current-fault `[0x5, 0x26ee0007]`. The child consumed its full `3000 us` refill and stopped at post-unit `seL4_Yield` FaultIP `0x213434`; retained `service_pending=1`, `control_pending=1`, and `ingress_pending=0`, together with the v5 successor-before-work contract, identify completed `StackPoll` returning `Continuation` with `Session` committed next. Smoltcp 0.13.1 explicitly documents `Interface::poll` as potentially unbounded because it loops ingress and egress, so v5 is live-falsified rather than qualified. V6 replaces only the private service cursor with `ServicePollUnit::StackIngress -> StackEgress -> Session`: commit each successor before work, let `StackIngress` call exactly one `poll_ingress_single` and return `Continuation`, let `StackEgress` call one `poll_egress` and return `Continuation`, and leave `Session` unchanged as the only `Complete` result. Preserve the same child Yield-then-Wait seam after each nonterminal unit, retained-first publication priority, root v21 behavior, schema 1.11, all numerics, ABI, grammar, capability, and authority. V21/v4/v6 remain pending fresh canonical QEMU authentication and standard/timeout injection; the v21 runs are diagnostic failure evidence only. - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU/Pi projections + focused runtime/compiler tests — the historical V7 child candidate was `m26e-qemu-console-closing-send-guard-candidate-v7`. The immutable diagnostic artifact `out/cohesix-m26e-hvf-20260813T054027Z` bound rootserver SHA-256 `48ae02bd3faae9626a03c29932ca15b809d30f9552404ddfbe81051d24dace95`, child SHA-256 `89c241b6198a140170744b02b707a6000486acf39dee0799a302d74605fde52b`, and CPIO SHA-256 `0619e47f1157815f43629ab56c03b39f342e44460b931efd822bc93e42e0c689`. The fresh map `out/m26e-qemu/v23-v6-tcg-gateway-fault-map-20260813T172000Z` localized the console fault to FaultIP/NextIP `0x213d58` (`BRK`), LR `0x21373c`, `x0 = 5` (`RuntimeError::Backpressure`), and the old image's shared send/backpressure exit `0x21832c` with smoltcp TCP state `FinWait2`. V7 gated `send_slice` on both `can_send()` and complete-frame capacity, retaining closing-state output without commit or false `OutputDrained` until peer close reached the existing `end`/one-`Disconnected`/relisten path. Other Session errors remained terminal. Preserve this exact V7 evidence as the historical predecessor; it is not current V8 qualification. - apps/console-network-runtime/src/{lib.rs,kernel.rs} + apps/root-task/src/net/isolated_console.rs + configs/root_task*.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU/Pi projections + focused child/root/compiler tests — the historical V8 console child advanced to `m26e-qemu-console-stale-control-generation-fence-candidate-v8`. The canonical HVF V24 artifact `out/cohesix-v24-attach-fastpath-hvf-qemu10-20260813T081651Z` bound rootserver SHA-256 `e2386dc044fb78ab2cf757db3304bf918847b99990f7aa7869eb366647cbdcb7`, console child SHA-256 `b1689774784e6e2ab11d5ac878fee173f42150deb6c371baa26017a8a81f18db`, CPIO SHA-256 `d9dc4058acb5f97d65af7ff17219dfc4034e0527c407b063f2bcd482ea97316b`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. The sequential diagnostic `out/m26e-qemu/v24-attach-sequential-20260813T083057Z/boot_v0.log` completed `OK AUTH` and `OK ATTACH role=queen`, then timed out waiting for the first `TAIL /log/queen.log` response. Live UART explicitly reported `terminal-fault class=Standard`, and the read-only map placed the child at FaultIP/NextIP `0x213d80` (`BRK`) with LR `0x2136cc`; the TCB fault payload had already been consumed and read as zero. The value `0x26ee0007` at SC offset `0x30` was only the configured timeout-handler badge, not evidence that Timeout initiated this fault. Exact source/state mapping placed the child in retained `ApplyControl(SendLine)` after the owning session had ended and `AuthState` was inactive. The control page carried a connection identity, but the V7 reader discarded it, so a valid already-staged old-generation line was misclassified as a current unauthenticated error and entered terminal fault. V8 preserves and validates the nonzero connection identity. A well-formed control for an ended or different connection is consumed as `StaleConnection`, advances the accepted sequence, and publishes its exact `ControlCompleted` without output, `OutputDrained`, or fault; malformed records and matching-current pre-authentication or queue errors remain terminal. A stale control can therefore neither mutate nor reorder a replacement session. Root retains the one-slot in-flight record until that exact completion, and the isolated adapter reports backpressure rather than success when no authenticated connection exists so a not-yet-staged stream record cannot advance silently. Preserve V7's closing-send guard, v6 service cursor, one-unit/refill boundary, schema 1.11, every numeric, page, field, event kind, grammar, capability, and authority value. V24 is exact failure evidence, not V8 qualification. - apps/root-task/src/{sel4.rs,bootstrap/log.rs,ninedoor.rs,event/mod.rs} + focused logger/activation/attach tests — keep the existing bootstrap-readiness and namespace-authority boundaries without another provenance change. Once endpoint ready, endpoint validated, IPC send unlocked, and post-commit IPC unlocked are all true, the syscall wrapper returns through an inline four-read fast gate before shared bootstrap trace counters, tracer snapshots, formatting, locks, or UART diagnostics; any failed readiness condition enters the unchanged cold diagnostic/refusal path. A successful target namespace `prepare_namespace(Attach)` is the sole fallible application attach transaction: NineDoor commits its local attached/session context before best-effort audit, logger, or boot-tracer observation, and root commits its session plus `OK ATTACH` only after that transaction succeeds. Attachment enters nonblocking UART+EP mirroring only. The optional ping/ack self-test and EP-only promotion may run only from a later explicit request and cannot veto, roll back, or weaken namespace authority; UART+EP mirroring remains functional. These are bounded implementation corrections within the existing root v23 and namespace contracts, not a new root/supervisor provenance or numeric change. - apps/root-task/src/event/** + apps/root-task/src/hal/critical_tcb.rs + configs/root_task*.toml + tools/coh-rtc/src/** + focused source/behavior/compiler tests — retain every v21 Timer/Nic/diagnostic, v18 Operator, v13 Runtime, v4 recurring root-fault, v11 child, and v15 supervisor boundary, but advance root-control provenance to `m26e-qemu-root-exclusive-predispatch-candidate-v23` and root-fault provenance to `m26e-qemu-root-fault-service-units-candidate-v6`. The exact immutable v22 launch set `out/cohesix-v22-qemu-20260812T074004Z` bound root ELF SHA-256 `d392ee72ada945f5b5ae52e4dee285ed3e7ff67fa9283103a234af9d15e389fc`, system CPIO SHA-256 `7055a956cf84cbaa2c6b00b8c9fe59d73c52c7cd157e07b66960434ac66af64c`, console child ELF SHA-256 `89c241b6198a140170744b02b707a6000486acf39dee0799a302d74605fde52b`, and kernel SHA-256 `865b5a0614f1633ca636800705f97339e78f47065fdaffd2cb4139e4a25630c0`. Non-claiming run `out/test-plan-convergence/v22-v4-v6-auth-20260812T074300Z` bound dirty commit `bf77d71946e958c5a4671db1c4f5bd9edd959aae` and source digest `sha256:4f7473411494f351def533a52e6bf8e3f02037b75c8945992171a16108cf7c28`; all four authentication attempts wrote 18 bytes and read zero. A controlled exact-image AUTH run first remained healthy at the prompt, then recorded initiating root-control timeout badge `0x26ee0001`; the secondary current fault was root-fault timeout badge `0x26ee0002`. Root-control was inactive with FaultIP/NextIP `0xe9ddc`, the not-yet-executed outer phase-successor store after `reconcile_physical_response_barrier` and `queue_stream_prompt_tail_if_ready`; the selected and retained phase was `Operator`, so no Operator leaf ran. The child remained healthy at `seL4_Wait` after completed `StackEgress`, with `Session` committed and `service_pending=1`, `ingress_pending=1`, and `control_pending=0`. This falsifies v21 root's composed compact predispatch housekeeping, not child v6. Exact V22 root-fault state separately binds secondary timeout badge `0x26ee0002` to FaultIP/NextIP `0x113e70`, immediately after the Receive turn terminal Yield SVC at `0x113e6c`; LR `0x113e5c` followed publication of initiating label `5` and badge `0x26ee0001`, with Classify already committed. That secondary fault was not the initiating root failure, but it independently falsifies v4's unprimed first Receive boundary. V23 keeps compact QEMU predispatch success-sensitive without adding a phase or cursor: `TailInFlight` performs one response-barrier reconciliation and returns if the barrier clears, otherwise exactly one compact Operator unit runs before return; an eligible stream prompt performs one queue attempt and returns if pending clears, otherwise bounded queue backpressure likewise falls through to exactly one compact Operator unit before return. Ready reboot retains its exclusive pre-phase return. Every path preserves the ordinary phase and both retained Runtime/Network cursors; only the fallback Operator subcursor may advance. Only a turn with no predispatch duty reads the ordinary phase, commits its successor, and dispatches one existing phase. Generic and Pi paths keep their existing behavior. Root-fault V6 retains initial `PrimeReceive`: once constructed, sealed, resumed, and runnable, it commits Receive and yields before any endpoint receive, copied fault value, or Reply association; an early sender may remain queued on the already constructed endpoint. All recurring legacy lanes continue to commit Receive directly. Service classification instead commits `ResolveService`, which performs one fixed generated lookup and one nonblocking registry-lock/scalar-snapshot attempt, retrying without loss on contention. It then advances `SuspendService -> RecoverPassiveService -> PublishService -> Receive`; active console service records skip `RecoverPassiveService`. Suspension performs one quiet bounded syscall, passive recovery may issue at most one Reply while active console recovery issues zero, and publication performs one mailbox action while retaining the snapshot on backpressure. Preserve schema 1.12, every timing/resource/serial/output numeric, grammar, external authority, root-fault V6, child v11, and supervisor v15 value. V23/root-fault-V6/child-V11 remain pending fresh canonical QEMU authentication and standard/timeout injection. - apps/root-task/src/hal/console_network.rs + apps/root-task/src/net/{isolated_console.rs,isolated_network_turn.rs} + configs/root_task.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU projections + focused root tests — advance only QEMU root-control provenance to `m26e-qemu-root-publication-ack-unit-candidate-v24`. The exact V23/root-fault-V6/child-V11 canary timed out root-control at the sole outer Yield after ObserveChild completed while the console child remained healthy, falsifying same-visit observation-plus-ACK composition rather than child V11. V24 records debt only after valid copy and durable adapter retention, returns without signalling, then selects one distinct highest-priority `AcknowledgePublication` Network unit on a later root refill. That unit clears debt before Release+Signal; success forces the following lower unit to ObserveChild, while failure contains without granting credit. Preserve V23 predispatch and Timer/Nic/diagnostic behavior, Pi V23 provenance, child V11, root-fault V6, supervisor V15, schema 1.12, ABI v2, every timing/resource/capability value, and all external grammar. V24 is now exact failed evidence under the following chronology entry; it is not qualification. - configs/root_task.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU projections + focused temporal/resource-admission tests — advance only QEMU root-control temporal provenance to `m26e-qemu-root-temporal-envelope-candidate-v25`. The exact read-only V24 snapshot `out/m26e-qemu/ack-split-v24-20260813T122117Z/v24-gdb-readonly-snapshot.txt` records current-fault label `5`, badge `0x26ee0001`, root ELR/FaultIP `0x5361c` at `KernelSerialDriver::read_byte+84`, and LR `0x5391c` at `SerialPort::poll_rx_current_tcb+92`; the committed outer successor was Runtime and Operator successor was SerialDispatch. The child was healthy at Wait `0x21360c`, root-fault was receiving, and root-emergency alone was fail-stop. This exactly falsifies V24's `2750 us` QEMU root envelope during an admitted SerialIo unit; it does not falsify the ACK split or child V11. Keep root-control on core 0 but set only its QEMU budget/WCET/response to `5500/5000/7600 us`. Move only the QEMU console-network task, matching service core, and SchedControl row from core 0 to core 2; keep child budget/WCET/period and V11 provenance unchanged, derive child response `2400 us`, and update same-priority GPU/LoRA responses to `3000 us`. Compiler admission must prove core-0 demand `8750 us` and core-2 demand `3800 us` within the unchanged per-core `9000 us` usable window. Pi root-control retains exact V23 placement, numerics, response, provenance, and source; its child remains V11 under schema 1.12. Schema, ABI, caps, periods, refills, priorities, MCPs, and product source remain unchanged. These values are a conservative pending envelope, not proven numerically minimal. V25 remains pending fresh canonical QEMU authentication, the two-session generation-fence canary, and standard/timeout injection. - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/tests/ai_lora_contract.rs + generated default/QEMU/Pi projections + focused runtime/compiler tests — advance only the console child lifecycle provenance to `m26e-qemu-console-peer-close-relisten-candidate-v12`. The immutable V25 artifact `out/m26e-qemu/temporal-v25-20260813T125130Z/artifact` completed the first raw AUTH, but replacement raw connections were reset at both `+1 s` and `+10 s`; the retained logs are `raw-auth-twice.log` and `raw-auth-after-10s.log`. A live read-only snapshot, whose transcript was not retained, showed root current fault `NullFault`, root-control fully replenished at budget `5500 us`, and the healthy child blocked in core-2 Wait. Source comparison then found that peer FIN advanced the isolated child socket to `CloseWait` but no child transition requested the server half-close or relisten; M26b Complete `72288c7d` had explicitly converted `CloseWait` into its bounded disconnect/close path. V12 invokes the existing idempotent `session.request_disconnect()` only while the socket is `CloseWait`; it preserves already-authorized exact-generation output, then reuses the existing `close_ready`/`Closed`/`end`/`listen` path and emits exactly one `Disconnected`. A real two-stack in-memory regression proves peer-FIN relisten without root disconnect control. This changes no ABI, READY identity, schema, page, capability, timing, grammar, host timeout, retry policy, root-control, root-fault, supervisor, Worker, NineDoor, or gateway contract. V25 and every V11 ACK invariant remain intact; only child provenance advances to V12 on QEMU and Pi. Fresh target proof must perform raw session-1 AUTH, close that host socket, obtain same-boot raw session-2 AUTH, then complete two sequential direct `cohsh` sessions before any downstream regression or performance claim. - apps/cohsh/** + apps/coh/** + all `.coh` scripts + apps/swarmui/** + apps/hive-gateway/** + tools/cohesix-py/** + scripts/{m26e_qemu_pressure.sh,rest_perf_harness.py} + docs/BENCHMARKS.md — perform the same-change host-tool and performance-harness compatibility review for v25/root-fault-V6/child-V12 and the common-MCS bounded NineDoor containment cursor. The repairs, including V12's peer-close/relisten transition, V7's internal closing-state sendability guard, V8's connection-generation disposition and root unauthenticated-output retention, the all-ready IPC fast gate, and the nonblocking ATTACH logger transition, add no verb, frame, ACK/ERR/END state, namespace or authority path, timeout, quota, benchmark workload, retry policy, evidence record, or report-schema change, so these implementations, fixtures, benchmark inputs, and report schemas remain unchanged. NineDoor's latch-only turn, 18 material units, and proof-only Complete turn alter only internal target recovery scheduling; ordinary Pi scheduling remains unchanged, while fresh Pi containment evidence is pending. V25 preserves V24's ACK split and V23's featured internal NIC cadence of one NIC visit per three Network visits. Successful physical-tail reconciliation or prompt-tail queueing returns before phase selection; bounded backpressure may run exactly one compact Operator unit without ordinary-phase advance, and ready reboot remains exclusive. After AUTH and standard/timeout injection pass, run the focused direct base `.coh` batch, the Hive Gateway REST core/parity batches plus Python smoke, and Conditional B2's exact-three executable QEMU pressure. Run Conditional D's no-retry `1 MiB`, `10 MiB`, `100 MiB`, and `1 GiB` telemetry matrix separately against the exact packaged gateway's explicit host-model backend. Regenerate compiler-owned default/QEMU/Pi projections and hashes for the V12 provenance change; Pi scheduling, placement, and V23 root-control truth must remain unchanged, and any unrelated drift is a blocker. Stage 03, Hive Gateway REST regression, Conditional B2 executable QEMU pressure, Conditional D host-model comparison, and complete host-tool acceptance remain withheld until the v25/root-fault-V6/child-V12 same-boot peer-close/relisten and generation-fence gate plus unchanged v15 QEMU gate and bounded NineDoor QEMU containment pass; Pi acceptance additionally requires fresh Pi containment and target-performance evidence. - docs/ARCHITECTURE.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md + docs/USERLAND_AND_CLI.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md — preserve authentication, sole-listener, transport-confidentiality, external ACK/ERR/END, fixed page layouts, and operator-priority contracts while advancing the internal console contract to ABI v2 and schema 1.12 while recording the compact shared-page implementation, strict Operator/Runtime/Network unit boundaries, one-unit-per-refill child boundary, resumable root-control Recovery, exact live v5/v6/v7/v8/v9/v10/v11-root/v4-child/v12-v5/v13-v5/v14-supervisor/v15/v16/v17/v18/v19/v20/v21/v22 root, V22 secondary root-fault, V24 stale-control child failure, the exact V24 SerialIo timeout above, the QEMU-only V24 publication-ACK-unit split, the V25 temporal envelope/core placement, and the V25/V11 peer-close failure, V12 correction, and pending v25/root-fault-V6/child-V12 qualification plus the evidenced v15 supervisor entry. `USERLAND_AND_CLI.md` keeps its human-authored command, framing, grammar, and response contract unchanged; only its compiler-owned generated identity mirrors refresh. - focused runtime-source nomenclature — freeze the exact isolated-QEMU selector, `OrdinaryOperatorUnit::{SerialIo, SerialDispatch, RetainedOutput, NetEvent, NetLine, LocalSeat, DisplayAttach}`, the tiny `poll_split_ordinary_virtio_compact` phase dispatcher, and distinct noinline Operator leaves. In that compact dispatcher, `PhysicalResponseBarrier::TailInFlight` must call `reconcile_physical_response_barrier`, inspect the resulting barrier, and return if cleared or run exactly one compact Operator unit before return if still in flight. `!stream_end_pending && stream_prompt_pending` must call `queue_stream_prompt_tail_if_ready`, inspect the resulting pending bit, and return if cleared or run exactly one compact Operator unit before return on bounded queue backpressure. Ready reboot must retain its exclusive return. Each path must precede ordinary phase selection and preserve the ordinary, Runtime, and Network cursors; only a fallback Operator subcursor may advance. Only when no predispatch duty applies may the dispatcher read `ordinary_service_phase`, commit `phase.next()`, and dispatch one existing phase. The compact selected path must never call `poll_generic`, `poll_ordinary_operator_turn`, or a generic Runtime body. `SerialIo` calls only the bounded RX-only serial probe and may retain `SerialDispatch`; retained `SerialDispatch` is selected before a new probe, commits `RetainedOutput`, and owns serial consume/echo plus TX flush. Neither unit may call the other's work or select another material leaf in the same Operator. With no retained diagnostic, `poll_split_ordinary_virtio_network_turn` must read `ordinary_virtio_network_unit`, commit its `OrdinaryVirtioNetworkUnit::{Timer, Nic}` successor before work, and dispatch exactly one unit. Timer calls only `poll_runtime_timer_prelude`; Nic calls only one noinline `poll_one_split_ordinary_virtio_network_unit`, then retains one compact diagnostic observation after unchanged immediate flush, connection-id, and NineDoor ingest accounting. The former composite `poll_split_ordinary_virtio_network_prelude` must be absent. With a retained observation, the Network visit takes it before reading or advancing the Timer/Nic cursor, runs NETDIAG only, and returns; quarantine clears the observation but preserves the cursor. The distinct split Runtime prelude retains CYW43/HDMI reconciliation. Retain private `OrdinaryVirtioOperatorWork::{serial_input, serial_output, local_seat_input, dispatchable_network_line, pending_console_output, physical_response, stream_or_tail, reboot, serviceable_display, serviceable_frontier, serviceable_attach}` with pure `is_empty` only for the unchanged generic path, plus private `ServicePollUnit::{StackIngress, StackEgress, Session}`, public `ServicePollOutcome::{Continuation, Complete}`, and `poll_service_unit`. Root-fault must retain private `RootFaultCriticalTurn::{PrimeReceive, Receive, Classify, ResolveService, SuspendService, RecoverPassiveService, PublishService, SuspendCritical, SignalEmergency, ResumeService}` with the atomic default at PrimeReceive. Service classification selects the exact generated bounded timeout continuation or commits `ResolveService`; registry contention retains Classify and its pending fault. ResumeService commits Receive before one zero-label, zero-length kernel Timeout Reply; resolution owns one fixed generated lookup plus a nonblocking registry-lock/scalar-snapshot attempt and retries without loss; service suspension owns one quiet bounded syscall; only passive donated Calls select the at-most-one-Reply recovery unit; active console selects `PublishService` directly; and mailbox backpressure retains the snapshot. PrimeReceive commits Receive then yields exactly once without receive, Reply use, copied fault value, classification, cap lookup, suspension, or signal; every recurring return path commits Receive directly. For Session output, tests must require both `socket.can_send()` and complete-frame capacity before `send_slice`, retain closing-state output without commit or `OutputDrained`, and prove a peer-initiated `CloseWait` requests the existing graceful disconnect, retains exact-generation output until `close_ready`, then reaches `Closed`, exactly one `Disconnected`, and relisten through the existing path; other Session errors remain terminal. Tests must reject successful predispatch fallthrough, ordinary-phase or Runtime/Network cursor advance during housekeeping, more than one Operator fallback or fallback on helper success, cursor advance after rather than before selected work, more than one material compact Operator leaf, Timer/Nic composition in one visit, Network reconciliation, advancing the Timer/Nic cursor during NETDIAG, stale postlude retention across quarantine, any `Interface::poll` call in the v6 service path, composing ingress and egress in one service step, clearing `service_pending` on `Continuation` or error, treating unattached-seat flags or broad hints as Operator work, or applying the QEMU-only split when the exact selector is inactive. - focused lifecycle guards — require the child control reader to carry the committed `connection_id` into application, validate kind/payload/nonzero identity before stale classification, return `StaleConnection` only for a well-formed record not owned by the exact current session, publish the matching `ControlCompleted`, and neither enqueue bytes nor fault nor expose `OutputDrained`. Prove an ended connection and a newly authenticated replacement both reject the old control while the exact replacement control remains applicable. A real two-stack regression must drive a peer FIN without root disconnect control and prove `CloseWait -> request_disconnect -> close_ready -> Closed`, one `Disconnected`, cleared generation state, and restored LISTEN. Root boundary tests must keep the one-slot control in flight across `Disconnected` and release it only for exact `ControlCompleted`; isolated root output without an authenticated connection must return backpressure before line normalization or queue mutation. The QEMU root Disconnect transaction must set its issued latch only after successful publication, leave it clear on backpressure, retain the requested Quit reason across `ControlCompleted` and `OutputDrained`, refuse a second publication for that connection, and then let the unchanged lower cursor reach Ingress and ServiceTick. `Connected`, `Disconnected`, no-active, graceful terminal, and fail-closed transitions clear the latch for the appropriate generation. ATTACH tests must prove namespace preparation precedes local NineDoor authority commit, that commit precedes audit/logger/tracer observation, root session/`OK ATTACH` follows bridge success, and attachment itself cannot run the optional EP-only ping/ack loop. IPC source tests must prove the all-ready path reads all four gates before returning and cannot reach the shared bootstrap counter, tracer snapshot, formatting, or UART path; the cold not-ready path retains those diagnostics. - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU/Pi projections + focused real-stack runtime/compiler tests — advance only the console child lifecycle provenance to `m26e-qemu-console-peer-close-timewait-relisten-candidate-v13`. Preserve V12 as historical evidence: immutable set `out/m26e-qemu/peer-close-v12-20260813T133000Z` bound source digest `sha256:c047b0886ba42ba1dfe0004009a8e9377d4d2cbd98e997e8dfd463e4bc80eaa0`; raw session-1 AUTH, host close, and same-boot raw session-2 AUTH passed, then a `cohsh` session passed AUTH, ATTACH, four-line TAIL, END, and QUIT. Replacement AUTH timed out at `+5 s`, raw AUTH still timed out at `+30 s`, and UART recorded no fault. The read-only GDB reproduction in `out/m26e-qemu/peer-close-v12-20260813T133000Z/attached-teardown-gdb-20260813T134100Z` found all CPUs kernel-idle. QUIT made the server the active closer; smoltcp 0.13.1 retained the sole socket in `TimeWait` for its fixed `10 s` close delay and re-armed that timer for each incoming replacement SYN, so repeated probes could prevent passive expiry indefinitely. M26b Complete `72288c7d` explicitly treated `TimeWait` as terminal. V13 restores only that boundary: on `TimeWait`, call `TransportSession::end` once for the old generation, abort the completed TCP control block, and immediately relisten; retain the existing `Closed` path. A real two-stack exact regression must authenticate replacement connection 2 immediately and preserve one old-generation `Disconnected`, cleared auth/output state, and generation ordering. This changes no ABI/READY identity, schema, page, capability, timing, placement, grammar, authority, host retry, or timeout. V12 is failure evidence, not V13 qualification; fresh V13 target proof must repeat the raw two-session gate and then complete two sequential direct `cohsh` sessions, with the first END/QUIT active close followed by immediate replacement AUTH, before downstream regression or performance claims. - apps/cohsh/** + apps/coh/** + all `.coh` scripts + apps/swarmui/** + apps/hive-gateway/** + tools/cohesix-py/** + scripts/{m26e_qemu_pressure.sh,rest_perf_harness.py} + docs/BENCHMARKS.md — review V13 against the V12-compatible host and performance surfaces. V13 changes only the internal completed active-close terminal transition and provenance; it adds no verb, frame, ACK/ERR/END state, namespace or authority path, timeout, quota, benchmark workload, retry policy, evidence record, or report schema. No hand-authored host-tool, Python-library, workload, fixture, or report-schema change is required. Regenerate compiler-owned default/QEMU/Pi projections and hashes once; Pi timing, placement, and V23 root-control truth remain unchanged, and unexplained drift blocks the target canary. - docs/ARCHITECTURE.md + docs/ROLES_AND_SCHEDULING.md + docs/SECURITY.md + docs/INTERFACES.md + docs/USERLAND_AND_CLI.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md — preserve the V12 historical CloseWait correction and exact V12 target chronology while selecting V13 as current internal lifecycle provenance. `USERLAND_AND_CLI.md` receives no human-authored change because V13 changes no command, framing, grammar, retry, timeout, or response contract; its compiler-owned generated identity alone refreshes if selected by canonical regeneration. - apps/root-task/src/net/isolated_console.rs + apps/root-task/tests/isolated_virtio_network_phasing.rs + configs/root_task.toml + tools/coh-rtc/src/codegen/root_tcb_topology.rs + generated default/QEMU projections + canonical lifecycle docs — advance only QEMU root-control provenance to `m26e-qemu-root-disconnect-single-issue-candidate-v26`. Preserve V25 and V13 history. The immutable V13 artifact bound rootserver SHA-256 `d91c89bc9e076097e45085c92a368760ecf39cb36fbf1fede2faa9099d87f31d`, console child SHA-256 `4057c1b6a850ae806e2d9d5fde018ad88a831b66c606f4cf7a105ea38fe3f387`, and CPIO SHA-256 `bb60bfaf2b9b0775361ecc111b972ab8f8f9ae1b0d9d9afd672bac3e56e4cdf1`. In `out/m26e-qemu/peer-close-timewait-v13-20260813T140319Z/same-boot-two-complete-sessions-20260813T141000Z`, session A completed AUTH, ATTACH, four-line TAIL, END, and QUIT; same-boot session B connected twice but each authentication wrote 18 bytes and read zero, then failed after 21 seconds. QEMU remained alive, UART reported no runtime fault, and the exact child ELF contained V13's `TimeWait -> end -> abort -> listen` path. Root nevertheless kept `disconnect_requested` true after the first successful Disconnect. The child's `ControlCompleted` reopened the one-slot control page and `OutputDrained` marked that newest sequence drained, so the next strict `ObserveChild -> StageOutput -> Disconnect` pass published another Disconnect. Each successful child signal reset the lower cursor to ObserveChild; repeated transactions therefore starved Ingress and ServiceTick, preventing the peer ACK/FIN from reaching the child and preventing the packaged V13 branch from executing. V26 adds one per-connection issued latch: set only after successful Disconnect publication, unchanged on backpressure, retained across completion/drain while the requested Quit reason remains, and cleared on the connection/generation terminal paths. The next Disconnect visit becomes a no-op and advances to Ingress and ServiceTick. This changes no ABI/READY identity, schema, field, page, badge, capability, timing, placement, resource, grammar, authority, declared retry, or timeout; Pi root-control remains V23, child lifecycle remains V13 on QEMU and Pi, and V25's complete temporal envelope remains unchanged. Host tools, `.coh`, SwarmUI, Hive Gateway, `tools/cohesix-py`, benchmark workloads, evidence records, and report schemas require no hand-authored change. V13 is failure evidence for V26, not V26 qualification; a fresh exact V26 boot must complete the same two direct sessions before downstream gates. - retained V26 target result — preserve immutable artifact `out/m26e-qemu/disconnect-single-issue-v26-20260813T145200Z/artifact`, source digest `sha256:8c8ef66e0434852a9974bf9ba8d87e40062f46f4d6e9c95fc4496f7a28adda39`, root SHA-256 `6ec97ca4633e7d81ba75907ccc4080392385310a88c96a3239a2f8dea9b5d110`, child SHA-256 `4057c1b6a850ae806e2d9d5fde018ad88a831b66c606f4cf7a105ea38fe3f387`, CPIO SHA-256 `00474245ff59d239e87814ed97cf1c821c166989aca0c993ebcc42ed49f40317`, kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`, and exact same-boot evidence `same-boot-two-complete-sessions-20260813T150000Z`. Sessions A and B each completed AUTH, ATTACH, four-line TAIL, END, and QUIT without reconnect or target fault. This qualifies the narrow V26 Disconnect/relisten transition only; it does not qualify large responses, REST, performance, full Stage 03, or Milestone 26e. - crates/console-network-abi/** + apps/console-network-runtime/** + configs/root_task*.toml + tools/coh-rtc/** — V14 introduced console ABI/READY identity v3 under manifest schema 1.13 and binary root control `SendBatch = 3` inside the existing 2368-byte exchange payload: header `(encoding_version=1, count, used_bytes, reserved=0)`, one through eight exact records, and each record `(line_len, UTF-8 bytes)` with `1..=256` bytes and no CR/LF. The child validates the complete payload before mutation, retains one private batch, stages at most one external response frame per replenishment-bounded Session unit, and binds `ControlCompleted`/`OutputDrained` to the exact connection and batch sequence. After Session commits one complete retained wire frame, including the final batch frame, it retains exactly one following `StackIngress -> StackEgress -> Session` service cycle; the next no-progress Session completes and quiesces. Pending batch state or a capacity/sendability failure alone cannot retain that cycle. This avoids one root ServiceTick per batch record without a child self-spin, and `SendLine` remains supported. The first exact V14 target build stopped at the root image-binding layer before a root ELF or QEMU artifact existed: console child ELF SHA-256 `e16fc715975d4d73959c6536d9c4246058857040339c3c05a68721223a2d3f16`, 73,568 bytes, had page-rounded PT_LOAD span `0x200000..0x23c000` with the final LOAD ending at `0x23b540`, so it required 60 image pages while generated truth admitted 59. That is build-failure evidence, not target evidence. V15 advances the common child to `m26e-qemu-console-send-batch-60-page-candidate-v15` and reconciles only that exact footprint: 60 image pages plus 32 stack, one IPC, one init, and four shared pages total 98 frames; the additional retained frame cap raises root slots to 123. QEMU fixed/maximum frame-slot totals become `2018/4058` and `2066/4250`; Pi totals become `4066/8962` and `4114/9154`; adding the unchanged reserve yields admitted totals `2578/6298` and `4626/11202`. The four page layouts, offsets, notification objects, ACK badge 64, untyped bytes, timing, placement, and every non-frame/cap resource remain unchanged. Pi root-control remains exact V23; only its common child provenance/ABI/schema/resource selection advances to V15/v3/1.13 pending fresh Pi evidence. - apps/root-task/src/event/** + apps/root-task/src/net/** + focused root tests + configs/root_task.toml + tools/coh-rtc/** — advance only QEMU root-control provenance to `m26e-qemu-root-bounded-authenticated-response-lane-candidate-v27`. An exact authenticated connection may activate one generation/connection-bound response lane. One producer unit fills only the existing eight-line adapter queue; one Network unit performs exactly one useful ACK, egress, batch-stage, ingress, or child-service action; routine success diagnostics remain retained for ordinary service. After exactly eight response units, root executes exactly one ordinary Operator/Runtime/Network debt turn, preserving physical input, fatal output, timers, diagnostics, and ordinary cursors before resuming the same response identity. Terminal completion requires the exact terminal batch's `ControlCompleted` and `OutputDrained`; disconnect and generation fencing remain V26. V27 changes no budget, WCET, response-time admission value, SC, core, page, cap, badge, external line grammar, host retry, or timeout. - apps/root-task/src/net/isolated_console.rs + apps/root-task/tests/isolated_virtio_network_phasing.rs + configs/root_task.toml + profile-scoped coh-rtc oracles + generated default/QEMU projections + canonical lifecycle docs — advance only QEMU root-control provenance to `m26e-qemu-root-terminal-response-disconnect-fence-candidate-v28`. Preserve V27 and V15 as historical evidence. Exact immutable artifact directory `out/m26e-qemu/bounded-response-v27-v15-20260813T164606Z/artifact` bound rootserver SHA-256 `a2070492a08a8b30f0fbc15047443ec35ee82bd4c31345352a354479387cc8e8`, console child SHA-256 `e16fc715975d4d73959c6536d9c4246058857040339c3c05a68721223a2d3f16`, system CPIO SHA-256 `21530c54e416a4bb0690d383813de932379e990f4df6b00c1f6b785cc4330fa3`, kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`, and launch-record SHA-256 `87b615d808a7ba6f1789ee81a204145191e2fe730fba2f2b8b50e5323bf52ea8`. Its non-claiming evidence directory `out/m26e-qemu/bounded-response-v27-v15-20260813T164606Z/sendbatch-tail64-cat-20260813T165110Z` completed boot, AUTH, ATTACH, the 64-record TAIL, bounded CAT, and host-side script exit zero, then QUIT reached `closing session` before UART fail-closed with exact reason `response-completion-sequence`. V27 allowed the Disconnect control to become eligible from child-side output drain before root had retired the terminal SendBatch response lane's exact `ControlCompleted` plus `OutputDrained` identity. The resulting Disconnect `ControlCompleted` could therefore be observed while that lane still owned a different terminal batch sequence and was correctly rejected as a sequence collision. V28 adds only a root-local terminal-response fence: while any response lane remains present, Disconnect publication is ineligible; after the exact lane retires, the existing V26 per-connection issued latch permits one successful Disconnect publication, remains clear on backpressure, and prevents restaging. Preserve the V27 response cadence and ordinary debt, V26 one-shot lifecycle semantics, V15 child, schema 1.13, ABI v3, every resource/timing/placement/capability/badge value, external grammar, host retry, timeout, workload, evidence record, and report schema. Pi root-control remains V23 and common child remains V15. This target result is V27 failure evidence, not V28 qualification; the retained V28 result below qualifies only the fence and same-boot reconnect transition. - retained V28 target result — preserve immutable artifact `out/m26e-qemu/terminal-disconnect-fence-v28-v15-20260813T171339Z/artifact`, rootserver SHA-256 `ed20cddd0d2c7b269101a56cc548dec2e5d26f648923f505ee9743e5eaf0efec`, console child SHA-256 `e16fc715975d4d73959c6536d9c4246058857040339c3c05a68721223a2d3f16`, system CPIO SHA-256 `02bd7f7b914ca070ad06b43e0f15066d59fbad6a7419bdacb4cea2e46cf2b9df`, kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`, launch-record SHA-256 `0937cebd1af7035ab2028558c7c9a66ac6440252ba5062717d3f376b406eed2a`, and resolved-manifest SHA-256 `1c1091695d958339b268340b6fddbe3bb70a6ffe65050e25757e4517d8477333`. Evidence `two-session-sendbatch-20260813T171736Z` recorded both sessions exit zero, one connection per session, 25 retained records between TAIL and CAT in session one, and zero UART terminal faults. This qualifies only V28's terminal-response fence and same-boot reconnect; it does not qualify generalized synchronous producers, Stage 03, REST, performance, or Milestone 26e. - apps/root-task/src/event/** + apps/root-task/src/net/** + apps/root-task/src/hal/cache.rs + focused root tests + scripts/qemu_tcp_response_matrix.py + tests/test_qemu_tcp_response_matrix.py + configs/root_task.toml + profile-scoped coh-rtc oracles + generated default/QEMU projections + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-bounded-synchronous-response-stream-candidate-v29`. For an exact isolated authenticated generation and connection, capture HELP, NETSTATS, SMP, and CACHELOG body lines plus the exact ACK or ERR terminal root-locally before publication, seal that response immutable, and drain it through the existing bounded response lane on later Network visits. Retain identity and cursor state across backpressure, preserve V27's eight-useful-unit/one-ordinary-debt cadence and V28's terminal Disconnect fence, and discard stale identity without publishing to a replacement session. CACHELOG takes one immutable newest-first snapshot: reserve its bounded vector before taking the cache-log lock, copy at most the existing 1920-record capacity while holding the lock once, render later, and return a typed bounded error on allocation failure. Conflicting physical synchronous producers receive bounded BUSY while the network response owns shared state. This changes no external verb, frame, line, ACK/ERR/END ordering, retry, timeout, authority, SC, core, page, cap, badge, placement, or resource numeric. Pi root-control remains V23; the common child remains V15 under schema 1.13 and ABI v3. - apps/root-task/src/net/stack.rs + focused root wrapper-delegation tests + configs/root_task.toml + profile-scoped coh-rtc oracles + generated default/QEMU projections + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-default-netstack-response-delegation-candidate-v30`. Preserve immutable V29 artifact `out/m26e-qemu/bounded-sync-response-v29-v15-20260813T190157Z/artifact`, rootserver SHA-256 `f60d716573afe3387360689b20f5e9012171a0c4e34ebdd7d4b21bf89811b9a6`, and resolved-manifest SHA-256 `983b5433ec4b4138ebc5bc05401393bcd6f623bae96e46d9ca4ad52694889adc`. Its fixed matrix completed AUTH and ATTACH, then HELP returned zero bytes before the unchanged 30-second client timeout. A read-only live snapshot showed clean root and child state. Breakpoints proved HELP reached root command handling and finished with `capture_started=false`; the selected live `DefaultNetStack` vtable used the trait-default bounded response identity and returned `None`. V29 implemented four isolated response hooks on `IsolatedVirtioConsole` but the selected enum wrapper did not delegate terminal-line publication, bounded response identity, response-lane inspection, or response-budget polling; it also omitted the preexisting `console_event_pending` delegation. V30 forwards all five hooks to every selected backend, with the VirtIO arm preserving the isolated implementation. This changes no capture, lane, child, external grammar, ABI, schema, resource, timing, placement, capability, authority, timeout, retry, workload, evidence-record, or report-schema contract. Pi root-control remains exact V23 and the common child remains exact V15 under schema 1.13 and ABI v3. V29 is failure evidence for the wrapper boundary, not V30 qualification. - apps/console-network-runtime/src/{kernel.rs,lib.rs} + apps/root-task/src/{console_network_service.rs,hal/console_network.rs} + configs/root_task*.toml + tools/coh-rtc/src/** + generated default/QEMU/Pi projections + focused runtime/compiler tests — select common child provenance `m26e-qemu-console-natural-postpone-full-budget-candidate-v16` under schema 1.14. Preserve V30/V15 history: immutable artifact `out/m26e-qemu/default-netstack-response-v30-v15-20260813T200444Z/artifact` completed HELP and NETSTATS before its child fault localized to the Yield SVC with two adjacent refills totalling exactly `3000 us`; the terminal timeout endpoint converted that exhausted fragmented refill into terminal service containment. Non-claiming local-Poll diagnostic artifact `out/m26e-qemu/local-poll-diagnostic-v30-v15-20260813T204840Z/artifact` then completed HELP, NETSTATS, and the correct first-call SMP body count of 16 on its first boot; the then-stale host oracle expected 26 and was repaired without changing target behavior. A second fresh boot of those same artifact bytes reached `root-console.start.ok` and then emitted `root-emergency fail-stop` before any TCP probe. These runs are failure diagnostics only and disprove promotion of V30/V15 with a terminal console timeout endpoint; neither is qualification. V16 gives only the active console child manifest policy `NaturalPostpone`: root leaves that child's TCB timeout-handler slot empty, so seL4 natively postpones an exhausted active SC until replenishment instead of manufacturing a console `Timeout` teardown. The standard fault endpoint remains terminal. The compiler still mints, reserves, badges, accounts, and registers the console timeout cap/resource for stable containment topology, but does not install it as the child TCB timeout handler. The child rechecks the coalesced badge and publication credit before every retained logical unit. Eligible retained private work uses local `seL4_Poll`; an idle or publication-uncredited child calls `seL4_Wait` directly, with no ordinary `seL4_Yield`. Natural postponement, not a source-level one-unit-per-refill claim, bounds a retained burst by the unchanged `3000 us / 10000 us` SC. Its honest WCET and QEMU response become `3000 us`; Pi response becomes `8100 us`; same-priority QEMU GPU/LoRA responses become `3600 us`. The already admitted QEMU core-2 demand remains `3800/9000 us`, and the Pi core-0 demand remains `9000/9000 us`; all other budgets, periods, priorities, MCPs, placements, resource counts, ABI v3 pages, ACK badge 64, external grammar, host timeout, retry, workload, evidence record, and report schema remain unchanged. - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + tools/coh-rtc/src/** + canonical docs + focused runtime tests — advance the common child to `m26e-qemu-console-authenticated-oversize-drain-candidate-v17`. V16 target regression exposed that an authenticated frame whose declared payload exceeded the child buffer was incorrectly classified as pre-authentication failure: it emitted `ERR AUTH`, closed the connection, and forced host reconnect churn. V17 queues exact `ERR FRAME reason=invalid-length`, drains exactly the complete declared payload across fragments, and resumes parsing only after that drain on the same authenticated connection. A payload above the 2304-byte command bound receives the same treatment. Pre-authenticated oversize remains terminal `ERR AUTH`. Preserve schema 1.14, ABI/Ready v3, V16's `NaturalPostpone` policy and local-Poll/direct-Wait cadence, every budget/WCET/response/period/priority/MCP/core, all pages/caps/badges/resources, external command grammar, client timeout/retry policy, workloads, evidence records, and report schemas. - apps/root-task/src/event/mod.rs + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-failed-stream-producer-retirement-candidate-v31`. Preserve the non-claiming V30/V17 Stage 03 artifact ID `sha256:466f8210e6aa98757f6393758bfed0cee24e15272f95e680a5263feab26ea90e`, root SHA-256 `47df96e2a444e507a6872bf43af5ddd47133f960c8daebdc2dba71d10f53b690`, and resolved-manifest SHA-256 `eb274d4358345ddef0d4a191d75fd2bd40ff98c6577f0135fd18cd599f9afbd0`. Its fixed matrix, `boot_v0.coh`, `9p_batch.coh`, and `host_absent.coh` passed. `observe_watch.coh` then received the correct typed invalid-path `ERR CAT`, but provisional ordinary `pending_stream` remained owned while `stream_end_pending` was false, so same-connection QUIT could not dispatch and timed out. V31 invokes the narrow `retire_failed_stream_producer` transition after failed CAT, LS, TAIL, or LOG only: it drops an uncommitted ordinary stream shell, while a committed/successful stream, synchronous response mode, and every other command remain unchanged. Preserve Pi root V23, child V17 on QEMU and Pi, schema 1.14, ABI/Ready v3, all scheduling/resource numerics, command/error grammar, retry/timeout policy, workloads, evidence records, and report schemas. This V30/V17 result is failure evidence, not V31 qualification. - apps/root-task/src/{debug_uart.rs,event/mod.rs} + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-bounded-routine-audit-buffer-candidate-v32`. Preserve the non-claiming V31/V17 Stage 03 run `out/m26e-qemu/stage03-v31-v17-20260814T005001Z`, invocation/source SHA-256 `21b37c19572ef05accf6258c602442d21cd2ee24ff9594a2a3e0d2ab489bfae3`, and base launch record SHA-256 `099e8de70ece2c38f38ebf1cd7d1b1acaf730e5baa5d7ca20d3ba6021ce2d94e`. Its base artifact ID was `sha256:a1f6953065daa1dac388ba249c302a0acf8563e3e75546da9f94a1ab9a1454f5`, with resolved-manifest SHA-256 `29f5c8c7a044fa3b9c611bad06be30904a6f77db43d17cabce53e30cfa89545e`, rootserver SHA-256 `919de64dfe7e69e627e7461e1f6822cc7714f3fbaf2171cb84b59592189084f9`, CPIO SHA-256 `62ba464d2613206526f8d2b3d001cbea233ba3b32d5a81e95885a2ec426bf12e`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. The fixed matrix passed 7/7, followed by passing `boot_v0.coh`, `9p_batch.coh`, and `host_absent.coh`. The first two rapid TAILs in `observe_watch.coh` passed. Its third TAIL reached target command begin, `tail.start`, `tail.stop reason=eof`, and command end with status OK, but `cohsh` received no complete response before the unchanged five-second deadline; CAT and QUIT were not reached. The gated image was built but never target-run: launch record SHA-256 `2925c2c8540e3b1034d0d949c4852a16d97b64439bde8eb9e5ddfad0a5820f04`, artifact ID `sha256:650b5b5c171f2cc18c0ad2ba3ffa2f65157625cd49c11b951e57c69f41765000`, resolved-manifest SHA-256 `2ae9b9afdcd3bf9c1cf90db81822636ca69cbbe66774bddb3aab542e099dd100`, rootserver SHA-256 `e1dc0c5664c4834e451c5bbc396cd98b9dc30130802e0a209f8a04fb198df0ee`, and CPIO SHA-256 `cfa93f1591b50928622ac8fc3a638afa2ab000c926e9830c6f099aad7270bfb8`, with the same source and kernel. V32 preserves V31's failed-producer retirement and all response scheduling, but routes routine command, session, TAIL, and NineDoor audit lines to the existing bounded log once either that log channel or the linked serial owner is active. Pre-handoff routine audit falls back to the existing diagnostic helper. V32 does not reroute ordinary console-failure, critical/fatal, or fail-stop sites; in the selected isolated QEMU failure path they retain raw UART. Preserve Pi root V23, child V17 on QEMU and Pi, schema 1.14, ABI/Ready v3, every scheduling/resource numeric, external response text/order, command/error grammar, timeout/retry policy, workload, evidence record, and report schema. This V31 result is failure evidence for V32, not Stage 03 qualification. - apps/root-task/src/{debug_uart.rs,event/mod.rs,serial/mod.rs} + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only QEMU root-control provenance to `m26e-qemu-root-private-routine-audit-idle-drain-candidate-v33`. Preserve the immutable non-claiming V32/V17 Stage 03 run `out/m26e-qemu/stage03-v32-v17-20260814T014606Z` and invocation/source SHA-256 `3e1d02dac334fbe0019f517b34a3aad13f483e52e9d07570b52d122391a14eb1`. Its base artifact ID was `sha256:105b33911515641a19cde0a7c670c848911c16e14134bdf00efcdeba418c0483`, launch-record SHA-256 `94d409d0b5bdae883c929defaf801ee3cbaeb2d88688bf690b71f40ff983199b`, resolved-manifest SHA-256 `03f72150a556b78a897ae291752c81d9def8cf283a930a8cd8b55b92464270e1`, rootserver SHA-256 `592b60dc45597f1ca29d646ae9cf0fd4c8df86298f393016ee915f0e91ce161e`, CPIO SHA-256 `2fd94dad9e75b43ea7eb8f42c38a4a587dc5e07a1c8f33cb10c2a6444fa29500`, console child SHA-256 `513ec72cf5174c2765d46696a41d28610b1171ee880b23720cfab0b261f51f40`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. Its fixed matrix passed 7/7 and `boot_v0.coh` passed. `9p_batch.coh` then wrote `batch-1`, `batch-2`, and `batch-3` successfully but failed line 12 because V32 routine command/session diagnostics entered public `/log/queen.log`; the bounded CAT preview was contaminated and did not contain exact ordered substring `batch-1|batch-2|batch-3`. One of 17 selected operational `.coh` scripts passed before the runner stopped. The gated image was built but never target-run: artifact ID `sha256:6b9b281b4c872c588154f5d9a309797d4ec20e263943e0920e49ca0af492f1f0`, launch-record SHA-256 `b4d7babfad21b2a70aa9311900e7f0692ecfbb6a4a772f5d933bd31909f8ace9`, resolved-manifest SHA-256 `aeb4e263793c7b25bc1c4fc00983e25de033298c71fa8ce447a5a24eae19e101`, rootserver SHA-256 `841ed16776c3dca1b1e3b1c6b7599d5a7b001e67f83f6a98cc889c33740688ad`, and CPIO SHA-256 `22c24fc9d72c4c66a820986869786ca596efe9f0707a1404e089ed8c2636d40f`, with the same source, child, and kernel. V33 removes selected-QEMU routine diagnostics from both the response path and public log. A QEMU-only, EventPump-private four-record FIFO retains routine command begin/end, session attach/detach, TAIL start/stop, NineDoor error, and CAT-ack diagnostics. Saturation or an oversized record drops only the new best-effort diagnostic and preserves older FIFO order, with no retry or fallback. `RoutineAudit` is the final-idle OrdinaryOperator unit: it attempts one nonblocking serial admission, pops only after success, and cannot run while response/input/stream/flush, retained-output, containment, network, or display work is eligible. Once admitted, the QEMU-only `SerialPort` provenance flag marks the complete staged TX backlog as audit-only. Ordinary `SerialDispatch` skips retrying that exact audit-only backlog while the UART remains stalled, so a newly eligible `NetEvent` and then `NetLine` can run before a later final-idle `RoutineAudit` retry. Admission of any nonempty ordinary serial record or bytes promotes the staged backlog to ordinary dispatch priority without reordering it; audit admission remains atomic and preserves FIFO plus exact `\r\n` framing. The public `/log/queen.log` contract is unchanged. Compile-time `net-backend-virtio` selection excludes the FIFO storage, provenance flag, and unit from Pi; Pi root V23, linked-runtime, legacy/non-VirtIO, ordinary console-failure, critical/fatal, and fail-stop paths retain their existing raw diagnostic route. Preserve child V17 on QEMU and Pi, schema 1.14, ABI/Ready v3, every scheduling/resource numeric, external response text/order, command/error grammar, timeout/retry policy, workload, evidence record, and report schema. The V32 result is failure evidence for V33, not Stage 03 qualification. - V33 Stage 03 CAS-routing repair — preserve the immutable non-claiming run `out/m26e-qemu/stage03-v33-v17-20260814T024137Z` with invocation/source SHA-256 `4c186a1114d06b7fc1744ff49f7553363d49f6924fec9d4fc2a431cebfde94ec`. Its base artifact ID was `sha256:e3f5108fdeb3e4e190a879dd7ec63b7857cbffaf9b1a28bb08badad700ee1cf2`, resolved-manifest SHA-256 `aeb07bd7f8c78a2f070a156817f19d00d1789070feeb18c5cd5f9b61abc312e1`, rootserver SHA-256 `8cdcfb9de60aa91f5e1758ee853e2835fc7c8dc94dc69b443d5c92022d64c508`, CPIO SHA-256 `07f4a9eb864467e98aca709ac7e1bbc6851695adfa8830c841f2d49569d04d5e`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. The fixed matrix and seven base `.coh` scripts through `busy_backpressure.coh` passed. `cas_roundtrip.coh` then failed at line 22: its first two 96-byte manifest fragments were incomplete CBOR and correctly returned `OK`, while the third completed a manifest signed by the repository fixture key `207a0678…`; the operational base profile correctly verified against public key `9d96cc26…` and returned `ERR ECHO reason=policy detail=denied ... EPERM`. The gated artifact was built but never target-run: artifact ID `sha256:9391ad8b68ec149909cd9364b723567d1efdd6da801d0acd1331a5bf6def84e3`, resolved-manifest SHA-256 `d043d827ea98f57248d6838b2bff6d56f18fd4ba6fd2250545b5f76a8d66699f`, rootserver SHA-256 `e91855a1814174ddb60d18d7f2c1f3108d92c8610a02714f609e91e25090162c`, and CPIO SHA-256 `ebf9b4d377efd922e1c8c668530c0a7bfa221f971b53d104377ca4bfa74cdd33`, with the same source and kernel. This is a harness trust-profile routing failure, not a target CAS defect or V33 qualification. Keep the operational public key and private signing material boundary unchanged: base QEMU and Pi run only `cas_fixture_signature_rejected.coh`, while the full fixture-positive resume/signature/delta `cas_roundtrip.coh` runs only in the QEMU gated fixture-key artifact. A full QEMU batch is exactly 18 `.coh` scripts plus the fixed matrix, for 19 recorded workloads; a full Pi batch remains exactly 17 `.coh` scripts, with no fixed matrix and no fixture-positive CAS upload. Focused QEMU base is 10 `.coh` plus the matrix, QEMU gated is four common gated scripts plus one CAS fixture script, Pi base is 10 `.coh`, and Pi gated is the four common scripts. The unrelated policy-preflight assertion is not part of the CAS fixture-positive script. - V33 target-local policy/replay routing repair — the same Stage 03 selection audit found that `policy_gate.coh` and `replay_journal.coh` still named fixture-populated `/host` children. Their live QEMU/Pi gated coverage uses uniquely named, approved session-local `/queen/ctl` binds from `/proc/boot`: PolicyFS proves missing approval, consumption, applied alias readability, and one-shot refusal; ReplayFS records successful Cohesix control ACKs, matches from cursor zero, and rejects a future cursor. `QUIT` clears the binds, and no Worker, lifecycle, provider, or predefined-host state is created. The intended bounded audit and decision records remain same-boot state. - apps/root-task/src/{event/mod.rs,serial/mod.rs} + focused root regressions + configs/{root_task,root_task_regression}.toml + exact coh-rtc oracles + canonical docs — advance only selected-QEMU root-control provenance to `m26e-qemu-root-single-byte-routine-audit-drain-candidate-v34`. Preserve the immutable non-claiming V33/V17 Stage 03 run `out/m26e-qemu/stage03-v33-v17-20260814T031936Z` and source digest `sha256:6e5a11b51a744d584a1d839421a047b21bd2093aa2d4840ecee2797100ca668c`. Its base artifact ID was `sha256:33007af1046bbf1bb4b09a60182104f5224d807e1f17c2c3ad0929f5675af238`, with rootserver SHA-256 `7c4a8eaca8aba695a3aefd294e06379d831f5d2b8719627a08a5342a6df398ef`, resolved-manifest SHA-256 `aeb07bd7f8c78a2f070a156817f19d00d1789070feeb18c5cd5f9b61abc312e1`, CPIO SHA-256 `af683916fdbd2eba0bf6eca3c3e3e15613482484933ea763dcfbaf941441c938`, and launch-record SHA-256 `0ea06f80a124dd474215e04214587236b504e65a15ea2dbdd3726d8e9883345b`. Its gated artifact ID was `sha256:de3a14760a8d6df84c69f24e289f0c51f54de16a4802d6ec880b9358e5055dbb`, with rootserver SHA-256 `11460ae9449bcaa6a6ff462dc0f00ea58f454e09f101a630f9e41a46dfdb80d1`, resolved-manifest SHA-256 `d043d827ea98f57248d6838b2bff6d56f18fd4ba6fd2250545b5f76a8d66699f`, CPIO SHA-256 `de7bf9c197b39fc17325c2c0b36288f553d6f42e83a3ad1a89e3fb606acc7c01`, and launch-record SHA-256 `b452eb2f1a671928899d711bf82d83c0e9506d21ffe411c195ae44eaa717fdde`. The fixed matrix passed 7/7, then `boot_v0.coh` and `9p_batch.coh` passed. Immediately after the final successful QUIT audit and before `host_absent.coh` could authenticate, root-emergency fail-stopped. Exact same-base-artifact GDB evidence at `out/m26e-qemu/v33-post-9p-critical-gdb-20260814T035000Z` captured root-fault classification at `commit_root_fault_suspend` with task index `0`, timeout badge `0x26ee0001`, and seL4 Timeout label `5`, proving root-control exhausted its temporal budget; the emergency and `host_absent` failure were downstream. V34 changes only selected-QEMU routine-audit physical TX: each eligible final-idle `RoutineAudit` Operator visit may transmit at most one byte, while the complete record and its audit-only provenance tag remain retained across later visits until the record drains. Response, stream, input, retained-output, containment, `NetEvent`, `NetLine`, display, and ordinary serial priority are unchanged. Preserve Pi root V23, child V17 on QEMU and Pi, root-fault V6, schema 1.14, ABI/Ready v3, every timing and resource numeric, external response text/order, command/error grammar, timeout/retry policy, workload, evidence record, and report schema. This V33 result is failure evidence for V34, not Stage 03 qualification. - compatibility and promotion gate — the complete host-tool suite, including `coh`, `cohsh`, `coh-status`, Hive Gateway, SwarmUI, `gpu-bridge-host`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, and `cas-tool`, plus every `.coh` script, `tools/cohesix-py`, `scripts/m26e_qemu_pressure.sh`, and `scripts/rest_perf_harness.py`, continues to consume unchanged external `OK`/body/`END` lines. Historical V34 changes only selected-QEMU private routine-audit physical-TX granularity. The reopened M20f restoration below changes only `cohsh` pooled attachment bookkeeping: a cold, disconnected, reset, or changed exact authority still performs the existing authenticated wire ATTACH, while later logical leases for the same attached role and normalized ticket allocate host-local session IDs without another wire ATTACH; pooled QUIT remains a no-op. These changes alter no public `/log/queen.log`, grammar, response order, timeout, retry, namespace authority, Python contract, benchmark workload, evidence record, or report schema, so the other host-tool and library implementations and schemas require no compatibility edit. The Stage 03 CAS script selection changes only which declared trust profile exercises each existing signature outcome. Existing `scripts/cohsh/9p_batch.coh` remains the direct unchanged-log oracle and must receive exact ordered `batch-1|batch-2|batch-3`. The fixed one-socket QEMU matrix must return HELP `15 + OK`, NETSTATS `19 + OK`, first-call selected-QEMU SMP activity `16 + OK`, and CACHELOG `9 + OK`, then PING and QUIT without retry or reconnect and within the preexisting client timeout. The authenticated oversize regression must then receive exact `ERR FRAME reason=invalid-length`, drain the declared body, complete QUIT, and observe EOF on that same connection with no retry or reconnect. A refused CAT/LS/TAIL/LOG must likewise emit its exact typed ERR and then complete QUIT plus EOF on the same connection, with no retained provisional ordinary stream, retry, or reconnect. The internal 1920-record CACHELOG ring capacity remains an implementation bound, not a separate 1920-record/five-second promotion gate. The Stage 03 base boot runs the fixed matrix before its operational `.coh` group; it excludes fixture-only `scripts/cohsh/host_sidecar_mock.coh`, because operational `/host` begins `unavailable source=none` with no predefined units until an authenticated host snapshot populates it. Isolated `policyfs` and `host_sidecar_policy` fixtures retain restart approval/EPERM/consumption coverage without producing live host evidence. A missing, duplicate, reordered, or unexpected body or terminal line, public-log contamination, timeout, retry, reconnect, fixture-selection leak, multi-byte routine-audit TX visit, lost record, lost audit-only tag, or extra pooled wire ATTACH/QUIT fails Stage 03. The V34/V18 requirement is retained as historical failure chronology. Fresh V35/V18 exact-artifact evidence must prove standard-fault terminal containment and root budget-exhaustion natural-postponement liveness/isolation; it must not expect a root-control `Timeout` teardown. Stage 03, REST, performance, and Milestone 26e promotion remain withheld until those gates and all later applicable stages pass. - V34 Stage 03 telemetry-fixture repair — preserve the immutable non-claiming run `out/m26e-qemu/stage03-v34-v17-20260814T040349Z` with source digest `sha256:9852bb0c7dfc5fb7029f84e434ee1831acac5eb6716d94d3a83223ae5d107fc6`. Its base artifact ID was `sha256:054abe6b2e33bb22d3ff30c18c35c1f6292c64a687d1b1308e0ca96de9ab0ef2`, with rootserver SHA-256 `8d476189ee8f17c7d3514285082a2a9e0cab0bc7e3452b97523d8d5c4fff5ed3`, resolved-manifest SHA-256 `df9fec5f01854a873437fe9938443ac8f67fc7a3f3778b5ad517fd3199110ae3`, CPIO SHA-256 `e358bf089084a0fde0d7c7b76ebbaa50ad95f06b2d03fb5774a80de0332b6248`, and launch-record SHA-256 `2b476508b62a48a693b8605c4becb16ceafe1ca683c269fceb0405e135eb8a50`. The fixed matrix passed 7/7 and all ten base scripts passed. The fresh base-telemetry boot then completed the expired-ticket, scope-denial, spawn, twelve 90-byte telemetry writes, ring wrap, and 64-line log TAIL transitions, but `telemetry_ring.coh` line 56 expected `ERR ... ELIMIT` from a later CAT and received `OK CAT`. The old ticket encodes a one-request-per-second `/log` read scope, no explicit bandwidth quota, and one telemetry cursor advance; current manifest resolution therefore gives it the `131072`-byte default, while `/log/queen.log` is not a telemetry cursor path. The multi-turn TAIL can cross the one-second rate window, and selected-QEMU routine diagnostics are private, so elapsed time or incidental public-log volume is not a deterministic quota oracle. Replace only the short-lived pre-workload denial ticket with an otherwise scoped, bootstrap-signed `bandwidth_bytes=8` fixture, prove CAT `ELIMIT` immediately after the existing write `EPERM`, then detach; retain the existing operational ticket and complete wrap workload, and remove the late timing-sensitive CAT. The gated artifact ID `sha256:b71799152fed6e06124a62933d256b22f4091557abf79c71c671168bbe2dcece` was built but never target-run. This repairs only script authority and its structural oracle; it changes no target implementation, manifest, generated artifact, public log, quota semantics, timing, workload payload, grammar, or acceptance boundary, and the run remains failure evidence rather than Stage 03 qualification. - V34 Stage 03 pooled TCP safety restoration — cite discovery task `m26e-console-network-service-isolation` together with Reopened Milestone 20f task `m20f-cohsh-tcp-pool-safety`, whose existing contract requires logical pool leases over one locked TCP owner without extra ATTACH/QUIT. Preserve the failed staged run `out/test-plan/m26e-console-qemu-v34-v17-20260814T063134Z`, attempt `20260814T074732.814568Z-34073-6859f9f8537f`, source digest `sha256:599240eb411428ac7c973c8b346300ff3f9f9fa7e3b46bb2363573fbf5aa327c`, base artifact ID `sha256:61f24940ce81779d1372e801839e29ad5c36da805c1e58bbca8cb08762e5ca4a`, rootserver SHA-256 `792d3a79b475a0d103f96221a3cfe0c745bf6e26f82a9b2d84ea58dd5ec7a330`, resolved-manifest SHA-256 `df9fec5f01854a873437fe9938443ac8f67fc7a3f3778b5ad517fd3199110ae3`, CPIO SHA-256 `7d2d7afa5840adfde384c9e20769bd22c6a8082aec2527ef527a131806107912`, launch-record SHA-256 `2725b8d3fd7f51c53638fdd34c831c0f9e144bd46599038f7472d7f56f15eee5`, and packaged `cohsh` SHA-256 `689b523b32655681ae0005413c0d2d9c7e70dc39b58761d9c0728d36e3bec01d`. Stage 01 passed 21/21 and Stage 02 passed 2/2. Stage 03's fixed matrix passed 7/7 and nine base `.coh` scripts passed through `tcp_basic.coh`; `session_pool.coh` line 5 then failed during its ordinary 64-operation baseline, before the deliberate eight-byte short-write injection. Commit `a8a692da7e` had replaced pooled host-local lease allocation with an unconditional wire ATTACH, so the 24 logical telemetry checkouts advanced target session authority from the script's primary sid 11 through sid 35 before the baseline connection closed; reconnects accepted TCP but returned no AUTH response, and the runner stopped without a Stage 03 result or later-group execution. No root-emergency, fail-stop, panic, or unhandled target-fault marker was recorded, so the exact target close reason remains unproven. The gated artifact ID `sha256:ff567e69fef939430276775a0088921e1c1e08b530fd1ddcf30e82f08491fc85`, rootserver SHA-256 `9a7eb8a9d88778009bf3689049f5c30118e92056155e50ce59ee2137f5fd5c74`, resolved-manifest SHA-256 `3c7956af210a2e4b131c853e90315ff61c8c1a3d02176af401b9c48493d836e3`, CPIO SHA-256 `a7d3feb2b2da5b271b31a3304cf930b6ed33b8b3b6b36674ae438df8253ba235`, and launch-record SHA-256 `1298815ff35ecc121d7e109a2a5458f97a64735a27ca354b90ccb1758f189c81` was built but never booted. Restore the M20f/M25f contract in `PooledTcpTransport`: validate and normalize every requested ticket; when the live attached connection has the exact cached role and normalized ticket, allocate only a distinct host-local logical session ID; otherwise perform the existing real ATTACH so cold start, reset, disconnect, or changed authority remains target-proven. Keep pooled QUIT a no-op. The deterministic listener regression must prove one AUTH plus one ATTACH across 24 exact-authority logical leases, deterministic 25th-lease exhaustion, a subsequent PING, a second real ATTACH for changed normalized authority, and zero pooled QUIT. QEMU artifact v2 must also reject a duplicate or incomplete file inventory and content-bind all eight packaged host executables before any exact-version host-tool result. Fresh same-boot Stage 03 evidence must then prove no redundant pool ATTACH churn before the intentional short write, exact reconnect recovery, `expected=64 observed=64`, clean QUIT/EOF, and all remaining groups. The mixed old-target/current-host replay that later fail-stopped before reaching this workload is non-claiming diagnostic evidence only. This host-only restoration changes no target, wire grammar, target ATTACH semantics, timeout/retry policy, workload, evidence record, or report schema and introduces no target counter, delay, or clock dependency; QEMU's 24 MHz and Pi 4's 54 MHz generated timer truth remain unchanged, while fresh Pi execution remains separately required for Pi acceptance. - apps/console-network-runtime/src/lib.rs + configs/root_task*.toml + exact coh-rtc oracles + canonical docs + focused real-stack runtime test — advance the common child to `m26e-qemu-console-received-progress-retention-candidate-v18`. Preserve the failed canonical Stage 03 state `out/test-plan/m26e-console-qemu-v34-v17-poolfix-timerfix-20260814T092311Z`, resumed attempt `20260814T094657.522207Z-26353-639b8740c198`, and source digest `sha256:e69fb97d01a4199c77ff7f44b4a071d73e615a9d36e0f8013422545decbd0e62`. Its base artifact ID was `sha256:61453059dcc4f6eb91ee636e4eb3a7f52cb7ad056b90b640e0ffe7348e32eead`; its built but unbooted gated artifact ID was `sha256:f0b27ffef079cd5494d19e12e12797d969d1b050a55b514e668cd4c093d114a1`. The canonical QEMU 10.1.0 resume passed the fixed response matrix 7/7 and `boot_v0.coh`. `9p_batch.coh` then completed three writes, exact ordered CAT, and authenticated oversize `ERR FRAME reason=invalid-length`, but line 15 QUIT timed out with no response. The target logged the exact frame error and no root-emergency, fail-stop, panic, or unhandled fault. V17's Session unit retained `PollService` only after committing an outbound wire frame; consuming a bounded fragment of the already-buffered oversize body without such a commit returned `Complete`, cleared child scheduler `service_pending`, and blocked even though later body bytes and QUIT remained in the smoltcp receive queue. V18 treats every nonzero successful socket receive as durable private progress: Session returns `Continuation` and retains one fresh `StackIngress -> StackEgress -> Session` cycle; only a Session unit with zero received bytes and no committed wire frame returns `Complete`. The focused `buffered_oversize_body_and_quit_retain_service_until_same_connection_parse` two-stack regression buffers an oversize body plus QUIT together, proves at least four bounded Session reads progress with no fresh packet/control notification, parses QUIT on the same authenticated connection, and then quiesces on the first zero-progress cycle. Add no poller, synthetic wake, retry, timer, delay, or clock-speed assumption. Preserve QEMU root V34, Pi root V23, root-fault V6, schema 1.14, ABI/Ready v3, all timing/resource numerics, page/cap/badge layouts, grammar, response order, timeout/retry policy, workloads, evidence records, and report schemas. Because this is common child code, QEMU and Pi select V18 provenance; QEMU evidence cannot substitute for a fresh Pi build and hardware run at the generated 54 MHz timer truth. - V18 packaging-oracle closure — `tests/test_console_network_runtime_packaging.py` independently requires the exact `committed_wire_frame || received != 0` result after receive admission and after complete-send/commit ordering. Fresh Stage 01 attempt `20260814T102527.190708Z-45453-417ba8e027f2` passed 17 actions, then exposed only the stale V17 return-expression oracle after 1,773 Python tests and 7 subtests passed. The corrected focused file passed 11/11 and the complete standalone Python gate passed 1,774 tests plus 7 subtests. This host closure is not Stage 01 qualification; use a fresh state and source identity. - common root-control adjacent-refill temporal restoration — cite discovery task `m26e-console-network-service-isolation` together with the reopened Milestone 25 root-service temporal-restoration authority carried by `m26e-root-tcb-target-proof`. Preserve the immutable non-claiming V34/V18 staged state `out/test-plan/m26e-console-qemu-v34-v18-oraclefix-20260814T104728Z`, Stage 03 attempt `20260814T105938.465736Z-11947-27f75501fecd`, and source digest `sha256:f514ef3dfe5a76cd31e778a90b76e97b6cb78016a97be11b1be0b6587ed3ffab`. Stage 01 and Stage 02 passed. The Stage 03 base artifact ID was `sha256:11921e2eedbf8e9c46f781c500b89acdcb9669ebda42eb6db0ed21a4eb47dac3`, with rootserver SHA-256 `546de0283fd03b2bcfedc4876a96f5f41ea2071ce5b94aac627f4cf741638832`, resolved-manifest SHA-256 `7d267475fa010c369cb47f60a201f77186505f05222b73bdc89645f2b0a392fc`, CPIO SHA-256 `d44e33b75876129cdb60b8510088b48ad67d686bff2b943b13d11a286036281b`, and launch-record SHA-256 `3cab273fd5bac9f936194090384e278e45698b032e1eda5ddd25b486fc3607bd`. The gated artifact ID was `sha256:46ce91c8bffae218f557fedb19ec125cdded39118db641aee70db9e63949163b`, with rootserver SHA-256 `f28934ee16357b1aef5ac201b1cd654097cbd9bc0d1cbb5b0dde439cf78fdfbe`, resolved-manifest SHA-256 `8e3a9d1f2ab1b83715fbb42ee58672bcb57941ab76df98066c1bcafeded038fa`, CPIO SHA-256 `54ee771686e8e89164c1591a0a49308c4697d05f069b59da2640881d59c86e05`, and launch-record SHA-256 `5b8c27efeb8f2dbf4333392a93fe489cfa61f82521cda94b985fbbcc0ccd2de4`. The fixed matrix passed 7/7; all ten base scripts passed, including `9p_batch.coh` and `session_pool.coh`; and the fresh base-telemetry boot passed `telemetry_ring.coh`. `telemetry_push_create.coh` then reached its expected invalid-path CAT denial, the peer closed, and line 26's oversized telemetry push failed because every replacement connection wrote the complete 18-byte AUTH frame and read zero bytes. The staged runner stopped at that first failed action; this is not Stage 03 qualification. - exact immutable replay of that V34/V18 base artifact proves the adjacent-refill cause and bounds the restoration. Root-fault received task index `0`, timeout badge `0x26ee0001`, and seL4 Timeout label `5`; the saved root-control PC was immediately after the sole outer `seL4_Yield`. Retained EventPump successors identify an ordinary `Network` phase and selected `Timer` unit. Its tick `356343` was not a multiple of 8,000, so the timer-trace branch did not run. The adjacent refill amounts were the exhausted current `38,090` counter ticks and the already-valid next `93,910` counter ticks; together they equal the configured `132,000` ticks or `5,500 us` at generated QEMU `24,000,000 Hz`. The installed terminal timeout endpoint converted exhaustion of only the current refill, despite the already-valid adjacent refill, into root-fault classification and downstream `root-emergency` fail-stop; it does not falsify child V18, the Timer arithmetic, console grammar, or any host surface. Advance the selected QEMU root only to `m26e-qemu-root-adjacent-refill-natural-postpone-candidate-v35` and the selected Pi root only to `m26e-pi4-root-adjacent-refill-natural-postpone-candidate-v24`. Both root-control records select `NaturalPostpone`: retain the generated timeout cap, badge, resource, and registry identity, but omit the TCB timeout endpoint so current-refill exhaustion postpones onto the already-valid adjacent refill. The standard fault endpoint remains installed and terminal. Preserve QEMU/Pi root budgets, periods, deadlines, WCETs, response bounds, priorities, MCPs, refills, cores, reserves, timer clocks (`24 MHz` QEMU and `54 MHz` Pi), every other resource numeric, root-fault V6, common child V18, supervisor V15, schema 1.14, ABI/Ready v3, page/cap/badge layouts, grammar, response order, timeout values, retry policy, workloads, evidence records, and report schemas. - V35/V24 compatibility and promotion gate — this common root-control scheduling-policy repair changes no public schema, API, wire frame, namespace, command, ACK/ERR/END contract, workload, retry, client or protocol timeout, host-tool implementation, `tools/cohesix-py` contract, benchmark implementation, evidence record, or report schema. The complete cross-surface review covers `coh`, `cohsh`, `coh-status`, Hive Gateway, SwarmUI, `gpu-bridge-host`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, `cas-tool`, every `.coh` script, `tools/cohesix-py`, `scripts/m26e_qemu_pressure.sh`, and `scripts/rest_perf_harness.py`; no hand-authored compatibility edit is required outside canonical truth and generated target policy. Fresh exact V35 QEMU evidence must pass boot, fixed matrix, the full `.coh` regression harness including the V34/V18 failure sequence, root standard-fault terminal handling, root budget-exhaustion postponement/liveness, complete staged QEMU acceptance, Hive Gateway REST core/parity and Python smoke, the complete exact-version host-tool suite, the Python library gate, Conditional B2 exact-three executable target pressure, and the companion Conditional D host-model gateway matrix before promotion. QEMU evidence cannot qualify Pi. Fresh V24 Pi proof must use a regenerated `54 MHz` Pi profile, exact build and media identity, flash/readback, cold boot, the complete applicable Pi staged/hardware path, standard-fault terminal handling, root budget-exhaustion postponement/liveness, operator and driver coexistence, host-tool/Python compatibility, and a Pi-selected target-performance path; Conditional D is only companion host-model gateway evidence. Until both exact targets pass their own gates, V35/V24 are selected candidates and the V34/V18 run remains failure evidence only. - Stage 04 REST operation-deadline restoration — cite active discovery task `m26e-console-network-service-isolation` together with Reopened Milestone 24e tasks `m24e-rest-client` and `m24e-cohsh-rest-transport`, Reopened Milestone 25 task `m25-smp-rest-regression-batch`, and only the deadline-composition portion of Reopened Milestone 25f task `m25f-gateway-broker-refactor`. The fresh V35/V18 staged state `out/test-plan/m26e-console-qemu-v35-v18-full-20260814T134855Z`, source identity `sha256:0a1c64ec92fc9f80d74e423972c2579872fc067fbf76370c54daf14e823b2821`, passed Stage 01 `21/21`, Stage 02 `2/2`, the fixed TCP matrix `7/7`, and all 18 selected `.coh` scripts. Stage 03 bound base/gated artifact IDs `sha256:d7f978d66935e93318892a09a7be426bc6083e55fc7237aaaea5d9ff332523f9` and `sha256:d0141863625f009280bab8f3bcbc085c0adc36dcdf978c116c9b42f0ac67c981` and completed with aggregate result `sha256:3cad4f939982e0d892ed9a92299bf9082345a601ee001f9489df032b61109e6b`. Stage 04 attempt `20260814T142002.169146Z-32864-8dc11c8651a4` then passed REST `boot_v0.coh` but failed `observe_watch.coh` line 8 with `ERR TAIL path=/proc/ingest/watch reason=gateway transport error`; QEMU remained responsive, the gateway retained one connection and one upstream ATTACH, and no root-emergency, fail-stop, panic, or target fault occurred. The Rust REST client had a three-second operation deadline even though the gateway may legally wait `5,000 ms` for broker admission plus up to the larger configured control/telemetry broker response deadline plus `5,000 ms` for HTTP response delivery. Define the client filesystem-operation response window as `5,000 + max(control_response_ms, telemetry_response_ms) + 5,000`; the canonical `120,000/120,000 ms` gateway therefore requires `130,000 ms`. Keep metadata, DNS resolution, connect, and response-body transfer separately short. Apply the composed window to the shared `GatewayClient`, the primary and every pooled `cohsh` REST transport, the Stage 04 Python smoke, and Stage 04 readiness/core/parity calls. Stage 04 must configure and retain the local gateway's two broker deadlines, or require an external gateway to declare both; an explicit client window below the composition fails before execution. This repair changes no HTTP endpoint, request/response schema, target wire frame, command grammar, ACK/ERR/END meaning, namespace, authority, Stage 04 concurrency, pool size, workload, retry policy, performance error budget, or performance report schema. Compatibility review covers the eight packaged host executables (`cas-tool`, `coh`, `cohsh`, `gpu-bridge-host`, `hive-gateway`, `host-sidecar-bridge`, `host-ticket-agent`, and `swarmui`), `tools/cohesix-py`, and `scripts/rest_perf_harness.py`: shared Rust consumers inherit the safe default; `cohsh` additionally exposes the checked override; the Stage 04 Python caller supplies the same explicit window without changing the library's public default or retry policy; and the performance workloads, no-retry semantics, and report schema remain unchanged. This is a host deadline-alignment repair, not new Stage 04 acceptance; rerun Stage 04 and every later applicable gate against a fresh source-bound artifact. - Stage 04 runner-environment provenance restoration — preserve exact state `out/test-plan/m26e-console-qemu-v35-v18-rest-timeout-enumbound-20260814T150747Z`, attempt `20260814T153840.420898Z-83984-3692079da030`, and source digest `sha256:9e782b7b531895b5e30954e16bb28b6fd460b29e42a2d0fadfabb5251e057f56`. The Stage 03 base artifact verified, local QEMU and Hive Gateway became ready, the concurrent REST core batch passed `boot_v0.coh`, `observe_watch.coh`, and `session_pool.coh`, the parity batch passed `rest_control_plane_smoke.coh`, the Python REST smoke passed with 12 root entries and a 12-byte lifecycle state, and the Stage 04 result wrote and verified as `sha256:6c971c409a8b352d5aef197e3cf40fca475f18f3b1a0275173b5502f7fe5a277`. Finalization nevertheless recorded `stale-inputs`: initial context digest `sha256:ee0a82e7448afebb6e8daaa10f9c85979dc8f39da7722b5609549de9ef4f6fc2` changed to `sha256:dbe746163ea96ed2d8b6485d3d8512f38d0cfbbaff2eeac42f9896f1a1898bde` solely because the Stage 04 process retained seven runner-owned exports absent from its initial context: `COHESIX_GATEWAY_URL`, `COHSH_REST_RESPONSE_TIMEOUT_MS`, `COHSH_REST_URL`, `COH_REST_URL`, `HIVE_GATEWAY_BROKER_CONTROL_RESPONSE_TIMEOUT_MS`, `HIVE_GATEWAY_BROKER_TELEMETRY_RESPONSE_TIMEOUT_MS`, and `HIVE_GATEWAY_URL`. Git HEAD, status, tracked diff, untracked inventory, source digest, action digest, toolchain digest, and the Stage 03 dependency attestation were unchanged. This is provenance self-mutation, not target, REST, external-concurrent-edit, or generated-restoration failure; the behavioral passes do not qualify Stage 04, its status remains `stale-inputs`, and Stage 05 was not reached. Before exporting any endpoint, deadline, auth, or FUSE helper selector, capture the exact inherited set/unset state and value of every Stage 04 runner-owned variable. Restore that snapshot before normal `tp_stage_complete` and before failure/cleanup delegates to `tp_stage_exit_trap`, preserving inherited values rather than merely unsetting them. Focused regression `test_stage4_restores_runner_owned_environment_before_final_context` must prove both finalization paths restore an inherited URL exactly, remove runner-created selectors, and retain the existing timeout composition. A fresh source-bound Stage 04 run is still required. - Stage 04 immutable PASS and Stage 05 due-diligence selector isolation — preserve exact state `out/test-plan/m26e-console-qemu-v35-v18-rest-timeout-envrestore-20260814T154759Z`, Stage 04 attempt `20260814T161701.848576Z-19430-73991892f2e6`, and source digest `sha256:c9736b7be1f5c14d16a2606f1259588e523b3fa03e33c774ac3f5040a80a4886`. Its initial and final contexts are byte-identical at context digest `sha256:9b90429e67bf72aec97941ee7e93eba99eeb0379624e8672b14f1c2f82a6a782`; the immutable passing Stage 04 manifest is `sha256:f475d77ecda220df2d1bb992d724a574175b0638691d87175bbdccc4051462de`. The Stage 03 base artifact verified, the local gateway recorded `5,000 + max(120,000, 120,000) + 5,000 = 130,000 ms`, the concurrent REST core batch passed `3/3` (`boot_v0.coh`, `observe_watch.coh`, and `session_pool.coh`), parity passed `1/1` (`rest_control_plane_smoke.coh`), the Python REST smoke passed with 12 root entries and a 12-byte lifecycle state, and result `sha256:de30a40d14f9e2e075c515c9e1f83cf3cd94d0662238c9f23afa045a0a64e98f` wrote and verified. That is immutable Stage 04 QEMU REST integration PASS for the exact source, dependency, artifact, and context, not five-stage or Milestone 26e acceptance. Following Stage 05 attempt `20260814T161937.357994Z-20575-399d58a7497f` passed `required-audit-assets` and `staged-evidence-state`, then first failed `stage-01-attestation`: recorded context `sha256:bc69f60f93bd1a670a3eb13e71476bb9c01cb8d086805f3d255599a75f1bec7d` recomputed as `sha256:a40a397cce804241bad65a1d8b0da96c0f5ee4167f6fb83985dbc7a00dc7a973`. Forensic reconstruction established exactly three additions in the verifier environment—`DD_GATE_LOG_DIR`, `DD_REUSE_STAGED_EVIDENCE_FROM`, and `DD_REUSE_STAGED_EVIDENCE_TARGET`—while source, toolchain, action, and dependency identities remained unchanged; no later Stage 05 gate ran. Keep the reused-stage verifier direct. `test_plan_evidence.selected_environment(scope, stage)` now records `DD_*` controls only for Stage 05 and ignores them for Stages 01-04, where they do not govern behavior, while each context continues to bind its applicable `TP_*` selectors, toolchain, source, and target. Focused regression `test_due_diligence_selectors_bind_only_stage_five_context` passed; the complete evidence suite passed 30 tests plus 5 subtests, and the complete due-diligence lifecycle suite passed 27 tests plus 2 subtests. Stage 05 and full acceptance remain open pending a fresh all-stage run. - CAS host-tool capacity-projection restoration — cite discovery task `m26e-console-network-service-isolation` together with Reopened Milestone 17 task `m17-cas-regressions` and Reopened Milestone 24e task `m24e-cas-tool-rest`. The exact historical QEMU state `out/test-plan/m26e-console-qemu-v35-v18-rest-timeout-ddscope-20260814T163813Z` passed all five stages for source `sha256:ea8bc5458e4ccbbcd1ecb2731030b66e7ec05782750534c0bf4a683a3fba9b60`: Stage 01 passed `21/21` with manifest `sha256:4320add56bd34ce7c4461507703eb6be4a22ee44b70424c4a8f5dedb5acc1f5f`; Stage 02 passed `2/2` with manifest `sha256:c9ae96134c2d2e2211c51e4524a98f1f6aa0654b75130a8ac5e596ef42ac6c03` and resolved manifest `sha256:72b6fdbd175150ec352f9345d99791a1d576cf01de47363aed2a64ad0c463a93`; and Stage 03 passed its full 19-workload selection (fixed matrix `7/7` plus 18 `.coh` scripts). Stage 03 bound manifest `sha256:71092307be0d3501b47b12191604d698656fcb773007ede12fda798ae961499d`, aggregate `sha256:b65136f01a90d0f06ba192cdfe7252a29dff5e5f113d72f613a2d6609dc4976e`, base artifact `sha256:2491dc27b6b27a939b4427742c517405376516c27fbcb00962da03f1036f3012`, and gated artifact `sha256:1b0345bc385ef50480a439fb274e72f11877e40ef70f9ce5bae58ca00bd9939e`. Stage 04 passed REST core `3/3`, parity `1/1`, and Python smoke with manifest `sha256:f0c960c1a4b4103b851b71fb928fa54a5c96b30a43abf35558d3c9bf81456bee` and result `sha256:a8cd9ded3369ba74daf4e21bdad144a1d49eba3eb8a92e6d13d069836fb3d246`; Stage 05 passed with manifest `sha256:f03756e37da6eaef8edea929da5512144d80f4608a4b7296c486b12dabeceb88`. - The exact-version post-pass under `out/host-tool-postpass/ddscope-stage03-20260815` then found the first later failure in the gated `cas-tool` REST upload. The gated artifact was `sha256:1b0345bc385ef50480a439fb274e72f11877e40ef70f9ce5bae58ca00bd9939e`; its packaged `cas-tool` was `sha256:9c9970f587faca3177bb7434f7c3e6288148c557464011ddbf7184d9f5d4e9be`, its generated gated CAS host template was `sha256:2472ebc6fe70834d2070d3f4344b35ae19b2298a9b62337f5a32a1c6fa2c032b`, the padded payload was `sha256:20154db1804eefa5ea8947cf340421a4d2970dd2e28aa3532c137db6889617b3`, and the packed manifest was `sha256:e27a58e015b8a3b0dcadbbb92dbab8c88415f06bdc106d5e30b0fc64dd5011d9`. The retained `tests/fixtures/traces/trace_v0.trace` is 1,073 bytes and the documented zero-padding produced 1,152 bytes, or nine 128-byte chunks. Manifest-v1 has always admitted at most eight chunks; the target correctly accepted the first eight and refused digest `247fbe6cb8e8f54887478fb4b4ffc1c8ca21324c5b0640db57fe638c0023196f` with typed `ERR ECHO reason=quota detail=buffer-full`. The packer and generated host template had not projected or preflighted that bound. Therefore the five-stage record remains valid only for its exact source and staged workloads; it does not close the later host-tool gate or qualify changed source. - Restore one shared `cohesix-cas` maximum consumed by the compiler, both target CAS implementations, and `cas-tool`. The generated host JSON template projects tooling-only `limits.max_chunks = 8` plus `limits.max_payload_bytes = chunk_bytes * max_chunks`; neither key is serialized into the unchanged eight-field CBOR manifest-v1 wire. A legacy template with no `limits` falls back to the shared eight-chunk maximum, while an explicitly present maximum must equal the shared value exactly and its byte capacity must match the selected chunk size. `--chunk-bytes`, when supplied, must equal the selected template rather than overriding it. Pack rejects over-limit input before creating a bundle, and upload rejects an over-limit legacy or foreign manifest before reading chunks or opening TCP/REST. These structural preflights do not reserve the independent bounded target store, which may still return typed `buffer-full` when other chunks or models consume global capacity. - Conditional B retains the full trace unchanged for replay and as the exact `1,073 -> 1,152` byte, nine-chunk negative pack preflight. It adds the 359-byte source fixture `tests/fixtures/cas/max_chunks_v1.txt` at `sha256:7f97db91e95d67b8cdd7baa194c563e2a03f94045a4e5c3282b4bb8e7fc3fda1`, packaged byte-identically as release `cas/max_chunks_v1.txt` with its digest sidecar. Extend that whole separately named fixture to exactly 1,024 bytes with the documented deterministic nonzero tail and require eight distinct chunk digests for the positive pack/upload lane; do not truncate or relabel the trace. This restoration changes no target capacity, namespace, ACK/ERR/END grammar, retry, timeout, authority, Python API, benchmark workload or report schema, evidence schema, root/child provenance, manifest schema, QEMU 24 MHz truth, or Pi 54 MHz truth. The host-only Python wheel checks are not target Python evidence; Conditional D host-model comparator execution and formal Python target projection remain withheld after the first Conditional B failure. No Pi image, boot, or hardware test ran, so QEMU cannot qualify Pi. Fresh exact QEMU artifacts and the complete staged, eight-tool, Python, and Conditional B2 executable-pressure post-pass are required; Conditional D remains separately scoped, and Pi acceptance remains a separate fresh 54 MHz build/media/boot/hardware and target-performance lane. - Conditional D population-authority restoration — cite active discovery task `m26e-host-worker-integration` together with Reopened Milestone 25f task `m25f-harness-large-scenarios-no-retry`. Exact source `sha256:43b401a632c964f6662ca4c2feaa7cc80f087dfa0e1677ea1c42ae68282c4ab1` passed all five staged QEMU stages, bound Stage 03 base/gated artifacts `sha256:e7b2f6e239e74513017193f667eb96fa9a5eb67f96910d2d4067cfbf30acefb8` and `sha256:95c263977d892f846d640292382fa1fccbcb73479d7e760c58b66715e50bdcfa`, and completed the exact-version CAS/host-tool/Python post-pass through the signed eight-chunk upload. The first Conditional D `telemetry-1mb` run then stopped before measurement: canonical `--population-mode host-model --fast-ramp` requested at least 24 Heartbeats through a live `backend_class=console-projection`, but the selected generated QEMU role matrix admits exactly one Heartbeat slot. The first approved spawn succeeded; the second approved same-role spawn returned exact non-retryable `ERR ECHO reason=busy detail=busy path=/queen/ctl`. Gateway control-write retryable/error/retry/exhaustion counters remained zero. An independent immutable-artifact canary retained at `out/host-tool-postpass/cas-capacity-releasefix-stage03-20260815/worker-slot-canary/worker_slot_canary.clean.out.log`, SHA-256 `7b6936448e40dbf9e88f8f2e025a719f07eeea4c9baef9c0cceb977dbaaca7da`, proved one admitted `worker-1`, the second approval consumed only for its refused mutation, exact Busy, and the original sole Worker still listed. This is `WorkerSupervisorError::SlotBusy` before `TARGET_HANDOFF`; it does not authorize policy restoration, handoff repair, target-capacity growth, Busy retry, or wire-error remapping. - Restore the benchmark owner boundary before population work. `scripts/rest_perf_harness.py` must require exact connected `backend_class=host-model` for synthetic high-count host-model population and reject `console-projection`, unknown, missing, malformed, or unreadable backend metadata before `/worker`, `/actions/queue`, `/queen/ctl`, or the benchmark start marker. Conditional D keeps its 24-to-120 population, operation weights, random-input policy, no-retry semantics, broker deadlines, 1200 ms gateway retry window, 1% error budget, and report schema, but runs each scenario against a fresh exact packaged Hive Gateway with the explicit in-process host model. Its report must retain `backend_class=host-model`, `proof_class=host-model`, no population cap, and the configured endpoint observed. Read-only `--mode perf` records the actual gateway backend without applying synthetic-population admission and does not derive QEMU or Pi proof from a console projection. Conditional B2 remains the distinct accepted-QEMU exact-three executable lane. The independently generated QEMU and Pi role maps currently both contain one Heartbeat, GPU, and LoRA slot, but their manifests, gateway contracts, and target evidence are distinct; a QEMU gateway or QEMU acceptance validator cannot qualify Pi. Pi remains a fresh Pi-selected 54 MHz build/media/boot/hardware and performance lane. This repair changes no target code, target capacity, public HTTP/console/NineDoor schema, namespace, ACK/ERR/END meaning, timeout, retry classification, Python API, generated target manifest, or benchmark report schema. - The first managed-host-model canary retained at `out/bench/perf-backend-managed-mock-canary-20260814T2030Z` proved the owner boundary and four synthetic Workers, then exposed the next exact comparator defect. `tail_worker_telemetry` issued one request for `/worker/worker-3/telemetry` with the inherited 256-byte ceiling. NineDoor's valid compact `cohesix-worker-observation/v1` response is 381 bytes, so Hive Gateway correctly returned HTTP 400 with `tail exceeded max_bytes 256`. The run completed 12 operations with 11 successes and one error, exceeded the unchanged 1% budget at `8.3333%`, and retained zero gateway broker exhaustion, timeout, or control-write retry counters. This is deterministic benchmark-input drift, not pressure, capacity, QEMU, Pi, gateway-retry, or target failure. Advance only the Worker telemetry read ceiling to the existing complete-state bound `8192`, make `--tail-bytes 8192` explicit in every Conditional D command and retained report, and state that revised results are not directly comparable to historical 256-byte Worker-tail runs. Keep the request single-attempt and leave the schema, response bytes, operation weight, ramp, timeout, retry, error budget, and report schema unchanged; do not truncate the record or copy the adaptive Queen-log path. The focused harness suite now passes 81/81, including the exact 381-byte host record, one legacy-path request, one canonical executable-path request, the fail-closed missing-path neighbor, and the final-interval endpoint arithmetic. The bounded repaired canary at `out/bench/perf-backend-managed-mock-tail8192-canary-20260815T204536Z` then passed all `12/12` operations, including exact `tail_worker_telemetry` `1/1`, with zero errors, unchanged 1% error-budget PASS, and zero pool exhaustion, timeout rejection, or control-write retry counters. Its retained summary is `managed-mock-tail8192_20260814T204537Z.summary.json`, SHA-256 `7160d41f19451f49d97b0c0a33ea1da20b1fcc80842f693532124901c48342c9`, and reports `backend_class=host-model`, `proof_class=host-model`, and `workload.tail_bytes=8192`. These are repair diagnostics, not final Conditional D or target acceptance; rerun complete source-bound acceptance and all four canonical scenarios. - The first full revised `telemetry-1mb` comparator retained at `out/bench/conditional-d-tail8192-diagnostic-20260815/telemetry-1mb` then exercised the exact 24-to-120, two-minute, eight-second, no-retry shape against packaged base gateway SHA-256 `d41cfb6de609bf059d70c4e05a2a0a78a005be1c1e96a74d33c463ae28cac4a6`. Worker telemetry passed `360/360`, but the run failed the unchanged 1% budget with `7,636` total operations, `643` errors, and error rate `0.08420639078051335`; summary SHA-256 is `fa10a29882582c0568f82afa54cd7eb8a7f1ff2d2d261ef4ecddcd051c97aadc` and gateway-log SHA-256 is `ee78b9782a8d50bcf018ef1025a17cb723dd3812cee516d06cad45e78fe95919`. Every error was an HTTP 503 from `schedule_write` or lease grant/preempt/quota after the host NineDoor model's cumulative control readback mirrors reached 8,192 bytes; target NineDoor already rotates oldest complete records within the same bound. Restore exact host/target parity in the shared schedule/lease/export mirror helper: reject only one individually oversized record, otherwise evict oldest complete mirror records before append, without changing the independent queue/list/window capacities, payloads, weights, retry classification, or error budget. The same failed report observed only `114/120` Workers because elapsed-time interpolation never began the configured endpoint before the run ended. Compute ramp progress so the configured Worker/intensity maximum is held for the final ramp interval; endpoint observation remains a qualification requirement. This diagnostic supplies no QEMU or Pi evidence and the remaining three scenarios were correctly not run after the first failure. - The repaired full-matrix diagnostic retained at `out/bench/conditional-d-tail8192-rolling-endpoint-diagnostic-20260815` used locally built release-profile Hive Gateway SHA-256 `e4a1a57ad868536b25ad17d9bfdabed7a7dd53b1a2d6d733515ca34835d56188` and the 24-to-120, two-minute, eight-second, no-harness-retry, 1% shape. `telemetry-1mb` passed `8,689/8,694` with five counted errors and rate `0.0005751092707614447`; `telemetry-10mb`, `telemetry-100mb`, and `telemetry-1gb` passed `8,571/8,571`, `3,038/3,038`, and `525/525` with zero errors. Their summary SHA-256 values are respectively `86fca194119947f499166b459691bbdd298de7292ed3b238521697b32e39103b`, `470f4d016e7ac4c65dea43f0447df37d0df53b8fed3d80de06a3a8fb157e33d7`, `94c0697e707ee9af3cedede7f7e70dc94699d0291c27db6d02d1276db75d9da5`, and `6238bfe04c6551e7a9bb6ab53e39f0f8ebaebe2ed2a406e1fbb8a752b54e27f2`. Every summary retained `backend_class=host-model`, `proof_class=host-model`, `tail_bytes=8192`, `worker_cap_limited=false`, and exact configured endpoint `120/120`; all four recorded zero pool exhaustion, checkout retries, timeout rejection, control-write retryable errors, control-write retries, and retry exhaustion. This is passing diagnostic evidence for the rolling-mirror and final-interval repairs in the host-model comparator only; it supplies no QEMU or Pi target evidence and does not replace a final exact-source rerun after the canonical chronology is frozen. The diagnostic retained `strict_control_errors=false`, exposing a canonical-authority contradiction: typed `buffer-full` could be projected as success even though TEST_PLAN and BENCHMARKS require every bounded refusal to count against the 1% budget. Final Conditional D commands therefore add explicit `--strict-control-errors`, require `report.workload.strict_control_errors=true`, and must rerun all four scenarios under that named comparator revision. Together, strict handling and `--no-retries` ensure a returned refusal is counted once without harness replay or success reclassification; the separately configured and reported 1,200 ms gateway control-write window remains unchanged. - The strict four-scenario Conditional D diagnostic retained at `out/bench/conditional-d-strict-rolling-endpoint-final-20260815` kept `strict_control_errors=true`, `no_retries=true`, `backend_class=host-model`, `proof_class=host-model`, and observed the configured `120/120` endpoint. `telemetry-1mb` recorded `9,730/9,687/43` attempted/success/error operations at rate `0.004419321685508736`, summary SHA-256 `e81ea8d40043d4b5f3f9462e8a44d80242c64572f64360cf2a00bb557e240929`; `telemetry-10mb` recorded `9,924/9,854/70` at `0.007053607416364369`, SHA-256 `a690509e030adf62b9c2881b36f77caa77aa99f1cb6a53e52e8831a1532528f2`; `telemetry-100mb` recorded `3,235/3,235/0`, SHA-256 `63e2e69cf594988de7a410fe51e2a20bc891fb8f8caf81b770d4e6c836021186`; and `telemetry-1gb` recorded `528/528/0`, SHA-256 `ae269cf8e3102a4e09decf46854182085bdbd635f725a988c31819dcd92bb345`. The first two runs admitted exactly 256 schedule entries, then classified their 43 and 70 semantic-capacity failures as generic HTTP 503 `other_errors`, with `buffer_full_errors=0`. Their aggregate error budgets passed, although the first interval-budget crossings were `0.02821522309711286` at the final `telemetry-1mb` interval and `0.01749271137026239` at `telemetry-10mb` step 13. Aggregate `report.reliability.error_budget_pass` remains the scenario verdict and interval crossings remain diagnostics, but the required lossless bounded-refusal classification did not pass. The matrix is therefore diagnostic and non-qualifying. The locally present release gateway was SHA-256 `e4a1a57ad868536b25ad17d9bfdabed7a7dd53b1a2d6d733515ca34835d56188`, but the summaries contain no source, Git, or gateway-binary identity and cannot establish exact-source Conditional D provenance. - Restore only the exact in-process `NineDoorError::Protocol { code: TooBig, ... }` schedule, lease, and export capacity cases to the canonical `ERR ECHO reason=quota detail=buffer-full path= error=buffer full`; retain the typed source error and leave unmatched paths, messages, and error codes generic. Hive Gateway preserves that canonical semantic refusal as HTTP `200` with `GatewayResponse.status=ERR`. Conditional D's joint strict-plus-no-retries handling counts each returned refusal once and performs no harness retry; the gateway's independent bounded retry window, cooldown, and counters remain unchanged. This changes no HTTP field, response-code catalog, NineDoor or console grammar, capacity, operation weight, workload, report schema, or error budget. - The following staged attempt retained at `out/test-plan/m26e-console-qemu-v35-v18-strict-perf-final-20260814T214011Z/evidence/attempts/stage-01/20260814T214030.244940Z-23431-989e20fcd8a5` bound source digest `6fa1cb471dc3191c8b035ddda2cfc7842e0fb77298a0a66221f6474ec095bf25` and context digest `89edf724bc379cc2406a75040e597113c972a233698fd523318cc25eb0892076`. Actions 1–20 passed; action 21, `host.rust-risk-ratchet`, stopped with exit `130`. Its action-record SHA-256 is `a5c6fcb017aee6dd8fc491265c0b5c59014e7fb42682aa5e50015e6efdc8b5bd`, action-log-slice SHA-256 `c1e9a2f3ef002979417cab98044f949773d9b7bae78028cadaaa37dfa11a680f`, failed Stage 01 record SHA-256 `a04d82aa5116c553cee929f47e5dc59f26e5beed2605729f692cd64c0bcc1c45`, and complete stage-log SHA-256 `b6f6512724d754d683f8b78c86299941b740f4b74565895eb15ed4b64210a551`. Stage 01 emitted no pass attestation; Stages 02–05 and exact-source Conditional D did not run. Nothing from this state may be reused as staged or Conditional D PASS evidence. - M26e production-surface release-truth closure — the strict release input-set check introduced with compiler-owned `configs/generated/root_task_topology.json` rejected the canonical source because `[release].generated_configs` omitted that tracked as-built topology while requiring an exact generated-directory set. Under active task `m26e-production-surface-truth-and-stub-retirement`, package the topology beside the resolved manifest and lock its selection in the release-manifest regression. Do not weaken the exact-set check, add a redundant topology sidecar, or rewrite historical bundles. This inventory-only correction changes no runtime, target image, protocol, host-tool, Python, benchmark, QEMU, or Pi behavior, but it must precede fresh source-bound acceptance so later release repair cannot invalidate the staged source identity. - Pi exact-a7 isolated-console cadence and current-contract correction — cite the same exact `a7dfa38b42beddfe5fa353ed8b5cbd0803212635` source, `ac42859d4aa14b7b0d4894b077dd3b8bb85b37fc397a6fab0e3a763a8d0de9c8` image ID, `ae43686674df7e01f25f12b7e693f535f8ebe8f943ea025c04ceb801e928396e` image SHA-256, `4231476a82e8cef643a26ac5fa126d1c6cae06d76fba09693af8dd2964d1195b` manifest, exact serial boundaries, and boot-paired `20260828-192427` captures under this task as well as `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. Functional WiFi TCP with 118.198-166.825 ms SYN response, 237.421-290.250 ms command response, about 3.2 KiB/s output and post-flush exhaustion 20 proves a root/child response-cadence defect rather than packet loss; 30/30 internal USB byte conservation without timely visible WiFi echo, versus healthy same-image GENET echo, separately proves presentation-arbitration debt. Preserve the target-falsified ordinary isolated lower rotor exactly one unit per Network visit. Only a nonzero retained response cursor whose identity matches both current active and authenticated connection may retain the root's already-guarded activation for its next separately charged useful response turn, and only after actual Network activity plus exactly one service-turn advance; stale identity, no progress, containment, quarantine, recovery, reboot, or operator rotation stops it. This is not a multi-unit child burst and changes no one-op/two-frame/fixed-byte charge, 8/16 response bound, ordinary debt, manifest or MCS numeric, child authority, physical-input priority, QEMU direct-VirtIO path, or external grammar. A partial local-seat line must take one bounded `Dispatch -> Display -> Serial` path before Network while retaining the immutable CYW43 parent/operator fence; a reboot acknowledgement or physical response tail retains immediate Serial priority and leaves echo queued. Reconcile current generated truth atomically: schema remains 1.15, console ABI and Ready identity are v5, and the convergence catalog rather than the generated TEST_PLAN table is edited before regeneration. Historical ABI v2/v3/v4 chronology remains evidence for those candidates, not current selected truth. At that exact-a7 chronology point, Direct-GENET diagnostic v2 kept the exact 192-byte layout while offset 108 reported cumulative physical-level DPC adoption and the `genet_direct_dpc` row added `level_adoptions`; the later exact-5f current contract below supersedes it with diagnostic-v3 raw receive-boundary evidence, the eleven-row focused fixtures, and the authenticated peer-driving helper while leaving console grammar, Python, REST, `.coh`, workload, benchmark, report-schema, generated-profile, and build/manifest consumers unchanged. Host/source/QEMU/image results cannot claim Pi latency, throughput, visible echo, WiFi/GENET parity, or acceptance; fresh exact-image dual-mode hardware evidence remains authoritative. Commands: - cargo test -p cohesix-cas - cargo test -p cas-tool - cargo test -p nine-door host::cas::tests::ninth_chunk_quota_refusal_preserves_exact_eight_chunk_state -- --exact - cargo test -p root-task --no-default-features --features driver-tests-qemu --lib ninedoor::tests::cas_ninth_chunk_quota_refusal_preserves_exact_eight_chunk_state -- --exact --test-threads=1 - cargo test -p coh-rtc --test roundtrip manifest_codegen_is_deterministic -- --exact - cargo test -p coh-rtc --lib implementation_surface::tests -- --test-threads=1 - .venv/bin/python -m pytest -q scripts/ci/test_check_implementation_surfaces.py tests/test_release_bundle.py - .venv/bin/python -m pytest -q tests/test_rest_perf_harness.py - cargo test -p coh-rtc root_control_turn_candidate_is_exactly_accounted - cargo test -p coh-rtc supervisor_cold_activation_candidates_are_profile_scoped - cargo test -p coh-rtc --test ai_lora_contract - cargo test -p console-network-abi -p console-network-runtime - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_attached_wifi_continuation_requires_one_productive_network_successor - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib linked_cyw43_rx_admission_honors_input_and_clears_on_guards - cargo test -p console-network-runtime buffered_oversize_body_and_quit_retain_service_until_same_connection_parse -- --exact - cargo test -p root-task --no-default-features --features driver-tests-qemu isolated_response_lane_pays_exactly_one_ordinary_debt_after_eight_units -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu isolated_help_capture_publishes_complete_body_then_one_terminal -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu private_routine_audit -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu stalled_routine_audit_uart_does_not_block_new_network_event_or_line -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu routine_audit_tx_tag_survives_empty_record_and_promotes_on_ordinary_admission -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu cat_queen_log_ack_includes_recent_echo_batch -- --exact --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu hal::cache::tests -- --test-threads=1 - cargo test -p root-task --test console_network_service - cargo test -p root-task --no-default-features --test mcs_activation_order -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-qemu --lib bootstrap::log::tests -- --test-threads=1 - cargo test -p root-task --no-default-features --test isolated_virtio_network_phasing -- --test-threads=1 - cargo test -p cohsh --test script_catalog - cargo test -p cohsh --features tcp pooled_tcp_uses_one_wire_attach_for_twenty_four_exact_authority_leases -- --exact --test-threads=1 - cargo test -p cohsh --features tcp -- --test-threads=1 - cargo test -p cohesix-rest - cargo test -p cohsh --features rest -- --test-threads=1 - cargo test -p hive-gateway -- --test-threads=1 - cargo clippy -p cohsh --features tcp --all-targets -- -D warnings - cargo build -p cohsh --release --features tcp - .venv/bin/python -m pytest -q tests/test_console_network_runtime_packaging.py - .venv/bin/python -m pytest -q tests/test_qemu_tcp_response_matrix.py scripts/ci/test_run_regression_batch.py - .venv/bin/python -m pytest -q scripts/ci/test_test_plan_evidence.py - .venv/bin/python -m pytest -q scripts/ci/test_rest_regression_batch.py - bash -n scripts/ci/test_plan_stage_04_rest_multiplexer.sh - cargo check -p console-network-runtime --target aarch64-unknown-none - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-qemu - cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4 - cargo fmt --all -- --check - scripts/check-generated.sh - python3 scripts/ci/test_plan_catalog.py recommend scripts/qemu_tcp_response_matrix.py tests/test_qemu_tcp_response_matrix.py - python3 scripts/ci/test_plan_catalog.py converge --target qemu --format json scripts/qemu_tcp_response_matrix.py tests/test_qemu_tcp_response_matrix.py - scripts/ci/test_plan_run.sh --list - scripts/ci/check_test_plan.sh - scripts/cohsh/run_regression_batch.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-console-qemu-v35-v18 - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-console-pi4-v24-v18 Checks: malformed packets/auth frames fault or fail inside the child; its active SC stays inside the generated `3000 us / 10000 us` budget/period and selected natural-postpone policy; historical ABI v2/schema 1.12 retains the publication-ACK transition, ABI v3/schema 1.13 added only the bounded binary SendBatch control, and selected schema 1.14 adds the manifest-owned console-child `NaturalPostpone` choice. V35 and Pi V24 additionally select the same kernel-native policy for root-control while preserving every numeric and external contract. V34 preserves V33/V32/V31/V30/V29's bounded synchronous capture, V27 response scheduling, and V28's terminal-response Disconnect fence while retaining V30's selected-wrapper delegation and V31's failed-producer retirement; V16 changes only the child timeout-policy/cadence contract and its derived WCET/response inputs, V17 changes only authenticated oversize rejection and exact declared-body drain, and V18 retains a fresh private service cycle after every nonzero bounded socket receive until a zero-receive/no-commit Session unit quiesces. V34 retains V33's selected-QEMU private routine-diagnostic FIFO and final-idle serial admission, but permits at most one physical audit byte in each eligible `RoutineAudit` Operator visit. The complete record and its audit-only tag remain retained across later visits until the exact `\r\n`-terminated record drains. Its private capacity-four FIFO still uses bounded drop-new saturation and never enters public `/log/queen.log`. A stalled UART cannot make ordinary `SerialDispatch` outrank a newly eligible `NetEvent` or `NetLine`; response, input, stream, retained-output, containment, network, display, and ordinary serial priorities are unchanged. The next admitted nonempty ordinary serial bytes still promote the backlog to ordinary dispatch without changing FIFO or exact byte order. Compile-time `net-backend-virtio` selection leaves Pi, linked-runtime, legacy/non-VirtIO, ordinary console-failure, critical/fatal, and fail-stop paths on their existing raw diagnostic route. All four fixed page sizes/offsets, ACK badge 64, and resource numerics remain unchanged; packet/control publication is true commit-last and bounded to the compact scalar header plus active payload; commit mismatch and oversized length fail before accepted-sequence advance; inactive padding conveys no authority; the child receives read-only root-to-child pages and read-write child-to-root pages only. Target disassembly must show bounded small page-helper frames, no whole-page aggregate load/store/copy, and a nested stack chain strictly inside 32 pages. The live QEMU run at source `290ef6028` reached readiness but failed its first authenticated packet with timeout badge `0x26ee0007` inside the compiler-expanded 4096-byte `PacketPage` read, followed by a root timeout before containment-mailbox drain; it is failure evidence and cannot qualify the repair. The compact-page live run at source `00bf02540` reached the root prompt and then timed out `root-control` at the console-network control poll, disproving the v3 combined Network/runtime-IPC phase; it is also failure evidence. The later live run at source `4d1a47b89` preserved all three outer phases but timed out in `VirtioTxToken::consume` after queue notify, falsifying v4's multi-unit Network visit rather than showing a device-completion wait; it also cannot qualify the repair. The subsequent live v5 run consumed exactly `3000 us` in `console-network-service` and raised timeout badge `0x26ee0007` at `Send` after `publish_exchange`, then consumed exactly `2750 us` in root Recovery and raised timeout badge `0x26ee0001` at the sole outer yield after containment/quarantine. Those failures invalidate the multi-material child turn and whole-containment root turn; they are not qualification evidence. The canonical v6 run used root ELF SHA-256 `0059fd675b476106888d6ca62c8bba21f9b340b9aa607e000fbf96997fd29900`. Its healthy child remained blocked on notification and no Recovery ran, but `root-control` consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at the sole outer yield after a Network visit attempted empty ObserveChild, no-op StageOutput and Disconnect, then committed and signalled the first 60-byte ARP ingress as sequence 1. This is failure evidence for v6's composed no-op lower path, not qualification. The canonical v7 run used root ELF SHA-256 `d2f69bddbf56deef6919ec6ea802e9d3c44a691c2dbe05aa59428854bbf7a6ae`. It reached the startup command list while the UART-visible `[mark] root-console.start.ok` record remained queued; the missing wire marker does not place source before the console lifecycle boundary. Before any ordinary Network or Recovery phase, `root-control` consumed exactly `2750 us` and raised current-fault class `Timeout`, badge `0x26ee0001`, at the serial queue's `inner_dequeue` (PC `0x43e84`) called by `SerialPort::flush_tx_unlocked` (LR `0x77b74`). This is failure evidence for v7's unbounded serial poll/flush composition inside one Operator turn, not a failure of its strict Network cursor, child loop, or resumable Recovery. The canonical v8 run used root ELF SHA-256 `5052e7a5070987c252d3c1f5cf6f27172bd5ece1836a8f6c2a5c329c789a0a61`. With the generated `64`-byte serial admission active, `root-control` consumed the complete `2750 us` refill and raised current-fault class `Timeout`, badge `0x26ee0001`, at PC `0xede84` immediately after `emit_prompt_now`. This is failure evidence for v8's remaining composition of multiple retained output records in one Operator, not qualification. The canonical v9 run used root ELF SHA-256 `fa488c9367136f0eadef7182a18691664c3ae51c2ac2974e12000ff5d27f38ed` and CPIO SHA-256 `aca549e99e0d86299e9f98348d896b730259277654544ebd22a74595b61e9bfb`. The direct command list completed under the bootstrap SC. In the first post-bind Operator, serial was idle, the one-record cursor remained full, and the retained marker plus prompt remained queued. `root-control` consumed the complete `2750 us` refill and raised current-fault `Timeout`, badge `0x26ee0001`, at PC `0x13a798`, the first instruction of `compiler_builtins` `memmove`; LR `0x79ccc` was `heapless::Vec::remove(0)` and `x2 = 0x110` described the prospective 272-byte move. Zero bytes were copied. This falsifies v9 through aggregate first-post-bind refill exhaustion, not through proven copy cost or a failure of its one-record bound. The canonical v10 run used root ELF SHA-256 `022908395c954f73a67136f70fe4404d96e0cf1ff16f4531fa95eae7a6f57cb5`. Its universal post-activation yield completed, and UART then emitted the retained `[mark] root-console.start.ok` record and prompt in separate bounded Operator visits. In the second fresh Runtime visit, `root-control` consumed the complete `2750 us` refill and raised current-fault `Timeout`, badge `0x26ee0001`, at PC `0xce98c`: the `seL4_NBWait`/nonblocking receive on root endpoint `0x0a70`. The Runtime successor had already committed Network, the output FIFO was empty, the one-record cursor was inactive, and the response barrier had crossed the emitted prompt. This falsifies v10's composition of Worker service, control-endpoint polling, bootstrap drain, stream flush, and reboot tail in one fresh Runtime refill. It does not falsify the retained activation, serial/output, Network, or Recovery boundaries. The same run recorded console timeout sequence 1, badge `0x26ee0007`, with Terminal policy. The saved child was at `seL4_Wait` with `service_pending = 1` and `control_pending = 1`: one logical unit completed, but its pending successor composed on the residual child SC. Recovery reached Complete with the TCB suspended, SC unbound, mappings scrubbed, capabilities revoked, objects deleted, and generation fenced; NineDoor remained healthy. This falsifies the v3 child replenishment boundary, not containment completeness. A fresh four-core GICv3 QEMU run must pass authentication and the exact two-session generation-fence canary before separate fresh-boot standard-fault containment and budget-exhaustion/postponement liveness-isolation injection, the full canonical `.coh` batch, Hive Gateway pressure benchmarks, or complete host-tool validation can begin. On one boot, session 1 must authenticate, attach, begin a streamed response, and close with a control still staged or retained; session 2 must then authenticate and attach. The old control must complete once without child fault or any byte entering session 2, and session 2 must receive its own bounded ACK/TAIL/END response while the sole listener remains live. After root-control binds its generated SC and timeout endpoint, one universal activation-seam yield must sacrifice the initial remainder and wait for the next replenishment before any containment probe or first Operator. Root-control then cycles exclusive Operator/Dispatch, Runtime/IPC, and Network phases across the sole recurring outer yield with the exact ownership and adjacency defined above; buffered TCP commands never execute in the NIC turn, runtime IPC never shares that turn, and physical input/output remains bounded and live. Each isolated QEMU Runtime visit selects exactly one persistent unit in the order Worker -> ControlEndpoint -> BootstrapDrain -> StreamFlush -> RebootTail, commits the successor before the compact isolated-VirtIO Runtime prelude, and returns to the sole outer yield. That prelude reads the HAL timebase and performs one timer poll. An observed tick updates `now_ms`, increments the timer metric, publishes HAL timebase, and runs the existing conditional timer trace; without a tick, `now_ms` takes the read timebase. It then reconciles CYW43 network-ready HDMI state and must not execute the generic Runtime-without-control tail. Worker consumes at most one pending mailbox operation or checks one retained Heartbeat/GPU/LoRA role slot; ControlEndpoint performs at most one poll and its immediate forward; BootstrapDrain takes exactly one staged `Option`; RebootTail owns its visit. The MCS fault poll is absent from the cursor. StreamFlush uses distinct visits for its terminal sequence: one visit emits one retained final line and returns; the next no-line visit performs cursor/bandwidth finalization only and returns; the third visit emits END only and returns. Every earlier line likewise uses its own visit. Legacy Pi/non-VirtIO Runtime retains its existing 48-line/16-KiB bound. Each isolated VirtIO Operator must create one generated `64`-byte serial-I/O credit, share it across every root-context RX poll and TX flush, and retain unfinished bytes after exhaustion. Entry-time TX backlog reserves exactly `32` bytes for TX and caps RX at `32`; without entry backlog RX may consume all `64`. Tests must reject helper-local credit reset, total service above `64`, pending output starvation under sustained RX, or application of this cut to linked-runtime/Pi paths. With a nonzero generated VirtIO serial bound, the Operator must attempt at most one retained output record and preserve every later FIFO and response-tail record for a later Operator. Tests must reject a second record attempt or helper-local reset of that admission; Pi and non-VirtIO turns must retain the existing two-record attempt limit and prior phasing. Each isolated Network visit must attempt exactly one internal unit, including a no-op. The persistent lower cursor must cycle ObserveChild -> StageOutput -> Disconnect -> Ingress -> ServiceTick -> ObserveChild. Every no-op advances; every successful unit that signals the child forces the next lower attempt to ObserveChild. A pending compact normal-success diagnostic emits first, at most once on a non-publish visit, and returns. Otherwise retained TX preempts the lower cursor, performs no more than two reclaim checks, atomically attempts at most one TX plus any required notify, and returns on success or backpressure. Both preemptions must preserve the exact lower cursor and forced-observe state. The bounded gate must sample successful attempt sequences 0 through 63 and every 64th eligible success thereafter, never every post-window TX, while counters remain continuous. ObserveChild may retain egress but must return without TX. Tests must prove Observe -> TX -> DeferredDiagnostic before resuming the preserved lower state for a sampled success, while anomalies remain immediate. Tests must reject post-publication buffer mutation, completion waiting, duplicate publication, premature head reuse, or dropped retained egress. The V18 child must recheck its badge and publication-credit gates between logical units in retained-first order: completion publication, service-event publication, egress publication, service-poll continuation, new ingress, then new control. Exact eligible private `PollService`, `IngestPacket`, or `ApplyControl` work uses `seL4_Poll`; idle or publication-uncredited work calls `seL4_Wait` directly with no ordinary `seL4_Yield`. Natural postponement, not a terminal timeout handler, bounds SC exhaustion. Ready and ordinary wakes grant no credit; internal work preserves it, and one Publish consumes it before mutation. Stable empty packet/control hints must retire before their one separate service cycle so Poll cannot self-loop. Root sets ACK debt only after valid copy, clears it before post-retention signal, and forces ObserveChild; duplicate/late ACK fails closed. Revoke parks without publication; graceful shutdown waits for credit, retires terminal debt without ACK, and starts bounded containment. Within retained `ChildTurnUnit::PollService`, tests must prove the private `StackIngress -> StackEgress -> Session` cursor commits before dispatch, `StackIngress` executes exactly one `poll_ingress_single`, `StackEgress` executes one `poll_egress`, and both return `Continuation`; `Session` owns the connection/session RX, tick, TX, close, and relisten work. Any nonzero receive or committed wire frame returns `Continuation`; only zero receive plus no commit returns `Complete`, and the kernel clears `service_pending` only after that `Complete`. Session output must call `send_slice` only when the socket reports both `can_send()` and complete-frame capacity. Free capacity in `FinWait2` must retain the complete output without commit, `OutputDrained`, or error; peer close must reach exactly one `Disconnected`, clear the ended connection, and relisten. Established-state complete sends remain covered, and no other Session backpressure or error is converted to continuation. Every committed control must retain its nonzero connection identity through the child reader. Kind and payload validation precede identity disposition. A well-formed stale identity must advance the exact accepted sequence and publish `ControlCompleted` without output, `OutputDrained`, or fault; zero-id, malformed, and matching-current pre-authentication errors remain fail-closed. After connection 1 ends and connection 2 authenticates, a delayed connection-1 `SendLine` must leave connection-2 output byte-for-byte unchanged, while a connection-2 control remains applicable. Root must retain the one-slot control owner across `Disconnected` until its exact completion, and an unauthenticated isolated adapter must return backpressure so the root stream cursor cannot advance before lifecycle cleanup. An error or coalesced badge cannot skip the one-unit/refill Yield boundary or falsely complete PollService. Retained publication must force a blocking Wait until explicit ACK credit; eligible internal work may Poll after Yield. The isolated QEMU VirtIO Operator must also prove that the first bounded priority pass returns before its repeated tail when the exact serviceable-work snapshot is empty, while any real serial/local-seat/authenticated-line/output/barrier/reboot or attached display/attach work prevents that cut. Pi/non-VirtIO behavior must not use the v12 empty-Operator cut. Before every phase, console-network containment has conditional-probe precedence over NineDoor; any attempted containment owns one complete Recovery refill, advances at most one material unit in fixed owner-local order, persists its cursor, performs zero ordinary phase work, preserves that phase plus both retained Runtime- and Network-unit cursors, and reaches the sole outer yield without pump fallthrough. Simultaneous faults require every console unit before any NineDoor unit, with one outer yield per material unit and no interleaved ordinary turn. Console-network quarantine retains the three ordinary phases and retained unit state while fencing NIC polls in Network rather than combining Operator and Runtime/IPC. The Stage03 wrapper and its regression must select the canonical generated cohsh policy whose hash and resolved-manifest fingerprint match the current binary, never the legacy stale `out/` policy. Root policy cannot be bypassed; TCP load and child failure never consume the independent root/emergency/fault reserves or starve serial/local-seat/fatal output; no second listener or root-owned physical NIC path appears. The v5 candidate remains falsified; the v6 root candidate is falsified by the exact composed no-op Network turn; the v7 root candidate is falsified by the exact first-Operator serial-flush timeout with its lifecycle marker still queued; the v8 root candidate is falsified by the exact post-`emit_prompt_now` output-record timeout; the v9 root candidate is falsified by aggregate first-post-bind refill exhaustion before its first prospective FIFO move copied any byte; and the v10 root plus v3 child candidates are falsified by the exact fresh-Runtime and residual-child-SC evidence above. The exact v11 root and v4 child artifacts are falsified by the `PollService` and post-empty-Operator outer-Yield timeouts above, despite complete containment. The exact v12/v5 non-claiming artifacts were root ELF `7cec5bd582d063adc73830af8cc62e0ec8dbbb33d91bd4701db09ca69e32e6ca`, console child ELF `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO `dc36495a5de0df13bfb853ffa33fdc6e7ccc3bbf3a1a3c8c4cd74c8551160c16`. Its four authentication attempts each wrote 18 bytes and read zero. Root was the only timeout: badge `0x26ee0001`, exact `2750 us`, outer-Yield PC `0xf612c`, ordinary successor `Network(2)`, Runtime successor `StreamFlush(3)`, and staged bootstrap `Option = None`; fault sequence 2 and the healthy child at Yield-then-Wait exclude child fault or Recovery. The run embedded dirty commit `a533290ffe264f0a2bf0af3db4bb4c45d1a4a278`, while HEAD later advanced to `84934dda6`, so it only falsifies the generic Runtime-without-control prelude composed with empty `BootstrapDrain`. The following v13/v5 non-claiming run `out/test-plan-convergence/v13-v5-auth-20260812T014607Z` bound dirty source commit `84934dda6fcffbfa536d4e437cc1904c7fdeb0b1`, root ELF `0275cd7d701263cc1731ca3301d9aeab8a0393651745659f192106a0d558d78f`, the unchanged v5 child `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO `142e2aec64662888a9872ff77ff85d1f5f7c351b7aaa478ded8cf99ba9e64f29`. All four authentication attempts wrote 18 bytes and read zero; the first failed proof layer was `real-target-operation`. The initiating timeout was root-control badge `0x26ee0001` at `sel4::poll` SVC PC `0xce98c`, with caller `0x108910` immediately after the child-to-root notification poll in `IsolatedVirtioConsole::poll`. The committed ordinary successor was `Operator` and the lower successor was `StageOutput`, so the selected Network unit was `ObserveChild`. The child remained healthy at `seL4_Wait`. Root-fault then timed out with badge `0x26ee0002` at `suspend_tcb` SVC PC `0xce0cc`, targeting the root-control TCB cap `0x10`; root-emergency fail-stop was downstream. This falsifies the v13 generic Network-prelude/all-unit adapter path and the v2 composed root-fault terminal-critical path, not child v5. The later exact v16 image bound root ELF `4fab7abc8707b9829ba66ac525efdfc7afefa812df4bab9abb8cb67d504a76a6` and system CPIO `456558cac05e4d136d3cbc18d1290cc48bebf619ba5459cd623b667dbfff3e96`. The prompt serial/output completed, but root-control consumed the full `2750 us` and faulted at outer-Yield PC `0xf61c4`; its saved successors were `Runtime` and `ControlEndpoint`. Exact disassembly showed the selected route still paid the generic EventPump frame (`0x42c0`) and generic Operator frame (`0x12a0`) before its bounded output leaf. Root-fault then consumed the full `3000 us` at the first post-classification Yield, PC `0x113938`, before suspension or emergency signalling. These are diagnostic failures of v16 root-control and v3 root-fault, not child v5 qualification. The exact v17 non-claiming run `out/test-plan-convergence/v17-v4-auth-20260812T041428Z` bound root ELF `3d0641bac42d21ce383c47f38628a05db0d2474fab69fc6e14b67ba39a71bd47`, the unchanged v5 child `920883c5e706688a65e7f168a643dbc527d09d7f48584bfb41fbd0c0ae823cb6`, and CPIO `fa478638d6d2b93b654a2615e4dcd1e1d7f666d0945d4e012adcf28da2292af1`. All four authentication attempts wrote 18 bytes and read zero. Current fault `.1` was root-control at outer-Yield PC `0xf6624`; ordinary, Runtime, and Operator successors were `Runtime`, `Worker`, and `SerialDispatch`. This proves the compact v17 path ran but falsifies its remaining composition of serial driver admission/RX and TX flush inside `SerialIo`; it does not falsify root-fault v4 or child v5. The exact v18 non-claiming artifact bound root ELF `e7d34f018ff308c575fedb79ca7cef5542a7da8e753c09ddb9d55cf9daa79d4e` and system CPIO `0dca41cc6fdd9a877144dcd2db610beaeafef95423a81ce6896b01bb9b8f5cf5`. All four authentication attempts wrote 18 bytes and read zero. Root-control consumed exactly `2750 us` and raised timeout badge `0x26ee0001` at outer-Yield FaultIP `0xf66e4` after completing Network. The ordinary successor was `Operator(0)` and the lower successor was `Disconnect(2)`, proving that the selected lower unit was `StageOutput(1)`. Pending egress was zero, deferred diagnostic state was `2`, and no child signal occurred. Root-fault timeout `.2` at `suspend_tcb` SVC PC `0xce1f4` with cursor `SignalEmergency` was downstream. This falsifies v18's split Network prelude composition, not its Operator split, root-fault v4, or child v5. The exact clean v19 artifact bound root ELF `0737a6f008197fd5b931af104c95164ddcd925fa04a8440439895c1e76b26fca` and CPIO `51e7b955b449b42b7a0cad569aa187e19a0f71464ffb81080d29733a589e7ed0`. All four authentication attempts wrote 18 bytes and read zero. Root-control timed out at outer-Yield PC `0xf66dc` after completed Network. Lower successor `Ingress(3)` proves selected `Disconnect(2)` was a no-op without child signal; pending egress was empty, the child was healthy at Wait PC `0x21343c`, and root `smoltcp_polls` was `250098`. This falsifies the composed post-leaf counter-refresh, NETDIAG, and NineDoor aggregate. V20 retains one compact diagnostic observation after each timer-plus-one-NIC visit and consumes it in the next Network visit through NETDIAG only, without timer or NIC work. The exact immutable v20 root ELF `ed5cb9f587d0d63e6121f8b00b083e68f5a0a7dd23dd6d2bbf0c899e1e85e80f` and CPIO `ca2a52038eb0814a17c8609f03bec32ff357fdd524edee3e7080ac69ceb7823b` reached the root marker and prompt but then entered root-emergency fail-stop. Root-control timeout `.1` was at outer-Yield PC `0xf680c`; successor Operator and retained NETDIAG `Some` prove the timer-plus-NIC visit completed while the exclusive diagnostic visit had not run. Exact lower-cursor, egress, and child state remain unconfirmed. V21 therefore splits only the QEMU Network timer and NIC units through a successor-before-work `Timer -> Nic` cursor; the retained diagnostic preempts without advancing it, producing `Timer -> Nic -> DeferredDiagnostic -> Timer` when diagnostics are featured. The exact V8 artifact `out/cohesix-v8-stale-control-hvf-qemu10-20260813T090943Z` bound rootserver SHA-256 `f200ecf56021e5eb712e28ecd3ea290d476552166ba2ce3a6b6b5d959f811910`, console child SHA-256 `ed0b2b7ecbf2c9f302a30d087d54fbfe264fbfe6857f1717f94319ae4735b551`, CPIO SHA-256 `991ea1d85fa8fb5a2d1146cbe9b183eaf3c204301d8348d4f18a722cb490156d`, and kernel SHA-256 `8aa06eaf462a87d3aa6c1f8500ad1d1ed5632f5ad8031c5eab53fdd2095257da`. Its live canary reached `root-console.start.ok`, then two TCP connections each wrote 18 AUTH bytes and received zero bytes for five seconds without a target fault or UART AUTH response. V9 then attempted local Poll with a global post-publication fence, but exact artifact `out/cohesix-v9-retained-work-hvf-qemu10-20260813T095338Z` still wrote 18 AUTH bytes and read zero. V11 permits private internal Poll but requires explicit post-observation ACK credit for each publication; ordinary wakes never credit. V8 and V9 are exact liveness-failure evidence, not V11 qualification. The narrow V26 root-control/V13-child two-session canary and retained V28 terminal-response-fence/two-session result are passing evidence for only their stated transitions. The V27 artifact remains exact terminal-response/Disconnect sequence-collision failure evidence. The immutable V29 artifact is selected-wrapper failure evidence: AUTH and ATTACH completed, HELP returned zero bytes before the unchanged 30-second timeout, clean root/child snapshots ruled out a target fault, and breakpoint plus live-vtable proof showed `capture_started=false` because `DefaultNetStack` returned its default bounded identity instead of delegating the isolated implementation. The selected V35 QEMU root-control, V24 Pi root-control, V6 root-fault, and V18 child candidates remain pending fresh exact target builds, the fixed one-socket HELP/NETSTATS/SMP/CACHELOG matrix, standard-fault containment, budget-exhaustion natural-postponement liveness/isolation, and all downstream gates. Stage 03, Hive Gateway REST regression, Conditional B2 executable target pressure, companion Conditional D host-model performance, and complete host-tool and Python-library acceptance remain withheld until that exact-artifact QEMU evidence passes. Fresh Pi 4 build, flash, hardware, and a Pi-selected target-performance path at generated `54 MHz` remain independently required; Conditional D supplies no Pi target proof. Pi/non-VirtIO EventPump behavior remains on the generic path apart from the universal one-period startup activation wait. The active-MCS child rechecks badge and publication-credit gates between retained units, uses local Poll only while eligible work remains, and calls Wait directly when idle or publication-uncredited, with no ordinary Yield; natural SC postponement supplies the budget boundary. Deliverables: Restricted console/network child with bounded compact shared-page IPC, ABI v3 SendBatch plus explicit publication ACK, exact-identity bounded synchronous capture, a bounded authenticated response lane with ordinary-service debt, preserved external operator semantics, fixed response-matrix evidence, target-disassembly evidence, and live four-core GICv3 QEMU containment evidence. Title/ID: m26e-qemu-shared-control-path-performance Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / QEMU pressure validation and shared bounded service quanta Goal: Remove measured artificial service-turn, Worker-scan, activation, transport head-of-line, and per-instance-SC ceilings while preserving one bounded shared architecture across QEMU and Pi. Inputs: `m26e-console-network-service-isolation`, `m26e-worker-supervisor-child-isolation`, accepted executable-Worker pressure harness, ABI v3 SendBatch/publication-ACK boundary, configs/root_task*.toml, crates/{console-network-abi,worker-task-abi}/**, apps/{cohsh,console-network-runtime,hive-gateway,nine-door,root-task,worker-heart}/**, tools/{coh-rtc,cohesix-py}/**, scripts/m26e_qemu_pressure.sh, scripts/rest_perf_harness.py, docs/{INTERFACES,ROLES_AND_SCHEDULING,USERLAND_AND_CLI,TEST_PLAN,BENCHMARKS}.md. Changes: - GENET acceptance and release-preparation decision, 2026-09-09 — the operator explicitly authorizes replacing the 1.845-ms latency requirement with the measured sustained performance envelope: unpaced 1,024-request canonical raw TCP runs must achieve >=600 requests/s and <=5-ms p95 on two exact-image release boots. Controlled 180/s latency is diagnostic. Preserve the successful passive-read repair, complete runtime ABI v13, causal continuation, existing MCS reservations, ownership and liveness. Protected release runs measured 627.000/627.579 requests/s with 4.779/4.818-ms p95; main `11f61938c` GENET G00/G01 measured 620.448/673.663 requests/s with 4.748/4.085-ms p95. These support the revised numerical target without another speculative runtime change. Preserve G00's earlier controlled-load failure (4.015-ms p95) and later 0.732-ms repeat; active diagnostics preceded that original measurement. Packet/queue evidence identifies bounded initial root/display interference without proving every delay is necessary or all defects are eliminated. No samples or historical verdicts are removed. Further optimization requires a reproduced material defect, not failure of the retired limit. Medium/high REST, cohsh, zero-failure and bounded-liveness checks remain required; the earlier 25/50-ms batch proposal remains a reference rather than a newly imposed gate. WiFi throughput/latency and full <=42-second boot requirements remain unchanged. Freeze a clean-main release build using the default release `seL4/build_UBOOT` kernel. Review the complete host-tool suite, Python SDK and benchmark consumers: this acceptance-only change requires no CLI, schema, generated output or runtime modification. Existing exact-image RAM results and retained release-QEMU evidence remain distinct from the final staged image's normal SD boot qualification. Scope remains this task restoring `m26e-console-network-service-isolation`. - Explicit controlled-load GENET measurement — preserve the protected release image and successful passive-read repair while evaluating the user-selected latency contract at controlled target load and reporting saturation separately. Add optional `--raw-request-rate` to the canonical harness, preserving unpaced defaults, every latency sample, one outstanding PING, complete-session throughput and exact terminal/EOF checks. Record actual starts and rate policy; use actual-start spacing without catch-up bursts, never hidden pacing. Deterministic tests cover rate validation, early/late host wakeups, slow responses, arithmetic and unchanged unpaced behavior. The additive report fields do not change target ABI, manifests, kernels, cohsh, REST modes or the Python SDK. Compare 1,024 PINGs at a recorded 180/s ceiling with separately measured unpaced capacity on two protected GENET boots before refining performance targets. Historical failed results retain their original workload and verdict. Scope remains `m26e-qemu-shared-control-path-performance`, restoring `m26e-console-network-service-isolation`; no new runtime policy is authorized by the measurement. Two protected release RAM boots subsequently measured 172.279/171.093 requests/s at the recorded 180/s ceiling, with 0.744/0.896-ms p95, passing both numerical operating-load gates. Separate unpaced 1,024-request runs delivered 627.000/627.579 requests/s with 4.779/4.818-ms p95. TCP scripts and complete wire audits pass. An earlier host-undersupplied run remains failed against the throughput floor; bounding each blocking host sleep to 1 ms addressed timer overshoot without changing target policy, sending early, spinning or hiding samples. At that stage, recommend a separate sustained floor of 600 requests/s with <=5-ms p95 and <=25/50-ms medium16/high32 mean batch references from the protected two-boot REST evidence. The subsequent acceptance decision above adopts the capacity target and supersedes the controlled-load gate; it does not retroactively rewrite these results. Retain first-connection tails, maximum latency and zero-failure/liveness requirements. Further runtime changes require a reproduced material defect in the defined workload. RAM transfer evidence is not complete runtime BUILD or cold-SD proof; WiFi and full staged acceptance remain separate. Evidence: `out/bench/pi4-genet-load-envelope-20260909/REPORT.md`. - GENET/console placement experiment retired — under `m26e-qemu-shared-control-path-performance`, restoring `m26e-console-network-service-isolation`, source `b58fc32552f5` tested independent GENET and console-network owners together on core 2, with root on core 0. HDMI moved to core 2 and the GPU executor/passive Workers to core 1, preserving every per-core reservation sum and all budgets, refills, priorities, guards, memory and capability bounds. Two release RAM boots completed all raw/coh/Worker32/medium16/high32 workloads. First-64 p95 worsened to 8.489/9.023 ms; exercised 1,024-request runs delivered 641.802/659.941 requests/s with 4.276/3.477-ms p95. Concurrent 16/32-read batches averaged 28.792/52.827 and 27.866/49.753 ms, versus protected 22.134/47.080 and 21.024/46.441 ms. The mixed tail improvement did not establish a repeatable overall benefit. Retire the placement portfolio; preserve the successful root passive-read repair and baseline fixture corrections. Exact packet traces still show millisecond delays before Signal and after Signal on the same core: cross-core transport is not necessary for this delay, but the experiment does not identify scheduling-context eligibility or rule out every alternative placement. Exact Pi build and focused checks passed. Release QEMU live convergence passed; its original aggregate stale-fixture FAIL remains preserved alongside the corrected canonical 37-guard PASS. Evidence: `out/bench/pi4-genet-colocated-20260909/REPORT.md`. - GENET IRQ owner-core routing experiment retired — under `m26e-qemu-shared-control-path-performance`, restoring `m26e-console-network-service-isolation`, exact release RAM source `bd539e48ff5f` tested aligning the MCS GENET SPI's physical delivery with its active scheduling-context core. The selected GICv2 kernel initializes SPIs to the boot CPU; the existing four-word ARM GetTrigger call does not retarget them, despite GENET's generated core-1 execution. The candidate used the selected upstream five-word GetTriggerCore contract, with target in MR4 and validated owner authority. All IRQ189 capabilities, triggers, notifications, badges, driver images, budgets/refills, guards and packet bounds stayed unchanged. Two boots completed all raw/coh/REST workloads and strict wire audits. First-64 p95 was 4.532/4.465 ms; subsequent 1,024-request runs measured 665.091/703.872 requests/s with 4.558/4.561-ms p95, versus the protected baseline's 648.703/680.796 and 4.666/4.225 ms. Concurrent 32-read batches averaged 45.653/45.565 ms, only a small change from 47.080/46.441 ms; the second medium run retained a 77.171-ms sample. Neither original p95 closure nor a material repeatable tail improvement was shown. Retire the routing change and its private marshaller/selector, preserving the successful passive-read repair and optional v3 timing evidence. Focused IRQ23 checks, release QEMU root-MCS convergence and exact Pi build passed; the experiment is not acceptance. Evidence: `out/bench/pi4-genet-irq-owner-20260909/REPORT.md`. - GENET exact-packet wake/receive discriminator — under `m26e-qemu-shared-control-path-performance`, restoring `m26e-console-network-service-isolation`, reuse the bounded queue timing probe and extend its optional v3 peak with the exact producer's completed Signal, consumer's last blocking receive entry/return/badge/kind, and GENET's last explicit Yield entry/return and existing route reason. Prior queue traces place millisecond gaps across both reciprocal rings; refill10 and RX grouping do not close raw p95. Distinguish pre-notification, receive-boundary and post-return delay without copying VirtIO ownership, changing the release kernel, any MCS number, packet authority, deadline, retry or the successful 28d3 root dispatch repair. Missing/raced timing is unavailable and cannot change transport. Fixed wire/bounds and existing ring/driver/format contracts, exact target builds and narrow QEMU proof precede raw-first Pi observation and the unchanged medium/high harness. Review complete host tools, Python SDK, cohsh/scripts, generated manifests and performance/evidence consumers: only documented optional diagnostics change; transport, workloads and report schemas remain unchanged. This is a non-claiming discriminator, not a latency fix or acceptance evidence. The temporary observer requires a 70-page console image: admit exactly 108 service frames and 165 retained slots, one page and cap above the qualified 69-page image. The fixed/maximum/reserve inventory uses 7,667 of 8,192 frames and 19,517 of 65,536 root slots. Retire this temporary admission with the observer. Stack, queues, untyped and QEMU stay fixed; regenerate the Pi SDK profile digest without changing its public fields. Keep the root constructor at the same 70-page/108-frame/165-slot inventory. The first diagnostic boot retained the former root inventory and failed before console readiness despite verified RAM delivery; bind both source manifests to the root inventory in a deterministic regression. This is candidate construction repair, with no new performance result. Fresh SD0880 two-boot proof restores readiness and all raw/coh/REST function; raw p95 remains 4.003/5.369 ms. A 1,024-request control has 217 slow wire requests but only nine overlap root Yield. Exact TX peaks place 6.940--7.616 ms after completed Signal with the last Recv already returned; this motivates the v3 explicit-Yield discriminator. Its three additional words fit the unchanged optional 256-byte record, with no new syscall, guard change or scheduling authority. Missing observations remain unavailable. Exact `006c883f8638` passed focused chronology/row tests, release QEMU root-MCS convergence and the release Pi build. Two CRC-verified GENET RAM boots completed raw TCP, focused scripts and medium/high REST, with concurrent 32-read batches averaging 47.080/46.441 ms. First-64 p95 remains 5.405/4.884 ms; subsequent 1,024-request runs measure 648.703/680.796 requests/s and 4.666/4.225-ms p95, still failing the original 1.845-ms gate. Exact sustained TX peaks contain guard-triggered Yield intervals of 3.374/1.005 ms, but substantial delay precedes each Yield. A separate repeat-boot TX peak instead spends 2.650 ms before Signal entry and only 22 us from completed Signal to consumer copy, with no overlapping driver Yield. These observations distinguish boundaries, not CPU use or refill eligibility, and do not justify guard removal as a complete fix. Preserve the successful passive-read repair and unchanged scheduling authority. Evidence: `out/bench/pi4-genet-yield-binding-20260909/REPORT.md`; RAM delivery is not SD/cold-boot or complete runtime BUILD attestation. - GENET bounded hardware RX interrupt grouping experiment retired — exact release source `f24f2b9a648519fcb3605368c0d4c1f8fad71e71` tested two packets or thirteen hardware timer ticks (106.496 us) on two RAM boots, keeping all MCS numerics and the root read-dispatch repair unchanged. Raw64 measured 605.707/483.210 requests/s with 5.239/5.995 ms p95; throughput passed and the original 1.845 ms latency gate failed. Both boots passed the unchanged cohsh, Worker32 and medium/high `rest_perf_harness.py` workloads. Compared with the retained two-boot 28d3 baseline, concurrent 16/32 batch means improved 12.50%/4.63%, while sequential means slowed 2.92%/4.47%. These small samples do not establish an overall benefit. Restore immediate RX interrupts; retain the complete experiment under `out/bench/pi4-genet-irq-batch-20260909`. First-boot p95 remained 5.239 ms despite a maximum recorded driver slice of 93 us: lower interrupt work does not identify the owner delaying a slow PING. The original tail-latency frontier remains open. The complete host-tool suite, Python SDK, .coh, generated profiles and harness were reviewed; protocols, workloads, report schemas and implementations need no change. QEMU execution, the release kernel, owner/IRQ/cursor bounds and the successful root dispatch repair remain unchanged. - GENET owner refill-capacity experiment retired — exact release RAM image `a142b05b347c9a92dcf882b3540e370bc147f3c4` tested ten total refills in the existing 256-byte GENET SC with unchanged budget, period, priority, core, WCET, packet bounds, root/console and successful passive-read dispatch. Two fresh boots completed raw TCP at 567.890/660.108 requests/s with 4.998/4.115 ms p95; the original 1.845 ms gate still failed. High concurrent 32-worker TAIL batches averaged 42.829/45.264 ms, essentially unchanged from the retained eight-refill pair's 43.339/45.429 ms. Medium batches improved slightly, but the experiment did not establish an overall gain or resolve raw latency. Restore the exact eight-refill implementation, compiler/profile and fixtures while preserving the root-dispatch repair. Keep the stale root-SC test correction and production QEMU console documentation aligned with existing as-built truth. All raw, cohsh, Worker32 and medium/high REST workloads and complete wire audits passed functionally. QEMU live canary passed; stale Pi fixture failures and the corrected 37-guard pass remain separate evidence. Host-suite, SDK and benchmark contracts remain unchanged. Evidence is non-claiming under `out/bench/pi4-genet-refill10-20260909`; this does not exclude refill postponement generally or authorize a wider scheduling change. - GENET bounded passive-read dispatch candidate — restores `m26e-console-network-service-isolation`. Two exact release-Pi queue-timing boots show sub-0.16 ms packet handoffs under high TAIL pressure but roughly 10 ms per command at root admission/dispatch. Permit authenticated direct GENET TAIL/CAT/LS to use ordinary bounded dispatch with existing generated NaturalPostpone and per-Call ResumeOnceReturnError enforcement. Keep exact topology, connection/generation, physical-operator, response-owner and recovery fences; retain the Pi reserve path for all other commands and WiFi. No retained response token, concurrent passive Calls, SC numeric, manifest, kernel, ABI or timeout-policy change is included. The existing Yield/Consumed preparation guard cannot prove remaining CPU refill credit; this change explicitly uses kernel postponement, not invented WCET credit. Focused admission tests, release QEMU root-MCS, exact Pi compilation and fresh same-image GENET/WiFi harness evidence qualify the candidate. Review the complete host-tool suite, Python SDK, .coh, raw/REST workloads and report schemas: their public contracts and implementations remain unchanged because only target read admission changes. Physical performance and original raw p95 remain unclaimed until measured. - Initial-SC runtime admission repair — the unchanged `d16284b35` GENET pair regressed to approximately 20 ms per PING because the runtime continuation predicate still required root SC bits 7/refills 2. Kernel allocation and compiler admission correctly selected bits 8/refills 8; the stale runtime check disabled continuation and caused a Yield on almost every turn. Preserve the selected storage experiment and bind this runtime predicate to the same exact 8/8 policy. Its positive test reads those fields from the actual Pi TOML manifest, with a host-test-only TOML parser, and rejects the stale values independently. Other budgets, fields, fences, queues and fault routes remain exact. The complete unchanged dual-mode matrix precedes the repair; repeat the exact Pi and QEMU checks and a new two-GENET/two-WiFi matrix to test storage with continuation actually enabled. Host tools, Python SDK, public protocols, benchmarks and evidence formats retain their existing contracts; only the root's development dependency and its lockfile entry change for the manifest-binding regression test. - CYW43 completed-batch publication repair — the same unchanged matrix's W00 medium pressure run retained parent `0x559`, a valid one-frame batch at queue commit `0x402`, and the queue-after pair `0` then `0x403`. Treat only internally valid same-generation queue publication as pending before HAL retires op8. Retain its immutable request and original deadline, then carry one exact validation receipt to the immediate payload consumer. Preserve malformed/stale/poison rejection, both payload header fences, ordered pair recovery and receipt clearing before request-sequence reuse. Sideband op11 defers before copy; its validated admission, still-issued parent and immutable header protect the subsequent ACK from independent queue publication. This restores `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, discovered through `m26e-console-network-service-isolation`. Deterministic publication/identity/copy/ACK tests and exact Pi compilation qualify source; a fresh exact-image dual-mode matrix must establish physical recovery and performance. No SC numeric, retry, deadline, physical I/O, shared ABI, command grammar or benchmark change is included. The complete host-tool suite, `tools/cohesix-py`, generated contracts, `.coh`, raw framed TCP and REST benchmarks retain their implementations and schemas. The existing `wifi dump-state` rejection row now describes actual rejection, excluding deferred publication; operator and driver documentation change together. - Pi initial scheduling-context storage candidate — discovered through `m26e-console-network-service-isolation`, restore the selected `m26e-mcs-abi-foundation` allocation/admission contract. After the unchanged `9e99701e1` two-WiFi/two-GENET matrix, both WiFi gates pass and GENET p95 remains 5.5–6.2 ms. A separate, benchmark-ineligible 0/12/0/12 ms load discriminator gives burst p95 5.05/5.30 ms and paced p95 0.71/0.75 ms. Actual root CPU and blocking receipts distinguish this from the already repaired empty-receive and completed-response Yield defects; they motivate testing refill fragmentation, without claiming per-packet exhaustion proof. The prior manifest-only eight-refill attempt was invalid because upstream allocates a 128-byte initial SC. Extend the exact authenticated Pi source overlay to reserve, allocate and describe that same initial SC as 256 bytes, then select eight refills. Preserve root budget 5,500 us, period 10,000 us, WCET 2,500 us, priority, admission, every other task and upstream scheduler algorithm. Clean QEMU/proof sources retain their upstream initial SC. Source-profile schema 3 declares the complete sorted patch path set; preparation, tamper rejection, source/build stamps, compiler target checks, generated artifacts, the Python Pi target descriptor's manifest hash and exact Pi profile outputs change atomically. Review the complete host-tool suite, `tools/cohesix-py`, `.coh` scripts, trace and evidence consumers, raw/REST harnesses, workload arithmetic and report schemas. Only the source-profile preparation interface changes from singular `target` to `targets`; its tests/docs change together. Other public interfaces and benchmark gates require no change. Exact kernel/Pi builds, QEMU root-MCS and fresh two-WiFi/two-GENET evidence can falsify this candidate; no static or paced result is performance acceptance. - Empty receive register restoration — discovered through `m26e-console-network-service-isolation`, restore the `m26e-mcs-abi-foundation` receive contract after the unchanged `425b75684` two-WiFi/two-GENET matrix. The selected seL4 16 kernel clears only the badge on failed NBRecv. The emitted steady root path leaves `now_ms` in AArch64 x1, while root interprets that stale MessageInfo as endpoint work. Seed x1 to zero in the receive-only assembly for MCS and classic bindings; real IPC still supplies its tag, bound notifications remain badge-first, and send/receive retains its outgoing MessageInfo. Preserve all Reply, donated-call, queue, retry, timer, SC and operator fences. Verify the trap register contract, existing empty/real-message classifiers, exact QEMU and Pi compilation, emitted instructions and fresh unchanged dual-mode boots. The full host-tool suite, `tools/cohesix-py`, compiler/generated contracts, `.coh` scripts, raw/REST workloads, benchmark arithmetic, trace consumers and report schemas require no change: no public surface or target setting changes. Build or static correctness does not establish a speedup. - WiFi first RX-batch rejection operands — under `m26e-qemu-shared-control-path-performance`, discovered through `m26e-console-network-service-isolation`, the sealed unchanged `02dd1a964` two-GENET/two-WiFi matrix retains W00's first root restart at `driver_task_net.rs:28073`, parent 692/op8, FrameReady/detail 0x5803/result 1. Selection failed before payload copy; its merged Option does not distinguish an unavailable queue publication from invalid metadata or stale identity. Retain the exact original validation samples and failed stage before the unchanged restart. Preserve first evidence until accepted Gate 8 and expose eleven bounded metadata-only rows through explicit `wifi dump-state`. No new read, clock, poll attempt, retry, queue, recovery decision, runtime ABI, compiler manifest, SC setting or compact diagnostic row is introduced. The complete host-tool suite, `tools/cohesix-py`, compiler/generated consumers, `.coh` scripts, raw/REST benchmark workloads, arithmetic and report schemas were reviewed. The trace normalizer retains the four new row prefixes as passive metadata and excludes even malformed or unknown versions from gate classifiers, with a focused regression. Other host consumers need no implementation or workload change. Exact sample-retention, invalid identity/commit/header and output-bound regressions plus exact Pi compilation/layout are required. This Pi-only diagnostic cannot establish a fix or replace fresh dual-mode hardware. - GENET ready-publication charge equivalence — the unchanged `40b7ff26f` pair reduces console CPU about 30% but retains p95 7.112/6.082 ms and in-flight causal-limit Yields. Preserve the final typed Wait/Arbitrate/Closed result across the existing single poll/recheck/receive helper. A durable publication seen before receiving returns to ordinary arbitration without charging the causal-wait allowance, whether the poll observed an empty notification or a coalesced hint. Actual receive returns, endpoints and hints without ready publication retain their existing charge. Preserve both 64-count bounds, unslid clocks, periodic operator wake, all fences and unchanged WiFi empty-poll-only routing. No added accounting syscall or numeric scheduling change. Test notification equivalence, real-wait charge, retained endpoints, unavailable Reply authority and exact production branch ordering. Qualify exact Pi/layout and pinned QEMU, then repeat both modes. Discovery: `m26e-console-network-service-isolation`. The complete host-tool suite, Python SDK, generated contracts, raw/REST workloads, diagnostic readers and report schemas need no changes. Other latency tails and the earlier WiFi recovery quarantine remain open pending physical evidence. - Pi TCP execution-cost candidate — the sealed unchanged `c47da0a6d` two-GENET/two-WiFi matrix retains GENET p95 6.595/6.752 ms and console-child CPU 32.395/32.329 ms per full 64-request session. Compile only Pi console-network-runtime and smoltcp at level 3 in the runtime invocation; root retains its separate level-3 build, other children and QEMU retain z. Admit the measured 69-page ELF with 107 service frames and 164 retained root slots, three additional image frames/caps relative to the 66-page comparator. Update the compiler, constructor, source manifest, projections and generated profiles atomically, retaining exact-size rejection. Earlier global-profile attempts stopped at the 69/66 guard and have no physical speed result. Qualify emitted child/root stack use, all image bounds and pinned QEMU before fresh unchanged dual-mode Pi measurement. No scheduling numbers, ownership, packet/session logic or wire workload changes. Discovery: `m26e-console-network-service-isolation`. Review the complete host-tool catalog/suite, tools/cohesix-py, raw/REST benchmark scripts and evidence consumers: only the generated Pi resource profile changes; public interfaces, workload arithmetic, thresholds and report schemas need no edit. WiFi first-SYN loss and the earlier recovery quarantine remain open; neither a faster build nor later healthy traffic closes those failures. - GENET condition-after-hint repair — both unchanged `75a5be626` boots reach the causal-return limit of 64 with an exact response still pending, only 15–21 completed quanta and no productive-cap or policy rejection. The complete traces contain only seven/five blocking-receive invocations; most logical returns therefore came from a nonblocking fan-in observation. After the existing single poll, revalidate the same exact child debt and full operator/recovery fence. An empty poll or fan-in-only hint may then enter the existing single receive; a new durable publication returns to ordinary arbitration. A retained endpoint or unavailable Reply authority must never receive again. This is bounded by one poll and at most one wait, with the same 64-return/quantum caps, clock, cursor, SC and physical owners. There is no repeated notification drain, increased allowance or reset. Require the existing identity-bound PCIe periodic wake before this GENET receive, enabling it once if still Disarmed. The mixed fan-in can name operator bytes not yet imported into root queues, and TCP backpressure cannot strand their service. Observe absolute timer duty around the typed enable and repeat the full exact debt/operator/recovery check afterwards; a rejected timer retains ordinary arbitration. No timer interval changes. Test closure order, state-change rejection, endpoint retention and a second coalesced wake; qualify exact Pi layout and pinned QEMU root-MCS before fresh dual-mode raw/CPU/Yield/receive and functional/pressure comparison. Discovery: `m26e-console-network-service-isolation`. The complete host-tool catalog/suite, Python SDK, generated interfaces, diagnostic readers and raw/REST workloads/report schemas require no changes. No target gain or reliability closure is established until fresh physical evidence passes. - Exact final GENET Yield decision — the unchanged c45d79075 pair retains p95 7.603/7.670 ms while complete receive traces total only 453/421 us. Recorded explicit Yields overlap several slow PINGs, but 21/20 of 64 exceed the latency gate; elapsed non-Yield poll gaps remain separately unresolved. Preserve one packed word in each existing Yield context: this loop's identity-matched cached idle mask, retained continuation class, hint state, quantum/wait counts, rejection bits and tail/clock/profile state. It must not resample hardware, call kernel accounting, change a scheduling decision or add an output row. Cover field packing, unavailable/stale cuts and full maximum-width rendering. Discovery: `m26e-console-network-service-isolation`. The complete host-tool catalog/suite, Python SDK, passive trace consumers, generated interfaces and raw/REST benchmark arithmetic require no changes; existing key/value readers ignore the additive field. This diagnostic is not a performance fix or target acceptance claim. Fresh same-image dual-mode evidence remains required before selecting a further behavioral repair. - GENET consumed-control continuation — a successful StageOutput may accept the child's consumption watermark during its existing immediate observation. Preserve the new stage's exact generation/connection/control sequence from its root-owned consumed-but-undrained batch when no control remains inflight. An invalid extant control never falls back to another batch; missing, stale, zero-sequence or already-drained debt grants no continuation. Existing final condition-before-block, durable-publication arbitration, operator/fault fences and episode limits remain authoritative. This closes the constructor gap before the already-supported response-drain wait. The final shared publication-service level also retains root's copied-but-unacknowledged credit. A parked child cannot publish its successor until the ordinary root rotor returns that ACK; neither causal nor global idle may strand it. Validate all shared frontiers before considering local ACK debt, so malformed or stale pages still fail. Keep raw publication peeks and `pub` trace fields distinct from this service-readiness predicate; their meaning stays unchanged. Propagate service readiness through both driver adapters and the selected network wrapper. Cover real READY publication acceptance, owed credit, completed credit and stale-page rejection. Discovery: `m26e-console-network-service-isolation`; unchanged `9992131b5` evidence still has pending-response Yields and non-Yield root gaps. Add two CNTVCT reads around an existing root receive/endpoint-handler call only for a live nonzero Pi TCP identity. Retain its slowest sixteen brackets with stable ties and explicit totals/omissions/invalid counts under existing `smp poll-time`; the full command remains within 58 body rows and existing queue bounds. A bracket includes endpoint handling and preemption, so it cannot prove sleep duration, CPU consumption or refill exhaustion. No new accounting syscall, device action, wake, timer or scheduling parameter. Cover exact continuation debt, stale/final rejection, bounded sorted trace, arithmetic and complete maximum fields; qualify Pi/QEMU before fresh boots. Host-tool catalog/suite, Python SDK, generated grammar/ABI and raw/REST workloads/report consumers reviewed: additive diagnostic documentation is required, with no protocol/parser/schema/workload changes elsewhere. - Exact-6f26 first WiFi recovery provenance — four unchanged boots retain WiFi raw passes at 26.984/29.039 requests/s and GENET latency failures at 8.134/5.995 ms p95. W01 then loses QUIT after successful AUTH/HELP/TAIL; root remains live while the pair quarantines. Preserve the first root recovery call site and exact CYW43 completion before scrub, without changing any owner, recovery decision, deadline, scheduling number or physical path. Emit one bounded passive `scheduler_root` row in the existing recovery transaction and verbose snapshot. The full host-tool suite, Python SDK, generated interfaces and raw/REST workloads require no contract change; the trace normalizer preserves this diagnostic without gate authority. Require first-wins/reset, exact-sequence, complete bounded-output checks, exact Pi layout qualification and fresh physical fault evidence before a behavioral repair. Discovery: `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and `m26e-console-network-service-isolation`. - GENET productive-progress wake recheck — after the unchanged `223133490` dual-mode comparison, renew one nonblocking fan-in race allowance only when a private exact productive continuation is successfully consumed. Preserve the enclosing 64-quantum cap, clock, causal-wait count and every identity/operator/recovery fence. Observing a publication or an empty rotor does not renew this allowance. This repairs stale spent-hint state crossing new work; it does not assume every slow PING contains a Yield. Retain the first 32 valid explicit Yield records for the latest nonzero session, with complete total/omitted/invalid counts and original counter frequency/context, under existing `smp poll-time`. No extra clock reads, accounting calls, output-queue growth or scheduler numbers are introduced. Discovery: `m26e-console-network-service-isolation`. Cover productive renewal, signal-only rejection, unchanged episode limits and trace bounds; qualify exact Pi layout and pinned QEMU, then correlate fresh first-raw hardware evidence. The complete host-tool suite/catalog, Python SDK, generated grammar/ABI and raw/REST workload/report consumers were reviewed: the additive diagnostic rows need owning CLI/evidence documentation, with no parser, schema, workload, credential or namespace changes elsewhere. - Isolated peer-first close restoration — sealed `5e54f83d9` two-WiFi and two-GENET evidence proves improved WiFi raw throughput but also a W01 sequential connection refusal. The sole isolated TCP socket starts a simultaneous FIN exchange and rejects replacement SYNs until the final FIN retransmission. Restore the existing peer-first close contract for exact authenticated root Disconnect controls: drain application and TCP output, wait up to one second for the peer FIN, and close from CloseWait; expire the bounded drain or peer grace by abort, without renewing either deadline on duplicate controls. Preserve independent authentication/error close, end/relisten and revocation, existing socket/buffer inventory, ABI, scheduling and benchmark bounds. Discovery task: `m26e-console-network-service-isolation`. Reproduce FIN ordering with the real two-stack host fixture, qualify exact Pi and pinned QEMU, and require fresh immediate sequential scripts on both physical backends. The complete host-tool suite, Python SDK, generated contracts and raw/REST workloads already require exact QUIT acknowledgement and peer EOF; no consumer or schema changes are needed. This repair does not establish GENET latency. - Pi root execution cost after memory repairs — the sealed `31cf29b35` two-WiFi/two-GENET matrix leaves GENET root CPU at 69.2/71.0 ms per 64-request session and p95 at 5.75/5.57 ms. Maintenance consolidation has no demonstrated improvement; WiFi passes throughput only once. Select execution-speed optimization for the Pi root package alone and preserve all child/dependency/QEMU policies and scheduling values. Earlier compiler trials stopped at stack, null PCIe mapping and interrupt-bank defects; those now have independent repairs and dual-mode boot proof. Require retained baseline artifacts, exact emitted stack/TLS/text and archive admission, focused builder tests and pinned QEMU before RAM reset/CRC tests. Compare first raw CPU/wire and later functional/pressure evidence twice per backend. No performance result is inferred from compilation. The complete host-tool suite/catalog, Python SDK, generated interfaces, evidence consumers and raw/REST workloads retain their contracts and need no consumer changes. Never transplant the old defective image or enlarge object, memory or temporal bounds to admit this candidate. - GENET operator maintenance rotation — the exact `33227d8da` four-boot comparison meets both WiFi gates twice, while GENET p95 remains 5.43/5.62 ms. Retain the coherent-memory correction. During exact authenticated direct GENET with no physical input/response, stream/synchronous output, reboot, quarantine or containment debt, run composite IPC/Worker/bootstrap/output maintenance in Dispatch once per operator rotation. Serial, LocalSeat and Display keep their physical work and timer/reconciliation preludes; Network retains its existing no-control-tail contract. Urgent work, missing or mismatched identity and WiFi preserve all existing maintenance cuts. Do not change SC numerics, wake allowances, the 64-quantum cap, device ownership or command semantics. Test maintenance counts and fallbacks, preserve passive admission and physical-operator contracts, qualify exact Pi and QEMU, then compare raw CPU/latency and functional/pressure evidence on fresh hardware. Host-tool suite, Python SDK, generated interfaces and raw/REST workloads are compatible without consumer changes. Repetition is source-proven; its contribution to GENET latency must be measured. - Pi coherent driver control memory — after the unchanged `1096630c9` two-WiFi/two-GENET matrix, map CPU-only control and SHARED resources as identical cacheable Normal/XN memory in root, owner and reciprocal driver aliases. The selected SMP kernel supplies inner shareability. The device address audit binds SDIO DMA4 control/bounce and firmware requests, GENET buffers and USB rings to separate private DMA resources; retain their Device attributes and all MMIO/framebuffer mappings. Preserve barriers, publication and range contracts, owner boundaries, SC numerics and targets. Emit `coherent-shared-plus-barriers` with zero cache-operation counters and retain both historical trace policies. Test resource-class mapping and receipt validation, inspect exact Pi aliases/stack and run pinned QEMU root-MCS before fresh RAM reset/CRC dual-mode measurements. WiFi source-to- queue means near 13.38 ms and long post-root-dequeue response tails identify shared CPU service as a candidate, not proof of a cache-only bottleneck. Host-tool suite/catalog, Python SDK, generated manifests/ABIs and raw/REST workloads retain their contracts; only the trace-policy consumer changes. - Pi packet and poll correlation — the unchanged `e8929515a` two-WiFi, two-GENET comparison contains one passing Wi-Fi raw run, one retransmission tail failure, and unchanged GENET p95 around 5.55-5.71 ms. Preserve targets and compare against the exact August 10 pre-26e software path. Add a bounded latest-flow TCP-header journal at the existing Wi-Fi dequeue observation, retaining available source/Q11/root-copy/full-counter metadata without a new device call or payload. Six `wifi rx-trace` pages expose independent packet receipts. Separate `smp poll-time` records root ordinary poll phases and between-poll wall intervals by connection without resetting kernel CPU accounting or modifying exclusive passive-admission ordering. Validate parsing, missing evidence, eviction, clocks, output bounds, shared host forwarding, exact Pi code/stack and pinned QEMU root-MCS. Existing SMP CPU rows and report capacities remain intact. No budget, guard, scheduling, device, retry, manifest or ABI changes are part of this diagnostic batch. Host-tool catalog/suite, Python SDK, raw/REST workloads and arithmetic are reviewed; only shared command/help forwarding and the physical diagnostic command-marker inventory require consumer changes. Fresh packet/service correlation must select the next performance correction; aggregate maxima alone do not establish the responsible owner or a hardware limit. - Root CPU-sharing synchronization — after the unchanged `db420f1c1` two-WiFi, two-GENET matrix, remove kernel cache-maintenance calls from HAL-owned shared control and payload handoffs. Control pages and ordinary payloads are identically uncached; serial/GENET CPU-only SPSC payloads are identically coherent Normal memory. Preserve all range checks, release/acquire barriers, sequence-last publication, stable rereads, owner/generation fences and physical DMA/image maintenance. Remove obsolete cache-call accounting; the fixed counter fields remain present and zero for these shared handoffs. Emit `cache_policy=uncached-plus-root-barriers`; the trace normalizer accepts this only with four explicit zero cache counters and retains historical maintenance receipts. Test mapping classes, publication/queue contracts and both receipt policies; inspect exact emitted Pi code and retained stack, then run pinned QEMU root-MCS and fresh dual-mode Pi raw/functional/pressure checks. The redundant work is source-proven; its performance contribution remains a hypothesis until measured. Complete host tools, Python library, generated manifests/ABIs, `.coh` workloads and raw/REST arithmetic require no implementation or schema changes beyond the affected trace consumer. - Pi WiFi idle Retry and GENET root overhead — route the attached WiFi final idle `Retry` through the existing one-shot outer recheck. Renew that hint only after proven productive attached Network progress without resetting either activation counter or the 64-turn cap. Exact GENET rotor units no longer open unrelated CYW43 operation/cache/retirement scopes, and NIC selection precedes WiFi admission snapshot derivation. Validate immutable generated GENET continuation topology once per EventPump; retain all live transaction and fault fences. Read narrow local-seat ingress/recovery fields and avoid parser-readiness queries for empty ingress. Preserve operator service, SDIO deadline fault hints, MCS numerics, driver ownership, all protocol/manifest/ABI and workload contracts. Exercise progress/cap, topology drift, GENET operator ownership, USB input/debt and WiFi rotor contracts; qualify exact Pi code/stack and pinned QEMU root-MCS before delivery. Existing session Yield/CPU/idle and wire timing receipts remain the discriminator. This is a candidate optimization, not proof of either target; fresh repeatable dual-mode raw TCP remains required. Complete host tools, `tools/cohesix-py`, generated contracts, raw/REST benchmarks, `.coh` workloads and trace consumers require no changes to code or schemas. - Exact-d35fc94f0 USB controller recovery — the cold PCIe sequence now passes in both modes with stable root text and live serial; GENET reaches DHCP. USB EngineInit completes with device-unavailable while networking remains gated, so neither boot measures the retained performance changes. Seal serial, diagnostics and boot-paired capture prefixes in `out/bench/d35fc94f0-startup-stall/` before edits. Complete the initial PERST sequence with one firmware reload after full endpoint configuration; extend phase admission through mailbox completion and rearm failed proofs. Preserve same-command USB failure phase in the existing terminal result, prioritize that fault over later idle progress and queue one bounded physical fault notice. Keyboard absence must not block controller or network admission; keyboard enumeration remains downstream. Preserve all earlier address, stack, TLS, ownership and unmeasured performance fixes. Complete host tools, `tools/cohesix-py`, generated interfaces, raw/REST workloads, report schemas and trace normalization consumers were reviewed: existing key/value diagnostics retain the additional phase without layout or parser changes. DRIVERS owns the additive diagnostic semantics. Exact Pi and narrow QEMU qualification cannot replace physical recovery or raw performance evidence. Discovery remains console/network isolation and driver-runtime MCS/CYW43 coexistence; both performance targets stay fixed. - Exact-6ffce5702 cold PCIe handoff recovery — one WiFi and one GENET boot halt with SError before either network driver starts. Preserve both serial slices and their shared capture window in `out/bench/6ffce5702-failed-boots/baseline.json`; these failures provide no performance matrix. Correct host text sampling to the runtime interval `[4,4096)`: both boots match the exact ELF (`bbe04ea4`, word34 `d2850e89`), so the current evidence does not show text drift. Selected U-Boot removes the bridge with INIT/PERST asserted and SerDes powered down. Make SW_INIT the first controller access; verify reset release before hard-debug, configuration, MSI or status access. Retain the existing settle bounds, physical ownership and endpoint proof. Separate in-progress from completed phase admission and rearm all typed failures. Remove the unreachable status-only shortcut and its unsafe pre-reset diagnostic read. Retain the prior WiFi idle-Retry/productive-rearm and GENET root hot-path changes; neither has fresh Pi performance evidence yet. Compile and inspect the exact Pi image before the next physical attempt. Full host-tool suite, `tools/cohesix-py`, generated contracts, raw/REST benchmark workloads and report schemas require no changes; private HAL receipt changes are documented in DRIVERS. Discovery remains `m26e-console-network-service-isolation` and `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. No target is relaxed. - Exact-b8e293bc9 shared PCIe bootstrap recovery — the user's WiFi and GENET boots both halt with kernel SError at `0x624cc`, immediately following the first write to legacy interrupt MASK_SET at `0xfd504310`. Preserve both exact serial segments and the shared capture window in `out/bench/b8e293bc9-failed-boots/baseline.json`; individual reset wall times are unobserved and this is not a four-boot performance matrix. Restore the workspace `z` compiler profile because root-only level `3` has no repeatable dual-backend performance result. Keep the proven 1-MiB stack, occupied TLS storage and nonzero PCIe cache-publication repairs. Match selected BCM2711 U-Boot setup: quiesce the dedicated MSI bank after root reset/window setup, use command aliases only for writes and separate mask/pending status for proof, never access the legacy STB bank as an additional MSI bank. Clear the prior proof before an attempt and return typed errors for invalid addresses or unsuccessful masking; retain endpoint interrupt suppression. Add bounded begin/result receipts and exact register/status contracts; compile and inspect the exact Pi image and stack before fresh hardware. No MCS numerics, physical owner, manifest, ABI, protocol or workload change. Full host-tool suite, Python library, generated contracts, raw/REST and trace consumers require no implementation or schema changes; the private HAL boot diagnostic fields are documented in DRIVERS. Discovery remains `m26e-console-network-service-isolation` and `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. Source qualification cannot close SError recovery, GENET recovery or either performance target. - Exact-1894029de PCIe mapping publication repair — the unchanged two-WiFi, two-GENET matrix completes before edits. Both GENET boots prove code word `0x34` changes from `0x91002100` to PCIe BAR2 value `0x11` before network construction, then fault at that address. The first successful mapping cache compare-exchange returned its previous zero instead of the new page; register offsets therefore addressed low root text. Return the published page or existing winner, and reject zero or unaligned page bases before register access. Preserve HAL ownership, mapping/capability policy, memory, SC, driver, protocol and workload bounds. Test first publication, existing winner and invalid address contracts; retain exact Pi code-integrity and network proof before claiming recovery or performance. Complete host-tool, Python library, generated interface, raw/REST benchmark and trace-consumer review finds no consumer, schema or workload change. Discovery remains `m26e-console-network-service-isolation` and `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. - Exact-7b6 bootstrap storage and instruction investigation — collect two WiFi and two GENET boots before edits. Both GENET boots report the same root UserException at PC `0x34` after `stack-allocation.ok`; the saved ELF contains a valid ADD instruction there. Independently, the exported zero-sized `__tls_base` aliases local-seat flags despite an eight-byte bootstrap store. Let `sel4-sys` own both the real, aligned atomic word and its accessors; remove the mismatched runtime declaration. Retain bounded Pi bootstrap samples of the first text page, excluding its null-address entry word, at root entry, IPC installation, fault-receiver activation, and GENET constructor cuts. Compare these with the exact ELF to distinguish live code alteration from a saved-image or instruction-cache question. Preserve all scheduling, mapping, owner, memory-reservation and external interface contracts. This repairs proven storage corruption but does not yet attribute the GENET exception or prove either performance goal. Review the complete host-tool suite, Python library, raw/REST workloads, generated contracts and trace consumers: additive diagnostic text needs no consumer or report-schema change. Exact builds, symbol-size/non-overlap checks, focused contracts and the shared root-MCS QEMU canary precede fresh Pi proof. Discovery remains console-network isolation and driver-runtime MCS/CYW43 coexistence. - Exact-17e bootstrap fault reporting repair — two WiFi cohorts complete raw, functional and pressure tests before edits, but reach only 15.583/16.811 requests/s with p95 114.550/115.978 ms. GENET's controlled boot expires its 300-second shell deadline; two externally reset attempts repeat the same `stack-construction.begin` stop after `owner-proof.return`. Their shared outer capture interval is retained without fabricated per-reset packet timing. No GENET TCP test runs. Start only the existing Pi root-fault and root-emergency receivers after their construction, before the vulnerable constructor; keep full registry sealing mandatory for service/Worker activation and recovery. Unsealed faults retain copied raw operands and emit sixteen-byte raw UART chunks across explicit replenishment boundaries, independently of logging/registry locks and normal queues. QEMU retains late receiver activation. Narrow GENET-only constructor cuts distinguish allocation/storage/socket frontiers if no fault arrives. Preserve all SC, capability, memory, driver, protocol and generated numeric contracts. Full host-tool suite, `tools/cohesix-py`, raw/REST workloads, generated consumers and trace parsers reviewed: additive bootstrap fatal text requires no external grammar, workload or report-schema change. Source and QEMU regression checks cannot prove this Pi fault branch, the constructor fix, or either performance goal; exact Pi failure operands and fresh target validation remain required. Discovery tasks are `m26e-console-network-service-isolation` and `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. - Exact-8d0 root execution-cost experiment after stack repair — the unchanged 1-MiB-stack image completed two WiFi and two GENET boots before edits. All raw64, four command scripts, Worker32, medium16/high32 application and strict wire audits pass; all eight WiFi or seven GENET CPU rows complete. WiFi reaches 11.614/14.036 requests/s with p95 136.251/137.229 ms; GENET reaches 350.343/417.612 requests/s with p95 5.682/5.625 ms. Both performance goals remain open. WiFi root CPU totals 2.373/2.027 seconds per session, compared with 13/13 ms in console-network; GENET root totals 73/71 ms. These asynchronous session receipts motivate reducing root execution cost but cannot prove a particular request exhausted its SC. Re-evaluate speed optimization now that both backend boots pass the corrected stack layout: the experiment selected level `3` only for root-task, leaving QEMU, child packages and dependencies at `z`. The b8e recovery above retires that experiment without a repeatable performance gain. Preserve constructor logic, all scheduling numerics, physical ownership, memory declarations and archive limits. Require exact Pi compilation, retained ELF/call-frame and image admission, then fresh raw and pressure hardware evidence before attributing any gain. Previous failed compiler/stack artifacts remain immutable. Complete host-tool suite, `tools/cohesix-py`, generated contracts, raw/REST workloads and report schemas were reviewed: no external format or consumer change. Discovery tasks remain `m26e-console-network-service-isolation` and `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. - Exact-772 optimized GENET bootstrap discriminator — `772f4a40b` builds and passes image admission with an inspected 266,688-byte bootstrap/GENET call chain inside the corrected 1-MiB stack. Verified RAM transfers and post-reset CRCs reach exact BUILD and GENET owner-state readiness, but the shell does not appear within 300 seconds; one subsequent serial PING also times out. No TCP workload runs. The earlier stack defect alone cannot explain this repeated boundary; the terminal instruction remains unknown. Retain the failed boot and use four Pi bootstrap-trace-only raw UART receipts around the owner-proof snapshot and fallible network-shell constructor. Preserve optimization, constructor and driver behavior so the next physical boot discriminates this gap. No source/build result claims a performance repair. Full host-tool, Python, `.coh`, raw/REST benchmark and trace-consumer review: additive bootstrap text is retained as diagnostic data, requires no parser or workload change, and cannot create driver or performance acceptance. - Exact-8d34 performance evidence and rejected compiler experiment — two WiFi and two GENET cohorts completed before edits. WiFi raw64 reaches 16.563/13.275 requests/s, p95 87.489/127.706 ms; GENET reaches 404.704/382.062 requests/s, p95 5.825/5.625 ms. All four functional, Worker32, medium16 and high32 workloads pass, including boot-paired wire audits. WiFi records 106/152 root Yields, 105/151 at the other-boundary cut; their elapsed handoffs total 0.769/1.029 seconds. GENET records five root Yields per session; packet-owner maximum slices of 99/158 us do not hit the elapsed guard. These observations do not identify a per-request SC exhaustion cause. The original speed-optimization variants were rejected: driver and console variants exceed declared page bounds, global root optimization exceeds QEMU archive capacity, and the Pi-only `e3fc025cb` physical boot stops before shell construction. Its exact ELF proves nested frames of at least 266,688 bytes against the 262,144-byte root stack; the terminal instruction is unobserved. Destination-first construction in `a5e1add5b` leaves that bound unchanged, while the no-inline `0cf98579f` variant still requires at least 265,568 bytes. Both are rejected statically before hardware execution. Restore the original `z` profile and constructor; preserve all failed evidence and unchanged child/SC admission bounds. - Root bootstrap stack admission repair — the exact restored size-optimized `bc6bf415d` Pi ELF also violates the prior 256-KiB declaration: retained `kernel::start` (24,368 bytes), `kernel::bootstrap` (303,824 bytes), and GENET construction (208,688 bytes) already total 536,880 bytes before deeper calls. Outlined probe loops are included; direct call edges are verified. Reject this candidate before flash. Set the root linker reservation and independent layout policy to 1 MiB, with headroom for deeper service calls, retaining the 2-MiB heap, child declarations, SC policy and archive limits. Correct the misleading guard comment: the mapped gap above the stack only separates IPC storage and cannot detect downward overflow into the heap. This repairs a measured memory-layout defect, not a compiler speed claim. Inspect exact emitted frames and memory admission, run layout contracts and the shared root-MCS QEMU canary, then require fresh physical boot evidence. No existing successful boot establishes absence of prior heap corruption; no specific NineDoor fault or latency sample is attributed to it without further evidence. Full host-tool/Python/benchmark compatibility review: initial image memory footprint changes by 768 KiB; packaging and loader consume the ELF bounds. Wire/API/workload/report formats need no change. - Deadline-complete WiFi causal waits — retain the distinct persistent/steady parent deadline classification, but permit its bounded fan-in wait after exact physical WiFi topology and the existing PCIe timer's live, sealed lifetime are proven. Poll root's absolute timer before and after the enable Call, then re-read physical completion, empty child publication and all operator/recovery/fault fences. A timer hint returns to the normal rotor and parent-deadline observation. Ready, revoked, unknown child state or rejected timer proof cannot authorize blocking. Preserve the existing activation and causal-wait caps, physical ownership, scheduling numerics and GENET path. Discovery tasks: `m26e-console-network-service-isolation` and `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`. Pure classifier tests, condition-before-block source guards, exact Pi build and pinned QEMU 10.1 root-MCS canary qualify only the candidate; fresh Pi raw evidence must establish any performance gain. Complete host-tool, `tools/cohesix-py`, generated-contract and benchmark compatibility review finds no changed API, command, wire format, workload, measurement arithmetic, report schema, artifact path or object declaration; those consumers need no code change. - console-network ABI — advance the common READY/ABI identity to v4 and add child event `CommandBatch = 27`, encoding version 1, with one through eight exact same-connection authenticated commands. Each record retains its own `now_ms`, length, and UTF-8 bytes inside the unchanged 2368-byte payload and four-page/capability topology. - restricted child — use generated `max_commands_per_wake <= 8` to coalesce only consecutive command events that fit the fixed page. A lifecycle or connection-identity event is an absolute fence; a single command remains the legacy `Command` record. - root boundary — validate the complete private batch, reserve the complete bounded command-queue capacity before mutation, then admit exact FIFO command/timestamp records. Any malformed, over-capacity, cross-identity, or stale batch fails closed without partial execution. - Worker service — use a rotating pending bitmap and a fixed internal Worker quantum so every executable slot receives fair service and one activation may complete a bounded useful batch while rechecking mailbox/fault priority between records. - Worker execution topology — replace one active sporadic SC per Worker with compiler-expanded passive Worker records and two fixed active executor lanes, one on each Worker core. Each lane owns a bounded generated budget, accepts only its generated role set, selects instances through a fixed allocation-free fair queue, donates its SC through a depth-one endpoint Call, and regains it only through the instance-owned Reply object. Root-control remains the sole admission/policy owner; executors gain no root CSpace, untyped, namespace, or cross-role authority. - scalable isolation — the QEMU and Pi profiles each admit 256 simultaneous executable Workers (one Heartbeat, 127 GPU, and 128 LoRA) and retain `max_workers=256` plus per-role `namespace_capacity=256`. The Pi profile selects a 16-bit root CNode: 65,536 slots, with 19,516 consumed by the compiler-accounted fixed inventory, complete Worker mix, and post-construction reserve, leaving 46,020 slots of deterministic headroom. Neither target weakens instance VSpace, CSpace, identity, fault, timeout, Reply, generation, or teardown boundaries. Share only sealed read-only/read-execute image frames within an exact role/image identity; every writable image page, ABI page, IPC buffer, and stack remains instance-private. Replace single-word pending state with a fixed compiler-bounded bitmap and retain allocation-free bounded selection/drop accounting. This is static configuration and build admission, not Pi construction, READY, driver-coexistence, performance, or hardware acceptance evidence; executable population remains capped at 256. - passive fault recovery — retain one generation-scoped recovery view of each Worker Reply in root-fault. A standard or timeout fault suspends the exact passive generation, issues at most one typed failure reply to release the blocked executor, returns the donated SC, and then performs the existing bounded containment and fresh-generation fence. Stale Reply, cross-lane donation, missing caller, nested donation, or incomplete SC return fails closed. - transport progress — retain the single authenticated target connection and add bounded command/read batching with an exact response for every input. Schedule three fixed host lanes over it: root-admitted host-ticket specification ingress first, receipt/control progress second, and bulk telemetry third. Bound every queue and burst; follow each execution burst with control and telemetry service so priority cannot become starvation. Remove the idle broker's artificial 20--40 ms ordered-channel wait without adding a retry or alternate transport. - root activation — after useful QEMU progress, retain a bounded active window through transient empty snapshots until the existing counter guard, completion cap, or probe cap. A genuinely idle activation still stops after the minimum probe quantum. A mechanical quota with durable work may re-enter the outer loop without `seL4_Yield`, but every re-entry retains the original counter-window start and checks the guard before its next bounded leaf. Reaching the guard requires an explicit yield so the passive-call and epilogue reserve cannot be consumed by a restarted local timer. The unchanged MCS scheduling context remains the hard execution bound. Generic and non-CYW43 Pi paths retain their explicit-yield boundary. The deferred physical CYW43 supervisor alone may retain the current refill across strict Operator/Driver alternation under the generated root-control `budget_us - wcet_us = 250 us` pre-admission cut and a 64-productive-unit cap; equality stops new-unit admission so one complete declared 2,500 us WCET remains inside the unchanged 2,750 us SC. An independent WCET audit rejected the proposed 2,500 us elapsed work window because it could admit a fresh leaf at 2,499 us with only 251 us of SC budget remaining. After service readiness, an actually productive attached CYW43 Network unit with exactly one service advance and an immediate Network successor with durable schedulable work may retain that window. An authenticated response cursor may instead cross exactly `Network -> Serial -> LocalSeat -> Dispatch -> Network` when its connection, one-step cursor and flush advances, unchanged command count, and generation/pair/lifetime rotation token remain exact; this admits LocalSeat exactly once, performs one backend poll only when USB service debt exists, performs no second Network operation in the wrapper, and rechecks the unchanged loop-top reserve before the next separately charged Network turn. Physical input or response, terminal return, identity drift, operator conflict, recovery, quarantine, containment, or reboot denies that exception. Invalid configuration/timing, waits, idle/nonprogress, handoff, terminal state, or the guard restores the explicit yield. Only the Pi direct-GENET-feature isolated authenticated console socket disables delayed ACK and Nagle for its bounded interactive request/response protocol; QEMU retains its qualified TCP policy. These corrections change no SC budget, period, fault priority, epilogue slack, listener, queue, authority, or wire grammar. - exact-5f Pi network latency correction — exact source `5f145d2ba316c0b510788b760f54ad0e170216f9`, image ID `6f050f6f840a53595d4a04233bc32a6c45ad9b74a1e09e9d274d2e2c8d064874`, image SHA-256 `d1aacfd13d97f3f06db6656f112255f6ff2605a4692816861e2708da515e4b0a`, build ID `8ff606e5a57f9723179b3a581ddbc8820f18932e17d62df029497df82f91aaec`, exact serial boundaries, and boot-paired `20260828-210830` WiFi/USB captures prove both selected Pi interfaces accept authenticated TCP and pass `boot_v0.coh`, `tcp_basic.coh`, `smp_parity.coh`, and `converge_target_activity.coh` on the first attempt without retransmission, zero-window, reset, quarantine, or containment evidence. WiFi nevertheless retained 114.684 ms median handshake, 266.080 ms median request-to-first-data, and 151.224 ms median streaming gaps; GENET retained sub-millisecond handshake/DHCP but 30.186 ms median request-to-data and only 24.993 request/s versus the August comparator's 180.269 request/s. These are functional proof and latency failure evidence, not parity. Retain the safe generated CYW43 admission guard at `budget_us - wcet_us = 250 us` inside the unchanged 2,750 us natural-postpone SC. An independent WCET audit rejected the proposed 2,500 us productive wall-time expansion because it could admit a fresh 2,500 us leaf at 2,499 us elapsed with only 251 us of SC budget remaining. The Pi feature alone still disables delayed ACK and Nagle. Direct GENET supersedes the earlier exact-a7 strict-ordinary-rotor candidate only for its own driver contract: select exact ready StageOutput, then exact ready Disconnect, otherwise alternate one ObserveChild/ServiceTick unit; QEMU direct-VirtIO remains byte-for-byte on its strict selector. When one first GENET Network visit observes one exact nonsaturated authenticated command, preserve Serial and LocalSeat priority, Dispatch it, and spend the fifth existing Pi quantum unit on exact response staging while leaving Display as the next debt. Add diagnostic-v3 raw receive-boundary notification receipt/rejection/badge-union evidence in the existing 192-byte record, counted once before filtering with no service authority, and make the canonical serial helper launch one validated generation-bound `boot_v0.coh` peer so `nettest` exercises real TCP while the target's exact final terminal remains authoritative. Preserve schema 1.15, the 256-Worker population, 16-bit Pi root CNode, every manifest/MCS numeric, core placement, Reply/fault/isolation boundary, queue/frame/unit bound, QEMU packaging behavior, and public console grammar. `cohsh` needs only its additive eleven-row captured fixture; the trace normalizer and serial helper need focused tests. The complete remaining host-tool suite, `tools/cohesix-py`, generated-profile consumers, `.coh` workloads, benchmark arithmetic, and report schemas were reviewed and require no implementation change. Source, host tests, QEMU, static Pi validation, construction, or image identity can reject this candidate but cannot prove either physical speedup; fresh exact-image WiFi and GENET captures plus authenticated benchmark evidence remain mandatory. - exact-38a Pi dual-mode latency routing — exact source `38a28fad6e9a00062b63fc3bbbd0dd0a3afca576`, image ID `ff258f65e09b360e22bec0a596834ba2d9bcd5819159eecc40168aada8c60093`, image SHA-256 `116c933037083b8c53fe3f738ee7e582040043a675d9b2be06d298232d16b0a9`, build ID `22d6b06c2a08c14ae885d99875129871fa5aa9fe15b10bb130c6cc685e97faf8`, resolved-manifest SHA-256 `4231476a82e8cef643a26ac5fa126d1c6cae06d76fba09693af8dd2964d1195b`, exact serial boundaries, and boot-paired `20260828-230431` captures prove both modes remain functionally correct while rejecting latency parity. WiFi reached DHCP at 69.460 seconds, passed all four canonical `.coh` scripts on their first no-retry attempt, and showed no queue drop, overrun, quarantine, containment, or driver terminal, but retained 105–212 ms SYN response, 233–266 ms command response, 266,809 us average accepted-to-issue delay, and about 20 ms issue-to-terminal cadence. GENET passed the same scripts, 10/10 sub-millisecond ping, and 64/64 raw requests, but retained 39.885 ms median first payload and 24.997 request/s versus the accepted August comparator's 1.677 ms p95 and 180.269 request/s. The fresh pcaps show no loss, retransmit, reset, zero-window, or NIC-side delay capable of explaining either result. For direct GENET only, the generation- and connection-bound isolated response lane now supersedes the weaker legacy post-dispatch cursor once it owns exact `ControlCompleted` plus `OutputDrained` proof; the fifth existing Pi unit stages the response without manufacturing eight redundant Network debts, while any generation, authentication, connection, or runtime drift fails closed to the bounded legacy cursor. CYW43 keeps that cursor because its ordinary smoltcp path still needs it. When one exact authenticated CYW43 cursor flush accepts exactly one response frame after the turn's ordinary TX opportunity, and no physical operator, recovery, containment, reboot, quarantine, or earlier CYW43 operation owns the cut, the same remaining `DriverServiceBudget` may offer that frame to the sole op7 owner before returning. The existing outer-operation claim still caps the complete turn at one physical operation; zero, multiple, saturated, stale, unauthenticated, cross-generation, or already-claimed evidence denies the opportunity. This changes no SC, priority, period, budget, refill, queue, cursor limit, physical-input precedence, driver authority, schema, generated profile, protocol, or retry. A Pi-only static root/console priority equality plus `SchedContext_YieldTo` was reviewed and rejected for this 26e repair because equal-priority FIFO weakens the current kernel-enforced pre-authentication physical-operator precedence; authenticated/no-TCP priority modes remain compiler-owned Milestone 29b scope. Existing `netstats`, TX phase, MCS, and queue evidence already distinguishes the repaired seams, so no console grammar or telemetry schema change is warranted. The host-tool suite, `tools/cohesix-py`, generated contracts, `.coh` workloads, benchmark arithmetic, and report schemas remain compatible and require no target behavior change. Fresh exact-image WiFi and GENET hardware evidence remains mandatory before any speedup or parity claim. - exact-de930 Pi refill and direct-owner convergence — exact source `de930ab607f7d2fccb4bdf20455c7f1f39e1e91a`, image ID `9ed16bbe2e256b5f1277981c436ffbd35d1b27910893d2cf931bac5a241f1a64`, image SHA-256 `d4e834ee403070c05066b9ee96d979f42ccdd8a429b2da598ac0cc5c130478d9`, build ID `0ee3b46cb08113fb90f841ca63979450ae53fdf6d2ddd070be1d687c3544df50`, resolved-manifest SHA-256 `4231476a82e8cef643a26ac5fa126d1c6cae06d76fba09693af8dd2964d1195b`, exact serial boundaries, and boot-paired `20260829-063651` captures prove WiFi DHCP, authenticated TCP, `boot_v0.coh`, `tcp_basic.coh`, and `smp_parity.coh`, but reject performance closure: raw 64/64 sustained only 2.740 request/s with 240/269 ms p50/p95 and service readiness arrived at 82.740 seconds versus the accepted August 10 comparator's 25–39 request/s and 8.740 seconds. Eight exact child traces locate 98.2% of the slow interval after sub-millisecond SDIO physical terminal and before CYW43 acceptance, in repeated near-10-ms periods. GENET separately proved DHCP, direct rings, `nettest`, `boot_v0.coh`, and `tcp_basic.coh`; `smp_parity.coh` then reproduced a spurious IRQ followed by direct-peer containment, so it is functional-prefix and failure evidence rather than TCP/performance acceptance. The selected seL4-16 AArch64 MCS object ABI proves an 8-bit scheduling context holds ten total refill records (`sched_context_t=96`, `refill_t=16`). Supersede only CYW43 and SDIO `max_refills=2` with eight while preserving each 1,500/10,000 us budget/period, priority 184, core, timeout, Reply, fault, authority, and WCET value; the compiler must bind this capacity to the exact selected kernel/profile/build identity and reject eleven. Root may make one immediate exact terminal-only CYW43 Network revisit after the intervening Serial unit only when the same parked parent request, generation, canonical runnable cut, and captured open pair-lease identity remain exact, with no command, successor, operator, recovery, quarantine, reboot, or physical operation; it then stops the turn. Finite bootstrap keeps bounded HID polling after command-ready so HDMI cannot advertise an interactive prompt before local-seat input is serviceable. Direct GENET supersedes the one-productive-quantum-per-Yield candidate with a dense owner-local MCS window: preserve accounting across Block, admit exactly one material packet operation per guard sample, alternate RX/TX first choice with an exact 8/8 split under continuous bidirectional pressure, charge retained cursor reconciliation to the same 16-slice cap, re-enter only while durable work remains, and force a post-command fresh-refill boundary, half-budget elapsed guard, one bounded no-progress retry, exact max-two-refill `3,000/10,000 us` handoff/runtime truth, exact compiler/profile `wcet_us=800`, terminal counter fault, and fail-closed handoff preflight. Diagnostic v4 reuses record offset 12 for measured packet-slice high-water and adds cumulative fresh, guard, counter, cap, and stalled dense-window reason flags without changing the 192-byte record, commit offset 184, page topology, packet authority, or eleven-row ordering. Mandatory driver-fault output retains one bounded record until both physical output and qlog accept it, without duplicate output or falsely incrementing best-effort drop telemetry. This candidate changes no public AUTH/framing/command/ACK/ERR/END behavior, listener, namespace, queue/frame bound, QEMU direct-VirtIO behavior, Worker population, CNode, schema 1.15, or hardware configuration. `cohsh` and trace-normalizer fixtures require the additive DPC fields; `coh`, `coh-status`, Hive Gateway, SwarmUI, GPU/sidecar/ticket tools, `tools/cohesix-py`, generated profile consumers, `.coh` workloads, benchmark arithmetic, and report schemas are reviewed and require no behavior change. Source, host tests, QEMU packaging, static profile validation, construction, image identity, and flashing cannot prove WiFi/GENET latency, throughput, August parity, or Pi acceptance; fresh exact-image dual-mode hardware benchmarks remain mandatory. - exact-2be Pi packet-slice and response-continuation correction — exact source `2be53e2270562be0a2b9d6435b831c826a9dde37`, image ID `21f4a24b173609992e43cd18c852a29fca58aa833ea59600a7b44f2509a603eb`, image SHA-256 `7e5cf5fbdd7721c9a4b8f345c35026df87d991ead6b8ff5259ad2914854b9587`, resolved-manifest SHA-256 `28f99df3f09adc490c25c82625e7ef89d4335cba0563efd3a07b6a806e1e0650`, and boot-paired `20260829-085248` captures prove WiFi first-generation Ready, DHCP, authenticated TCP, and three focused scripts without loss or quarantine, but only 2.630 raw requests/s and 306.254 ms p95 first response. The same exact image reaches GENET link, DHCP, valid direct rings, and an 11 us pre-load window high-water before the first authenticated `nettest` ingress raises the terminal `bcmgenet-v5` MCS timeout and correctly quarantines the pair; no post-containment wired TCP, REST, script, or performance result is admissible. The next candidate replaces each direct-active 16-frame attempt with at most one material TX or RX/finalization operation per guarded slice, alternates first choice for an exact eight/eight split across the 16-slice dense window under continuous bidirectional pressure, and permits an empty side to donate its slice. A malformed RX descriptor recycle consumes its guarded slice and cannot also donate it to TX. Compiler/profile validation requires exact `wcet_us=800`; handoff/runtime validation retains exact max-two-refill `3,000/10,000 us`, the half-budget elapsed guard, command-freshness boundary, one no-progress retry, and fail-closed counter/cursor behavior. Nonforeground CYW43-to-SDIO bus-link copies validate both complete runtime/owner ranges and actual virtual-address alignment, use bounded word copies only when both mappings permit them, preserve invalidate/barrier/clean ordering, and cannot cross the runtime-ring/shared-payload seam; foreground sealed-parent trace and prepared-write/overlay authority remain bytewise unchanged. An authenticated CYW43 response may retain the current activation across exactly `Network -> Serial -> LocalSeat -> Dispatch -> Network` only with one service and flush advance, a one-step still-active connection-bound cursor, unchanged accepted-command count, and one exact generation/pair/lifetime token consumed at Dispatch. That wrapper admits LocalSeat exactly once, performs one backend poll when USB service debt exists, performs no second Network operation, and returns through the unchanged loop-top 250 us reserve and 64-unit guard before another separately charged Network turn. This changes no manifest allocation, SC numeric, CNode or Worker population, public command/wire/namespace, ABI field/layout, QEMU direct-VirtIO path, `.coh` workload, benchmark arithmetic, or report schema. A REST `perf` status/telemetry run made after executable READY preflight blocks is transport/read-path diagnostic only and cannot substitute for Worker pressure, capacity, Pi acceptance, or QEMU parity. Source, deterministic tests, static profile validation, QEMU checks, image construction, and flashing cannot prove the physical correction; fresh exact-image dual-mode hardware and qualified benchmark evidence remain mandatory. - exact-0745 direct-GENET retained-window candidate — exact source `0745e3592778ba802453735d8015d8f4be934d41`, image ID `af050eb6a31ddb676214b3b425a902a09fce2d5260fb632da4893d6d2f1a7529`, image SHA-256 `c43082a92ead026254bdc07420d6c773617c64e1ec9200d7b045ed9a743934a5`, serial diagnostics, and boot-paired `20260829-124133` captures prove WiFi Gate 8/DHCP/authenticated TCP/three focused scripts and a first GENET lifetime with DHCP, direct rings, peer-assisted `nettest`, authenticated TCP, and post-ARP 0.676 ms SYN-to-SYNACK. They reject performance and repeatability closure: WiFi raw 64/64 remains 2.396 requests/s with 362.848 ms p95 first response, and a clean second GENET boot raises the terminal `bcmgenet-v5` timeout during its first material direct episode with fresh plus elapsed-guard reason evidence before correct pair quarantine. Keep the exact `3,000/10,000 us`, two-refill, half-budget, 16-attempt, 800 us WCET, one-stalled-retry, wall-accounting, timeout, fault, DMA/IRQ, direct-ring, and containment contracts. A `Reenter` successor now remains inside the same notification or final-prewait handler instead of escaping through the generic command-ring loop between packet slices; a successor guard Yield returns to outer arbitration, and only an actual TX/RX owned-state advance is productive. Unresolved reconciliation still consumes its exact slice without resetting the no-progress retry. Descriptor-admitted uncached payload copies use the existing audited aligned volatile 64-bit primitive with bounded byte prefixes/tails while preserving DMA barriers and sequence-last cursor commits. Focused regressions must prove local multi-slice re-entry, successor-Yield return, zero-progress peer/IRQ/ambiguous-cursor bookkeeping, retained wall guard and stalled Yield, unchanged non-test unsafe count, word-copy bytes/order, and invalid-cursor fail-closed behavior. No budget, priority, refill, retry, queue, manifest, schema, telemetry, QEMU direct-VirtIO, or hardware setting changes. Source, host tests, QEMU packaging, static profile validation, image construction, and flashing cannot prove repaired GENET continuity or August parity; fresh exact-image dual-mode hardware evidence remains mandatory. - exact-3ad Pi child-handoff and sustained-GENET candidate — exact source `3ad239e95c7e145c28a2fbc9a2f5b5b291eba652`, build `d50b3c2b4c43ff6c3c4b5a38c9cf86284fbbf1558f65ea946ee8d354d6083f3b`, image ID `fcd8c0609b3575ba2770cf3ad74def759c53e04e489ab4af39c7e72e63b3f567`, image SHA-256 `b55da37cc692542939aa991f33b4175569c3ec783cbebfbe884f9c0acc36c658`, serial evidence, and boot-paired `20260829-163547` captures prove the corrected 104-frame/161-slot child contract, WiFi DHCP plus three canonical scripts, GENET DHCP/direct-ring health/peer-assisted `nettest`, and one complete 10,771-byte authenticated wired response without retransmission or reset. They reject performance and repeatability closure: WiFi remains on a repeated 10 ms root/child scheduling staircase, while a controlled later GENET `boot_v0.coh` reproduction first raises `bcmgenet-v5` Timeout during a sustained TAIL response and then correctly pair-quarantines the console child. Supersede only the disproven scheduling assumptions. A final direct-GENET slice that leaves no durable ring condition returns `Block` before guard/cap/stalled Yield, so quiescence cannot charge the remaining refill. Sustained ready traffic retains the exact `3,000/10,000 us`, two-refill, priority-160, core-1, 800-us-WCET, half-budget guard, 16-attempt, ownership, DMA/IRQ, standard-fault, protocol-fault, cursor-fault, and pair-containment contracts, but selects `NaturalPostpone`: ordinary budget exhaustion is kernel-postponed rather than misclassified as a terminal device fault. This does not enlarge CPU authority or create a fallback. On Pi only, root-control and console-network select equal priority/MCP `200/200` on core 0 and retain their existing `2,750/10,000 us` and `3,000/10,000 us` SCs. After an exact sequence-last packet/control/publication-ACK commit, or after electing one bounded service-tick wake, root must successfully signal the one-hot child notification before it may invoke `SchedContext_YieldTo` on the already retained child SC; inactive, contained, null-SC, wrong-core, unequal-priority, insufficient-MCP, unsignalled, or syscall-failure cases fail closed. Root's physical-input rotor and all budgets, refills, queue/credit bounds, ABI v5, schema 1.15, 256-Worker population, 16-bit CNode, hardware configuration, QEMU priority and direct-VirtIO path remain unchanged; compiler response analysis records `8,100 us` for both Pi root-control and console-network. The complete host-tool suite, `tools/cohesix-py`, `.coh` workloads, REST harness arithmetic, generated external profile contract, and report schemas were reviewed and require no behavior change. Source tests, QEMU packaging, static Pi validation, construction, image identity, and flashing cannot claim fixed GENET continuity, WiFi latency, August parity, or Pi acceptance; a fresh exact-image dual-mode boot and benchmark remain mandatory. - exact-0be4 dual-backend active-time and connection-proof correction — exact source `0be4e9f4027d0cdf694ba09ef73f6d94b0076182`, build `d945d7d493093286fcd1057e5d9c1acd6832a1e7977a16425024b20af294c397`, image ID `8f607abebae9da4ac9811cff7f0e2f8768deaa79e67cb9eae5da00bfed4ddfbe`, image SHA-256 `55367a1aa518b5dffca14d1844c7bebda867d7cfdab7b6f261412b0c8c777d70`, serial evidence, and boot-paired `20260829-180642` captures prove WiFi Gate 8, DHCP, authenticated TCP, three focused scripts, and 8/32 medium/high REST pressure with zero transport/control errors, plus GENET DHCP, balanced lossless direct rings, authenticated TCP, the same scripts, and the same pressure with zero errors. They reject latency closure: WiFi needs about 93.5 seconds to become ready and records 3,155 outer 25-ms time-cap exits, while GENET retains a 10.251-ms mean ping floor and MCS fresh/guard/cap reasons on otherwise quiescent wakes. Preserve the audited 250-us root pre-admission reserve; do not reinterpret it as a 2,500-us work window. Instead, accumulate the outer 25-ms CYW43 cap only across admitted Network-service intervals, excluding replenishment gaps, exact-child waits between turns, and physical-operator phases while retaining the independent 25-ms real-wall operator checkpoint and absolute 192-turn cap. A direct-GENET final slice with exact empty rings and rearmed source closes only the userspace episode start/attempt/stalled state before Block; a later real IRQ or reciprocal peer wake starts a new episode on the same unchanged kernel SC. Continuously durable work retains GUARD/CAP/STALLED, and endpoint-command FRESH survives quiescent closure. The peer-assisted self-test must execute its observation on every selected console poll, bind a first later authenticated connection at its fresh zero counter epoch, and latch that identity's command-read, response-write/drain, TX, RX, and listener facts; retirement prevents a replacement peer or later unrelated NIC traffic from completing missing proof. The complete host-tool suite, `tools/cohesix-py`, generated profile/contracts, manifests, `.coh` workloads, REST harness arithmetic, report schemas, ABI v5, schema 1.15, every manifest/MCS numeric, core/priority/refill, queue, ownership, and public command/diagnostic format were reviewed and require no implementation or schema change. Focused tests, QEMU packaging, profile validation, image construction, and flashing cannot prove the latency repairs; the next exact image must repeat both backend scripts and medium/high REST pressure. - exact-f754 dual-backend root/child latency correction — exact source `f7544e88868d77ca90e7bcd687fedb66c1d11f02`, build ID `bbc72b4085fd69d7d2e613b037df8c80df148a92b97a4a9e52b5f77b0386a71b`, image ID `63ce19d903d15a2369b8c7fa5d0dae2e24898ee1b5f05a9b286dc1fd2913c68d`, image SHA-256 `fa74ee65dab14b5258c72882cea956d7537c43aae48e07d00f44a474a71ea85b`, exact serial evidence, and boot-paired `20260829-192549` captures prove both backends remain functionally correct while rejecting August latency parity. WiFi completes 64/64 framed requests on one connection without retry at 3.786 requests/s, 234.838 ms median, and 301.319 ms p95; its physical SDIO/CYW43 DPC work is predominantly sub-millisecond while root/console-child progress retains the repeated near-10-ms scheduling staircase. GENET completes the same 64/64 workload without retry at 24.646 requests/s, 38.323 ms median, and 45.511 ms p95; its rings conserve every observed descriptor without drop or poison, and the paired capture places target TCP ACK below one millisecond while application response remains 39--45 ms later. The next candidate removes those two root/child seams without changing public telemetry. The physical linked-runtime Network leaf runs only its timer/NIC/reconciliation responsibilities; the existing Serial, LocalSeat, Dispatch, and Display leaves retain the bounded root IPC/bootstrap/stream/reboot control tail, preventing that composite tail from being multiplied by every retained child microstep. The already compiler-admitted equal-priority Pi child handoff extends to mediated WiFi only after the service is exactly `Authenticated`, root committed and successfully signalled one one-hot wake, the runtime is active and uncontained, and its retained SC is live; pre-authentication and closing/fault/terminal states keep the ordinary physical-operator rotor, while QEMU direct-VirtIO remains non-YieldTo and direct GENET keeps its existing policy. When one direct-GENET Network unit observes an exact authenticated command with no physical-operator, response, recovery, containment, reboot, quarantine, pressure, or identity debt, the existing five-unit composer may run `Network -> Dispatch -> Network` to stage its exact response, then must return to Serial and stop. It adds no unit: a queued second command remains behind the restored `Serial -> LocalSeat -> Dispatch -> Display` debt, and every rejected or drifted entitlement falls back to the ordinary bounded rotor. All SC budgets, periods, refills, priorities, MCPs, cores, WCET inputs, queues, authorities, ABI v5, schema 1.15, 256-Worker population, 16-bit CNode, manifest, hardware configuration, and public command/diagnostic formats remain unchanged. The complete host-tool suite, `tools/cohesix-py`, generated profile consumers, `.coh` workloads, QEMU response matrix, REST benchmark arithmetic, and report schemas were reviewed and require no implementation change. Focused source tests, QEMU checks, static profile validation, image construction, identity verification, or flashing cannot prove latency or performance improvement; the next exact-image boot must rerun first-attempt scripts plus medium/high and raw framed benchmarks on both WiFi and GENET before any August-parity claim. - exact-ae2 passive-service and MCS-wake correction — exact source `ae2dd774126d9be70767d0b56068a13e58de5fd4`, build ID `12946f3637f482a3f70b47309dc43f3a2084c59e9d817597f13d2a7f5d9ac05d`, image ID `249549ae082f2d9a854c2c8b2da85bc6859f7bf55540ff3e39eca94b14573736`, image SHA-256 `19e499454c6a9e0efa4a0f7eb4eb1381adc482586299b1645c77f3d55e3d874d`, exact serial diagnostics, and boot-paired `20260829-210442` captures prove WiFi root readiness at 8.115 seconds, USB command readiness at 9.235 seconds, Gate 8a--8h, DHCP `192.168.86.154`, sealed 272/272 MCS registration, and five fresh TCP handshakes plus `AUTH` without driver fault or quarantine. They also reject function and performance closure: every Queen operation fails `ERR ATTACH reason=busy detail=busy error=busy`, mean SYN-to-error is about 626.6 ms, target-only `peer-assisted-pass` conflicts with the nonzero exact host-peer result, canonical `.coh` scripts cannot start, and medium/high REST pressure fails closed at the first request with HTTP 503. The authenticated serial reboot is blocked at the same ATTACH boundary, so ae2 supplies no GENET boot result. Route this first to `SERVICE_RUNTIME` under `m26e-console-network-service-isolation` and `m26e-root-tcb-target-proof`, not to RF, SDIO, CYW43, DHCP, queues, retries, or GENET tuning. Supersede only the disproven authenticated mediated-WiFi handoff: WiFi is signal-only in every lifecycle state, while direct GENET alone retains the compiler-validated guarded `SchedContext_YieldTo`; QEMU direct-VirtIO remains on its existing branch. On selected MCS, runtime receive classification uses the exact compiler-owned 64-bit command badge plus nonzero length for IPC and treats an admitted low-32 nonzero badge as notification work regardless of stale `MessageInfo`; zero, zero-length command, wrong-task, and foreign high-domain observations fail closed, while classic behavior remains length-first. Before any physical-Pi serial, local-seat, or TCP path dequeues a command that may donate root's SC to passive NineDoor, validate generated root budget/WCET/period/admission/consumed-evidence truth and accumulate `SchedContext_Consumed` over a conservative full-period window. Admit only strictly below the checked `budget_us - wcet_us` limit of 250 us, leaving the complete 2,500 us WCET inside the unchanged SC; retain the exact command and yield without resampling or sliding while blocked; carry the first post-expiry sample into the next window; and latch invalid profile, counter, period, or syscall evidence fail closed with one bounded operator marker. A `Closed` result at exact `CallArm`, `Call`, recovered timeout, or recovered fault stage revokes and fences the generation, preserves its first evidence through containment, and cannot reset/retry a `REPLIED` lane. No SC budget, period, refill, priority, MCP, core, queue, retry, owner, capability allocation, 16-bit CNode, 256-Worker population, schema 1.15 manifest, ABI layout, hardware configuration, public AUTH/framing/ATTACH busy response, `.coh` workload, benchmark arithmetic, or report schema changes. The full host-tool suite, `tools/cohesix-py`, generated profile consumers, QEMU response matrix, `.coh` workloads, REST harness, and evidence scripts were reviewed and require no implementation change. Focused source checks must be followed by a fresh canonical QEMU boot with TCP AUTH/ATTACH, one representative NineDoor operation, and fault scan; QEMU remains a rejection gate, not Pi evidence. Fresh exact-image WiFi and GENET boots must independently pass scripts, raw framed latency, and medium/high pressure before function, performance, or August parity can be claimed. - exact-284 Pi operator-liveness correction — exact source `284926dacef4b7ee892d2c861ae2e8d2232a7b9b`, build ID `02e611f7b6347c68c0889d033d9529b9a81977df37d4ae5d4d665a5b19bbbb10`, image ID `6de50f3ba2ee24bb87fe0f6082c823ba2164f161301a8d85e5fc33b8161618188`, and image SHA-256 `e1961fd8e37bbf646ade643595565a3c7c4e87d8ec94b9ef5ff3e42c8c971554` reached root and USB command-ready in both network modes but the operator observed neither serial nor USB command response. Selected seL4 source confirms `seL4_SchedContext_Consumed` returns microseconds, rejecting a unit-conversion defect. The shared regression is instead the newly introduced reserve check ahead of raw serial, local-seat, and TCP dequeue: it can suppress a byte or diagnostic that cannot donate to NineDoor. Move that unchanged fail-closed reserve to the parsed-command boundary. Raw bounded ingress, echo, parsing, and root-owned diagnostics remain live; only `ATTACH`, NineDoor namespace operations, and other commands that can enter the passive service sample the unchanged conservative window and receive typed `busy detail=root-sc-reserve` when denied. Preserve every SC numeric, Reply/fault/isolation boundary, driver owner, queue, manifest/schema, CNode/Worker allocation, hardware setting, QEMU selector, public framing, `.coh` workload, benchmark arithmetic, and report schema. Focused Pi-feature regressions must force admission closed and prove serial, USB, and TCP `help` still execute while a passive command cannot reach NineDoor. Static tests, image construction, identity verification, and flashing cannot prove physical liveness or August parity; the next exact-image dual-mode boot must rerun operator diagnostics, authenticated scripts, raw framed requests, and medium/high pressure. - bounded sub-MSS response wire-train candidate — replace one-smoltcp-enqueue-per-response-record draining with complete-record trains capped at 1,400 bytes, below the qualified Pi TCP MSS. The maximum eight-by-256-byte response remains eight unchanged length-prefixed external frames and drains as exact 1,300-byte and 780-byte trains; no aggregate frame or new grammar is introduced. Preparation is non-mutating, socket capacity is preflighted for the complete train, and only an exact enqueue may commit the connection-, batch-identity-, and cursor-bound advance. Backpressure or stale preparation consumes nothing; a partial enqueue is a terminal invariant failure rather than a retry that could duplicate output. Preserve ABI v5, schema 1.15, AUTH/ATTACH and ACK/ERR/END behavior, queue and record bounds, publication credit, retry policy, QEMU direct-VirtIO behavior, and every manifest/MCS numeric. Compatibility review covers `coh`, `cohsh`, `coh-status`, Hive Gateway, SwarmUI, GPU/sidecar/ticket tools, `cas-tool`, every `.coh` workload, `tools/cohesix-py`, generated profile consumers, REST benchmark arithmetic, and report schemas; unchanged length-prefixed framing requires no consumer or schema change. Focused source tests and QEMU packaging can reject this candidate but cannot prove Pi throughput or August parity; fresh exact-image WiFi and GENET benchmarks remain mandatory. - exact-324 Pi response-publication discriminator and bounded correction — cite both `m26e-qemu-shared-control-path-performance` and its owning `m26e-console-network-service-isolation` boundary. Exact source `324abf4a8bb1d25d562fe3fd098f8179ffdaa986`, build ID `5b573301b9c4f3e74da9e6be27b0eb851f0085282c1aebde477161c8b653d3ff`, image ID `9ed8e7e7887cc97bbba1ae815ca8f9a56b06e0fbea288256730397bdcff17fbc`, image SHA-256 `5c6dad802b4cd6c9bdf38a8bb215bccd43c3411e87b5d8c194aed2a0850b167f`, retained Pi manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273`, the `20260830-221544` boot-paired captures, and the exact `324abf4` WiFi/GENET serial transcripts bind the discriminator. WiFi reached root and USB readiness, Gate 8, DHCP, three first-attempt `.coh` scripts, peer-assisted `nettest`, and 64/64 raw framed requests without fault or quarantine, but sustained only `7.190` requests/s with `161.167 ms` p95. Its DHCP Offer-to-Request interval was `1,923.747 ms`, and later MCS evidence retained thousands of near-10-ms Yield periods even after transient-publication credits were minted and consumed. Medium/high REST transport checks completed without reconnect, retry, timeout, or semantic error, but their cache-dominated summaries do not establish target latency. The same image's GENET boot completed DHCP, sub-millisecond SYN-to-SYN-ACK, authenticated command ingress, and approximately 10.7 KiB of response traffic before `boot_v0.coh` reached its immediate `QUIT` terminal and the network pair was quarantined. The direct composer had incorrectly treated the absence of a `SyncCapture` record as containment even though `QUIT` had already queued the exact generation- and connection-bound terminal in the adapter response lane. Admit that typed `NoPending` outcome only when the ordinary stage-ready predicate independently proves the exact sealed lane; otherwise defer as `OutputMissing`, while identity drift retains the existing fail-closed containment. For copied WiFi, permit one already-minted credit to rebase after the ordinary Dispatch cut only when exactly one authenticated network command advances, the previously empty response lane becomes one exact nonempty sealed completed lane, the previously empty flush becomes one bounded same-connection flush, and lifetime, generation, response identity, service progress, operator rotor, recovery, containment, quarantine, reboot, and handoff evidence remain exact; every other delta rejects before Network. Finally, repair only Pi causal telemetry: child publication time and root observation/stage/drain samples use the same absolute `CNTVCT_EL0` epoch scaled by generated `TIMER_CLOCK_HZ`, and the GENET/CYW43/default wrappers forward the exact dispatch observation to the isolated adapter. Root elapsed time remains the runtime/smoltcp clock and is never compared with the child's absolute epoch; host tests and QEMU retain their existing fallback and release hot path. This changes no SC budget, period, refill, priority, MCP, core, MCS authority, queue, retry, owner, capability, CNode/Worker allocation, manifest/schema, ABI layout, hardware setting, QEMU selector, command/framing/ACK/ERR/END grammar, namespace, authentication, or `netstats` row shape. `docs/HOST_TOOLS.md`, the complete host-tool suite, `tools/cohesix-py`, `coh-rtc` and generated profiles/contracts, all `.coh` scripts, `cohsh`, Hive Gateway/REST, Pi helper and trace consumers, raw/REST benchmark workloads and arithmetic, evidence records, and report schemas were reviewed and require no implementation, fixture, generated-output, workload, or schema change. Source and QEMU checks can reject this correction, but neither the exact-324 failure evidence nor the corrected next image proves WiFi/GENET throughput, latency, August parity, repeatability, or Pi acceptance; fresh exact-image dual-mode Pi scripts, raw TCP, medium/high REST pressure, causal diagnostics, operator liveness, and boot-paired captures remain mandatory. - exact-082f dual-backend MCS response-episode correction — exact source `082fce832a325a6e6f6dc59b644258e4b98824ab`, build ID `6f1531d0bfb6d2aba8264e25649e0fc46af12f2c86995b74d99275d8dcdfcf08`, image ID `903daf8814e38770aeb1abdc97814eb2106622f3d2f85c781b845c7bad955d1b`, image SHA-256 `e089d9835c13a3b62ffd66912b10695f39223926e6e061d0bccd107f4425b635`, retained manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273`, exact `20260831-070751` boot-paired captures, and the `071216`, `072700`, `072804`, and `073100` serial transcripts prove both drivers and isolate the remaining delay above them. WiFi reaches Gate 8, DHCP, and authenticated TCP without fault or quarantine, but an exact command can wait seconds between isolated response stage and drain while MCS records repeated near-10-ms Yield periods. GENET DHCP completes faster than the August comparator, SYN-to-SYN-ACK remains `0.462--0.775 ms`, and request-to-ACK p95 remains `0.629 ms`, yet raw response p95 is `16.428 ms` versus August `1.582 ms`; its deterministic 10/20/30-ms response cadence begins only after TCP has accepted the request. For direct GENET, admit one cross-core root successor after exact `StagePublished` or fused `CommandAcceptedAndStagePublished` progress under the existing identity, topology, operator, recovery, and zero-`YieldTo` accounting fences. Stage-only authority is one-shot and cannot open the drain-only active tail. For copied WiFi, mint a separate exact authenticated response-episode token only from the already proven one-command Dispatch rebase. Bind it to physical generation/pair/lifetime, isolated generation, authenticated connection, accepted-command epoch, sealed response lane, service cursor, and bounded same-connection flush. The token may survive the selected Yield, but each resumed turn retains the current strict activation only after one exact response-owned stage, drain, or TCP/CYW43 egress successor; the existing exact response-rotation predicate remains the sole flush-continuation authority. An observe-only notification preserves the cursor but yields because it cannot prove response ownership; an unchanged observation, bare flush decrement, timer tick, generic network activity, or mixed-counter delta also yields. A second command, multiple physical operations, identity/cursor drift, physical-operator debt, passive admission, recovery, containment, quarantine, reboot, handoff, or local fault revokes it. Preserve the existing unslid manifest-derived `budget_us - wcet_us = 3,000 us` guard, 64-unit cap, one-physical-operation turn, every SC budget/period/refill/priority/core, queue, retry, driver owner, ABI v5, schema 1.15, 256-Worker population, 16-bit CNode, hardware configuration, and public command/telemetry shape. QEMU direct VirtIO and its qualified retained loop remain unchanged. The complete host-tool suite, `tools/cohesix-py`, generated profile/contracts, `cohsh`, all `.coh` workloads, REST/raw benchmark arithmetic, evidence consumers, and report schemas were reviewed and require no implementation or fixture change. Focused source tests, QEMU packaging, static Pi validation, image construction, identity verification, and flashing can reject this candidate but cannot prove either speedup or August parity; the next exact-image WiFi and GENET boots must rerun first-attempt scripts, raw framed latency, medium/high REST pressure, causal diagnostics, and operator liveness. - Historical Pi console image allocation correction — admitted the then-current direct-GENET console executable as 66 PT_LOAD pages, 104 service frames, and 161 retained root CSpace slots. This Pi-only increment is exactly one immutable executable image frame and its retained mapping cap; fixed, maximum, and admitted Pi frame/slot totals rise by one while the 32 external GENET pages, stack, CNode, Worker population, schema, MCS/timing values, and every data-plane and scheduling budget remain unchanged. QEMU allocations remain unchanged. - schedule lifecycle — add an exact FIFO `dequeue` record to the shared target/host NineDoor contract. Empty, stale, and out-of-order IDs fail without mutation; one success removes one pending record and increments the existing `dequeued` evidence. The REST workload measures an enqueue/dequeue lifecycle without widening the queue or treating consumer acceptance as Worker completion. - host execution recovery — compact only terminal host-ticket journal payloads after exact result publication and durable lane-cursor advancement. A durable cumulative admission-sequence fence preserves replay rejection and crash recovery while nonterminal provider state remains intact; a lane therefore has no fixed lifetime-operation ceiling. - lease lifecycle — retain completed preemptions in a fixed-capacity chronological ring in both target and host NineDoor implementations. A valid preemption evicts the oldest observation instead of failing control when evidence storage turns over; `/proc/lease/summary` keeps the cumulative successful-preemption count, preserving exact turnover accounting without widening the generated bound. - passive-service locality — place NineDoor on core 0 beside its sole `root-control` donor and require the common compiler-validated `locality_bound` invariant in QEMU, regression, and Pi manifests. This removes a cross-core synchronous handoff without changing the passive Reply-object topology, any SC budget/period, or any Pi-specific driver, hardware path, build/flash logic, or diagnostic. - passive-service publication — pair root and child release/acquire fences around each ordinary cached request/response frame before publishing or consuming the matching IPC sequence. IPC retains its sole notification/Reply role and no longer substitutes for AArch64 shared-memory ordering under high request pressure. - exact-077 passive-admission correction — exact source `077578a475c1916dcdcbc9119c2e27a960e25c58`, build ID `599797d9fbf4960dbf988082ebe308f2bc4b1711ebe11894fad1fa4e25d407c6`, image ID `aac79c8f539939eb3530cfd4ccd6ec958842d866b22e58cbefef6a111fd461e1`, image SHA-256 `634aec4a37e2a398cad629e43df709043bd873d924d29cc7090d5f96b6f3c679`, exact serial diagnostics, and boot-paired `20260829-230338` captures prove WiFi Gate 8, DHCP, authenticated TCP, responsive serial diagnostics, zero console/runtime drops, and a sealed 272/272 MCS registry without fault or quarantine. They reject functional and performance closure because the first passive command fails `busy detail=root-sc-reserve`: the first `SchedContext_Consumed` sample includes all prior root work and the retrospective accumulator can never establish a fresh 250-us reserve. Retain the exact parsed passive command and its session/connection identity after one baseline/reset sample, enter one mandatory selected periodic MCS Yield boundary, then on the first resumed activation refresh policy time and decide from one fresh sample. A value strictly below 250 us admits once; equality or excess emits one typed refusal and terminates without retry. Raw serial, local-seat, and TCP diagnostics remain live before retention. Newly published raw, intermediate, or final isolated-service recovery, reboot, containment, quarantine, timer/accounting invalidity, or authority drift preempts and cancels before sampling or dispatch; `CallArm` brackets its exact sequence with complete frontier checks and exact rollback. A proposed same-activation direct-GENET response-successor was audited and deliberately omitted: the generated contracts contain no independent worst-case bound for each fused root leaf plus epilogue, so a pre-unit wall check could not prevent the last unit from crossing the unchanged root MCS WCET. The established direct-GENET, mediated-WiFi, five-unit rotor, SC budget/period/refill/priority/core/WCET, Worker/CNode/manifest/schema, public grammar, and QEMU direct-VirtIO paths therefore remain unchanged. Current WiFi has no under-load proof after ATTACH and receives no speculative CYW43/SDIO mutation. The complete host-tool suite, `tools/cohesix-py`, generated profile consumers/contracts, `.coh` workloads, REST benchmark arithmetic, and report schemas retain unchanged external behavior and need no implementation change. Focused source and QEMU checks can reject the candidate but cannot prove Pi function, latency, throughput, or August parity; fresh exact-image WiFi and GENET scripts plus raw and medium/high pressure remain mandatory. - exact-1c MCS Yield-evidence correction — exact source `1c269ed97f8f12158a5ce549d96811764411bd25`, build ID `8d4e469aa94453989fa6df7fa7aecd7c35bfb37fdd0edbd8aeccfc3cae312de2`, image ID `c59c7b2e5823f10904516734aede16aa5c98d0931585a52307b7f347bc5e6cad`, image SHA-256 `39f7b19e4e51f47735793c06e56ff2716a3abdd3986a8bab0472d1d8a749dba7`, direct serial diagnostics, and boot-paired live `20260830-071519` capture prefixes prove WiFi Gate 8a--8h, DHCP, authenticated TCP, responsive serial/USB paths, sealed 272/272 MCS registration, and a generation-bound peer-assisted transaction without driver fault, quarantine, recovery revocation, queue drop, or overflow. They reject service and performance closure: the first standalone `boot_v0.coh` session completes TCP, `AUTH`, and Queen `ATTACH` but its first `log` is refused with `busy detail=root-sc-reserve`; a separate raw session fails at initial passive admission, cold-neighbour ping loses 2/5 packets with 127.921--167.312 ms replies, and usable WiFi readiness remains about 136 seconds. Do not run medium/high REST pressure past this first failed invariant or claim GENET, benchmark, or August parity from this WiFi-only boot. Selected repository-managed seL4 source proves the accounting cause: MCS `handleYield` relinquishes the remaining refill, then restores actual `scConsumed`, so the capture-time baseline leaves parse unwind and rotor work in the supposed fresh post-Yield sample. The original second pre-Yield Consumed-reset proposal is now disproven: that syscall clears stored `scConsumed` evidence but cannot clear the live per-core `ksConsumed` value which Yield preserves. Retain the baseline only for validation, perform the existing Yield, capture `CNTVCT_EL0` as the first resumed userland operation, then drain and discard the preserved Consumed evidence once. Complete bounded policy, authority, environment, and recovery preparation before the final admission sample, then decide from the strict wall interval between the resumed capture and that final admission/WCET cut. The strict comparison, direct dispatch, and bounded response/epilogue remain inside the declared 2,500-us WCET. Snapshot the cheap recovery frontier first; an already-published fault cancels and performs material recovery in the same turn, while a healthy retained command runs before ordinary no-fault containment probes and retains the post-decision and `CallArm` frontiers. Preserve strict `<250 us`, equality refusal, timer/frequency/counter drift refusal, one attempt/no retry, every MCS numeric and WCET, all driver owners and queues, schema 1.15, the 16-bit Pi root CNode, 256 executable Workers, hardware settings, public protocol, QEMU direct-VirtIO branch, `.coh` workloads, and benchmark arithmetic. The full host-tool suite, `tools/cohesix-py`, generated contracts/consumers, evidence tools, and REST reports were reviewed; unchanged external behavior requires no implementation or schema change. Focused state/source tests plus a canonical QEMU TCP/NineDoor canary are rejection gates only; fresh exact-image WiFi and GENET scripts, raw framed tests, and medium/high pressure remain mandatory for closure. - exact-91b complete-service-frontier correction — exact source `91b2c529cea01d0e6c857570b315963c5bf153ad`, build ID `33f71e80412cb39ef0f6e847deb8da17baf6084088d18089417a3b5df7e19116`, image ID `5ad7f4d0df188c7d311ebaaefabe4e4ab74182aeb01b6282fe6f49a1ac87659e`, image SHA-256 `2247a83073ae8d7aaa5bf686f5af07458b3b97cd5c038bcb9a0f2f2540d007e6`, serial diagnostics, and boot-paired `20260830-080743` captures prove that candidate temporarily admits the prior first-command sequence: generation-bound `nettest` and its exact host peer pass, then `boot_v0.coh`, `tcp_basic.coh`, and `smp_parity.coh` pass first attempt. They also reject sustained service and latency closure. The next no-retry raw session completes TCP and `AUTH` but receives `busy detail=root-sc-reserve` at `ATTACH`; the authenticated serial GENET reboot is refused at the same boundary. WiFi Gate 8 remains about 149.690 seconds versus the accepted August 10 10.6--12.7-second frontier despite clean SDIO/CYW43 protocol, queues, and conservation. The source-audited candidate cause is a shared deterministic tax: a generated-task-table scan accidentally placed in the root hot path. Each of the two exact service-fault queries resolves its ID across all 272 temporal tasks, and the deferred WiFi supervisor runs both queries before each useful turn while passive admission runs them inside the unchanged 250-us margin. Replace those two O(Workers) lookups with one fresh call to the existing complete-service frontier. It must sample raw, intermediate, and final-handoff service state with the existing Acquire ordering, treat handoff contention as pending, preserve existing invalid-state handling, cache no result, and preserve recovery-first arbitration, post-sample `CallArm`, strict `<250 us`, every MCS numeric/WCET, and all QEMU/GENET/driver behavior. Focused tests must prove empty, raw, intermediate, final, and contended frontier outcomes plus source ordering and absence of an O(Workers) lookup in either hot predicate. Public grammar and ABI, the complete host-tool suite, `tools/cohesix-py`, generated profiles, contracts, and consumers, every `.coh` script, and benchmark implementations, workloads, arithmetic, and report schemas are unchanged and require no consumer change. The canonical `root-mcs` QEMU canary is a shared-root rejection gate; only fresh exact-image WiFi and GENET scripts, raw latency, and medium/high pressure can prove sustained function, the expected Gate-8 reduction, or August parity. - exact-bdb Pi resumed-lease and reciprocal-progress correction — exact source `bdb33f82ca0b21b11e574073cb4c61516883d139`, build ID `f2fea17d6b3fd31644769b7f92627f1c8204413d762535717a7f39d2aaea30d7`, image ID `ceb753d08404f1045f3539d00158b8485297623522e4a4b58a7650ba1a2e7053`, image SHA-256 `48d24d8f2398c299dab6036e463b533baaa49cad3aa8e5802cee4ac89f1e2024`, exact serial diagnostics, and boot-paired WiFi/USB captures prove root readiness at 8.116 seconds, USB command readiness at 15.235 seconds, and Gate 8 at 52.270 seconds. The sole supervisor begins at 1.415 seconds and completes attach/control at 45.790 seconds after 5,227 turns, approximately 8.49 ms per turn; DHCP completes in approximately 205 ms. Established TCP shows no loss or retransmission, but application response remains 193--250 ms and approximately 3.42 kB/s. The first passive command is refused with `busy detail=root-sc-reserve`, medium/high REST pressure cannot produce valid benchmark values, and the authenticated serial reboot is blocked at the same boundary. This exact image supplies no GENET result and proves neither sustained WiFi service/performance nor August parity. Selected seL4 source disproves the second pre-Yield Consumed reset: it clears stored `scConsumed` but cannot clear live per-core `ksConsumed`. Retain one baseline validation sample, Yield once, capture `CNTVCT_EL0` as the first resumed userland operation, drain and ignore the preserved pre-Yield Consumed evidence once, then admit only when the exact capture-to-final-admission/WCET-cut wall interval is strictly below `budget_us - wcet_us = 250 us`; the strict comparison, direct dispatch, and bounded response/epilogue remain inside the declared 2,500-us WCET. Equality, timer-frequency drift, backwards/missing evidence, accounting failure, or invalid period conversion fails closed with no retry. In the CYW43 runtime, only an exact successful child completion under a sealed ordinary firmware-chunk or NVRAM-chunk parent may publish at most one following immutable SDIO child in that same root-granted turn. A fault terminal, other parent operation, steady or persistent path, pending child, stale/unknown identity, or consumed submit slot admits no new child, and a turn can never publish two new physical commands. This removes one avoidable reciprocal scheduling edge in the dominant cold streaming phases while preserving the sole SDIO physical issuer, every MCS numeric, generated manifest/profile, schema, ABI, queue, timeout, retry, recovery, Reply, containment, Worker/CNode, hardware, public protocol, and QEMU direct-VirtIO contract. The complete host-tool suite, `tools/cohesix-py`, generated contracts, profiles and consumers, selected manifests, `.coh` workloads, and benchmark arithmetic and report schemas were reviewed and require no implementation change. Focused source tests and the shared `root-mcs` QEMU canary can reject this source candidate, but build, QEMU, static-profile, image, and flash results cannot prove Pi behavior. Fresh exact-image WiFi and GENET scripts, raw latency, and medium/high pressure are mandatory before any function, speedup, or August-parity claim. - exact-3f87 dual-backend retained-quantum and USB-debt correction — exact source `3f87bca1f978ad80016a15ba4f81b14b0076783a` proves both selected network modes remain functional while rejecting August latency parity. WiFi reaches useful Ready at 46.660 seconds versus the accepted August 10 roughly 10.6--11.0-second frontier, completes DHCP, service readiness, focused `.coh` scripts, and 64/64 raw requests at 4.404 requests/s with 249.597-ms p95 versus 27.089 requests/s and 50.457-ms p95. GENET completes DHCP, service readiness, focused scripts, and 64/64 raw requests at 24.473 requests/s with 44.989-ms p95 versus 180.269 requests/s and 1.677-ms p95. Its paired capture proves 34.846-ms DHCP, faster than the accepted August 49.512-ms sample, 0.463--0.647-ms SYN-to-SYN-ACK, ingress ACK p95 no greater than 1.342 ms, and no retransmission or reset. The remaining wired delay is after ingress and before application response, not in PHY, DHCP, DMA, or TCP acknowledgement. Supersede only the disproven direct-GENET one-quantum stop: after the mandatory Yield, retain the first resumed `CNTVCT_EL0` origin across another complete ordinary five-phase root quantum only when the exact authenticated generation and connection remain current and one accepted command and its response-stage unit made durable progress. Before every new complete quantum, elapsed wall time must remain strictly below the unchanged generated `budget_us - wcet_us = 250 us` cut; equality refuses, and at most 64 complete quanta may be retained. A final side-effect-free recovery/operator/fault check, passive admission, reboot, containment, quarantine, handoff, identity drift, invalid timing, or no progress forces Yield and fails closed. No repeated Consumed sample creates authority. CYW43 retains its existing separate 250-us/64-unit semantics, and QEMU direct-VirtIO behavior is unchanged. The same boot exposes a separate USB eligibility defect rather than an xHCI timeout: once the required controller is admitted and ready, `controller_ready && !command_ready` remains bounded bootstrap `LocalSeat` debt even before backend polling is enabled. The finite CYW43 operator rotation grants one existing bounded local-seat turn, alternates with serial, and stops that extra debt at command readiness. This neither makes USB command readiness a CYW43 prerequisite nor changes a USB/CYW43 budget, retry, deadline, owner, or operation bound. Current WiFi still requires fresh physical proof that its synchronous child-Yield cadence is closed; no WiFi parity claim is made. The complete host-tool suite, `tools/cohesix-py`, generated contracts and consumers, `.coh` scripts, and benchmark workloads, arithmetic, and report schemas were reviewed and require no behavior or schema change. Fresh exact-image dual-mode scripts, raw latency, and medium/high pressure remain mandatory before promotion. - exact-5094 physical routing and bounded child-credit/stream/HDMI correction — exact flashed source `509445402f3f53a584cb5726da9a6559b3437167`, build ID `77862a10911e960f796467e5408d92eda00c8e1838c1d79f71e2d84e7845e754`, image ID `cbc7b62bff475069a25515fe314c5acd927927060bdfe0c8e9ea86d5b4997eee`, and image SHA-256 `cb9e0487b5b8aa930796d9576d4147cc9005835720a62a61dd94454dc535b66f` prove both selected physical backends remain functional while rejecting August latency parity. WiFi reaches root and USB command readiness at approximately 8.113 and 15.155 seconds, reaches useful CYW43 Ready at approximately 46.795 seconds, completes DHCP in approximately 205.278 ms, and retains authenticated TCP and focused `.coh` behavior; its fresh raw latency remains unmeasured. GENET reaches root and USB command readiness at approximately 8.324 and 9.360 seconds, completes DHCP, authenticated TCP, and focused scripts, and returns 64/64 raw requests without retry at 25.805 requests/s, 37.684-ms median, and 44.943-ms p95 versus the accepted August 180.269 requests/s and 1.677-ms p95. Healthy DHCP, DMA, IRQ, rings, and TCP ingress keep the first wired bottleneck in shared root/console MCS cadence rather than the GENET device path. Supersede the disproven all-wall, command-plus-stage continuation. For the exact direct-GENET generation, classify one root quantum as exactly one of command accepted, command accepted plus durable stage, durable stage, response drained, or drain plus durable stage. Before every direct child dispatch, drain its prior SC accounting, measure only the adjacent `YieldTo` call wall, and credit no more than both the returned child consumption and that call wall. Retained root time remains strictly below the unchanged generated 250-us cut, equality refuses, and the independent 64-quantum cap and every identity, operator, recovery, containment, quarantine, reboot, handoff, and no-progress fence remain exact. Invalid accounting is sticky and denies retention without stopping ordinary service. The mediated WiFi runtime in the same Pi image remains signal-only and performs neither the pre-drain nor `YieldTo`. This changes no MCS numeric, Reply semantic, ownership, ABI, manifest, or QEMU direct-VirtIO behavior. During an exact ACKed ordinary CYW43 firmware/NVRAM root grant, each exact immutable successful terminal may publish its single immutable successor, up to an independent 64-successor cap. Fault, malformed or waiting terminals, stale generation or descriptor identity, unknown issue state, pair restart, recovery, persistent/steady operations, and unacknowledged or delegated grants fail closed without moving the frontier or cap. The sole SDIO physical issuer, DPC/CARD_INT fairness, budgets, retries, deadlines, and recovery authority are unchanged. USB arrow input continues to move the desired HDMI viewport one row per repeat, while accumulated render debt uses the largest exact symmetric CSI `nT`/`nS` span fitting the bounded 512-byte frame. Every retained receipt is generation-anchored; wrap, eviction, missing history, and invalid anchors collapse to one canonical redraw. Pending tail bytes cannot be overtaken by a scroll departure, and the canonical `Cohesix console ready` rendering is queued ahead of the HDMI `cohesix>` prompt. The complete host-tool suite, `tools/cohesix-py`, generated contracts and profiles, `.coh` workloads, and benchmark workloads, arithmetic, and report schemas were reviewed and require no implementation or schema change. Focused source, target-compile, and QEMU gates can reject this candidate; a clean image or flash cannot prove physical speedup. Fresh exact-image WiFi and GENET raw latency, scripts, and medium/high pressure remain mandatory before parity or acceptance claims. - exact-a6c dual-mode discriminator and bounded refill-boundary correction — exact flashed source `a6cdb7a40c054d4f90d7d4a1bad0a10a5cff66ea`, build ID `5495d0a138fcd570ffb52cd717a437308e5156bacb981ce17f0a479e487cff30`, image ID `0cd0153f6499ed401dfcb7a7b2ed35b93c4761a7f701ba99bddb46da9eb401f3`, and image SHA-256 `26b5d91da4b7b16fbe7eb2914a77bd6db1eb2b1410197e7fe8dc7891aa50ffc9` prove lossless WiFi and GENET function while rejecting August latency parity. WiFi passes DHCP, authenticated TCP, generation-bound `nettest`, all three focused `.coh` scripts, and medium/high REST pressure; its raw 64-request result is 4.350 requests/s with 212.407-ms median and 250.393-ms p95. GENET passes DHCP, TCP, `nettest`, `boot_v0.coh`, and `tcp_basic.coh`, but `smp_parity.coh` and medium REST reach the exact typed `busy detail=root-sc-reserve` boundary. Its raw result is 23.016 requests/s with 39.992-ms median and 48.759-ms p95. The paired wired capture reports 1.637-ms p95 ingress acknowledgement but 48.576-ms p95 application response, locating the remaining wired latency after healthy GENET DMA/IRQ/TCP ingress. Supersede the stream-only cold CYW43 wording: within one exact ACKed root grant, immutable terminal-local continuation applies to every finite cold parent—transport init, firmware prep, firmware chunk, NVRAM chunk/tail, and release—under the unchanged 64-successor cap. Zero-payload parents additionally require zero descriptor and retained payload identity. Control, RX, steady, persistent, recovery, restart, issued-unknown, watermark-fault, generation, descriptor, payload, and ticket drift retain the ordinary root boundary. Healthy steady op7 already uses its durable lease and condition-before-sleep path without an explicit runtime Yield; no fabricated steady grant or budget increase is authorized by the cold correction. Preserve one parsed passive-service command across at most one genuinely new Yield/refill after an expired strict reserve lease. Each attempt starts from `AwaitingYield`, drains fresh Consumed evidence, retains the unchanged strict `<250 us` comparison, and rechecks every identity, authority, recovery, containment, quarantine, reboot, and session fence. A second expiry emits the existing single typed refusal. For exact direct GENET only, a successful response `StageOutput` may immediately observe and ACK the causal child publication after its same-core `YieldTo`; an absent, unrelated, backpressured, or faulted publication leaves any observed ACK pending for the ordinary `ObserveChild` turn, while non-GENET, QEMU, and WiFi paths never enter this observation. Exact stage-plus-drain progress accounts both child calls and cannot admit a second command ahead of the response lane. Local HDMI readiness is independent of network readiness: emit the ready banner only after root and USB command admission, and expose the prompt only after that exact banner frame completes. An arrow at the live tail seals and drains only the already-pending output prefix, rebases its completion with generation and logical-tail identity, then uses the bounded CSI scroll path. Later output remains ordered behind the fence; mismatch, wrap, eviction, or unavailable history requests exactly one canonical snapshot. This changes no xHCI issue, poll, completion, owner, retry, or budget path. The complete host-tool suite, `tools/cohesix-py`, generated profile and ABI consumers, `.coh` workloads, and benchmark workload, arithmetic, and report schemas were reviewed. The public console grammar, REST/TCP framing, manifest schema, generated contracts, and report formats do not change, so those surfaces require no implementation or fixture update. Pi-only source tests, exact AArch64 target compilation, and a nonclaiming QEMU root-MCS canary are required before a clean candidate image. A fresh dual-mode Pi run remains the only authority for boot speed, physical console behavior, sustained latency, pressure, and August parity. - exact-4be QEMU-shaped Pi scheduling and bounded active-response candidate — exact source `4be7bad98b3187dbd6be4b0d5a12c0d48f0f5628`, build ID `a9fcd26d0e559a1a85fc69e306cd9c6e6baafb08f5f4523acbc6235fa92a95dc`, image ID `3df7f9e4a401651c888f2b35c31d99ae2e7a502794f8e35e05748abac02d3797`, and image SHA-256 `fee4f0201bb52739802ca6d1bf892894e089282298a004cacf896f731b0e7ebb` prove both physical backends are functionally healthy while rejecting August latency parity. WiFi reaches root at 8.117 seconds, reaches Gate 8 at 37.855 seconds after 3,884 supervisor turns, completes DORA in 204.983 ms, passes generation-bound `nettest`, three first-attempt focused `.coh` scripts, medium/high REST pressure, and 64/64 raw requests without loss, retry, quarantine, or driver fault. Its raw result is only 4.362 requests/s with 210.987-ms median and 263.210-ms p95. GENET completes DORA, 8/8 ICMP at 0.812-ms average, `nettest`, the same three scripts, medium/high pressure, and 64/64 raw requests with conserved direct rings and no poison, drop, quarantine, or fault. Its raw result is only 22.989 requests/s with 41.965-ms median and 48.847-ms p95. The accepted August comparators remain 27.089 requests/s and 50.457-ms p95 for WiFi, and 180.269 requests/s and 1.677-ms p95 for GENET. Healthy DORA, ICMP, DMA/IRQ/rings, TCP ingress, queues, and conservation place the shared failure after physical ingress, in the selected-MCS root/isolated-console response cadence. Direct GENET admits only 62 of 271 productive continuations because the old 2,750-us root budget leaves a strict 250-us `budget - WCET` cut; selected MCS Yield charges the remaining head refill, producing repeated period-scale stairs that accepted non-MCS August scheduling did not pay. Adopt the bounded QEMU topology principle without copying QEMU numerics or weakening Pi admission. Pi root-control remains on core 0, keeps `max_refills=2`, priority/MCP 200/200, period 10,000 us, and exact 2,500-us WCET, but selects a compiler-admitted 5,500-us budget and 5,100-us response bound. Move the isolated console-network service from core 0 to core 2 with its unchanged 3,000/10,000-us budget/period, priority/MCP, WCET, authority, and queues, and select eight refill records in its existing 8-bit SC. Move HDMI from core 2 to core 1 without changing its 2,000/10,000-us reservation or priority. Keep PCIe on core 2, GENET on core 1, CYW43/SDIO on core 3, and both passive-Worker executor lanes on cores 2 and 3. The compiler must derive exact active demand `8,750/8,250/8,400/8,000 us` on cores 0--3 against each 9,000-us usable capacity, response bounds root/console/HDMI/PCIe/GPU executor `5,100/3,000/5,200/3,300/8,300 us`, and root's strict productive reserve `budget - WCET = 3,000 us`. Adjacent drift in budget, core, response, reserve, refill, sched-control core, or mirrored console configuration fails closed. QEMU retains its existing 9,000-us root, core-2 lower-priority console child, max-two-refill selections, affinities, and response bounds. Direct GENET becomes cross-core signal-only: root commits the one-hot wake but performs no `SchedContext_YieldTo`, pre-drain, child-consumed credit, or same-core accounting. Same-core and cross-core authority are distinct generated states; a missing or failed same-core Yield can never be reinterpreted as signal-only progress. An exact authenticated generation/connection `OutputDrained` transition may open one unslid root-local active response tail for at most 8 ms and at most 64 complete physical-rotor quanta. The scheduling context remains the hard CPU bound, and every quantum rechecks passive admission, physical operator work, response priority, recovery, containment, quarantine, reboot, handoff, local fault, generation, connection, phase, counter frequency, wall expiry, and the shared cap. Mediated WiFi remains signal-only and gains no direct GENET authority; its CYW43/SDIO SCs and physical protocol stay unchanged. GENET and console-network each select eight refill records only to preserve bounded fragmented wake progress; no device budget, period, WCET, packet bound, retry, or fallback is enlarged. Add root-local scalar telemetry for active-tail opened/admitted/closed and maximum wall time plus distinct same-core versus cross-core productive authority; change no shared child ABI, public command grammar, TCP framing, REST schema, or benchmark report. The complete host-tool suite, `tools/cohesix-py`, generated-profile consumers, `.coh` workloads, benchmark workloads/arithmetic, and report schemas remain compatible and require no consumer change. The internal Pi hardware-evidence normalizer and its proof fixtures advance only their exact HDMI affinity oracle from core 2 to core 1; this changes no public evidence schema. Focused source/profile tests, exact Pi target compilation, generated/Test Plan checks, and a QEMU root-MCS canary can reject this candidate. A clean image or flash cannot prove boot speed, operator quality, WiFi/GENET latency, or August parity; the next exact-image dual-mode boot must rerun diagnostics, three scripts, raw 64, medium/high pressure, and USB/HDMI/serial checks before any performance claim. - exact-0c refill-loss discriminator and bounded transaction-window candidate — exact source `0c734db7531ae1328155e03d74d79c4196404034`, build ID `44d4500c89565fb65ff4af07fe5d2597591c893f756ec28dced4f61d6487f84d`, image ID `668b10baad31fd143d05ad0cc55fac2dc96dd95481dc6fea06a226b7833fd4fb`, image SHA-256 `3c07203946678bad4328a9734d781a2122181222d156808f33607c25478d1cc5`, and resolved-manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273` bind the 2026-08-31 dual-mode evidence. WiFi passed DORA, authenticated TCP, focused `.coh` scripts, and 64/64 raw requests without driver fault, loss, recovery, or quarantine, but reached Gate 8 at 34.110 seconds and achieved only 7.02 requests/s with 166.209-ms p95. Its 2,926 reserve cuts and 7.575-ms average Yield hiatus account for approximately 22.17 seconds of the cold-boot regression, while request-to-ACK remains the dominant steady-state seam. GENET passed the same correctness path and reached 113.884 requests/s with 6.774-ms median and 16.459-ms p95, but retained 10,840 no-productive-successor exits and period-scale cuts inside a single authenticated transaction. These observations route both regressions to bounded MCS continuation, not CYW43/SDIO, GENET DMA/IRQ/rings, TCP framing, queue capacity, or hardware ownership. Preserve all selected budgets, periods, WCETs, priorities, refills, queues, retries, owners, capabilities, and physical-driver protocols. During cold CYW43 bootstrap, retain exact useful progress and transient-empty child observations only inside the existing unslid 3,000-us/64-turn activation. During attached WiFi service, bind that sticky progress to the exact physical lifetime, authenticated generation/connection, and accepted-command epoch; every operator, passive, fault, recovery, containment, quarantine, reboot, handoff, identity, time, and cap drift closes it. For current cross-core signal-only GENET, exact authenticated command acceptance may open the existing unslid transaction tail before stage/drain publication; stage-only progress cannot mint it, and dormant same-core mode retains its exact successful-`YieldTo` requirement. Sample one common absolute Pi dispatch timestamp for both causal recorders. Add only the bounded Pi `cyw43_productive_window` diagnostic row; it grants no scheduling or device authority. The complete host-tool suite, `tools/cohesix-py`, generated profile consumers, `.coh` workloads, benchmark workloads/arithmetic, evidence records, and report schemas were reviewed and require no consumer change. Focused Pi/QEMU tests and a QEMU root-MCS canary can reject the candidate, but only a fresh exact-image dual-mode Pi boot can prove the expected cold-start and latency improvement or August parity. - exact-a9 typed physical-operator fence correction — exact source `a9a852a58930cd3347ba141c074f292609959544`, build ID `f949dfcfc651926ccd7fb6f6e9db7f4ec1a0eb5fcf8f90df995c64dca6a4fcbe`, image ID `8d77972a9aa2fb7df56cd1884d73317cfa09fdee02d654f4f8ba1b453656d0ed`, image SHA-256 `f8b085e1c860b7a7bb9879be3f6518aaf4e231f96dde0320fb74af607e951a38`, and resolved-manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273` bind the next dual-mode discriminator. GENET completed 64/64 raw requests at 82.556 requests/s with 18.944-ms p95 while its request-to-target-ACK p95 remained 0.662 ms and ACK-to-response p95 was 18.096 ms. Its rings, DMA, queues, and driver state remained clean, while MCS Yield samples still showed period-scale root-return gaps around otherwise fast in-activation command, Dispatch, stage, and drain seams. WiFi likewise opened its productive window while request-to-target-ACK p95 remained 157.545 ms and ACK-to-response p95 was 20.166 ms. Exact retained state reported physical-operator pending mask `0x100` at the rejected cuts. These measurements reject the performance gates and locate the first shared invariant above both healthy device paths: retained post-Dispatch collectors collapsed `Idle`, passive `UsbServiceDebt`, and real `Input` into one Boolean, so a debt that had received its mandatory bounded `LocalSeat` turn closed useful Network continuation as though new operator input had arrived. Preserve that three-state physical-operator classification through the CYW43 transient-credit, authenticated-response, productive-window, and direct-GENET transaction-tail snapshots. At a post-Dispatch or complete-rotor continuation cut, `UsbServiceDebt` does not retain the Network fence after its one ordinary `LocalSeat` opportunity; real decoded or buffered `Input` still does. A missing direct-GENET snapshot fails closed. The pre-rotation transient probe, terminal-return shortcut, serial and local-seat priority, physical console response, display phase, passive-admission, recovery, containment, quarantine, handoff, reboot, identity, wall, and work-cap fences remain unchanged. This correction adds no notification, poll, retry, fallback owner, grant, or refill and changes no SC budget, period, WCET, priority, Reply semantics, isolation boundary, queue, device owner, or QEMU selector. `docs/HOST_TOOLS.md`, the complete host-tool suite, `tools/cohesix-py`, all `.coh` scripts, `scripts/rest_perf_harness.py`, raw/REST benchmark workload and arithmetic, evidence consumers, and benchmark report schemas were reviewed. The correction changes only an internal typed scheduling predicate, so those surfaces require no implementation, fixture, workload, arithmetic, or schema change. Focused predicate tests, exact Pi target compilation, generated/Test Plan checks, and the narrow QEMU root-MCS canary may reject the source correction; only a fresh exact-image dual-mode Pi run can prove WiFi or GENET performance and repeatability. - exact-4b notification-backed continuation and complete typed-gate correction — exact source `4b16de9b4f1a0895810851ace8cfa6a9d57c112f`, build ID `757f66ac236eb1e2625250faff9353926c567e2d8ac48e273bc4cea4febfe45c`, image ID `b49fb9b03f5a0aef0f81269e8c93ee5f4630883a50cb7d38ea35b82befd8d5ef`, image SHA-256 `c23066602dc3b4fd50986b73af43453e26649f0713cc9f27a7b39d398e184b4e`, and resolved-manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273` bind the decisive physical discriminator. WiFi reached Gate 8 only at 144.825 seconds, then completed 64/64 raw requests at 7.024 requests/s and 167.253-ms p95. Its request-to-target-ACK p95 was 149.803 ms, publication rejected 59,605 candidates at the initial probe, and the last pending `0x100 OTHER_BOUNDARY` Yield hiatus was 8,598 us. GENET completed 64/64 at 75.676 requests/s and 28.047-ms p95 while its direct stages, DMA, rings, queues, and notification conservation remained exact; 13,065 exits were `NO_PRODUCTIVE_SUCCESSOR`, and its last pending `0x100` hiatus was 8,743 us. Medium/high REST completed 960/960 operations without semantic error, target timeout, retry, reconnect, bounded-resource failure, recovery, containment, or quarantine on each backend. Preserving typed operator debt is safe but did not remove the dominant gap. The cross-commit cold discriminator also selects removal of exact-a9's transient-empty local retention. With the same selected driver/runtime architecture, exact `0c734db75` reached Gate 8 at 34.110 seconds; adding local re-entry after a useful turn followed by an empty child observation moved exact a9 to 124.145 seconds, and exact 4b remained at 144.825 seconds. An empty observation is not an event or durable successor. It must Yield; only the existing exact Operator-to-Driver or operation-executed Driver-to-Operator continuation may retain the cold activation. The cold Gate 8 path cannot use authenticated-response publication credit: it precedes stack attachment, DHCP, TCP authentication, and service readiness. Close only the narrower condition-before-Yield race with the existing generated CYW43 child-to-root notification. After one selected bounded operator condition turn, read the retained parent. If it is still waiting, poll the unbound receive cap once and re-read durable parent state. Only an exact current terminal or fault may select the ordinary Driver phase. An absent, stale, sideband-only, still-waiting, or attached-service hint preserves Yield; attached EventPump remains the sole consumer after stack attachment. This is a narrow race closure and the next Pi Gate 8 measurement, not source reasoning, decides whether it is sufficient. During attached WiFi service, retain a consumed root-wake edge only as a stack-local identity token. It must bind the exact CYW43 physical lifetime, authenticated response identity, accepted-command epoch, and a complete `Serial -> LocalSeat? -> Dispatch` rotor after the first Network unit. A fresh durable recheck at the return-to-Network cut may retain the caller's activation, but this wrapper performs no second Network unit. During direct GENET service, one stack-local token may bind an already staged batch and accept only its exact same-identity `OutputDrained` transition after the complete operator rotor; consumption forces the next phase to Serial and stops before a second command or Network leaf. Remove the older attached productive-window fallback that retained an unchanged empty snapshot after prior progress. A consumed wake plus durable identity is now the only post-rotor successor; an absent event yields. The additive `idle_admitted` counter remains in the diagnostic schema for comparable hardware evidence but this candidate does not increment it. Complete the typed correction at the earliest CYW43 transient-publication probe and the three direct-GENET compact command/stage gates. A CYW43 probe may preserve `UsbServiceDebt` only because successful minting installs the complete mandatory operator rotor before Network re-entry; real `Input` rejects. A direct-GENET one-command leaf may carry passive USB debt only while returning to Serial before another command; real Input and missing evidence reject. Every identity, response, recovery, containment, quarantine, handoff, reboot, wall, work-cap, and ownership fence remains unchanged. No spin, blocking wait, new notification, software work latch, local empty-state polling, fallback owner, queue, retry, grant, refill, SC budget, period, WCET, priority, Reply rule, isolation boundary, manifest population, or QEMU selector changes. `docs/HOST_TOOLS.md`, the complete host-tool suite, `tools/cohesix-py`, all `.coh` scripts, `scripts/rest_perf_harness.py`, raw/REST workload and arithmetic, evidence consumers, and report schemas were reviewed. These internal scheduling predicates change none of their interfaces, fixtures, arithmetic, or schemas. Focused predicate tests, exact Pi target compilation, generated/Test Plan checks, and the narrow QEMU root-MCS canary may reject the correction. Only the next exact-image cold WiFi plus warm GENET hardware run can prove Gate 8 or raw performance; passing that discriminator is still insufficient for the required multi-lifetime reliability depth. - exact-e957 hardware discriminator and exact-child root-control fan-in candidate — exact source `e95799d65d6cef8ca9178d9fac84adca2319fd09`, build ID `1588ff161b69d459f13d8cbdf68241658793609fafef46afda78e1fa4ff0663d`, image ID `2875d2d6dc4f8aa7802e2019e43bff7604c9a9b4f4eae33e35f105c95dbdd966`, image SHA-256 `e0e0691e9dabe59fa6023d6c4555e0fbd2b8e3338caff28be61518063cc98708`, and resolved-manifest SHA-256 `f83cd48d38d780d491d0317d98513a1703d24663406ed90f8b38911794dde273` bind the decisive same-image dual-backend run. WiFi reached root readiness at 8.074 seconds but Gate 8 only at 33.670 seconds, failing the 12.655-second gate. Its exact one-connection, no-retry 64/64 raw run sustained 7.669 requests/s with 128.214-ms p95, failing both 25.863 requests/s and 67.581-ms targets. The boot-paired capture places request-to-target-ACK p95 at 111.222 ms and ACK-to-response p95 at 16.882 ms. All three canonical `.coh` scripts passed first attempt and medium/high REST completed 960/960 without semantic error, target timeout, reconnect, retry, queue/drop, recovery, containment, quarantine, or driver fault. GENET's matching one-connection 64/64 run sustained 120.824 requests/s with 11.582-ms p95, failing the 162.242 requests/s and 1.845-ms targets. Its request-to-target-ACK p95 was 0.642 ms while ACK-to-response p95 was 10.902 ms, locating the deterministic gap after healthy ingress. All three scripts and 960/960 REST operations passed first attempt; DMA, IRQ, rings, queues, and driver state remained clean. WiFi root composer period hiatus averaged 7,668 us and reached 9,991 us; GENET averaged 8,995 us and reached 9,993 us, with 16,266 `NO_PRODUCTIVE_SUCCESSOR` exits. These are functional and reliability-prefix passes but explicit performance failures. The first shared failed invariant is root calling `seL4_Yield` while an exact finite child result remains pending. On the selected MCS kernel that forfeits the remaining head refill, so a later durable child notification cannot restore root until the roughly 10-ms replenishment boundary; August's non-MCS Yield merely rotated runnable work. The e957 follow-up candidate retained the event-driven fan-in only as a nonblocking hint immediately before the existing Yield boundary; it added no longer spin, budget, retry, poller, blocking wait, or fallback owner. Advance compiler truth from manifest schema 1.15 to 1.16 for this manifest-controlled capability change, console-network ABI v5 to v6, and Pi driver runtime-init ABI v10 to v11 without changing either fixed descriptor size. ABI v6 assigns the former console descriptor `reserved0` to child slot 6; ABI v11 assigns the former driver reserved field to child slot 12. HAL mints only Write-only badge-1 aliases of the additional root-control wake notification. CYW43's dedicated slot 11 remains distinct. The critical runtime receives separate restricted slot-5 aliases in the root-fault and Worker-supervisor task-local CSpaces; executor children use slot 5 only in their distinct CSpaces. The Worker supervisor publishes completion bits and exact fault bodies into its durable root mailbox before signalling the fan-in. Critically validated controls remain solely in the existing bounded sequence-last FIFO; the validator signals only after accepting that publication and adds no second counter or queue. Physical console and driver children commit their sequence-last event, packet-TX, terminal, RX, TX, or completion record, signal the existing component-specific notification first, then signal the fan-in; direct-VirtIO QEMU emits only its semantic publication signal because QEMU never consumes the Pi fan-in. On Pi only, the critical runtime signals only after its durable fault/service publication. QEMU retains the common sealed alias slots but compiles out this unconsumed syscall. In that e957 candidate every wake was a hint and the durable record remained authoritative. At an already-fenced ordinary or no-successor exit, root polled the fan-in once. A nonzero badge prompted exactly one return to outer operator/recovery-first arbitration, where all durable state was re-read; zero fell through to the existing bounded Yield. The badge granted no work or continuation authority, and root did not block on this fan-in. SDIO deadline publication and clear retained their prior commit-only behavior and do not signal root merely because an arm changed. Preserve every SC budget, period, refill, priority, MCP, WCET, Reply semantic, isolation boundary, quarantine/recovery rule, owner, queue, retry bound, manifest population, and QEMU selector. Compatibility review covers the public console/network grammar and framing, every `.coh` workload, `coh`, `cohsh`, the complete host-tool suite, `tools/cohesix-py`, raw/REST benchmark workloads and arithmetic, and report schemas; none changes. Generated target profiles and resolved manifests update for schema 1.16 and the two internal ABI versions. The target-common archive growth exceeded the former contract-bound QEMU placeholder capacity by exactly 7,220 bytes. Both release-QEMU profiles therefore reserve an exact 8 MiB non-shipping seL4Test placeholder and require an exact 9 MiB minimum validated elfloader archive. Whole-placeholder replacement remains fail-closed; the shipping rootfs bound and every MCS/runtime numeric and QEMU selector remain unchanged. Focused ABI/fan-in/profile-order tests, generated/Test Plan checks, exact Pi compilation, and the narrow QEMU root-MCS canary may reject the candidate. Only a fresh exact-image WiFi plus GENET boot can prove the performance targets, and the required multi-lifetime pressure depth remains separate acceptance evidence. - Pi cross-core complete causal-round-trip correction — exact clean source `61b9fdddf8f2a79a552e62936abcd82de3017449`, build ID `1f597eadb88f81bee43be6aef7ea939a7f080b545aafea705a6cb06d43a07680`, normalized image ID `d800175df3f1cab4ca00b6063b7fd973d9c06fb50b6379ddefc79bf1fd8e36d5`, and sealed image SHA-256 `82651a7a234df4ef9b0359353308133ba0a3896d0d58a5d82c07a77f4e4b5793` decisively reject the V26/V20 same-core `YieldTo` candidate. WiFi reached Gate 8 only at 60.190 seconds and completed raw64 at 3.0077 request/s with 319.353-ms p95; GENET completed raw64 at 37.1575 request/s with 31.396-ms p95. WiFi request-to-ACK/ACK-to-response p95 split 226.840/103.094 ms and GENET split 3.007/28.510 ms while physical links, direct rings, ingress, and bounded queues remained healthy. This is failure evidence, not performance or repeatability acceptance. It falsifies co-location and userland `YieldTo` as refill continuity: each useful root/child boundary still forfeited the causal activation before the finite child result became visible. Restore the independent Pi topology: root-control on core 0, console-network on core 2, and root-fault on core 0. Root and console remain equal priority/MCP 200/200. Every budget, period, priority, MCP, refill count, WCET, Reply rule, queue, owner, retry, recovery, containment, quarantine, and QEMU selector remains unchanged. The admitted per-core demands remain `8,750/8,250/8,400/8,000 us`; fixed-priority recurrence derives root/console `5,100/3,000 us`, root-fault `2,600 us`, and PCIe/GPU-executor `3,300/8,300 us` response bounds. Select exact Pi provenance `m26e-pi4-root-cross-core-causal-fanin-wait-candidate-v27` and `m26e-pi4-console-cross-core-causal-publication-candidate-v21`. Both Pi network modes use post-commit Release plus exact one-hot Signal only; neither pre-drains a child SC nor invokes `seL4_SchedContext_YieldTo`. Complete one causal round trip inside the current bounded activation only when durable state proves either an exact signal-bound finite one-way CYW43 operation whose sequence-last terminal is still absent, or an exact staged console control whose child-consumption watermark is still owed. Persistent and steady CYW43 parents retain root-polled deadlines and never block on the fan-in. The final condition-before-block cut revalidates every identity and operator/recovery/fault fence and proves the complete child frontier has no pending semantic event, packet egress, ingress watermark, or control watermark; it consumes a pending edge with one Poll and calls Wait only after an empty Poll. A stable terminal or publication already visible returns directly to the ordinary rotor. Once the exact control watermark is accepted, remote TCP ACK and `OutputDrained` work also return to ordinary timer/network arbitration rather than retaining Wait. Every wake returns through operator/recovery-first durable arbitration; the badge remains a coalescing hint and grants no work or identity. Bare physical idle, deadline, recovery, containment, quarantine, reboot, and operator-owned cuts never grant wait authority. The existing 64 logical/productive activation limits also bound causal waits; there is no longer spin, larger budget, polling loop, arbitrary retry, fallback owner, new queue, or weakened safety boundary. Compatibility review confirms no change to the host-tool suite, `cohsh`, `tools/cohesix-py`, any `.coh` workload, `scripts/rest_perf_harness.py` workload or report schema, public console grammar/framing, console ABI, manifest schema, evidence record, or raw/REST arithmetic. Canonical Pi generated truth, focused topology/condition-before-block/order tests, and the narrow QEMU root-MCS canary may reject the source correction. Only the next exact-image WiFi and GENET boot can prove the performance gates; repeatability and pressure depth remain separate physical acceptance evidence. - exact-ee post-action causal-frontier correction — cite this performance correction together with its owning `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and `m26e-console-network-service-isolation` tasks. Exact clean source `ee667bea33f80fa1637beb008e2ddd5a94040885`, build ID `39438ead96f20b9e5d583865f76e86466289e39d72d9d53e267281f09197f0b0`, normalized image ID `a7998649a85e938a06ec7bc9def7a7cbc664c3aba6e2be7ce2ff0e7695442917`, and sealed image SHA-256 `3489ce17c866b323b6519e4944598ff670468c5d4cb40ccafcbcaea805647231` reach root readiness at 8.116531 seconds, USB command-ready at 14.740 seconds, every CYW43 Gate 8 subgate, expected DHCP `192.168.86.154`, and actual service readiness at 30.835 seconds. The Gate 8 metric is the ready record's `next_attempt_ms`; the later `deadline_ms` is a future stabilization deadline and is not boot readiness. This also corrects the preceding exact-61b Gate 8 interpretation from 144.455 to 60.190 seconds. The boot-paired capture places DHCP Discover-to-ACK at 202.847 ms and shows no TCP/31337. Immediately after readiness, generic console publication ACK fails closed and quarantines the network, so TCP, scripts, raw64, REST, and GENET are unscored rather than failed-throughput measurements. Serial diagnostics remain responsive; a physical USB keystroke and the late HDMI path remain unaccepted. The first functional invariant is backend-independent: the compiler-sealed Pi cross-core signal-only topology is valid for both selected packet modes, but runtime admission incorrectly required a live direct-GENET mapping and rejected the intentional mediated-WiFi shell. Admit either Pi backend only under the unchanged generated cross-core, zero-`YieldTo`, activated, uncontained, live-SC fences; retain every direct-GENET-specific data-plane identity fence and the QEMU selector. The first performance invariant is the root-owned CYW43 continuation's missing post-action frontier. The child formerly published the exact consumed grant before physical service, so root could not distinguish an admitted action from a completed action; a full generated 10-ms wall-period veto then prevented overlap but imposed one dead interval per grant. Advance driver runtime-init ABI v11 to v12 without changing the fixed descriptor or 24-byte grant layout. Restrict root grant IDs to the low 31 bits and publish `0 -> grant_id|ACTION_ADMITTED_BIT -> grant_id`: the high-bit state proves ACK-before-I/O admission, the exact low-domain value is written only after one bounded arbitration or physical action, and only that exact completion may publish a successor. Commit the post-action value before the root fan-in; a sequence-last terminal instead retains its existing terminal fan-in and forbids a late grant write. The same admitted/action-complete distinction applies to delegated CYW43-to-SDIO grants: the initial grant-free action returns an exact service receipt, while every later exact grant uses the identical high-bit admission then low-domain post-action transition. Only a fully revalidated exact root grant bypasses the wall-period wake gate; unrelated retained, recovery, terminal, and endpoint lanes keep their existing cadence and fences. Preserve every SC budget, period, priority, MCP, refill count, WCET, Reply rule, operator priority, owner, queue, retry, deadline, recovery, containment, quarantine, manifest population, schema-1.16 field shape, and QEMU selector. Driver-runtime manifest schema v1 remains unchanged but its existing ABI field must carry v12. Compatibility review confirms no public TCP/REST/console/netstats schema, AUTH/framing/command behavior, `.coh` workload, `cohsh`, complete host-tool suite, `tools/cohesix-py`, benchmark workload/arithmetic, or report-schema change. Focused ABI/state-machine, generated-consistency, exact Pi compilation, and the pinned QEMU 10.1/HVF root-MCS canary may reject this candidate. Only the next exact-image WiFi boot and authenticated serial GENET reboot can prove the stated performance gates; repeatability and pressure depth remain separate hardware evidence. - exact-743e/51bf discriminators and superseding exact-publication/current-response correction — cite this performance correction together with its owning `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and `m26e-console-network-service-isolation` tasks. Exact source `743e554d9c990a84e1d92a34b6048bdf75160f09`, build ID `f934e7e3a8a115cb5a6019d0963fb640e9e42c7330383dde9b308a20597cfc13`, normalized image ID `2bf5a82422a788681bf333ab46f1e448e08b08a1a4919a89d16fdfcbb33d5f13`, and sealed image SHA-256 `ca8f5af5eee4fd8954776f5012cadff85b7431bf79aec7ad494f31ab3eaf6fa1` bind the exact-743e hardware discriminator. One cold and two rebooted WiFi lifetimes all stopped before Gate 8 and DHCP with the same exact state: root grant request 3 remained action-admitted at consumed value `0x80000001`, the sequence-last SDIO command `eff090d9/0001/2000/00000000/43595301` was visible, its completion remained empty, and the equal-priority SDIO owner recorded no observation before bounded pair recovery and quarantine. This is failure evidence at the committed CYW43-to-SDIO scheduling handoff, not RF, DHCP, firmware, device retry, or Gate-8 performance evidence. The same exact image's two valid one-connection raw GENET measurements completed 64/64 without transport retry or reconnect but reached only `143.2629479567085` and `137.12952399222013` requests/s with respective p95 latency `16.938749933615327` and `11.625333921983838` ms, below the required `162.242` requests/s and above the `1.845`-ms p95 limit. The first lifetime separately completed medium `192/192` and high `768/768` REST pressure without semantic, timeout, retry, reconnect, queue, containment, quarantine, or driver error. Its direct rings and IRQ path conserved `291/291` RX and `279/279` TX, while causal telemetry measured command to root observation at 4-ms average/17-ms maximum, dispatch to child stage at 6/20 ms, and 25,062 `NO_PRODUCTIVE_SUCCESSOR` exits with an 8,829-us average and 9,993-us maximum Yield hiatus. These are functional-prefix and performance-failure observations only; the second lifetime's erroneous host-side duplicate ATTACH invocation is excluded from script acceptance. Exact source `51bf6581f7f8b9ba343dc3e647e16ff245cfaff9`, build ID `92489bd085b49a3a049ee88cd2fd78f0ffccb7634c7305faad75f57008837a9b`, normalized image ID `f570b3ae990fa33f589601f61c9f5c86712c3de8a7ac67edb0de97964a594980`, and sealed image SHA-256 `9ef7b0a6e62cc22c0d6a1dbc4cdb331d64b417e1d31866fa0d224ee2e99d36b9` bind the superseding discriminator. Its cold plus two rebooted WiFi lifetimes again failed before Gate 8 and DHCP: root's stable double-read proved the same sequence-last SDIO command while the owner remained on its older engine-init sequence and no child bus episode or terminal appeared. Its two strict one-connection GENET raw64 runs completed 64/64 without retry or reconnect but measured only `106.8051723372317` and `101.42289185349958` requests/s at `18.985666800290346` and `19.93320812471211` ms p95. Both completed all three scripts first attempt; medium/high REST completed `960/960` without semantic, timeout, reconnect, queue, recovery, containment, quarantine, or driver error. Packet timing and balanced DMA/IRQ/rings locate the regression after ingress: the post-`OutputDrained` baton ran too late, while command publication to root observation and dispatch to stage still crossed MCS Yield periods. Repair the proven WiFi publication cut and the current-request GENET regression without changing either physical owner. Immediately after an exact persistent CYW43 parent commits its nonzero sequence-last SDIO child command, and before later semantic bookkeeping can unwind the publisher, revalidate the complete parent, child, generation, immutable frontier, root-grant environment, route, issued-unknown, pair-restart, and `Waiting` completion fences. Only that exact selected-MCS `Cyw43Client` publication may execute one `seL4_NBSendWait`: nonblocking-send the existing send-only slot-8 SDIO doorbell and atomically park CYW43 on its bound read-only slot-3 local notification. The durable ring command and completion, not either badge, remain authority. A returned root badge may enter only the existing exact expired-deadline classifier; without its immutable arm, lifetime, sequence, and expiry proof it schedules nothing. Every classic publication and every inexact, nonpersistent, stale, recovery, wrong-route, zero-sequence, replaced, or otherwise fenced MCS publication retains the existing single slot-8 signal-only path. The later finite foreground/DPC root-causal wait remains separately fenced; neither path creates another command, physical operation, retry, poller, queue, or owner. For direct GENET, bind every stage-bearing cross-core continuation to the exact nonzero one-slot child-control sequence in addition to the current authenticated generation and connection. The condition-before-block fan-in may wait only while that exact control still owes its child watermark; if the child wins the race, its durable publication returns to outer recovery/operator-first arbitration without an intervening Yield. Once the current request reaches its exact response terminal—either fused stage-and-drain or `OutputDrained`—retire that request's continuation. A fresh unconsumed child frontier may justify one separately charged Serial-first recheck after the lane and operator/recovery fences pass; preserve the enclosing clock, causal-wait count and 64-quantum cap. An executed empty recheck spends one quantum and stops; only fresh productive progress establishes another continuation. An absent frontier retains the existing idle/Yield route. Do not mint a post-response Network baton, open a cross-core empty hot tail, wait broadly for a future event, or admit a speculative sequential request. A future request must publish its own command and re-enter the ordinary Serial-first rotor. Identity, sequence, operator, display, passive, fault, recovery, containment, quarantine, reboot, or handoff drift fails closed without child work, NIC authority, queue entry, refill, or owner transfer. Exact 132a physical evidence retains an 8.899 ms mean publication-to-root gap after the declared timer repair removes idle timer rejection. The existing bound fan-in, endpoint/Reply multiplexing and periodic timer remain authoritative. The fresh-frontier recheck addresses a completed response's spent race allowance despite already durable child work; it does not replace the complete global-idle predicate. Do not add a post-response wait, spin, retry, poll loop, fallback owner, or unbounded future-request promise as a local substitute. Until hardware measurement, the current source is a discriminator, not certainty that GENET meets its raw gate. Preserve every SC budget, WCET, period, priority, MCP, refill count, Reply rule, operator ordering, physical owner, queue, retry, deadline, recovery, containment, quarantine, manifest population, ABI layout/version, schema, and QEMU selector. For this GENET continuation correction, `docs/INTERFACES.md`, the complete host-tool suite, `tools/cohesix-py`, compiler/generated contracts, all `.coh` workloads, `scripts/rest_perf_harness.py` workloads and arithmetic, benchmark evidence records, and report schemas were reviewed and require no change because the existing slots, rights, durable records, public grammar, and measurement contracts are unchanged. Focused state-machine/order tests, exact Pi target compilation, generated and Test Plan consistency, and the pinned QEMU 10.1/HVF root-MCS canary may reject this correction. They cannot prove a Pi speedup: a new exact-image cold WiFi boot, authenticated GENET reboot, first-attempt scripts, raw64, medium/high REST, operator liveness, causal diagnostics, and boot-paired captures remain mandatory before either performance or repeatability acceptance. - exact-2143 discriminator and authorized physical-Pi idle-receive closure — cite this performance correction together with its owning `m26e-driver-runtime-mcs-port-and-cyw43-coexistence` and `m26e-console-network-service-isolation` tasks. Exact source `2143ec681691239396f7bc2db259e6d7b53f1f55`, build ID `7b785377cba94ba055576f6c773d671c6d9b4a44541f2dc2cfcfac222e773451`, normalized image ID `c21244da51baff820e1c08367a044ebf695e2dc819dbe34166b4c2f3dd80ed8e`, retained manifest SHA-256 `4f81d4d7ff269a52124f60d8d1942a2963921baa14035e8302b38afa877dc930`, and sealed-image SHA-256 `e52bd5570d2b630b60b225ea1160f6bfa1621ed6da3ca55aaa46ba92fe66df1e` bind the rejecting hardware discriminator. The cold plus two authenticated WiFi lifetimes all stopped before Gate 8 and DHCP: the sequence-last ordinary one-way HOST_CONFIG child remained visible at `eff090d9/0001/2000/00000000/43595301`, while the SDIO owner stayed on its earlier sequence and produced no matching intake or completion. The persistent-only atomic publication selector had rejected that exact cold child before `seL4_NBSendWait`; RF, firmware, DHCP, SDIO issue, retry, and queue tuning were not reached. The same image's two strict one-connection GENET raw64 lifetimes completed 64/64 without retry or reconnect and passed all three `.coh` scripts on their first canonical invocation, but measured only `47.081996698261115` and `46.94507519743075` requests/s with p95 latency `20.135666942223907` and `20.135125145316124` ms. Request-to-target-ACK p95 remained `0.642` and `0.666` ms while target-ACK-to-response p95 was `19.314` and `19.323` ms. Balanced DMA/IRQ/rings and zero queue, recovery, containment, quarantine, or driver faults locate the first failure above the NIC: root accumulated 8.8--9.0-ms `NO_PRODUCTIVE_SUCCESSOR` Yield hiatuses and observed autonomous command publication only after a later refill. The first lifetime's medium/high REST pressure completed `960/960` without semantic or transport error; that is pressure/liveness evidence, not raw authority or reliability-depth acceptance. Supersede the persistent-only WiFi selector with one exact fresh-foreground publication admission. Before any admitted nonzero sequence-last foreground SDIO child, including cold HOST_CONFIG, commits, capture its route, turn, parent, child, physical generation, `Waiting` completion, issued-unknown, pair-restart, live-recovery, and immutable transaction fences and precompute the exact kernel-profile handoff. After the sequence-last commit and mandatory cache clean, selected MCS must execute the existing atomic slot-8 prompt plus slot-3 wait without an intervening passive read, diagnostic/progress publication, cache clean, or semantic operation. When that syscall returns, re-prove the same durable child and its exact first SDIO-owner action receipt. Only an unchanged child without that receipt takes one ordinary slot-3 wait, with no second slot-8 prompt; a visible first action, terminal, replacement, recovery, or identity drift continues through durable reclassification. The atomic route never replays legacy producer `SEND_DONE` or `WAIT_BEGIN` over newer owner evidence. On either SDIO peer-notification return, the sole owner stable-reads and seals a fresh one-way command in that activation before wake telemetry, source service, or another blocking boundary. A coalesced physical IRQ retains first physical-service priority, but the sealed command survives that boundary without another notification. Classic and every inexact publication remain signal-only and gain no additional wait. A release/acquire suppression latch may project private recovery into this scheduling decision, but it cannot initiate, complete, or clear recovery; only the existing pair-generation scrub clears it after canonical recovery authority has reset. Close the proven GENET/root seam as one physical-Pi direct-GENET-only, compiler-declared idle-receive topology. Bind the existing root-control fan-in notification to the init root-control TCB when its selected MCS temporal runtime is activated. Retain the already-allocated root-control Reply object and use it for every MCS endpoint receive and reply. Descriptor replay leaves the PCIe timer disarmed in every mode. At the exact direct-GENET ordinary global-idle cut, a completed empty quantum first permits exactly one nonblocking multiplexed receive. If that receive is empty, recheck timer, endpoint, durable producer, serial/local-seat/display, network, fault, recovery, quarantine, containment, and reboot state. At the first complete pre-enable fence only, issue one synchronous Reply-bearing typed enable Call, require the matching completion and durable identity-bound `Enabled` publication, then repeat the complete fence before blocking on the root-control endpoint. Later idle entries reuse that exact enabled lifetime without another programming operation. The bound notification may satisfy that receive only as a hint; an endpoint message must be copied into dispatcher-owned storage before returning, and all work is reclassified from durable state. A completed response may use the bounded fresh-publication recheck above. Reserve, operator, recovery, fault, and every non-global-idle boundary retain their explicit handoff. WiFi never enables the timer or enters this global-idle receive; it may wait only for a currently issued finite operation or an exact current-transaction causal child. Do not add a future-request tail, spin, retry, poll loop, larger root window, fallback owner, or notification-only wait. Authorize the minimum missing timer producer without adding a runtime, task, SC, refill, or owner population. Extend the always-present isolated `driver-pcie` runtime's manifest-declared physical authority with exactly one separately tagged, discontiguous BCM2711 system-timer page at `0xFE003000` and level IRQ 99 (GIC SPI 67), badge `2048`, handler slot 4, local-notification slot 3. Its existing 10-page PCIe host aperture remains separately tagged and contiguous. Descriptor adoption publishes `Disarmed` without programming channel 3. The first exact direct-GENET enable programs it at exactly half the unchanged generated `10000 us` PCIe-owner period, hence `5000 us`, and publishes `Enabled`; every WiFi lifetime remains disarmed. Each interrupt service performs only the bounded source clear, `CLO` sample, next-compare self-arm, ordering/readback, existing root-fan-in signal, and IRQ acknowledgement. It then immediately enters the existing combined command-endpoint/local-notification receive, returning a Reply-bearing command to ordinary dispatch or servicing one next genuine timer edge before blocking again. It performs no PCIe work, root timer processing, retry, polling, or catch-up loop. Missing or malformed hot-path, MMIO resource, physical address, page count, IRQ, badge, handler, notification, trigger, period, or interval identity must fail before MMIO, signal, or ACK. The isolated runtime remains sole owner of both its PCIe aperture and this exact channel; root remains a timer consumer and never maps or programs the device. The extra discontiguous resource uses the existing pointer-free runtime descriptor layout with additive internal resource tag 15; manifest schema 1.16 and runtime ABI v12 remain unchanged because no serialized field, width, offset, or interpretation of an existing tag changes. Regenerate all selected profile, resolved-manifest, topology, policy, and resource accounting outputs from the source manifest. Preserve every existing SC budget, WCET, period, priority, MCP, refill count, Reply association, core, operator ordering, driver issue owner, queue, retry, deadline, recovery, containment, quarantine, Worker population, listener, namespace, wire grammar, and QEMU selector. Clear the final U-Boot video frame before `bootm`, keep subsequent handoff diagnostics on serial, and construct the bounded HDMI runtime immediately after Serial while retaining PCIe before USB; this removes stale U-Boot text without changing HDMI budget or local operator precedence. Compatibility review covers `docs/INTERFACES.md`, the complete host-tool suite, `tools/cohesix-py`, `coh-rtc`, generated consumers, all `.coh` workloads, `cohsh`, Hive Gateway/REST, raw and REST benchmark workloads and arithmetic, trace/evidence readers, and report schemas. Only compiler, generated resource-accounting, Pi descriptor/IRQ/runtime, root MCS receive, scheduling documentation, and focused fixtures require change; public TCP/REST/console/netstats behavior and benchmark schemas do not. Focused ABI/IR/runtime/root-idle tests, exact AArch64 Pi compilation, generated and Test Plan consistency, and the pinned QEMU 10.1/HVF root-MCS canary may reject this candidate. A clean build, image hash, guarded flash, and media readback remain qualification only. Fresh exact-image WiFi and GENET hardware lifetimes must still pass their raw, Gate-8, script, REST, operator-liveness, packet/ring, and repeatability gates before performance or reliability acceptance is claimed. The first exact-image post-implementation discriminator is clean source `88c2142838b76056e8146304e030d93479fc2a7b`, build ID `32c01a6cb1b64ba9f8e3ed3bbc8d21c85ba743886182421fd42b3381291a16e6`, normalized image ID `99f81e783aa1f8ef2464519ac2e4305916ac37f575071f2dfd80bcdecc7b4032`, and sealed-image SHA-256 `5ba6a9cda127a4a69ad4f91ceaec20501c78db15fdbad569560fad99116ae6b8`. Two WiFi boots and one wired boot failed identically before root shell: WiFi pre-admitted only the `0xFE007000` DMA page and wired admitted no child page; later root mailbox/watchdog mappings advanced the monotonic device-untyped cursor past the lower `0xFE003000` timer page. `pcie-root` then failed `driver-runtime-pcie-timer-mmio-not-covered`, USB consequently failed `driver-runtime-pcie-bus-link-missing`, and exact fault-registry seal rejected `270/272` with only driver-pcie and driver-usb absent. No Gate 8, DHCP completion, root shell, TCP, or performance gate was reached. Repair that one construction invariant by pre-admitting `0xFE003000` first for every physical Pi network selection, followed by the existing `0xFE007000` DMA admission only for WiFi, before any higher root MMIO mapping. QEMU and host profiles admit no Pi device page. PCIe construction must require the timer admission to remain root-unmapped and consume it through the exclusive child-VSpace path; an ordinary cached or root-mapped substitute fails closed. This changes no resource count, manifest row, task, owner, SC numeric, IRQ identity, runtime ABI, or public surface. Compatibility review finds no required change to the host-tool suite, `tools/cohesix-py`, cohsh grammar, or raw/REST benchmark workload and report schemas because the repair is confined to pre-runtime physical-Pi device-cap construction order. Focused admission-order, exclusive-consumption, Pi target compile, generated-consistency, and narrow QEMU root-MCS checks qualify only the next candidate; a fresh exact-image Pi boot must clear registry seal and reach root shell before backend testing resumes. - runtime ABI v13 exact one-way causal activation — the same-image `0c734db` discriminator proves healthy RF/link, DHCP, GENET DMA/IRQ/rings, TCP ingress, `.coh` semantics, and clean REST pressure while failing both raw targets: WiFi 6.668 requests/s at 168.133-ms p95 and GENET 115.516 requests/s at 16.532-ms p95. WiFi request-to-ACK p95 is 150.479 ms; GENET ACK-to-response p95 is 15.793 ms. The first shared invariant is the useful root/runtime MCS activation ending before a finite child result or exact next action becomes visible, not a NIC, RF, DMA, IRQ, ring, retry, or queue defect. Advance the fixed-size driver runtime-init shared protocol from v12 to v13. Reply-consuming MCS bootstrap calls retain the supervised Call/Reply lane, donating the current root activation through the exact first descriptor or QEMU trampoline completion; classic bootstrap retains its bounded one-way behavior. A genuinely asynchronous generic MCS one-way command uses one initial notification prompt. After each bounded pending action, its linked runtime commits an exact 24-byte `DROW` record in the auxiliary slot with request sequence, command-action fingerprint, sealed runtime identity, strictly-next wait slice, and sequence-last commit, then atomically `NBSendWait`s the existing slot-12 root-control fan-in and slot-3 local notification. Root accepts only the current stable record, current ring, and current capability generation, changes only the magic to durable `DROA`, then signals that child once. The child resumes only after observing the exact acknowledgement and clears it before the next action. Stale or coalesced badges, duplicate or skipped slices, wrong identity, torn state, a terminal race, or an auxiliary grant/steady/persistent record grant no authority and fail closed. CYW43/SDIO keep their existing hard source-yield boundary; Serial, GENET, HDMI, USB, and PCIe generic work no longer insert an unconditional post-action Yield that forfeits the current refill. Preserve every SC budget, period, refill, priority, MCP, WCET, Reply and fault-supervisor rule, isolation boundary, queue, owner, retry, recovery, containment, quarantine, manifest population, and QEMU selector. The driver-runtime manifest producer and its independent pipeline oracle advance to v13 in the same change. The remaining host-tool suite, `tools/cohesix-py`, `.coh` workloads, public console/TCP/REST grammar, `scripts/rest_perf_harness.py`, raw/REST workload arithmetic, and report schemas were reviewed and require no change. Focused ABI/runtime/root tests and the pinned QEMU 10.1/HVF root-MCS canary qualify only a candidate. A fresh exact-image cold/warm WiFi and two GENET lifetimes with canonical scripts, raw64, medium/high REST, paired captures, diagnostics, and operator-path checks remain the direct performance and repeatability discriminator. - platform consistency — select the same v6 shared contract, including the v4-introduced bounded command batch, complete 256-Worker population, two passive-Worker executor-lane architecture, and passive-service locality invariant for QEMU and Pi manifests. Pi selects a larger root CNode only for its additional driver inventory and future capability headroom; QEMU optimization and static Pi composition require no Pi hardware interaction. - Pi build compatibility — refresh the repository-managed `pi4_diagnostic` tree from the freshly built SMP+MCS profile, require exact current-profile validation and deterministic immutable-tree composition, use the selected `CARGO_TARGET_DIR` for every Pi runtime payload, and compile direct VirtIO DMA containment only for QEMU/VirtIO profiles. Bind the pre-root-task Pi driver-runtime CPIO into image provenance and copy that exact archive into the SD stage, so `--skip-build` cannot repackage a later QEMU-feature child from the shared Cargo target directory. Retain the exact selected Pi resolved manifest beside the staged image before cleanup restores canonical QEMU generated outputs, and bind the stage-only runtime/DMA proof to that retained file and digest. - compatibility — preserve public AUTH/framing/command/ACK/ERR/END behavior, one-slot publication ACK semantics, root policy authority, MCS admission, evidence, and fault containment; advance the selected manifest through schema 1.16: schema 1.15 retains the generated internal Worker execution contract and transport correlation identity, while schema 1.16 seals the root-control fan-in slots and internal console/driver ABI versions. Update compiler, generated truth, host/target NineDoor, focused tests, host tools, Python library, SwarmUI projections, and benchmark compatibility review together. Full host-tool and `tools/cohesix-py` review preserves the public grammar, generated target-profile contract, and host dependencies. It requires bounded host-only compatibility repairs: `cohsh` TCP-only builds no longer compile in the in-process NineDoor/mock/trace implementation, in-process integration tests declare that required feature explicitly, `cas-tool` and SwarmUI integration tests resolve their Cargo-provided binaries at runtime so all-target linting remains portable, and the Python target validator adopts the generated Pi 1/127/128 population. The evidence and benchmark tools additionally derive the complete 265-task QEMU and 272-task Pi temporal seals from generated truth, keep exactly one detailed live exemplar for each executable role, admit target-neutral fresh-Pi proof, and compare provenance-compatible QEMU/Pi throughput and errors without turning QEMU latency into a physical-network gate. Hive Gateway's `/v1/meta/status` projection adds required normalized configured-backend `target_host` and `target_port` fields so fresh-Pi evidence binds the live gateway to the exact Pi console endpoint; it does not expose the REST bind endpoint or create target proof for host-model mode. `coh`, `cohsh`, `coh-status`, SwarmUI, `gpu-bridge-host`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, `cas-tool`, every `.coh` workload, and `tools/cohesix-py` tolerate or ignore those additive status fields and require no behavior or schema change. Existing QEMU results do not claim Pi performance, and the enlarged Pi declaration requires fresh exact-image physical evidence. The original manifest/build integration performed no Pi hardware interaction; later exact-image bullets bind their own fresh Pi evidence and still require a new exact-image boot after each source candidate. Commands: - cargo test -p pi4-driver-runtime --lib persistent_child_publication_selects_atomic_mcs_handoff_and_classic_signal -- --test-threads=1 - cargo test -p pi4-driver-runtime --lib sdio_peer_wake_admits_the_fresh_durable_one_way_command_immediately -- --test-threads=1 - cargo test -p pi4-driver-runtime --lib atomic_sdio_publication_never_replays_legacy_wait_progress -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib direct_genet_causal_wait_matches_only_the_current_control_identity -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_genet_completed_response_does_not_open_a_future_request_tail -- --test-threads=1 - scripts/ci/test_plan_converge.sh --target qemu --focus root-mcs --path apps/root-task/src/event/mod.rs - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib pi_root_control_ -- --test-threads=1 - cargo test -p root-task --test mcs_activation_order -- --test-threads=1 - cargo test -p root-task --test mcs_fault_lanes -- --test-threads=1 - cargo test -p root-task --lib service_fault_frontier -- --test-threads=1 - cargo test -p root-task --lib service_call_arm -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib isolated_self_test -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib linked_cyw43_ -- --test-threads=1 - cargo test -p pi4-driver-runtime --lib direct_genet_ -- --test-threads=1 - python3 -m pytest -q tests/test_pi4_trace_normalize.py tests/test_pi4_gate_proof.py - cargo test -p console-network-abi - cargo test -p console-network-runtime - cargo test -p root-task --no-default-features --test console_network_service -- --test-threads=1 - cargo test -p root-task --no-default-features --test isolated_virtio_network_phasing -- --test-threads=1 - cargo test -p coh-rtc console_network_service - cargo test -p nine-door --test schedule_create --test schedule_bounds - cargo test -p nine-door lease_ - cargo test -p host-ticket-agent - cargo test -p worker-task-abi -p worker-heart - cargo test -p root-task --test worker_ipc --test worker_supervisor --test worker_fault_lifecycle --test worker_resource_admission - cargo test -p coh-rtc temporal resource_admission - cargo test -p cohsh -p hive-gateway - cargo test -p cohsh --no-default-features --features tcp - python3 -m pytest -q tests/test_console_network_runtime_packaging.py - python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_pi4_compare_driver_models.py tests/test_worker_task_evidence.py tools/cohesix-py/tests/test_orchestration.py - cargo test -p coh-rtc --test pi4_profile --test python_profile - cargo test -p coh-rtc resource_admission - cargo test -p root-task --test isolated_virtio_network_phasing - python3 -m pytest -q tests/test_pi4_image_build.py tests/test_pi4_prebuilt_composition.py tests/test_sel4_profile.py - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - .venv/bin/python scripts/sel4_profile.py validate --repo-managed --profile pi4_diagnostic --build-dir seL4/build_UBOOT --require-artifacts --for-runtime - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean - scripts/cohesix-build-run.sh --no-run --cargo-target aarch64-unknown-none - scripts/m26e_qemu_pressure.sh with the canonical medium and high executable-Worker REST profiles on macOS, followed by equivalent Linux/KVM runs for an accepted Mac candidate Checks: one child publication admits at most eight already-authenticated commands; original timestamps, per-key FIFO order, connection identity, and queue bounds remain exact; lifecycle events never coalesce; peer-assisted self-test observes decisive state despite ordinary activity, uses one fresh per-connection epoch, and cannot combine replacement or post-retirement traffic; Worker selection is fair; every internal quantum and active window retains hard bounds; the CYW43 outer cap counts only active Network service while its real-wall operator checkpoint and 192-turn cap remain independent; a quiescent direct-GENET Block closes only its software episode while continuous durable work and endpoint freshness retain their guards; the QEMU and Pi 256-Worker populations each consume only the two generated executor-lane utilization reservations; the Pi fixed-plus-maximum-plus-reserve inventory fits its exact 16-bit root CNode with 46,020 slots left; each passive Worker has exactly one allowlisted donor lane and generation-scoped Reply path; shared mappings are immutable and role/image exact while all writable mappings remain private; fault/timeout injection releases the donor once before complete containment; the passive NineDoor service is compiler-rejected unless co-located with its sole root-control donor; the exact selected seL4-16 AArch64 MCS ABI admits eight but rejects eleven refills in an 8-bit SC; direct GENET compiler/profile validation rejects any `wcet_us` other than 800, handoff/runtime validation rejects drift from exact max-eight-refill `3,000/10,000 us`, each guarded slice admits at most one material packet operation, and continuous bidirectional pressure receives an exact 8/8 split inside the 16-slice window; diagnostic-v4 packet-slice high-water and dense-window reason fields round-trip and render without authority; nonforeground CYW43-to-SDIO copies pass both directions and every alignment without crossing either admitted arena or changing foreground trace/overlay authority; the exact authenticated response rotation retains activation only through `Network -> Serial -> LocalSeat -> Dispatch -> Network` and rechecks the loop-top guard before another Network unit; non-VirtIO profiles cannot select direct VirtIO DMA containment and reject an invalid cursor; the retained Pi manifest still hashes to the stage proof after canonical QEMU cleanup; the provenance-bound Pi driver-runtime CPIO rejects tampering and remains byte-identical in a skip-build stage even after later QEMU children occupy the Cargo target directory; schedule depth returns after each completed benchmark lifecycle; terminal execution journals compact without weakening exactly-once recovery; preemption evidence turns over without refusing valid lease control and retains cumulative accounting; public output is byte-compatible apart from documented additive diagnostics; no unbounded loop, queue, retry, donation chain, or authority exists; medium/high QEMU pressure improves materially without unexpected fault, MCS timeout, queue runaway, or operator-liveness regression on either host. Static Pi profile and stage-only PASS remain non-hardware evidence. Deliverables: ABI v6 bounded command quantum retaining the v4-introduced CommandBatch contract, two bounded Worker executor lanes, target-qualified QEMU and Pi 256-Worker populations, a 16-bit Pi root-CNode profile with deterministic reserve, immutable role-image sharing, generation-safe donated-SC recovery, three-tier bounded authenticated transport progress, bounded progress-retaining root activation, shared schedule consumer lifecycle, durable terminal-journal compaction, rolling preemption evidence, focused regression evidence, and same-source macOS/Linux QEMU before/after pressure records. Pi hardware acceptance remains a separate future evidence lane. Result (2026-08-25): the v152 same-source performance candidate passed fresh MEDIUM and HIGH boots on macOS 26.6.2/QEMU 10.1.0 HVF and Jetson Ubuntu 24.04/QEMU 10.1.0 KVM. Both hosts sealed all 265 fault sources, published 256/256 structured Worker READY records, completed authenticated NineDoor, console, GPU, and LoRA work, and recorded no unexpected standard fault, MCS timeout, receipt loss, reconnect, or queue runaway. Mac sustained 628.5 and 673.825 successful operations/s; Jetson sustained 93.142 and 100.65. Relative to the first 37-Worker same-harness Mac baseline, successful MEDIUM/HIGH throughput improved 14.3x/14.2x while the isolated population grew 6.9x. At HIGH, the guest used the complete bounded 4096-unit service quantum: aggregate drainage was 0.994 on Mac and 0.844 on Jetson, with zero flight-recorder `YIELD`, `TIMEOUT`, or `FAULT` exits. Mac QEMU averaged approximately one host CPU, so the remaining material ceiling is the deliberately single authenticated target-control stream rather than artificial MCS fragmentation. Exact metrics, typed retained-state refusals, commands, identities, and artifact paths are qualified in `docs/BENCHMARKS.md`; this is QEMU performance evidence and not Pi hardware acceptance. Title/ID: m26e-mcs-operator-inspection Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / bounded root-shell MCS operator inspection Goal: Expose source-labelled generated and live seL4 MCS state through `bi`, `caps mcs`, and `smp mcs` without perturbing scheduler accounting. Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-console-network-service-isolation`, selected seL4 BootInfo, generated temporal/resource-admission records, live fault-registry and critical-domain state, crates/cohsh-core/**, apps/root-task/src/{console,event,critical_tcb.rs,hal/critical_tcb.rs}, docs/{INTERFACES,USERLAND_AND_CLI,SECURITY,TEST_PLAN}.md. Changes: - crates/cohsh-core/** + generated grammar/fixtures — preserve bare `caps` and `smp`; add strict `caps mcs` and `smp mcs`; list both MCS spellings as explicit root-shell and host-client help rows; update every parser/help/transcript consumer. - apps/root-task/src/{console,event}/** — retain the legacy `bi` line, source every production help path from the shared root-console inventory, and emit bounded kernel BootInfo and generated profile records; keep every `caps mcs` record within the 77-byte Pi linked-HDMI fallback width without dropping fields. - apps/root-task/src/{critical_tcb.rs,hal/critical_tcb.rs,event/**} — copy the live registry nonblockingly, release its lock before output, and render authority/object, per-core admission, and per-task temporal/registration/generation state. Never call `seL4_SchedContext_Consumed`, mutate accounting, perform a debug dump, or create authority. - docs and compatibility — document provenance and separate QEMU/Pi evidence; review `coh`, `cohsh`, SwarmUI, Hive Gateway, `.coh`, `tools/cohesix-py`, fixtures, release, and performance surfaces without changing their semantics. Commands: - cargo test -p cohsh-core - cargo test -p root-task mcs_operator_inspection - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none - python3 -m pytest -q tests/test_qemu_tcp_response_matrix.py - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-mcs-operator-inspection-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-mcs-operator-inspection-pi4 Checks: legacy behavior remains; every production help path lists literal `caps mcs` and `smp mcs`; output is strict and bounded; every `caps mcs` field survives the Pi linked-HDMI fallback width; generated/live sources stay distinct; missing, contended, early, and fatal state are explicit; QEMU and fresh-Pi evidence remain separate. Deliverables: Additive root-shell MCS inspection, grammar compatibility, deterministic tests, and separate exact-target evidence. Title/ID: m26e-worker-abi-identity-notifications Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / Worker task ABI v1 and exact executable-role matrix Goal: Freeze one pointer-free namespace-projection ABI, collision-free instance identity, seL4-correct notification contract, and non-vacuous Heartbeat/GPU/LoRA role matrix before any Worker image or supervisor depends on it. Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-mcs-operator-inspection`, apps/worker-heart/**, apps/worker-gpu/**, apps/worker-lora/**, apps/root-task/src/worker_authority.rs, tools/coh-rtc/src/**, configs/root_task*.toml, docs/INTERFACES.md, docs/ROLES_AND_SCHEDULING.md, docs/USERLAND_AND_CLI.md, docs/WORKER_TICKETS.md, docs/GPU_NODES.md. Changes: - crates/worker-task-abi/** — add `worker-task-abi/v1` runtime-init, identity, bounded control/completion, READY, telemetry/receipt, shutdown, standard-fault, timeout-fault, and evidence records with fixed layouts, explicit version/length/sequence/epoch/generation fields, release/acquire rules, and no pointers or extra caps. Define exact `GPU_LEASE_RECEIPT` and `PEFT_RECEIPT` labels/records carrying the generated action code, confirmed/rejected outcome, receipt sequence, full Worker identity, and fixed SHA-256 idempotency/operation/subject/result digests, plus their bounded `worker-gpu-receipt/v1` and `worker-lora-receipt/v1` canonical telemetry encodings. - tools/coh-rtc/src/** + configs/root_task*.toml — generate immutable `(role, slot, lease_epoch, supervisor_generation, cap_generation)` endpoint/fault identities; lifecycle and supervisor-wake notification objects; reserved disjoint endpoint/notification badge ranges; per-slot one-hot lifecycle/completion bits and precedence; per-slot durable control/completion records; exact holders/slots/rights/syscalls; one active Worker SC bound only to its TCB; zero normal-IPC blocking Send/Call/Reply/donation depth; standard/timeout fault caps with `Write + GrantReply`; exactly one root-fault Read cap and one serialized receive Reply; per-role slots/images; accepted host-ticket request/result schema sets; the action/receipt-mode version matrix; root-pinned version-2 Worker bindings; and Heartbeat/GPU/LoRA `implemented = true` candidate contracts while WorkerBus remains model-only. - tools/coh-rtc/src/** + evidence schema — distinguish model-only, configured executable, QEMU-accepted, Pi-accepted, Worker-runtime-release-accepted, and production-use-case-accepted states; define strict, non-interchangeable `cohesix-worker-observation/v1` (`record_kind=observation`), `cohesix-worker-integration-evidence/v1` (`record_kind=worker-integration`), `cohesix-worker-task-evidence/v1` (`record_kind=target-component`), `cohesix-root-tcb-acceptance/v1` (`record_kind=root-tcb`), `cohesix-mcs-smp-system-acceptance/v1` (`record_kind=full-system`), and `cohesix-worker-release-acceptance/v1` (`record_kind=release`, scope `worker-runtime`) schemas with per-kind required/forbidden field matrices. Exact-target component records key the sorted exact role-required Worker-integration rows plus target/kernel/resolved-manifest/root/MCS-driver-archive/MCS-driver-manifest/CYW43-coexistence-record/Worker-archive/Worker-image-manifest/Worker-image/ABI/evidence hashes; the release record contains exactly six matching component/root/system record references plus the recursively cross-checked runtime artifact/integration graph. No consumer infers record kind, `implemented = true` never depends on later hardware proof, and the runtime release record cannot be parsed as a production use-case acceptance record. - docs/INTERFACES.md + docs/USERLAND_AND_CLI.md + generated grammar/fixtures — add the manifest-gated `lora` value to the existing spawn operation and `peft.export` to the existing host-ticket action enum/allowlist; define strict per-action version-2 request/result schemas on the existing host-ticket paths with exact argument sets/bounds, `operation_id`, `subject_ref`, receipt Worker role/id/supervisor-generation/cap-generation, root-resolved Worker slot/lease epoch, and canonical `result_digest`; reject unknown args, free-form host paths, symlink/traversal PEFT inputs, ungenerated GPU/device ids, and cross-subject bindings before dispatch; publish the accepted-schema sets and action/receipt-mode matrix; retain version 1 only for actions requesting no Worker receipt; reject federation fields for receipt-bearing version 2; keep `ATTACH` non-instantiating; and map validated terminal GPU/PEFT results through the generated supervisor records and exact receipt labels without a new VM verb, namespace, or executor. - docs/ROLES_AND_SCHEDULING.md + docs/WORKER_TICKETS.md + docs/GPU_NODES.md + docs/TEST_PLAN.md — define exact rights, capacity, identity, coalescing, durable completion, terminal-versus-recoverable fault, PEFT idempotency/receipt, and acceptance-state contracts. Commands: - cargo test -p worker-task-abi - cargo check -p worker-task-abi --target aarch64-unknown-none - cargo test -p coh-rtc worker_task - cargo test -p root-task --test worker_contract - scripts/check-generated.sh - scripts/ci/check_test_plan.sh Checks: duplicate/overlapping badge domains, zero or multi-bit notification events, OR aliases, role/slot/epoch/supervisor-generation/cap-generation overflow, unknown or action-incompatible ABI/host-ticket schema versions, unknown/oversized/action-incompatible args, free-form or escaping host paths, missing root-resolved slot/lease epoch, missing/cross-role/non-READY receipt bindings, federated/relayed version-2 receipts, post-admission Worker rebinding, extra caps, unbounded frames, broadened or reversed cap rights, SC-to-notification binding, normal Worker Send/Call/Reply/donation, missing durable completion, invalid fault `GrantReply`/Reply cardinality, missing Heartbeat/GPU/LoRA contracts, executable WorkerBus, and circular evidence-dependent `implemented` validation all fail closed; every WorkerGpu record maps exactly one terminal `gpu.lease.grant|renew|release` result, every WorkerLora record maps exactly one terminal `peft.export|import|activate|rollback` result, and both prove id/ticket/idempotency/digest/generation/replay behavior without granting host execution, credential, model, or device authority. Deliverables: Compiler-owned Worker ABI v1, exact mandatory role matrix, additive LoRA spawn value, and exact-image acceptance schema. Title/ID: m26e-worker-image-pipeline-loader Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / content-addressed Worker images and generic least-authority child loader Goal: Build, validate, package, hash, and load the three mandatory Worker images before root compilation without repackaging or modifying the newly accepted 26e MCS driver archive. Inputs: `m26e-mcs-abi-foundation`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-worker-abi-identity-notifications`, apps/worker-heart/**, apps/worker-gpu/**, apps/worker-lora/**, apps/root-task/build.rs, apps/root-task/src/hal/**, scripts/cohesix-build-run.sh, scripts/pi4-image-build.sh, scripts/ci/size_guard.sh, generated Worker ABI/slot records, and the newly hash-bound MCS driver/CYW43 coexistence identity. Changes: - apps/worker-heart/** + apps/worker-gpu/** + apps/worker-lora/** — provide real `no_std` target binaries and linker contracts that consume only the sealed runtime-init descriptor, issue READY, block on real IPC/notifications, use admitted time, and remove hard-coded CPtrs, synthetic identity/time, and spin loops; LoRA emits bounded PEFT lifecycle receipts and never trains, imports, loads, activates, rolls back, or infers itself. - scripts/worker_image_manifest.py + tests — validate AArch64 ELF class/machine, entrypoint, relocation/load span, W^X segments, stack/IPC bounds, canonical stripped bytes, role/ABI identity, content hashes, duplicate names, and tampering. - scripts/cohesix-build-run.sh + scripts/pi4-image-build.sh + apps/root-task/build.rs — add `worker-heart`, `worker-gpu`, and `worker-lora` explicitly to the target Worker build/staging inventory, build Workers first, create a deterministic separate `cohesix-worker-images.cpio` plus `cohesix-worker-image-manifest/v1`, then compile root with generated target-qualified digest expectations and retain the exact archive/manifest in rootserver for target loading. Byte-identical system-CPIO copies remain the host/release projection; typed BootInfo FDT records are never treated as that CPIO. A selected executable role missing from the build list, staged directory, archive, or manifest fails instead of being silently skipped. Do not append to, rename, reorder, or reinterpret `cohesix-driver-runtimes.cpio`, `COHESIX_PI4_DRIVER_RUNTIME_PAYLOAD`, or its seven-driver evidence fields. - apps/root-task/src/hal/** — add an additive HAL-backed generic W^X child-image planner/loader for generated Worker records without refactoring or duplicating the MCS-ported physical driver-runtime loader and ABI path. - exact-image/release metadata — bind the Worker archive, Worker image-manifest, and per-image hashes separately into QEMU and Pi identity and preserve the rootfs `< 4 MiB` guard. Commands: - cargo build --locked --release --target aarch64-unknown-none -p worker-heart -p worker-gpu -p worker-lora - cargo test -p root-task --test worker_image_loader - python3 -m pytest -q tests/test_worker_image_pipeline.py tests/test_pi4_image_build.py - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean - scripts/ci/size_guard.sh out/cohesix/cohesix-system.cpio Checks: root builds only after all three canonical image hashes exist; the exact archive and manifest contain Heartbeat/GPU/LoRA and no WorkerBus; wrong architecture, W+X, bad entry/load bounds, stale/tampered hash, missing LoRA binary, malformed runtime-init bounds, or rootfs overflow fail; QEMU/Pi Worker archives are target-qualified; this task leaves the input MCS driver archive/hash, CYW43/SDIO behavior, inventory, timing, restart, and evidence classification unchanged. Deliverables: Deterministic separately packaged Worker images, target-qualified image manifest, and reusable least-authority Worker loader without a driver/CYW43 packaging refactor. Title/ID: m26e-worker-supervisor-child-isolation Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / transactional executable Worker supervision Goal: Replace model-only target claims with real Heartbeat/GPU/LoRA child tasks whose spawn, READY, operation, shutdown, fault, teardown, and fresh-generation recreation are atomic and authority-safe. Inputs: `m26e-worker-resource-admission-critical-tcbs`, `m26e-worker-abi-identity-notifications`, `m26e-worker-image-pipeline-loader`, apps/root-task/src/worker_authority.rs, apps/root-task/src/lifecycle.rs, apps/root-task/src/event/**, apps/root-task/src/ninedoor.rs, apps/worker-heart/**, apps/worker-gpu/**, apps/worker-lora/**, generated slot/image records, canonical Worker docs. Changes: - Release Worker bootstrap reservation restoration — discovered by `m26e-mcs-smp-target-acceptance` on native KVM source `3603bd507f2d252d3dec825dabcffcd15c76569c`: an initiating kernel timeout capture identifies LoRA slot 43 (`worker-172`) executing init-record hashing at PC `0x212700`, with its temporary 400-us SC exhausted before READY; the final population is 255. Under schema 1.18, explicitly select `bootstrap_timeout_policy = "natural-postpone"` for MCS Worker startup, retaining 400/10,000 us, two refills, priority/core assignment, the five-second READY deadline and standard-fault containment. Unbind that SC before installing the existing passive ReturnError timeout endpoint, and publish READY only after both operations succeed. A failed transition keeps admission closed and deadline containment armed. Missing or terminal bootstrap policy and the previous schema fail compilation. Review the complete host-tool suite, Python library and performance scripts: regenerate manifest/profile/hash bindings together; public protocols, workloads, receipt requirements, thresholds and report schemas remain unchanged. Require focused compiler/transition/deadline checks, exact Mac/KVM/Pi builds, full QEMU lifecycle/fault gates and fresh uninterrupted Jetson bootstrap/pressure repeatability. This is a defect restoration under the existing executable-admission and transactional-supervision tasks, not evidence of release acceptance. - apps/root-task/src/worker_authority.rs + lifecycle/event code — implement the generated free/allocate/verify/map/configure/admit/resume/READY state machine, reserve ids before READY without publishing live authority, validate every child record, and serialize Queen decisions without blocking root-control, root-fault, or root-emergency TCBs. - apps/root-task/src/ninedoor.rs + console projection — make accepted spawn acknowledge bounded queue admission, add the generated LoRA spawn target, expose bounded starting/live/closing/faulted/terminal state, stop new authority immediately on kill, and preserve `ATTACH` as session-only. - supervisor completion/fault handling — drain generated per-slot durable READY/operation/receipt records from the supervisor-wake notification, validate sequence/identity/digest, preserve one-in-flight semantics, count droppable telemetry, receive nonblocking critical-TCB handoffs, and keep fault Reply ownership in root-fault until its terminal or allowlisted-recoverable decision completes. - supervisor teardown — close admission, signal one-hot shutdown, enforce the grace bound, suspend, clear durable records and notification state, resolve fault Replies, unbind notification/SC, unmap/scrub frames, revoke descendants from retained anchors, delete child objects, prove zero old-generation authority and no blocking-send path, reclaim the slot, and advance generation before reuse. - apps/worker-heart/** + apps/worker-gpu/** + apps/worker-lora/** — validate init/control records, publish durable READY/completion/receipt records before signaling, produce only explicitly droppable endpoint telemetry, honor coalesced lifecycle precedence, block when idle, and reject late/stale generations; WorkerLora maps the four PEFT result actions exactly and only WorkerBus remains model-only. - generated artifacts + canonical Worker docs — use `implemented = true` only for complete static executable contracts and describe acceptance-pending versus exact-target-accepted state separately. Commands: - cargo test -p root-task --test worker_ipc - cargo test -p root-task --test worker_supervisor - cargo test -p root-task --test worker_notification - cargo test -p root-task --test worker_fault_lifecycle - cargo test -p worker-heart -p worker-gpu -p worker-lora - cargo check -p worker-heart -p worker-gpu -p worker-lora --target aarch64-unknown-none - scripts/check-generated.sh Checks: ring/control saturation, duplicate sequence, forged role/slot/epoch/supervisor-generation/cap-generation, two sequential same-role generations with a simultaneous second-live-slot refusal, coalesced notifications, durable-completion publish/signal races, READY timeout, construction failure at every phase, ordinary terminal fault, allowlisted timeout recovery, fault before READY/during IPC, attempted forbidden blocking send, dropped telemetry, late completion/receipt, kill/fault repetition, generation exhaustion, and repeated maximum-slot churn fail or recover deterministically with no orphan namespace state, cap, mapping, pending record/signal, Reply, SC, or executable TCB; PEFT export/import/activate/rollback receipts prove the exact host-ticket-result-to-supervisor-to-WorkerLora mapping without moving host work into the VM. Deliverables: Real transactional Heartbeat/GPU/LoRA tasks and complete per-instance 26e containment/reclamation; WorkerBus remains honestly model-only. Title/ID: m26e-gpu-refresh-control-retention Milestone: Milestone 26e — host integration / m26e-host-integration-dependency-contract; release burn-in defect restoration Goal: Keep admitted GPU control records readable during ordinary inventory refreshes from the same live publisher generation. Inputs: exact Pi GENET burn-in 8c050a0aaf7b image, continuous real Orin inventory, 30-second GPU lease lost after a six-second observation interval, and WorkerGpu READY records. Changes: - apps/root-task/src/ninedoor.rs — preserve bounded ctl/lease/status append logs for an unchanged GPU identity within the same unexpired publisher epoch; withdrawal, changed device/source/epoch, expiry and stale-snapshot rejection remain fail-closed. - apps/nine-door/src/host/{core.rs,namespace.rs} — preserve the corresponding host-model journal semantics without claiming target execution or provider freshness acceptance. - docs/GPU_NODES.md and docs/HOST_TOOLS.md — describe inventory seeds versus appended control history and record complete host-tool, Python SDK and benchmark compatibility review. Commands: - cargo test --locked -p nine-door --test integration gpu_inventory_refresh - cargo test --locked -p root-task --lib --features driver-tests-pi4 gpu_snapshot - exact-profile Pi release build, image-bound RAM boot, first raw GENET gate, live refresh/lease/Worker and FUSE checks Checks: successful same-generation refresh preserves control bytes; changed generation/device, withdrawal, expiry and rejected updates cannot retain or create stale authority. No new CUDA executor, lease enforcement claim, schema, namespace, unsafe code or performance threshold. Deliverables: material retention repair with focused host contracts and fresh Pi evidence before a revised timed attempt. Title/ID: m26e-host-integration-dependency-contract Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / generated host-integration and use-case dependency contract Goal: Inventory every advertised host integration and use case, generate its transitive Worker/provider/release dependencies and acceptance obligation, and prevent a Worker, release, use case, or playbook from being promoted while a required host path is mock-only, missing, or unowned. Inputs: `m26e-production-surface-truth-and-stub-retirement`, `m26e-worker-abi-identity-notifications`, `m26e-worker-supervisor-child-isolation`, Cargo.toml, configs/root_task*.toml, configs/generated/implementation_surface_inventory.json, tools/coh-rtc/src/**, apps/cohsh/**, apps/coh/**, apps/coh-status/**, apps/hive-gateway/**, crates/cohesix-rest/**, apps/swarmui/**, tools/cohesix-py/**, apps/gpu-bridge-host/**, crates/host-cuda/**, apps/host-ticket-agent/**, apps/host-sidecar-bridge/**, apps/sidecar-bus/**, apps/cas-tool/**, scripts/release_bundle.sh, docs/USE_CASES.md, docs/HOST_TOOLS.md, docs/HOST_API.md, docs/GPU_NODES.md, docs/PYTHON_SUPPORT.md, docs/INTERFACES.md, docs/TEST_PLAN.md, and current release manifests. Changes: - tools/coh-rtc/src/** + configs/root_task*.toml — add compiler-owned `host-integration-dependency/v1` records that reference existing generated namespace paths, host-ticket actions, schemas, and authority rather than redefining them. Require integration id/owner, host profiles, dependent Worker roles/use cases/playbooks, `role_required|release_required|use_case_required|optional|future` obligation, required/allowed observed modes, unavailable/future ownership, auth/secret refs, timeout/retry/cancel/idempotency/fencing posture, readiness/degraded semantics, package/artifact requirements, evidence lane, and owning milestone. - tools/coh-rtc/src/codegen/** + configs/generated/** + docs/snippets/** — extend the implementation-surface inventory with one bounded dependency graph and conformance vectors consumed by Rust/Python/REST/UI/release tools. Include every host-facing workspace binary and library API presented as a product surface, every host integration named by any tracked README/canonical doc/help/example, all six `docs/USE_CASES.md` scenarios, and every built-in `cohesix-playbook` id; fail generated-drift checks when an advertised surface is missing, hand-classified elsewhere, or reaches a live row through a fixture/model/no-op dependency. - crates/cohesix-worker-evidence/** + schemas — add strict validation for `cohesix-worker-integration-evidence/v1` (`record_kind=worker-integration`) and a sorted bounded reference list on target-component evidence. Each record covers exactly one dependency row and binds its observed `unknown|missing|disabled|fixture|mock|dry-run|live` mode to the exact dependency graph, manifest, component/config/artifact hashes, optional QEMU or Pi target session, host profile/OS/architecture, provider/package versions, action/observation/receipt outcomes, redacted raw evidence, PASS/FAIL, and blockers without containing secrets or becoming Worker READY evidence. - configs/host_integration_acceptance.toml + scripts/ci/host_integration_run.sh + scripts/ci/check_host_integration_inventory.py + tests/test_host_integration_run.py — create the matrix-only, fixture/mock/dry-run/live, projection-compatibility, and release validation lanes plus their schema, tamper, mode-substitution, missing-owner, and secret-redaction tests. The mandatory 26e live target-session rows are `worker-control`, `gpu-receipt-path`, and `peft-receipt-path`; external GPU/PEFT provider rows remain separately observed and cannot be promoted from the receipt fixture. Advertised FUSE, systemd, Docker, Kubernetes, federation, SIEM/evidence, sidecar, CAS/artifact, and packaging surfaces receive their exact release/use-case obligation and deterministic unavailable behavior. Later NeMo, MCP/A2A, Prometheus/OpenTelemetry, general inference/training, and unbuilt industry providers are explicit future records, never silent omissions. - docs/USE_CASES.md + docs/HOST_TOOLS.md + docs/GPU_NODES.md + docs/PYTHON_SUPPORT.md + docs/TEST_PLAN.md — generate or embed the dependency/support-level table and define that executable-Worker proof, provider availability, package presence, mock/dry-run success, and use-case promotion are independent states. Commands: - cargo test -p coh-rtc host_integration - cargo test -p cohesix-worker-evidence - python3 scripts/ci/check_host_integration_inventory.py - python3 -m pytest -q tests/test_host_integration_run.py - scripts/ci/host_integration_run.sh --matrix configs/host_integration_acceptance.toml --matrix-only --state-dir out/host-integration/m26e-matrix - scripts/check-generated.sh - scripts/ci/check_test_plan.sh Checks: Duplicate ids, unknown action/path/schema refs, missing owners, unclassified host binaries/docs/playbooks, circular dependencies, a role-required integration with no live runtime lane, fixture/mock/dry-run satisfying a provider-live row, a release-required surface with no package/evidence rule, a use case promoted with an unsatisfied dependency, a future provider selected as live, secret-bearing evidence, and host/provider readiness interpreted as Worker READY all fail deterministically; the resulting graph assigns every integration gap to exactly one task-owning milestone id that exists in this plan, including the distinct 27c semantic, 27e inference, 28c MCP/A2A, 28b production-bundle, and 27f UI owners, with no ambiguous or compound deferral. Deliverables: One compiler-owned host-integration/use-case dependency graph, exhaustive inventory guard, strict per-row Worker-integration evidence schema, and exact milestone ownership for every dependency needed by fully functional Workers and their documented use cases. Title/ID: m26e-host-worker-integration Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / protocol-faithful host integration for real Workers Goal: Make Cohesix host tools and every mandatory 26e host-integration lane discover, start, observe, correlate, execute, package, and evidence real Heartbeat/GPU/LoRA Workers through existing Secure9P/console projections with one generated state/dependency contract, no new authority plane, and no VM-local GPU/PEFT execution. Inputs: `m26e-production-surface-truth-and-stub-retirement`, `m26e-worker-abi-identity-notifications`, `m26e-worker-image-pipeline-loader`, `m26e-worker-supervisor-child-isolation`, `m26e-host-integration-dependency-contract`, Cargo.toml, configs/root_task*.toml, configs/host_integration_acceptance.toml, crates/worker-task-abi/**, crates/cohsh-core/**, crates/cohesix-rest/**, apps/cohesix-proto/**, apps/nine-door/**, apps/cohsh/**, apps/coh/**, apps/coh-status/**, apps/gpu-bridge-host/**, crates/host-cuda/**, apps/host-ticket-agent/**, apps/host-sidecar-bridge/**, apps/sidecar-bus/**, apps/cas-tool/**, apps/hive-gateway/**, apps/swarmui/**, tools/cohesix-py/**, tools/swarmui-ui-tests/**, tools/coh-rtc/src/**, resources/openapi/hive-gateway.yaml, scripts/cohsh/**, scripts/ci/host_integration_run.sh, scripts/rest_perf_harness.py, tests/test_rest_perf_harness.py, scripts/release_bundle.sh, docs/USE_CASES.md, docs/HOST_TOOLS.md, docs/HOST_API.md, docs/GPU_NODES.md, docs/PYTHON_SUPPORT.md, docs/BENCHMARKS.md, docs/TEST_PLAN.md, docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md, generated Worker image manifests, and the accepted 26e MCS driver/CYW43 coexistence identities by immutable hash/reference only. Changes: - Release host-model Queen-log tail restoration — discovered by `m26e-mcs-smp-target-acceptance` during Conditional E's native three-hive scale comparator. The in-process `cohsh` transport must apply the target's existing 64-record default specifically to `/log/queen.log`; preserve explicit 1..256 line requests, complete CAT reads, and other paths. Fresh native KVM and native model probes provide the independent default-window oracle. Keep every benchmark operation, byte limit, Worker count, timeout, retry rule, error budget and report schema unchanged; preserve the failed 3,000-Worker run. Review all host tools and Python consumers as recorded in HOST_TOOLS. Host-model success remains distinct from live federation/provider and target acceptance. - Release systemd status parsing restoration — discovered by `m26e-mcs-smp-target-acceptance` during Conditional E on native Linux: the compatibility executor flattened successful `systemctl show` property records before the line-based parser, rejecting a valid inactive/dead response. Preserve property line boundaries inside the existing UTF-8-safe 256-byte capture bound; flatten only operator receipt/error summaries. Test actual property framing, byte boundaries and single-line summaries. Provider publication availability and federation success remain separate live gates; do not manufacture target unit entries or treat this parser repair as provider acceptance. Review the complete eight-tool host suite, Python library, generated contracts and benchmark consumers together; only host-ticket-agent parsing and its focused fixtures change, with no interface, workload, retry or threshold change. - Release staged host-test restoration — QEMU `4474dafe4` passed its medium/high pressure workloads but Stage 01 exposed two test-isolation defects. Preserve the documented QEMU Worker-supervisor/GPU-executor refill allocations of 10/10 and Pi allocations of 2/8, assert each exact value and 256-byte SC size, and remove only those two fields from cross-target equality. Isolate all TCP authentication resolver environment inputs in SDK tests and retain the primary-token precedence contract so the authenticated release runner cannot contaminate fallback tests. Runtime, generated manifests, host-tool interfaces, SDK behavior and benchmark workloads remain unchanged; rerun the complete Python gate with the release environment present. - Release pressure proof retention — discovered by `m26e-mcs-smp-target-acceptance` on QEMU `4474dafe4`: 87,683 medium operations and 3,106 successful GPU/LoRA receipts completed, but periodic qlog exports lost the Heartbeat teardown during full-fleet discovery; per-Worker receipt counters also coincided across live slots. Capture target teardown/READY records before dependent discovery and exact receipt/completion records before reusing their Worker lane. Retain original unique fragments within the existing 64 MiB bound, with bounded serialized capture and fatal missing/conflicting evidence. New pressure rows carry the authenticated five-part identity; the collector correlates that identity with target records and preserves strict ambiguity rejection for legacy rows. Runtime, scheduling, raw benchmark thresholds, console/REST, the complete host-tool suite and Python SDK remain unchanged; the benchmark producer, shared host log collector, evidence consumer, focused tests and benchmark contract change together. Preserve the original run and require fresh actual pressure/log correlation before promotion. - Release executable pressure report restoration — discovered by `m26e-mcs-smp-target-acceptance` on exact QEMU source `1e8254be3`: medium pressure completed 1,664 GPU renewals and 1,547 LoRA exports with zero receipt errors, but report validation required a setup-only GPU grant that had left the bounded 256-record window. Require the actual timed GPU renewal and LoRA export actions plus positive timed receipt counts; setup grants alone cannot qualify pressure. Preserve the producer's existing per-receipt timing/read diagnostics and validate their exact optional shape, finite nonnegative timings and positive read counts at the collector boundary. Unknown fields, malformed diagnostics, stale identity, nonmonotonic sequence, unconfirmed receipts and missing target-log correlation still fail. The complete host-tool suite and Python SDK need no protocol or generated-contract changes; both QEMU/Pi report builders, benchmark documentation and deterministic producer/collector tests change together. Preserve the failed canonical run and rerun real target reporting before promotion. - Release-candidate PEFT projection restoration — discovered by `m26e-mcs-smp-target-acceptance`: restore host registry activation/rollback without writing the read-only `/gpu/models/active` view. The CLI publishes the existing validated bridge snapshot; ticket-agent and Python local commits report pending projection. Prepare bounded state before the atomic active-pointer commit and reject interrupted state/pointer disagreement. Apply the existing 32-byte lease-id bound before every version-2 GPU provider operation, preserving the one-round-trip renewal. Repair receipt fixtures to admit valid GPU subjects before provider rejection, deliver expired results to their exact READY Workers, and independently retain fault/teardown/generation tests. Review all host tools, Python, generated contracts and benchmark consumers together; do not relax target policy, receipt outcomes, workload, thresholds or evidence provenance. - Release-candidate integration evidence routing — discovered by `m26e-mcs-smp-target-acceptance` after all nine Worker fault cases and 21 host terminal results passed: decode the authenticated Worker fragment stream and hash its original bytes in host-integration observations. Retain service teardown validation in the existing preflight collector over its three separate exact-boot UART/GDB pairs. Wait for each exact Worker receipt and retain its authenticated log before eviction. Reconcile the target gate with the existing host-ticket mapping: failed and expired results produce Rejected on a live Worker; a late result after retirement is fenced as stale at root and never delivered to the replacement. Preserve all 21 live receipt cases and add seven real agent publication barriers with ordered teardown, fresh same-role READY, exact ticket snapshots and unchanged replacement sequences. After sealing those observations, require fresh confirmed GPU and LoRA receipts on the final live replacements before preflight; retired completions remain ineligible. Correct unattended PTY input ownership and recognize only the exact root shutdown completion following synchronous teardown. The full host-tool suite, Python library, generated contracts and benchmark report consumers require no interface changes; runtime behavior and provenance remain unchanged. - Release benchmark liveness verdict — discovered by `m26e-mcs-smp-target-acceptance` on native KVM: 64 GPU/LoRA receipt failures and root-emergency were hidden by an aggregate error rate below one percent. Preserve numerical metrics and the declared budget, but fail both executable modes on lost Worker receipts or fatal UART status. Review the complete host-tool suite, Python API and benchmark consumers: no transport, provider, generated contract or report schema changes are needed; the command verdict now preserves the existing execution-liveness contract. Retain the failed target for diagnosis before any runtime repair. - Release benchmark passive Heartbeat parity — discovered by `m26e-mcs-smp-target-acceptance` after exact QEMU component preflight passed: align the benchmark acceptance-summary parser with the existing shared Worker evidence contract. A freshly recreated READY Heartbeat may have zero workload completions; GPU and LoRA still require positive completion sequences and confirmed receipts. Reject malformed, negative and Boolean sequences. Independent Heartbeat progress, lifecycle and fault evidence remains mandatory. The complete host-tool suite and Python library already preserve this role distinction; no public protocol, schema, workload, threshold or target-runtime change is required. - Release pressure agent state isolation — discovered by `m26e-mcs-smp-target-acceptance` after component and live preflight passed: execution lane topology and completed ticket cursors must survive the transition into pressure. Use eight lanes from the first receipt-matrix invocation, preserve its completed state as evidence, and resume pressure from a copy of those same cursors and journals. Empty state replays deliberately retired tickets and blocks later live work. Keep the agent's topology mismatch rejection, journal reconciliation and receipt fencing unchanged. Verify both emitted lane configurations and exact state handoff, then rerun the real target transition. The complete host-tool suite, Python library, generated contracts and benchmark schemas need no changes; the canonical harness preserves existing agent restart semantics. - Pi exact-132a W02 host-profile correction — the target correctly publishes worker-15 under shard 0f, but the gateway unconditionally reports the QEMU six-bit profile and makes structured discovery expect 03. Add an explicit generated Worker runtime profile selection, retain the QEMU default and select the existing eight-bit Pi profile for managed Pi benchmark gateways. Preserve the shard algorithm, namespace, bounds response shape, authentication, broker/pool limits, workload, readiness predicates and evidence classes. Focused CLI/default/profile bounds and managed-launch tests must cover both targets; actual Pi discovery and pressure remain physical evidence. - Cargo.toml + crates/cohesix-worker-evidence/** — add a host-only bounded parser/validator shared by Rust host consumers. It represents transport/action outcome separately from declaration (`model-only` or `executable`), lifecycle (`absent`, `queued`, `starting`, `ready`, `closing`, `faulted`, or `terminal`), artifact (`missing`, `verified`, or `mismatch`), receipt (`none`, `pending`, `confirmed`, `rejected`, or `stale`), integration obligation/observed mode, and execution proof (`none`, `host-model`, `qemu`, or `fresh-pi`). It validates record kind and its required/forbidden field matrix, role, public instance id, slot, logical lease epoch, supervisor generation, cap generation, receipt sequence, ABI/schema version, target class, dependency-graph and Worker-integration record hashes, kernel/root/driver/CYW43/Worker archive/image-manifest/image hashes, record bounds, duplicate identity, and stale generation without exposing raw badges, CPtrs, capability values, or secrets. Worker-runtime release eligibility is derived separately from artifact state plus satisfied role/release compatibility rows and the matching QEMU/Pi component, root-TCB, and full-system acceptance graph; a missing or mismatched kind/hash/schema/target/evidence layer is a typed failure, never a downgraded proof class, and this release status never implies production use-case acceptance. - apps/cohesix-proto/src/lib.rs — provide stable canonical role labels, strict parse/round-trip behavior, and `ALL_ROLES`; preserve `Role::Worker` compatibility as canonical `worker-heartbeat`. WorkerBus recognition never implies executability, and profile-dependent declaration/lifecycle/receipt/proof state does not enter this protocol-label crate. - tools/coh-rtc/src/** + generated clients/docs — generate the executable-role matrix, host-integration dependency graph, Worker ABI/evidence schema versions, maximum live tasks, canonical sharded telemetry template, legacy-alias gate, lifecycle vocabulary, receipt bounds, archive identity, and proof vocabulary from the selected profile. Rust, Python, REST, and UI consumers use the same generated JSON schemas and conformance vectors; direct-TCP local manifests remain expectations, while remote declarations come from bounded remote metadata and proof comes only from hash-matched Worker plus per-row Worker-integration evidence. - crates/cohsh-core/** + apps/cohsh/** + scripts/cohsh/** — support `lora`/`worker-lora` in the existing spawn/kill flow through `/queen/ctl`, keep WorkerBus target spawn deterministically rejected as model-only, discover canonical sharded Worker paths, render queued/starting/ready/closing/faulted/terminal separately, and never treat a successful control write as READY. Ticket mint/attach for WorkerBus remains session/model authority and never task-creation proof; help, generated grammar, transcripts, and ACK/ERR/END fixtures land together. - apps/coh/** — preserve existing GPU/PEFT transport or host-action `status` meanings and add independent declaration, lifecycle, artifact, receipt, and proof fields. Connected receipt-bearing GPU lease and PEFT flows explicitly select or spawn the matching WorkerGpu/WorkerLora, wait for READY within the generated bound, submit the strict version-2 record on the existing host-ticket path, and correlate grant/renew/release or export/import/activate/rollback terminal results with bounded Worker receipt ids and canonical telemetry paths. Direct/local flows remain host-only; a successful write advances only to queued/request-admitted, never READY or target-accepted. - apps/root-task/src/ninedoor.rs + apps/host-ticket-agent/src/{claim,lib,main,status,wal}.rs — make root's existing `spec.snapshot` the canonical enriched version-2 admitted projection and forbid execution from raw request bytes. Add the local single-agent lock/fence and crash-safe version-2 `prepared -> executing -> provider-result-persisted -> result-published -> terminal/cursor` journal for exactly the seven receipt-bearing GPU/PEFT actions, with action-specific observe/reconcile recovery. Separate v2 Worker lifecycle from GPU lease lifecycle so grant/renew/release never implicitly spawn/kill the receipt Worker and release/preempt result delivery precedes any independent teardown. Preserve version-1 behavior as a separately classified compatibility input; do not claim its general provider/federation durability is repaired here. - apps/host-ticket-agent/src/** + provider executor helpers — replace every byte-indexed `str[..N]` output/error truncation touched by the v2 path with a shared UTF-8-boundary-safe bounded encoder; add multibyte, exact-boundary, oversized, provider-error, journal-recovery, and receipt-output tests so untrusted non-ASCII text cannot panic the agent or an executor. - apps/coh/src/evidence.rs + apps/coh/src/evidence_timeline.rs — discover generated canonical paths; validate Worker image identity, lifecycle, receipts, integration obligations/observed modes, and exact-target evidence; emit `cohesix-worker-observation/v1` for live/host-model observations and import but never synthesize the distinct worker-integration, target-component, root-TCB, full-system, or release records; and keep host, host-model, integration, QEMU, fresh-Pi, runtime-release, production-use-case, GPU, PEFT, provider, and CYW43 evidence separate. Missing or mismatched target or required integration evidence produces no proof and a typed blocker, never a degraded PASS. - crates/host-cuda/** + apps/gpu-bridge-host/** — retain deterministic NVML-to-CUDA discovery/fallback and publish the existing GPU/model/LoRA snapshots with bounded generated operation, lease, model, and exact version-2 WorkerGpu receipt correlation when a receipt-bearing lease action names one. Classify mock/demo catalogs as `host-model`, zero-device/unavailable probes explicitly, and real NVML/CUDA inventory as provider `live`; a missing, malformed, unsafe, or unreadable live model registry yields explicit empty/unavailable state and never falls back to the demo catalog or implicitly activates the first model. Live TCP/REST publication resolves a non-placeholder secret reference before connection. The 26e role gate injects bounded provider results to prove all three result-to-Worker paths but does not promote inventory, publication, or a fixture result into GPU execution/device-isolation proof. Keep CUDA, NVML, model registry, adapter bytes, training, activation, and inference host-side; never call an internal Worker endpoint, derive READY from bridge publication, grant hardware caps, or imply that receipt-only WorkerGpu performs GPU work. Milestone 27b owns live GPU provider/executor conformance. - apps/coh/src/peft/** + apps/host-ticket-agent/** — add `peft.export` through the existing bounded `coh` export helper and generated action allowlist; consume only root-admitted, exact-READY-Worker-pinned, local-hive version-2 records for all three GPU lease and all four PEFT actions; and produce the canonical immutable result digest. Make the local version-2 executor safe enough to prove every receipt path: confine canonical registry/export paths, reject symlinks/traversal, lock per registry/active pointer, use unique bounded temporary files with file/directory sync plus atomic rename where supported, preserve the prior active pointer until commit, record recoverable partial host/VM publish state, and verify adapter/manifest/base-model/job hashes before import or activation. Distinguish host action completion, VM request admission, Worker READY, Worker receipt confirmation/rejection/stale state, timeout, terminal fault, artifact identity, and target proof while preserving version-1 uncorrelated/federated action-result semantics. Executors use only the root-admitted canonical record, existing console/Secure9P paths, the v2 pre-execution journal, and bounded observation; disconnected/local direct work stays explicitly host-only and never synthesizes a Worker receipt. These fixture/local transaction tests do not provide the production PEFT registry, training, evaluation, scanning, runtime-reload, or provenance acceptance owned by Milestone 27d. - apps/coh/src/mount.rs + generated `coh.mount` policy + release packaging/tests — add canonical sharded Worker roots and bounded dynamic Worker entries to the FUSE allowlist instead of relying on the legacy `/worker` root; run real direct-console and REST-backed Worker telemetry/receipt append/read/unmount/cleanup smokes through FUSE 3 on supported Linux packages and MacFUSE on advertised macOS packages. Resolve the current REST-backed write `EINVAL` limitation without broadening append-only offsets or target policy. Verify generated mount allowlists, dynamic telemetry bounds, request-auth, one-gateway-mount locking, disconnect behavior, and no generic POSIX create/rename/delete semantics; `--mock`, mount-directory creation, or library presence alone is not FUSE acceptance and a mount never supplies Worker readiness. - apps/host-sidecar-bridge/** + apps/host-ticket-agent/src/executors/{systemd,docker,k8s}.rs + tools/cohesix-py/cohesix/integrations.py — preserve current schemas/actions and prove they do not drift or masquerade as Worker state while the dependency matrix classifies them as current primitives/integration patterns. Mock, probe, or basic command-adapter success cannot promote an action-airlock, self-healing, Kubernetes, systemd, or Docker use case. Milestones 27a/27b own delegated identity, writer fencing, disposable live-safe and negative fixtures, full provider/version conformance, rollback/fail-safe policy, and installable production deployment profiles; 26e must name those blockers rather than silently substituting mock data. - host federation, SIEM/evidence, CAS/artifact, sidecar, and release surfaces — attach every shipped surface to its generated obligation and evidence lane. Preserve version-1 federation/fleet compatibility tests while classifying current action-completion as non-promotable until the later owner proves true pre-forward write-ahead persistence, enforced relay timeout, no pending-entry eviction, source-visible terminal receipt correlation, live metrics, and writer fencing; reject version-2 Worker receipt relay outright in 26e. Prove SIEM and evidence output is bounded/redacted/reconstructable, hash CAS/model refs without packaging payload secrets, and prove sidecar/provider readiness cannot parse as Worker READY. Optional or future integrations produce explicit unavailable/future records. - apps/hive-gateway/** + crates/cohesix-rest/** + resources/openapi/hive-gateway.yaml — add optional declaration-only `WorkerRuntimeBounds` to the existing bounds response: role matrix, ABI/schema version, maximum live tasks, canonical telemetry template, and legacy-alias gate. Absence means `unknown`, never model-only. Add optional gateway `backend_class` (`host-model`, `console-projection`, or `unknown`) to status; even `console-projection` proves no target class. Add an explicit bounded `--worker-acceptance-evidence `/generated-config import for a local evidence record or release-bundle acceptance file: require a size-bounded canonical regular file under the explicit operator/release root with no symlink traversal, validate its `record_kind`, complete hashes, target, and schema through `cohesix-worker-evidence`, then expose only a redacted optional `worker_acceptance` summary on the existing status response. Absence or validation failure yields no proof and a typed diagnostic. Live lifecycle/receipts stay on existing LS/CAT/TAIL namespace projections. Add canonical `/shard` post-control cache invalidation and backward-compatible absence tests; add no Worker REST action, direct Worker RPC, authority-bearing route, or optimistic success state. - apps/swarmui/** + tools/swarmui-ui-tests/** — stop inferring Worker roles from id prefixes or defaulting generic `worker-*` ids to Heartbeat. Render declaration, lifecycle, receipt, artifact, and proof separately from structured generated data; consume proof only from the gateway's shared-validator-backed optional `worker_acceptance` summary; version and migrate older model-only replay/snapshot fixtures so absent fields never default to READY; keep unrelated workbench redesign in Milestone 27f. - tools/coh-rtc/src/codegen/cohesix_py.rs + tools/cohesix-py/cohesix/generated.py — generate Worker declarations, ABI/host-ticket/evidence schema versions, maximum live tasks, sharding data, receipt bounds, and `/shard` mount permission. Add a typed bounded `cohesix/worker.py`; add existing-path `worker_spawn`, `worker_observe`, and bounded `worker_wait` APIs for Heartbeat/GPU/LoRA; reject WorkerBus spawn; and retain existing GPU lease entrypoints as compatibility wrappers over the same generated control and ticket projections. - tools/cohesix-py/cohesix/client.py + receipts.py + evidence.py — add grant/renew/release WorkerGpu and export/import/activate/rollback WorkerLora receipt consumers that explicitly bind a READY Worker through the existing host-ticket path while keeping `execution_location=host`; wait for and validate the root-admitted request, lease/Worker identity, terminal provider result, canonical result digest, Worker receipt, target manifest/image identity, and evidence reference. A successful append, local ACK, subprocess exit, local argument summary, unknown manifest, or `/proc` snapshot may be recorded only as a client transcript/observation and is never named or serialized as the authoritative receipt. Never invent or rebind a VM receipt when disconnected or after Worker teardown. - tools/cohesix-py/cohesix/backends.py + orchestration.py + playbooks.py + tests/examples/docs — classify MockBackend as `host-model`, REST from gateway `backend_class`, and TCP/filesystem as projection/unknown; model Heartbeat/GPU/LoRA lifecycle/receipts and reject WorkerBus in mocks; keep high-count playbooks explicitly control-model rather than task-creation proof; expose the typed API and host-only PEFT boundary. - apps/nine-door/src/host/** + Hive Gateway mock — mirror the generated Heartbeat/GPU/LoRA grammar and structured lifecycle/receipt records for compatibility tests, reject WorkerBus spawn, and mark every mock Worker `host-model`. Generic provider records such as `/host/... state=ready` cannot parse as Worker READY and mocks claim no image/task/MCS/fault/QEMU/Pi execution. - apps/host-sidecar-bridge/** + apps/sidecar-bus/** — keep provider/link readiness and WorkerBus session/model state independent of executable Worker lifecycle. These are regression-only surfaces in 26e: add no task-creation path, and prove their `ready`/linked/provider records cannot parse as Worker READY or target proof. - apps/coh-status/src/lib.rs + read-only tests — keep 26e to the existing library/replay surface: consume the shared Worker validator and generated canonical paths, replace the current generic `/queen/ctl`/legacy-`/worker` transcript with read-only canonical `/shard` and evidence fixtures, and prove no authority command or inferred proof exists. Do not add or claim a live `coh-status` binary here; Milestone 30 owns that standalone read-only CLI. - scripts/rest_perf_harness.py + tests/test_rest_perf_harness.py — add explicit `host-model` and `executable` population modes. Synthetic high-count workloads remain host-model; executable mode obeys generated `max_live_tasks`, discovers real structured READY instances through canonical `/shard` paths, forbids synthetic id expansion, records requested/discovered/READY populations plus backend/proof class, and calls a control write `admitted` rather than `accepted`. Starting QEMU alone never yields QEMU proof. - scripts/cohesix-build-run.sh + scripts/ci/host_integration_run.sh + scripts/release_bundle.sh — add `host-ticket-agent` and every selected-profile host tool explicitly to source-build/staging lists; execute selected target-session dependency rows and emit strict Worker-integration records; add verification-only `--verify-worker-acceptance`, Worker QEMU/Pi component, root-TCB QEMU/Pi, and full-system QEMU/Pi evidence inputs. Generate an exact named host-tool/image/evidence manifest and require externally supplied host-tool directories to match it; a missing required binary, Worker image, schema, or evidence file fails rather than being silently skipped or accepted because the directory is non-empty. Hash-validate the dependency graph and every role/release-required integration record plus `cohesix-worker-images.cpio`, its image manifest, ABI versions, MCS driver archive/manifest, CYW43 coexistence record, and every target acceptance input for selected executable 26e profiles. The release manifest selects the complete canonical Pi 4 SD stage by an exact compiler-owned file list, validates the sealed primary/fallback image identity against the current source commit, and rejects omitted, extra, linked, or stale stage files. Linux release production requires an argument-selected remote ARM64 builder, a source-bound exact host-tool provenance manifest, and remote creation plus local byte verification of the final tarball. Packaging alone yields artifact `verified` and execution proof `none`; it may report Worker-runtime release eligibility only after the matching integration/component/root/system graph exists, and it cannot emit the final release-accepted record before `m26e-mcs-smp-target-acceptance` or copy stale evidence onto a different host profile, provider, kernel, root image, driver archive, Worker archive, manifest, dependency graph, or CYW43 record. - canonical host/Worker/PEFT/interface/release docs and fixtures — document the shared state axes, existing-authority projections, host-only GPU/PEFT boundary, canonical sharded paths, evidence promotion, replay migration, and release requirements. No CYW43/SDIO timing, state-machine, restart, packaging, image-build, trace-normalization, or proof-classification file may be edited; this task consumes only its frozen artifact identity. Commands: - cargo test -p cohesix-worker-evidence - cargo test -p nine-door -p coh-status - cargo test -p cohsh-core -p cohsh - cargo test -p host-cuda - cargo test -p coh --features fuse,nvml - cargo test -p gpu-bridge-host -p host-ticket-agent -p hive-gateway -p cohesix-rest - cargo test -p host-sidecar-bridge -p sidecar-bus - cargo test -p cohesix-proto - cargo check -p swarmui --bin swarmui - cargo test -p swarmui --tests - python3 scripts/ci/check_swarmui_dependencies.py - npm --prefix tools/swarmui-ui-tests test - python3 -m pytest -q tools/cohesix-py/tests - python3 -m pytest -q tests/test_rest_perf_harness.py tests/test_release_bundle.py tests/test_worker_task_evidence.py tests/test_worker_image_pipeline.py - scripts/cohsh/run_regression_batch.sh - cargo test -p coh-rtc - scripts/ci/host_integration_run.sh --matrix configs/host_integration_acceptance.toml --mode live --target qemu --target-session out/m26e-qemu/target-session.json --observations out/m26e-qemu/host-integration-observations.json --state-dir out/host-integration/m26e-qemu - scripts/ci/host_integration_run.sh --matrix configs/host_integration_acceptance.toml --mode live --target pi4 --target-session out/m26e-pi4/target-session.json --observations out/m26e-pi4/host-integration-observations.json --state-dir out/host-integration/m26e-pi4 - scripts/check-generated.sh Checks: Heartbeat/GPU/LoRA use the existing spawn, kill, namespace, console, policy, and ticket paths, while WorkerBus target spawn returns an existing-form deterministic model-only error; every host surface agrees on role, public instance id, slot, epoch, supervisor generation, cap generation, lifecycle, receipt, artifact, integration obligation/observed mode, execution proof, and separately derived runtime-release versus production-use-case state; control ACK proves only admission, `implemented = true` only executable declaration, READY only live runtime state, host-model only modelling, and QEMU/fresh-Pi proof only matching evidence; absent REST bounds mean unknown and gateway connection/QEMU launch never imply proof; generic ids are never inferred to be Heartbeat; GPU lease ACTIVE, bridge publication, ticket success, PEFT completion, FUSE mount, provider `ready`, package presence, or mocks cannot independently promote READY or target proof; connected GPU grant/renew/release and PEFT export/import/activate/rollback fixtures obtain the exact bounded WorkerGpu/WorkerLora confirmed/rejected/stale receipts without moving host hardware/registry/training/inference authority; mandatory live `worker-control`, `gpu-receipt-path`, and `peft-receipt-path` target-session rows pass, while every advertised FUSE/systemd/Docker/Kubernetes/federation/SIEM/CAS/sidecar/release/provider surface records its exact current mode and later blocker rather than being promoted by compatibility; canonical `/shard` invalidation, sharding, version-1/version-2 accepted-schema matrices, local-only v2 rejection, root-pinned admitted projections, crash-safe v2 journal recovery, replay retention on existing host-ticket status/deadletter paths, validated gateway evidence-file import, SwarmUI proof sourcing, and ACK/ERR/END fixtures pass; absent, wrong-kind, stale, forged, duplicate, late, oversized, wrong-role, wrong-generation, wrong-host-profile, wrong-provider-mode, wrong-target, wrong-ABI, hash-mismatched, mode-substituted, and secret-bearing records fail deterministically; release artifacts expose no ticket, host secret, raw badge, CPtr, or capability value; no CYW43 behavioral contract or evidence classification changes. Deliverables: One generated protocol-faithful host Worker state/dependency contract; target-session per-row Worker-integration evidence; LoRA support across all four Cohesix PEFT receipt actions and Rust/Python/REST/UI compatibility projections; exact GPU/PEFT result-to-Worker correlation; canonical FUSE `/shard` compatibility; crash-safe local v2 execution; honest current modes for every shipped/future host surface; hash-bound Worker-runtime release inputs; and host tools ready for the separate exact QEMU/fresh-Pi promotion gate without claiming production provider/use-case completion. Title/ID: m26e-python-library-as-built-compatibility Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / Python SDK as-built compatibility gate Goal: Verify and, where required, correct the non-authoritative `cohesix` Python package against the freeze-bound 26e generated Worker, integration, receipt, evidence, namespace, and backend contracts without creating a second protocol or authority path. Inputs: `m26e-host-worker-integration`, configs/sel4/profiles.toml, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, tools/coh-rtc/src/codegen/cohesix_py.rs, configs/generated/**, generated Worker/integration schemas and conformance vectors, tools/cohesix-py/pyproject.toml, tools/cohesix-py/cohesix/**, tools/cohesix-py/tests/**, resources/openapi/hive-gateway.yaml, configs/host_integration_acceptance.toml, scripts/ci/host_integration_run.sh, scripts/release_bundle.sh, docs/PYTHON_SUPPORT.md, docs/HOST_API.md, docs/INTERFACES.md, and the accepted QEMU/Pi `worker-control`, `gpu-receipt-path`, and `peft-receipt-path` integration records. Changes: - tools/coh-rtc/src/codegen/cohesix_py.rs + tools/cohesix-py/cohesix/generated.py + configs/generated/cohesix_python_{qemu_smp_production,pi4_production}.json + scripts/check-generated.sh + tools/cohesix-py/tests/test_generated_contract.py — keep the wheel's generated module target-neutral and emit a versioned target-qualified `cohesix-python-profile/v1` contract for each selected resolved manifest. The profile contract, not a universal wheel constant, binds manifest hash, canonical role labels, executable-role matrix, Worker ABI/host-ticket/evidence schema versions, `/shard` paths and legacy-alias gate, lifecycle/receipt/proof vocabularies, operation and byte bounds, maximum live tasks, and host-integration modes. Extend the generated-artifact guard to resolve `configs/root_task.toml` through `qemu_smp_production` and `configs/root_task_pi4_uboot_aarch64.toml` through `pi4_production` into isolated temporary outputs, then byte-compare both committed target contracts in addition to the target-neutral default output; no target contract may be hand-edited or inferred from the other target. Static defaults are bounded fallback expectations only and cannot establish live target identity or proof; stale, hand-maintained, missing, one-sided, or mismatched contracts fail generated drift checks. - tools/cohesix-py/cohesix/{backends.py,client.py,worker.py,receipts.py,evidence.py,orchestration.py,playbooks.py} + focused tests — load an explicit target-qualified contract or bounded remote metadata for live use and verify Mock, filesystem, TCP, and REST behavior against the same fixtures. Cover Heartbeat/GPU/LoRA spawn, observe, wait, receipt, teardown, and stale-generation behavior; deterministic WorkerBus spawn refusal; canonical sharding; optional REST bounds and backend-class absence as `unknown`; version-1 compatibility versus local-only version-2 Worker receipts; all three GPU and four PEFT actions; and strict separation of request admission, READY, provider completion, Worker receipt, artifact verification, QEMU/Pi proof, runtime-release acceptance, and production-use-case acceptance. - scripts/ci/python_compat_run.sh + configs/host_integration_acceptance.toml — add a bounded `python-sdk-projection` release-required lane that runs the Python client through the existing target-session integration fixtures for QEMU and Pi and emits the existing `cohesix-worker-integration-evidence/v1` record. Package/backend conformance covers the minimum supported Python 3.11 and canonical macOS release-host Python 3.13; each target-session record names the exact interpreter/platform, shared wheel hash, and matching target-qualified profile-contract hash. The lane may consume but never replace the direct target role-required records, and it cannot promote external CUDA/NVML, PEFT, FUSE, systemd, Docker, Kubernetes, federation, or other provider modes. - tools/cohesix-py packaging/tests + scripts/release_bundle.sh — install and import the core package and declared `integrations`, `ml`, and `dev` extras on the Python 3.11/3.13 host matrix, build one target-neutral wheel, install that wheel into an isolated environment for import/public-entrypoint smoke, and emit an exact package manifest containing the wheel and QEMU/Pi profile-contract hashes. `dev` remains test-only and is excluded from deployed requirements; missing optional runtimes return typed unavailable rather than silently selecting mocks. - docs/PYTHON_SUPPORT.md + tools/cohesix-py/README.md + docs/TEST_PLAN.md — document the 26e Worker APIs, target-neutral wheel/profile-contract model, as-built proof boundaries, supported backend matrix, compatibility/migration rules, and the distinction between Python projection compatibility and target or provider acceptance. Commands: - python3 -m pip install -e 'tools/cohesix-py[integrations,ml,dev]' - python3 -m pip check - python3 -m pytest -q tools/cohesix-py/tests - python3 -m pip wheel --no-deps --wheel-dir out/python-wheels tools/cohesix-py - scripts/ci/python_compat_run.sh --wheel-smoke --wheel-dir out/python-wheels --package-manifest out/python-compat/m26e-python-package.json --state-dir out/python-compat/m26e-wheel - scripts/ci/python_compat_run.sh --python-matrix 3.11,3.13 --target qemu --profile-contract configs/generated/cohesix_python_qemu_smp_production.json --package-manifest out/python-compat/m26e-python-package.json --wheel-dir out/python-wheels --matrix configs/host_integration_acceptance.toml --target-session out/host-integration/m26e-qemu/integration/worker-control.json --state-dir out/python-compat/m26e-qemu - scripts/ci/python_compat_run.sh --python-matrix 3.11,3.13 --target pi4 --profile-contract configs/generated/cohesix_python_pi4_production.json --package-manifest out/python-compat/m26e-python-package.json --wheel-dir out/python-wheels --matrix configs/host_integration_acceptance.toml --target-session out/host-integration/m26e-pi4/integration/worker-control.json --state-dir out/python-compat/m26e-pi4 - scripts/check-generated.sh Checks: The same isolated-wheel smoke and public API pass on Python 3.11 and 3.13; each target-qualified contract matches its selected resolved manifest byte-for-byte where specified, while the shared wheel remains target-neutral; all supported backends preserve ACK/ERR/END, bounds, canonical paths, role identity, lifecycle, receipt, and evidence semantics; existing public compatibility wrappers remain valid or receive an explicit versioned migration; malformed, oversized, absent, unknown, wrong-version, wrong-role, stale-generation, wrong-target, wrong-contract, hash-mismatched, client-authored, and secret-bearing inputs fail deterministically; static fallback defaults and mocks remain non-proof `host-model`; no Python ACK, local file, subprocess result, provider state, or JSON object can become READY, an authoritative receipt, target proof, runtime release acceptance, or production-use-case evidence; QEMU/Pi Python rows bind the same wheel to their respective generated profile contract and target-session records but remain projection evidence only. Deliverables: One clean target-neutral wheel and exact package manifest, generated QEMU/Pi profile contracts, backend conformance tests, separate QEMU/Pi `python-sdk-projection` records, and release gating that proves the shipped Python SDK matches each 26e as-built target without widening Cohesix authority. Title/ID: m26e-worker-target-evidence-promotion Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / exact QEMU and Pi Worker acceptance Goal: Emit separate QEMU-accepted and Pi-accepted component records for the three configured executable roles only after exact-image evidence proves real IPC, faults, complete teardown, and fresh-generation recreation; do not promote release acceptance yet. Inputs: all preceding 26e target-runtime Worker tasks through `m26e-host-worker-integration`, matching live `worker-control`, `gpu-receipt-path`, and `peft-receipt-path` Worker-integration records for each target, selected QEMU/Pi SMP+MCS builds and manifests, positive exact-image CYW43 closure plus the matching 26e MCS-driver coexistence record, scripts/ci/test_plan_run.sh, scripts/pi4_gate_proof.sh, exact image identities, docs/TEST_PLAN.md, canonical Worker/security/interface docs. The adjacent `m26e-python-library-as-built-compatibility` task must finish any Python-only codegen/package corrections before the shared artifact freeze, but its PASS/FAIL record is not target-component evidence and cannot substitute for or alter this gate. Changes: - scripts/worker_task_evidence.py + scripts/m26e_qemu_pressure.sh + tests/test_worker_task_evidence.py — replace the pressure runner's inline target-session synthesis with the standalone `emit-qemu-target-session` command. It accepts only the repository root, verified QEMU output, resolved manifest, generated topology, and a new output directory; validates the immutable launch record and exact launch/Worker/driver/archive bytes, stable git-visible source inventory, Worker ABI identity, and topology-to-manifest parity; derives the QEMU CYW43 not-applicable binding and current exact target-session schema without caller-supplied hashes; and publishes each artifact atomically without overwriting an existing session directory. - scripts/pi4_gate_proof.sh + scripts/worker_task_evidence.py + scripts/rest_perf_harness.py + focused tests — capture one fresh Wi-Fi boot's serial and packets concurrently, emit a positive CYW43 v2 record only after the exact live gate passes, and finalize those immutable bytes into a canonical Pi target-session bundle. The finalizer independently validates the clean v5 stage/image graph, generated topology, source and Worker ABI identities, archives/manifests, latest boot marker, live outcomes, and controlled pcap before exclusive publication. A later same-image GENET boot supplies its own current runtime/pcap; qualified performance freezes and revalidates every input, binds the exact session/topology/Worker manifest to the live census and role exemplars, and cannot turn build, stage, offline, stale, caller-authored, or QEMU evidence into Pi proof. The separately collected Pi Worker component remains a full-milestone acceptance prerequisite and is neither consumed nor claimed by this performance lane. - scripts/worker_task_evidence.py + tests/test_worker_task_evidence.py + docs/TEST_PLAN.md — create the emitter/validator and tamper/mode/hash/target tests for `cohesix-worker-task-evidence/v1` with `record_kind=target-component`, exactly one proof target/class, a sorted bounded list of the three exact live role-required Worker-integration records, source/resolved-manifest/kernel/root/MCS-driver-archive/MCS-driver-manifest/CYW43-coexistence-record/Worker-archive/Worker-image-manifest/Worker-image hashes, one detailed live Heartbeat/GPU/LoRA exemplar, the exact topology digest and complete compiler-declared temporal-task/fault-registry seal for the aggregate 256-Worker population, role/slot/epoch/supervisor-generation/cap-generation/badge/core/SC/object inventories, bounded event outcomes, raw-artifact hashes, PASS/FAIL, and blockers. The generic evidence-list bound remains unchanged; only the topology-derived list may exceed it, and any count, order, identity, role-class, driver, service, critical-TCB, or registry drift fails closed. - QEMU target gate — prove all three mandatory roles through the direct target authority/observation path, including Heartbeat progress, fixture-backed but live root-to-Worker GPU grant/renew/release and LoRA export/import/activate/rollback confirmed/rejected receipts for success, failure and expiry, plus stale root disposition after each action's pinned Worker retires before the result arrives; also prove two sequential same-role generations, simultaneous second-live-slot and maximum-slot refusal, bounded control/receipt paths, combined notifications, durable-completion publish/signal ordering, budget exhaustion/timeout attribution, fault before READY/during IPC, forbidden-blocking-send refusal, stale-record revocation, no post-revoke activity/leak, and fresh generation under four-core SMP+MCS. Rust/Python/REST/UI/FUSE compatibility records are separate projections and cannot raise or block this runtime claim unless an explicit release profile independently requires them. - fresh Pi target gate — prove the identical direct runtime and receipt-path matrix on the exact flashed/booted image while preserving serial, local-seat, TCP, fatal, driver, and Queen liveness; require positive exact-image CYW43 closure plus the matching MCS coexistence record by immutable artifact/hash without merging proof classes. An accepted CYW43 blocker cannot produce Pi component PASS, and no host integration record can substitute for Pi execution. - generated/docs gate — publish only separate QEMU/Pi component acceptance records and update as-built role wording only when the selected exact hashes pass; missing target evidence cannot degrade to host/model PASS, and this task cannot emit `release-accepted`. Commands: - python3 scripts/worker_task_evidence.py emit-qemu-target-session --repo-root . --qemu-out out/cohesix --resolved-manifest configs/generated/root_task_resolved.json --topology configs/generated/root_task_topology.json --out-dir out/m26e-qemu/session - scripts/pi4_gate_proof.sh --skip-build --serial-device "$PI_SERIAL_DEVICE" --log "$PI_WIFI_SERIAL_LOG" --require-wifi-ready --require-driver-task-proof --network-interface "$PI_CAPTURE_INTERFACE" --network-capture-out "$PI_WIFI_NETWORK_CAPTURE" --gateway-status-url "$COH_REST_URL" --gateway-target-host "$PI_WIFI_TARGET_IP" --runtime-dma-proof-out "$PI_WIFI_RUNTIME_DMA_PROOF" --cyw43-coexistence-record-out "$PI_WIFI_CYW43_RECORD" - python3 scripts/worker_task_evidence.py emit-pi4-target-session --repo-root . --runtime-proof "$PI_WIFI_RUNTIME_DMA_PROOF" --cyw43-coexistence-record "$PI_WIFI_CYW43_RECORD" --max-age-secs 21600 --out-dir "$PI_SESSION_DIR" - python3 scripts/worker_task_evidence.py collect-pi4-component --target-session "$PI_SESSION_DIR/target-session.json" --generated-inventory out/pi4-sd/cohesix-root-task-topology.json --runtime-proof "$PI_RUNTIME_DMA_PROOF" --network-capture "$PI_NETWORK_CAPTURE" --transport genet --integration-dir "$PI_INTEGRATION_DIR" --max-age-secs 21600 --out-dir "$PI_COMPONENT_DIR" - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-worker-qemu - python3 scripts/worker_task_evidence.py validate --target qemu --evidence out/test-plan/m26e-worker-qemu/worker-task-evidence.json - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-worker-pi4 - python3 scripts/worker_task_evidence.py validate --target pi4 --evidence out/test-plan/m26e-worker-pi4/worker-task-evidence.json - scripts/check-generated.sh Checks: The QEMU session emitter refuses stale launch bytes, manifest/topology drift, malformed Worker/driver archives, aliases, source drift, unignored repository output, and any existing output directory before target execution; it derives every digest from exact bytes and emits only the current source-inventory, Worker-ABI, QEMU-CYW43, and target-session records. The complete topology/fault-registry seal covers all 256 Worker tasks plus the generated non-Worker tasks while the component retains only the three bounded live role exemplars; neither layer substitutes for the other. Heartbeat/GPU/LoRA each reach READY and complete their exact role contract on both exact targets through direct `cohsh` control/observation, root-admitted host-ticket v2 records, the host-ticket agent's crash-safe local receipt path, and the shared evidence validator; GPU grant/renew/release and PEFT export/import/activate/rollback receipt fixtures correlate with the complete root-resolved Worker identity/result digests without moving host execution or proving the external provider; confirmed/rejected live receipts and stale root fencing/replay behavior are deterministic across teardown; fault/timeout/revoke identity is unambiguous; combined notification, durable completion, stale-generation, and no-blocking-send tests pass; complete teardown leaves zero caps/mappings/pending records/signals/Replies/SCs/execution; recreation uses a fresh supervisor generation; operator and MCS-driver liveness hold; WorkerBus remains model-only; configured, queued, READY, host-model, projection compatibility, QEMU-only, or Pi-only state cannot satisfy runtime release acceptance, and runtime release acceptance cannot satisfy a production use-case row. Deliverables: Separate exact QEMU and fresh-Pi Worker component evidence/acceptance records closing the Milestone 26d general-Worker execution-truth gap without premature release promotion. Title/ID: m26e-root-tcb-target-proof Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / target containment and regression proof Goal: Prove the ordered service/Worker split reduces root authority and preserves deterministic QEMU/Pi behavior under normal, pressure, and injected-fault conditions. Inputs: `m26e-worker-target-evidence-promotion`, selected generated profiles and images, scripts/ci/test_plan_run.sh, scripts/rest_perf_harness.py, docs/TEST_PLAN.md, docs/BENCHMARKS.md, docs/audit/M26D_ROOT_TCB_BOUNDARY_AUDIT.md. Changes: - Production manifest and paired-kernel capacity parity (2026-09-08): refresh only `seL4/build_UBOOT` from the pinned external seL4 16 production profile, retaining its default immutable Pi image input. Align QEMU/Pi enabled production features and common scheduling policies at the existing safe 256-Worker execution capacity and maximum 8-bit sharding. Preserve selected kernel SC object sizes, hardware driver topology, measured WCET envelopes, memory accounting and fault/operator reserves. Document every remaining target difference and guard common feature/resource parity. This authorizes the manifest/kernel compatibility repair; it does not expand execution counts beyond admitted inventories or substitute static/QEMU proof for Pi. - root-task/service/Worker tests — add critical-TCB reserve, cap-inventory, W^X, IPC-bound, wrong-badge, notification-coalescence, stale-frame, fault-injection, complete teardown, fresh-generation recreation, shutdown, replay, cancellation, and pressure coverage for every split child. - scripts/ci/test_plan_run.sh + docs/TEST_PLAN.md — add separate host/model, QEMU execution, fresh Pi execution, operator-liveness, and fault-containment gates; emit separate `cohesix-root-tcb-acceptance/v1` QEMU/Pi records with `record_kind=root-tcb`, exactly one target, and bindings to the exact kernel, root, MCS driver archive/manifest, CYW43 coexistence record, Worker archive/image manifest/images, generated topology, raw evidence hashes, and observed critical-TCB/cap/SC/Reply inventories. - docs/BENCHMARKS.md + evidence packs — archive before/after TCB inventory, authority matrices, latency, pressure, and same-harness QEMU/Pi results with atomic change-set and pre-change baseline identity. Commands: - cargo fmt --all -- --check - cargo clippy --workspace --all-targets -- -D warnings - cargo check --workspace - cargo test --workspace -- --test-threads=1 - scripts/check-generated.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-root-tcb-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-root-tcb-pi4 - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26e-root-tcb-qemu Checks: generated and observed cap/SC/Reply inventories agree; root-control, root-fault, root-emergency, root-worker-supervisor, root-driver-supervisor, root-worker-executor-gpu, and root-worker-executor-lora each retain independent admitted progress; each child runs in the selected image, contains injected faults/timeouts, completes its 26e teardown/containment, loses stale authority, returns or revokes any service-only donated time, and cannot bypass serialized policy; QEMU and fresh Pi evidence preserve console/network/driver/operator behavior and separated proof lanes; the accepted split measurably reduces root authority without an unbounded latency, temporal-reserve, or TCB regression; each root-TCB acceptance record validates only against the exact immutable artifacts it names. Deliverables: Separate hash-bound QEMU/Pi root-TCB acceptance records closing the reopened Milestone 25 root-service/Worker task-isolation claims and establishing the prerequisite for final 26e and Milestone 28b acceptance. Title/ID: m26e-mcs-smp-target-acceptance Milestone: Milestone 26e — Root-Service Compartmentalization + Worker Task Isolation + SMP+MCS Temporal Isolation / full-system SMP+MCS target acceptance Goal: Accept the single four-core SMP+MCS operational architecture on QEMU and Pi 4 using the real root, service, Worker, and driver topology under normal, overload, timeout, fault, complete task teardown, fresh-generation recreation, and operator-liveness conditions, as a verification-only gate over the frozen artifacts produced by preceding 26e implementation tasks. Inputs: `m26e-mcs-abi-foundation`, `m26e-worker-resource-admission-critical-tcbs`, `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-python-library-as-built-compatibility` for the independent Python package gate, `m26e-worker-target-evidence-promotion`, `m26e-root-tcb-target-proof`, all enabled 26e child images and generated task records, separate matching QEMU/Pi Worker component records, separate matching QEMU/Pi root-TCB acceptance records, matching QEMU/Pi `python-sdk-projection` compatibility records plus their target-qualified contracts and shared wheel/package manifest for any release profile that ships Python, positive exact-image CYW43 closure plus matching MCS coexistence record, configs/sel4/profiles.toml, configs/root_task*.toml, scripts/worker_task_evidence.py, scripts/release_bundle.sh, scripts/ci/test_plan_run.sh, scripts/rest_perf_harness.py, tests/test_release_bundle.py, docs/ROLES_AND_SCHEDULING.md, docs/TEST_PLAN.md, docs/BENCHMARKS.md, docs/audit/M26D_MCS_DECISION.md. Changes: - Release console convergence dispatch repair — the exact `a5ef48045` QEMU console canary passes, but the following filtered Cargo commands compile unrelated kernel integration binaries and fail to link ELF `_text`/`_end` symbols on macOS. Select the existing complete `host.root-task-qemu-features` library action as a console convergence regression and remove its ten overlapping filtered invocations. Preserve all separate ABI, console runtime, direct-GENET, service integration, transport and packaging checks, nonzero inventories and the canonical ban on filtered library suites. Regenerate the Test Plan projection and execute the selected regression actions. This changes only test dispatch; runtime, manifests, host tools, Python, benchmark workloads and target evidence requirements remain unchanged. Open P1 findings and independent review still block final release acceptance. - final artifact-freeze gate — make no runtime, generated-policy, manifest, kernel-profile, or image change in this task. Validate that the MCS-only profiles, per-core admission, seven critical root reserves including both Worker executor lanes, active/passive/Reply topology, child runtimes, and exact kernel/root/MCS-driver/CYW43/Worker-archive/Worker-image-manifest/Worker-image identities are unchanged from the preceding component and root-TCB records. Any hash or generated-output drift sends execution back to the owning implementation task and requires all affected evidence to be rerun before promotion. - scripts/ci/test_plan_run.sh + scripts/worker_task_evidence.py — run the complete frozen topology on each target, then emit separate `cohesix-mcs-smp-system-acceptance/v1` QEMU/Pi records with `record_kind=full-system`, exactly one target, and bindings to the exact Worker component record, root-TCB record, kernel/root images, MCS driver archive/manifest, positive CYW43 coexistence record, Worker archive/image manifest/images, ABI schemas, full-system raw evidence, admission totals, timeout/fault/Reply outcomes, and performance/liveness results. - configs/sel4/profiles.toml + build/release validators — verify that the already-produced four-core MCS contracts are the sole runtime/release profiles for QEMU and Pi 4 and that no non-MCS switch, compatibility profile, or fallback selection remains; do not modify the profile here. - scripts/worker_task_evidence.py + scripts/release_bundle.sh + tests/test_release_bundle.py — create/extend Worker-runtime release promotion tests and, only after both full-system records validate, consume all six immutable QEMU/Pi Worker-component, root-TCB, and full-system records; recursively cross-check their role-required Worker-integration rows and complete artifact/evidence hash graph including the Worker image manifest; emit the `release-accepted` `cohesix-worker-release-acceptance/v1` record with `record_kind=release`, explicit scope `worker-runtime`, no singular target field, and exactly those six references; and exercise release verification. Missing either target or evidence layer, missing/wrong-mode role-required integration row, QEMU-only/Pi-only proof, stale hashes, wrong kernel/root/driver/Worker image or Worker image manifest, wrong ABI/resolved-manifest/CYW43 record, or artifact-only packaging fails closed. This record cannot satisfy the Milestone 27b production use-case release schema. - scripts/release_bundle.sh + tests/test_release_bundle.py — independently verify every selected release-required projection through exact paths recorded in the generated package manifest. A release profile that ships Python must carry both exact `python-sdk-projection` records, the shared target-neutral wheel hash, and each record's matching target-qualified profile-contract hash; a missing, one-sided, stale, wrong-target, wrong-contract, or mismatched Python record fails Python packaging without entering, raising, lowering, or changing the six-reference Worker-runtime acceptance record. - docs/ROLES_AND_SCHEDULING.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md + evidence packs — record WCET/admission inputs, per-core totals/reserves, full topology, exact build/image identity, timeout/fault/restart results, operator-liveness results, and performance deltas without overstating upstream AArch64 or SMP verification. Commands: - cargo test -p sel4-sys -p sel4-runtime - cargo test -p coh-rtc - cargo test -p root-task --test schedule - cargo test -p pi4-driver-abi -p pi4-driver-runtime - scripts/check-generated.sh - python3 scripts/sel4_profile.py validate --profile qemu_smp_production --build-dir out/sel4/profile-v2/qemu-smp-production --require-source --require-artifacts --for-release --for-runtime - python3 scripts/sel4_profile.py validate --profile pi4_production --build-dir out/sel4/profile-v2/pi4-production --require-source --require-artifacts --for-release --for-runtime - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m26e-mcs-smp-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m26e-mcs-smp-pi4 - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m26e-mcs-smp-qemu - HIVE_GATEWAY_REQUEST_AUTH_TOKEN="$HIVE_GATEWAY_REQUEST_AUTH_TOKEN" .venv/bin/python scripts/rest_perf_harness.py --mode simulate --population-mode executable --benchmark-target pi4 --benchmark-transport genet --pi-runtime-dma-proof "$PI_RUNTIME_DMA_PROOF" --pi-network-capture "$PI_NETWORK_CAPTURE" --pi-cyw43-coexistence-record "$PI_CYW43_RECORD" --benchmark-evidence-max-age-secs 21600 --target-session "$PI_TARGET_SESSION" --no-qemu --no-gateway --rest-url "$COH_REST_URL" --tcp-host "$PI_TARGET_IP" --tcp-port 31337 --workers-min 256 --workers-max 256 --intensity-min 8 --intensity-max 8 --duration-mins 2 --base-rps 4 --max-inflight 32 --seed 2608 --no-transient-retries --strict-control-errors --error-budget-rate 0.01 --log-dir out/bench/pi4-genet --log-prefix m26e-pi4-genet-high - python3 scripts/pi4_compare_driver_models.py --qemu-report "$QEMU_HIGH_REPORT" --pi-report "$PI_GENET_REPORT" --reference-unix-s "$(date +%s)" --max-age-secs 21600 --min-throughput-ratio 1.0 --genet-max-p95-ms "$GENET_SAME_HARNESS_P95_MAX_MS" --output out/bench/pi4-genet/qemu-pi-parity.json - python3 scripts/worker_task_evidence.py validate-system --target qemu --worker out/test-plan/m26e-worker-qemu/worker-task-evidence.json --root out/test-plan/m26e-root-tcb-qemu/root-tcb-acceptance.json --run out/test-plan/m26e-mcs-smp-qemu --out out/test-plan/m26e-mcs-smp-qemu/system-acceptance.json - python3 scripts/worker_task_evidence.py validate-system --target pi4 --worker out/test-plan/m26e-worker-pi4/worker-task-evidence.json --root out/test-plan/m26e-root-tcb-pi4/root-tcb-acceptance.json --run out/test-plan/m26e-mcs-smp-pi4 --out out/test-plan/m26e-mcs-smp-pi4/system-acceptance.json - python3 scripts/worker_task_evidence.py promote-release --worker-qemu out/test-plan/m26e-worker-qemu/worker-task-evidence.json --worker-pi4 out/test-plan/m26e-worker-pi4/worker-task-evidence.json --root-qemu out/test-plan/m26e-root-tcb-qemu/root-tcb-acceptance.json --root-pi4 out/test-plan/m26e-root-tcb-pi4/root-tcb-acceptance.json --system-qemu out/test-plan/m26e-mcs-smp-qemu/system-acceptance.json --system-pi4 out/test-plan/m26e-mcs-smp-pi4/system-acceptance.json --out out/test-plan/m26e-mcs-smp/worker-release-acceptance.json - scripts/release_bundle.sh --verify-worker-acceptance --worker-qemu-evidence out/test-plan/m26e-worker-qemu/worker-task-evidence.json --worker-pi4-evidence out/test-plan/m26e-worker-pi4/worker-task-evidence.json --worker-root-qemu-evidence out/test-plan/m26e-root-tcb-qemu/root-tcb-acceptance.json --worker-root-pi4-evidence out/test-plan/m26e-root-tcb-pi4/root-tcb-acceptance.json --worker-system-qemu-evidence out/test-plan/m26e-mcs-smp-qemu/system-acceptance.json --worker-system-pi4-evidence out/test-plan/m26e-mcs-smp-pi4/system-acceptance.json - scripts/release_bundle.sh --verify-python-compatibility --python-package-manifest out/python-compat/m26e-python-package.json --python-qemu-evidence out/python-compat/m26e-qemu/python-sdk-projection.json --python-pi4-evidence out/python-compat/m26e-pi4/python-sdk-projection.json - python3 -m pytest -q tests/test_release_bundle.py tests/test_worker_task_evidence.py Checks: every active TCB has an admitted MCS budget/period/core, every passive service TCB has a bounded allowlisted donor/Reply/timeout chain to an admitted active context, every passive Worker has zero bound SC, exactly one allowlisted active executor donor, and a generation-scoped Reply path that returns donated time once, every linked driver uses its admitted MCS path, and all paths preserve correct ownership; aggregate demand preserves all seven critical reserves: root-control, root-fault, root-emergency, root-worker-supervisor, root-driver-supervisor, root-worker-executor-gpu, and root-worker-executor-lora; four-core QEMU and fresh Pi pass cold/warm boot, the aggregate 256-Worker READY seal with three detailed role exemplars, mixed load, budget exhaustion, timeout, fault, faulted-driver-call recovery, complete Worker task-instance teardown, fresh supervisor-generation recreation, SC/Reply/cap/mapping/record leak, operator-liveness, protocol-regression, GPU/PEFT receipt, and positive CYW43 behavioral-coexistence; QEMU additionally passes Conditional B2 full-population executable pressure driven through the three role exemplars, fresh Pi independently passes its exact-evidence-bound same-harness performance gate, and the target-neutral comparator rejects stale or mismatched provenance and decides QEMU/Pi parity from successful throughput and error budgets only; Conditional D separately qualifies only the host-model gateway comparator. Worker-runtime release promotion binds exactly the six target/root/system records and complete artifact graph, rejecting every missing, one-sided, stale, or mismatched input; independently, a profile cannot ship or advertise Python without both exact `python-sdk-projection` records, the shared wheel/package manifest, and the corresponding QEMU/Pi profile-contract hashes, and Python compatibility cannot raise or lower target, component, full-system, or Worker-runtime acceptance; no implementation or artifact changes occur after component evidence, and no operational classic scheduler path or profile remains. Any failure blocks closure and requires whole-change source/configuration reversion rather than a shipped fallback. Deliverables: One target-qualified SMP+MCS scheduling architecture for QEMU and Pi 4, final `cohesix-worker-release-acceptance/v1` evidence, and no runtime scheduler rollback path. ``` --- ## Post-26d Benchmark Cadence (Milestones 26e+) [Milestones](#Milestones) 26d establishes the refreshed seL4 16 performance baseline. Later milestones must use that evidence as the rolling comparison point, but they must not turn every feature into a full hardware benchmark gate. Benchmarking after 26d is tiered: - **Full same-harness benchmark gate:** required only when a milestone changes runtime scheduling, physical driver/runtime service, hot network paths, gateway broker behavior used by the canonical REST harness, or a new physical target. The run must compare against the latest accepted rolling baseline and archive QEMU/Pi or target-specific artifacts in `out/bench/` or `docs/bench/` as appropriate. - **Targeted microbenchmark gate:** required when a milestone adds bounded storage drains, namespace roots, read/write authorization checks, protocol projections, exporters, UI render loops, or evidence-pack processing that can add measurable overhead but does not change the physical network/runtime path. - **No runtime benchmark gate by default:** applies to documentation-only, verification-only, schema-only, read-only inspection, and pure conformance milestones. These milestones may measure CI/proof/tool runtime or bounded command latency, but they do not rerun Pi/QEMU throughput unless their changes land in a runtime or gateway hot path. Benchmark evidence must keep proof lanes separate: raw direct `cohsh`/TCP, REST/gateway overhead, QEMU semantic/capacity reference, Pi wired/GENET production parity, Pi Wi-Fi research/diagnostic evidence, storage/spool pressure, UI render cadence, and target-specific ENA/AWS proof are not interchangeable. Any claimed optimization must identify the moved layer and preserve Secure9P bounds, ACK/ERR/END grammar, manifest authority, HAL-only physical-device authority, no-retry accounting, and bounded queues. Cadence by milestone family: - **26e task isolation and SMP+MCS transition:** full same-harness QEMU/Pi benchmark, timeout/fault-containment, admission, and operator-liveness gates because root-service IPC, network parsing, Worker execution, and the kernel scheduling model change together. - **29 persistence:** targeted QEMU/Pi spool/settings and block-pressure gates; final Pi acceptance also reruns the established CYW43 same-harness workload against the exact accepted pre-29 baseline, first with persistence idle and then under representative storage load. QEMU does not qualify Pi storage or Wi-Fi behavior, and 29 does not create a broader benchmark framework. - **28 verification:** no runtime benchmark; track verification-gate runtime and proof reproducibility only. - **29a core-local scheduling:** full same-harness QEMU/Pi benchmark gate with service-bucket counters and fresh target evidence. - **29b operator lanes:** full latency/fairness gate under mixed serial, USB local-seat, TCP console, HDMI, diagnostics, network, telemetry, and persistence pressure; throughput claims remain tied to 26d/29a baselines and must not collapse separated proof lanes. - **27 read-only utilities:** no full benchmark; require bounded command latency for inspect/diff/attest over representative evidence packs. - **27a/28c gateway authority/protocol work:** gateway-focused latency/backpressure benchmarks for REST delegated writes, MCP resources/tools, and A2A task flows; full Pi hardware benchmark only if gateway results expose runtime-path regression. - **27b/27c/27d/27e/28b:** targeted provider/exporter, semantic extraction/capsule, AI-run-cost, inference, or fault-recovery timing where the milestone changes those paths; no full Pi/QEMU throughput gate by default. - **27f UI workbench:** UI render/backlog benchmark gate for Live Hive, replay, and inactive-view polling behavior. - **30/30a field status:** bounded command-latency checks only. - **30b AI namespace:** namespace-scale microbenchmarks for high-churn job/run roots; no full hardware benchmark unless the namespace provider changes hot runtime paths. - **31 AWS/ENA:** new-target benchmark gates; single-queue first-link evidence is not peak performance, and peak ENA claims require archived EC2 evidence tied to generated queue and service-bucket policy. --- ## Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest [Milestones](#Milestones) **Status (2026-09-14):** Complete — Lukas Bower explicitly approved closure on the disclosed evidence: QEMU Stages 01–05 and live TCP/REST operator checks pass; Pi Stages 01–02 pass, while the final-image Pi boot, live operator checks, and Stages 03–05 remain unexecuted following failed serial recovery. The [completion record](audit/M27_COMPLETION_EVIDENCE.md) binds tested source `b54bdd2fcff97fe35c5e3a61faa4d5a761b2a1ac`, evidence hashes, and the exact decision. This closes the `m27-*` tasks without asserting full Pi qualification or activating downstream milestones. DD30 remains P1 / ACCEPTED_RISK under its separate approval; dynamic fault/wake remains UNEXECUTED. The stock Pi's positive signed-device requirement is excluded by the earlier owner decision. Absent signed evidence still produces a typed non-attested result, never a hash-based PASS; device-bound issuance remains the conditional reopened `m26-device-identity-attestation-closure` task. **Delivery posture:** Release A priority and the shared read-only foundation for the AI workflow and 27f showcase. **Why now (operator & adoption):** After Milestone 26e closes the selected task/topology and evidence baseline, Cohesix needs deterministic tools to understand, reproduce, compare, and explain system behavior before it adds more production AI authority. Milestone 27 is deliberately read-only and does not wait for downstream Milestone 28 or conditional Milestones 29, 29a, or 29b. When persistence, proof witnesses, service buckets, operator-lane counters, or signed attestation are absent, the tools report typed unavailable or unknown state and preserve the source evidence class. Mutating authority hardening remains Milestone 27a, not a hidden prerequisite inside Milestone 27. **As-built alignment (2026-09-14):** The current implementation adds `coh inspect`, `coh trace`, `coh diff`, a fail-closed `coh attest`, and the thin `coh bundle` alias. Canonical packs include bounded inspect observations, optional host attachments and digests; timelines add scenario-aware case summaries. Canonical trace capture supports live TCP and REST, with shared offline consumers and preserved version-1 fixtures. See [the operator contract](OPERATOR_EVIDENCE.md). The shared TPM2 signature verifier and explicit proof classes are implemented. Final-source QEMU trace acceptance passes; final-source Pi trace acceptance remains unexecuted under the completion decision. Public measurements never produce attestation PASS. This milestone delivers a small, opinionated set of host-side utilities that read existing file-shaped state and artifacts. They do not mutate system state, do not self-heal, and do not bypass policy. Milestone 27 is a **convergence milestone**. It does not create a second trace format or a second reproducibility artifact. Instead: - the existing `cohsh-core` / `cohsh` trace format remains the canonical trace substrate; - the existing `coh evidence pack` / `coh evidence timeline` surface remains the canonical reproducibility pack; - this milestone fills the missing operator-facing commands and makes those existing foundations compose cleanly. **Implementation status (2026-09-14):** Host utilities, case synthesis, Python consumers, audit consistency coverage, and bounded latency coverage are complete on the approved basis above. The signed wire/trust contract and `m27-attestation-verifier` are implemented and pass the shared cryptographic fixtures; optional-device availability remains explicit. Offline signature fixtures and QEMU success do not establish a live signed-device result. Authoritative receipt validation and verified-execution verdicts remain owned by `m27b-authoritative-receipt-and-evidence-core`. --- ## Goal Provide a coherent operator toolkit that: 1. Explains current system state (`inspect`) 2. Reuses canonical trace artifacts for deterministic diagnostics (`trace`) 3. Produces self-contained reproducibility artifacts without inventing a second pack format (`bundle`) 4. Compares system state and policy deterministically (`diff`) 5. Verifies device identity and attestation evidence (`attest`) 6. Refreshes audit blocker/risk ledgers from current generated artifacts and evidence packs so later milestones do not inherit stale proof claims. All tools must be: - host-side only - deterministic and scriptable - aligned with existing Secure9P / NineDoor surfaces - auditable and replay-compatible --- ## Non-Goals (Explicit) - No automatic remediation or self-healing - No in-VM UI or interactive tooling - No new protocols or transports - No mutation of authority, policy, or state - No persistent mutation of authority, policy, or state. A bounded authenticated attestation nonce request to the versioned ephemeral challenge node defined by Milestone 26 is permitted; it cannot alter policy or grant authority. - No dependency on POSIX filesystem semantics inside the VM - No second trace recorder/replayer distinct from the existing `cohsh-core` trace stack - No second bundle/evidence artifact format distinct from `coh evidence pack` --- ## Deliverables ### 1) `coh inspect` — Correlated System Explanation **Purpose:** Provide a correlated, human-readable explanation of the system’s current operational state. Reads (examples): - `/proc/lifecycle/*` - `/proc/root/*` - `/proc/9p/session/*` - `/proc/pressure/*` - `/proc/spool/status` - `/proc/attest/*` Output characteristics: - Structured text (stable field ordering) - No “healthy/unhealthy” judgment - Explains why the system is in its current state - Zero side effects Exit codes: - `0` — state internally consistent - `>0` — invariant violation (corruption, impossible state) --- ### 2) `trace` — Canonical Live Capture and Consumption **Purpose:** Consume the existing deterministic trace format for debugging, testing, and operator diagnostics without defining a parallel recorder. Capabilities: - Record bounded canonical traces through the real TCP and REST/console projection transports without changing their requests or responses - Reuse `.trace` artifacts emitted by the existing `cohsh` / `cohsh-core` stack - Correlate traces with relevant `/proc/*` and evidence-pack state when available - Replay traces against: - `cohsh` - SwarmUI Live Hive - read-only field diagnostics surfaces that consume the same shared core Constraints: - No live mutation during replay - Authentication exchanges, raw tickets, secret-bearing payload fields, and host credentials are omitted or schema-redacted before persistence - Byte-identical ACK/ERR ordering required - No second trace grammar, schema, or recorder is introduced by this milestone --- ### 3) `bundle` — Canonical Reproducibility Pack **Purpose:** Produce a single, self-contained artifact for bug reports, audits, and incident review by extending the existing `coh evidence pack` / `coh evidence timeline` workflow rather than creating a new pack format. Bundle contents (bounded): - Manifest + resolved manifest hash - Serial log excerpt (if available from the host capture) - Trace files (if present) - `/proc` snapshots (inspect-equivalent) - Spool status summary - Attestation summary - When Milestone 27d host-side AI control is enabled, the same canonical evidence pack may additionally include bounded AI run envelopes, checkpoint manifests, retrieval manifests, provider receipts, and prefix-reuse summaries; no AI-specific bundle format is introduced. Output: - Deterministic directory or archive layout - No secrets unless explicitly authorized - Hash recorded and printed Canonical surface: - `coh evidence pack` remains the primary CLI - If a `coh bundle` alias is later added, it must be a thin alias over the exact same artifact layout and tests --- ### 4) `coh diff` — Deterministic Comparison **Purpose:** Answer “what changed?” without guesswork. Supported comparisons: - Two live targets - Live target vs bundle - Two bundles Diff surfaces: - Namespace shape - Manifest-resolved limits - Policy rules - Lifecycle / root state - Attestation fingerprints - AI run/checkpoint/prefix evidence when present through the canonical evidence-pack layout Output: - Minimal, ordered diff - No semantic inference - Script-friendly format --- ### 5) `coh attest` — Identity & Evidence Verification **Purpose:** Verify device identity and boot provenance. Capabilities: - Submit a bounded fresh nonce through the Milestone 26 ephemeral challenge node and parse the uniquely correlated TPM2 Quote or DICE evidence from `/proc/attest` - Verify manifest fingerprint binding - Validate certificate/signature chain, nonce, boot/session identity, measurement selection, exact artifact hashes, freshness/replay data, and configured trust anchors - Emit clear PASS / FAIL + reason `measurement_only`, unsigned hashes, virtual TPM evidence presented as Pi hardware, and unavailable trust roots always produce a non-attested result. This command is binary by design and suitable for CI and compliance workflows. --- ## Implementation Scope - Host tools centered on `apps/coh/` with shared read-only internals reusable by `coh-status` and SwarmUI where appropriate - Reuse existing parsing and transport crates - No changes to VM-side authority logic - Minimal, additive code only --- ## Documentation Updates - `docs/USERLAND_AND_CLI.md` - Command reference - Output guarantees - `docs/SECURITY.md` - Operator tooling trust model - `docs/audit/*` - Current blocker ledger, risk baseline, and accepted-risk cross references - `docs/ARCHITECTURE.md` - Operator interaction layer (read-only tools) --- ## Testing & Validation - Golden output fixtures for each command - Evidence-pack/bundle → diff → inspect roundtrip tests - Trace replay regression using the existing canonical trace fixtures - Attestation positive and negative cases - Audit ledger consistency checks across blockers, exceptions, findings, and risk baseline files - Bounded command-latency checks for `inspect`, `diff`, `attest`, and evidence-pack reads over representative live and offline artifacts. This is a host-tool microbenchmark gate, not a QEMU/Pi throughput rerun. - Tools must operate correctly against: - the accepted four-core QEMU SMP+MCS profile - retired single-core QEMU evidence bundles only as offline parser/ compatibility fixtures, never as an operational target or proof source - Pi 4 boot profile (where applicable) --- ## Checks (Definition of Done) - All tools produce deterministic output - No tool mutates system state - No new protocols introduced - Trace replay yields byte-identical ACK/ERR using the existing canonical trace format - Canonical evidence packs/bundles are sufficient for offline diagnosis - Audit blocker/risk ledgers agree with current generated artifacts and evidence-pack schema before Milestone 27a/27d tasks cite them. - Read-only operator-tool latency evidence stays bounded on representative artifacts and any regression is classified as parser, evidence-pack, transport, or artifact-size overhead before downstream tools depend on the shared core. - Documentation reflects as-built behavior --- ## Outcome After Milestone 27: - Cohesix is operable, not just correct - Incidents are explainable and reproducible - Operators can reason about state without guesswork - Support and integration costs drop sharply - The control plane remains small, auditable, and boring - Milestone 27d reuses the same evidence/timeline/diff substrate rather than introducing an AI-only forensic path ## Sharpened Implementation Sequence 1. Add `coh inspect` as a read-only synthesis over existing `/proc/*`, fleet, and evidence-pack state. 2. Keep `coh evidence pack` / `coh evidence timeline` as the canonical reproducibility artifact; if `bundle` is exposed, make it a thin alias only. 3. Add `coh diff` against live targets and canonical evidence packs. 4. Add `coh attest` over `/proc/boot` + `/proc/attest/*` with trust-anchor validation. 5. Reuse the existing trace substrate for pack correlation and diagnostics; do not add a second trace recorder. 6. Refresh audit ledgers from the current repo state and generated outputs before 27a/27d hardening work cites blocker or exception state. ## Task Breakdown The M27 task statuses below share the explicit completion decision above. Their checks describe the preserved contracts; physical checks listed as unexecuted in the completion record were accepted as remaining evidence gaps, not relabelled PASS. ``` Title/ID: m27-owner-review-closure Milestone: Milestone 27 — Operator Utilities / exact owner approval and due-diligence closure Status: Complete — approved evidence basis recorded above Goal: Record Lukas Bower's DD30/Rust sign-off and subsequent milestone completion approval without altering historical approvals or target results. Inputs: Reviewed 7c3b82abbaf938f82f958dc40886d24fcf1c9f01; tested b54bdd2fcff97fe35c5e3a61faa4d5a761b2a1ac; both exact owner statements in docs/audit/M27_COMPLETION_EVIDENCE.md. Changes: Separate DD30_M27_APPROVAL.toml; explicitly selected DD_MILESTONE_ID=27 lifecycle validation; negative approval/source/expiry checks; completion record and reconciled Build Plan, status, Test Plan and audit documentation. Commands: scripts/check-generated.sh (includes scripts/ci/check_test_plan.sh); git diff --check; scoped documentation link, header and retained evidence hash checks. Checks: Exact protected and complete host/target/SDK/manifest implementation binding; unchanged P1/ACCEPTED_RISK and 2026-10-13 expiry; dynamic fault/wake remains UNEXECUTED; final Pi boot/operator/Stages03–05 remain unexecuted under the separate completion approval. Deliverables: Durable human review, residual-risk and completion decisions; passing QEMU evidence and explicitly unexecuted Pi checks bound to their original source. Title/ID: m27-pi-regression-isolation Milestone: Milestone 27 — Operator Utilities / physical regression prerequisite restoration Status: Complete — approved evidence basis recorded above Goal: Preserve exact append-stream assertions and fresh-boot Worker isolation across the complete physical TCP matrix. Discovery: The exact 9a5eb97f1 Pi image passed 14 of 17 scripts; the append test inspected an ACK preview, and later groups inherited a live heartbeat slot and boot-local Worker IDs. Changes: - scripts/cohsh/9p_batch.coh + TCP/REST batch runners — validate ordered appended records in the completed CAT data stream, independently of bounded ACK previews and interleaved audit records. - scripts/ci/pi4_regression_boot.py + TCP/Stage03 runners — invoke an explicitly configured, bounded external boot collector for each selected Pi group; verify fresh boot IDs and unchanged source/image/host/gateway bindings; retain each group's evidence and finish on base for existing Stage04 continuity. Checks: Missing, reordered or repeated append records fail; boot-hook failure, stale boot identity and changed image/source fail; all four groups retain distinct exact-image boot records and the complete 17-script matrix remains required. Compatibility: No target/runtime/Worker/console grammar change. Host suite, Python SDK, REST and benchmark consumers retain their contracts; only canonical test collection and evidence composition change. Deliverables: Deterministic workflow tests, passing final-source QEMU matrix, preserved failed Pi attempt and owner-approved closure with final-source Pi execution unexecuted. Title/ID: m27-live-operator-closure Milestone: Milestone 27 — Operator Utilities / live inspect and evidence-pack composition Status: Complete — approved evidence basis recorded above Goal: Close fresh-Pi-discovered host collection defects without weakening missing/error or proof classifications. Changes: - apps/coh/src/operator.rs + evidence.rs — use the bounded advertised /proc inventory for optional-root absence, preserve lease-ID directory semantics when empty, and retain nested directory listings in separate .listing leaves. - apps/coh/tests/operator.rs — exercise empty/populated lease directories, absent optional roots, refused parent listings, advertised-node read failures, and pack round trips. - docs/OPERATOR_EVIDENCE.md — document inventory-based availability and backward-readable listing storage. Checks: Fresh Pi TCP/REST capture composes with complete packs and byte-stable offline inspection/replay; actual read failures remain incomplete exports; old inventory-selected paths remain readable. Compatibility: Complete host-tool suite, Python SDK and benchmarks reviewed; inventory-based consumers need no schema or workload change. No target namespace, driver, scheduling, wire grammar or authority change. Deliverables: Host collector correction and separate exact-image live evidence. Title/ID: m27-build-evidence-blockers Milestone: Milestone 27 — Operator Utilities / restoration of build and evidence prerequisites; discovery in m27-attestation-verifier, restoring the exact-source invariant of m26e-worker-target-evidence-promotion Status: Complete — approved evidence basis recorded above Goal: Restore canonical test and image-build prerequisites without relaxing source integrity, evidence bounds or target acceptance. Changes: - tests/test_linux_host_tools_sync.py, tests/test_release_bundle.py, tests/test_sel4_profile.py — exercise the existing exact tracked-tree archive and argument-driven packaging contracts; preserve export-ignore coverage and secret exclusion. - scripts/ci/test_run_regression_batch.py — explicitly select the QEMU fixture target and action so common-stage execution under Pi does not inherit physical transport requirements. - scripts/worker_task_evidence.py + tests/test_worker_task_evidence.py — stream every git-visible regular source file in at most 1 MiB reads, including shipped images larger than the evidence parser's 64 MiB allocation bound; retain exact extent, metadata, path-set and repeated-content checks. This restoration does not reopen M26e runtime or physical behavior. - toolchain and selected build outputs — restore pinned compiler/Python/mkimage and the pristine canonical QEMU profile through documented setup. - scripts/ci/test_plan_target_root_check.sh + focused workflow tests — route Pi Stage 02 through the canonical clean-source Pi builder, compare its retained resolved manifest to the compiler-selected Pi identity, and verify exact staged image/source binding. Preserve QEMU identity rejection and all physical acceptance requirements. - docs/TOOLCHAIN_MAC_ARM64.md — distinguish advertised HVF from the validated QEMU 10.1.0 HVF/GIC runtime; retain the QEMU 11.0.3 pre-guest assertion as failed evidence and select the verified external executable explicitly. Commands: .venv/bin/python -m pytest -q tests/test_worker_task_evidence.py tests/test_linux_host_tools_sync.py tests/test_release_bundle.py tests/test_sel4_profile.py; scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml; scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27-qualification-qemu Checks: Source identities include exact large-image bytes without large allocations; same-read mutations and oversized evidence files still fail; canonical target and acceptance predicates remain unchanged. Deliverables: Restored provenance/build workflows and fresh command evidence, separate from physical acceptance. Title/ID: m27-evidence-case-summary Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / reviewer-friendly evidence case summary Status: Complete — approved evidence basis recorded above Goal: Extend the canonical offline evidence workflow with a deterministic scenario-aware case summary that reconstructs observed request, admission/refusal, state/lease/lifecycle, host-result, and receipt/dead-letter links while declaring missing, errored, unknown, and ambiguous evidence without asserting target, hardware, health, or external-execution proof. Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, apps/coh/src/main.rs, apps/coh/tests/evidence_pack.rs, apps/coh/tests/evidence_timeline.rs, tools/cohesix-py/examples/ci_evidence_pack.py, tools/cohesix-py/tests/test_examples_ci_siem.py, docs/USE_CASES.md, docs/OPERATOR_WALKTHROUGH.md, docs/OPERATOR_RECIPES.md, docs/HOST_TOOLS.md, docs/TEST_PLAN.md, current evidence-pack, audit, host-ticket, lease, lifecycle, and federation schemas. Changes: - apps/coh/src/evidence_timeline.rs + apps/coh/src/main.rs — extend `coh evidence timeline` rather than introduce a second pack format; emit additive, atomically written `case.json` and `case.md` with an explicit `generic`, `incident`, `change`, `maintenance`, `rollout`, or `federation` scenario class. - case synthesis — consume `summary.json` and retained timeline sources, group records by stable correlation keys, preserve cross-hive identifiers, link every derived stage to its source path/event identity, and classify each request, decision, state/lease/lifecycle, host-result, receipt/dead-letter, and federation-relay stage as `observed`, `missing`, `error`, `unknown`, or `ambiguous`. - outcome boundary — use only non-authoritative review outcomes such as `recorded-terminal`, `refused`, `deadlettered`, `incomplete`, and `ambiguous`; a current host-ticket status or client-derived record never proves external execution, target state, hardware behavior, or an authoritative receipt. Authoritative graph validation and verified-execution semantics remain deferred to `m27b-authoritative-receipt-and-evidence-core`. - compatibility and safety — preserve existing `timeline.ndjson`, `timeline.md`, pack layout, redaction, generated byte bounds, deterministic ordering, atomic writes, missing/error inventory, partial-pack handling, and offline operation; unknown additive fields remain compatible and secret canaries never enter case outputs. - tests and operator contract — add deterministic fixtures for incident, change, maintenance, rollout, and federation review; cover incomplete and conflicting chains, missing/error inventory, cross-hive correlation, malformed bounded inputs, secret canaries, and byte-stable reruns; update CI structural validation and operator documentation for the additive outputs and their proof limitations. Commands: cargo test -p coh --test evidence_pack --test evidence_timeline && python3 -m pytest -q tools/cohesix-py/tests/test_examples_ci_siem.py && cargo fmt --all -- --check && cargo clippy -p coh --all-targets -- -D warnings && scripts/check-generated.sh && scripts/ci/test_plan_run.sh --list Checks: Fixed evidence packs produce byte-stable case outputs without network access; every causal stage is source-linked or explicitly missing, error, unknown, or ambiguous; federation correlation remains operator-visible; existing pack/timeline consumers remain compatible; secret canaries do not survive; no outcome claims target/hardware proof, external execution, or authoritative receipt validation. Deliverables: Additive `case.json` and `case.md` in the canonical evidence pack, scenario and negative fixtures, CI structural coverage, and operator-facing documentation that keeps current evidence and future 27b authoritative receipt semantics distinct. Title/ID: m27-live-trace-capture Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / live canonical trace capture Status: Complete — approved evidence basis recorded above Goal: Make the existing bounded trace format record real TCP and REST/console-projection sessions while keeping replay offline, deterministic, and non-mutating. Inputs: apps/cohsh/src/{main.rs,trace.rs,transport/**}, crates/cohsh-core/src/trace.rs, apps/coh/src/**, apps/hive-gateway/**, existing trace fixtures/policy, docs/USERLAND_AND_CLI.md, docs/SECURITY.md, docs/TEST_PLAN.md. Changes: - crates/cohsh-core + apps/cohsh — wrap live TCP and REST transports with the existing recorder, preserve partial-stream/disconnect/reconnect boundaries, bind the header to schema, backend class, target/session id, manifest/image identity, capture time, and policy hash, and enforce generated byte/frame/duration limits with atomic finalization. - redaction — omit authentication frames and apply generated field-aware redaction before bytes reach disk; raw tickets, placeholder/real auth tokens, secret refs, host credentials, and secret-bearing control payloads are never recoverable from a trace. Redaction metadata is authenticated as part of the trace header/digest. - replay — keep replay transport-free and non-mutating, reject tamper/wrong-policy/oversize/secret-bearing input, and preserve byte-identical post-redaction ACK/ERR/END order across cohsh, SwarmUI, and shared read-only consumers. - public docs/tests — distinguish fixture, captured-QEMU, captured-Pi, and captured-host-projection traces and stop describing mock-only recordings as live artifacts. Commands: cargo test -p cohsh-core && cargo test -p cohsh && scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27-live-trace-qemu Checks: real TCP and REST sessions produce bounded, identity-bound, atomically complete canonical traces; disconnect/reconnect and truncated captures are explicit; secret canaries never appear; replay is byte-stable and emits no writes; mock traces remain fixtures and cannot satisfy live target evidence. Deliverables: One canonical trace recorder usable on real transports and one honest replay/evidence classification. Title/ID: m27-attestation-verifier Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / signed attestation verification Status: Complete — approved evidence basis recorded above Goal: Implement `coh attest` as a real verifier of the Milestone 26 device-bound evidence contract rather than a manifest-hash comparison. Inputs: accepted `m26-device-identity-attestation-closure` schema/evidence, apps/coh/**, shared evidence/attestation parser crate, trust-anchor inputs, QEMU vTPM and Pi hardware/device-root fixtures, docs/SECURITY.md, docs/TEST_PLAN.md. Changes: - shared host attestation core + apps/coh — generate a cryptographically random bounded nonce, submit the authenticated ephemeral challenge, correlate the response, parse TPM2 Quote or DICE evidence, validate algorithms/chain/signature/nonce/measurements/boot id/artifact identities/freshness/replay counter, and return stable machine-readable PASS/FAIL/UNAVAILABLE reasons. - evidence/bundle/diff — retain signed raw evidence only within generated bounds, record its digest and trust-policy id, redact enrollment metadata as configured, and keep QEMU virtual-device, Pi device-root, offline fixture, measurement-only, and unavailable classes distinct. - negative/conformance tests — replayed nonce, wrong PCR/manifest/image/kernel/root, wrong AK/DICE chain, expired or revoked trust anchor, malformed size, unsupported algorithm, measurement-only substitution, virtual-to-Pi proof substitution, and missing device all fail closed. Commands: cargo test -p coh --test attest && cargo test -p coh --test evidence_pack && scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27-attest-qemu && scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m27-attest-pi4 Checks: `coh attest` accepts only a fresh signed chain matching the exact target and configured trust policy; a matching public manifest hash alone never passes; no challenge grants or mutates authority; failure reasons and offline verification are deterministic. Deliverables: Shared cryptographic verifier reused by evidence packs, SwarmUI, and later `coh-status` without a second attestation vocabulary. Title/ID: m27-python-evidence-contract-parity Milestone: Milestone 27 — Operator Utilities: Inspect, Trace, Bundle, Diff, Attest / Python evidence contract parity Status: Complete — approved evidence basis recorded above Goal: Keep the non-authoritative Python SDK compatible with the canonical evidence-pack, timeline, redaction, trace-reference, and attestation-result contracts established by Milestone 27. Inputs: `m27-live-trace-capture`, `m27-attestation-verifier`, apps/coh evidence/attestation fixtures, canonical trace and legacy offline fixtures, generated evidence schemas and bounds, tools/cohesix-py/cohesix/{client.py,evidence.py}, tools/cohesix-py/tests/{test_evidence_receipts.py,test_examples_ci_siem.py}, docs/PYTHON_SUPPORT.md, docs/TEST_PLAN.md. Changes: - tools/cohesix-py/cohesix/{client.py,evidence.py} — consume the canonical generated evidence-pack layout, timeline ordering, opaque bounded trace references, redaction rules, bounds, artifact classes, and typed attestation outcomes without defining a second pack format, parsing or replaying trace payloads, verifying against weaker inputs, or inferring attestation success. Authoritative receipt migration remains owned by `m27b-authoritative-receipt-and-evidence-core`. - tools/cohesix-py/tests/test_evidence_receipts.py + tools/cohesix-py/tests/test_examples_ci_siem.py — run the shared canonical fixtures plus explicitly classified legacy offline parser fixtures; cover unknown additive fields, missing optional artifacts, signed PASS/FAIL/UNAVAILABLE records, measurement-only inputs, virtual-versus-hardware proof separation, truncation, and secret canaries. - docs/PYTHON_SUPPORT.md + docs/TEST_PLAN.md — document that Python may project or analyze the canonical record but cannot manufacture authoritative evidence or upgrade an offline/legacy/measurement-only artifact. Commands: - python3 -m pytest -q tools/cohesix-py/tests/test_evidence_receipts.py tools/cohesix-py/tests/test_examples_ci_siem.py Checks: Rust and Python agree on canonical fixture bytes, ordering, classifications, bounds, and redaction; secret canaries never survive; matching hashes alone never become attestation PASS; legacy artifacts remain offline parser fixtures only; Python output cannot become a second evidence authority. Deliverables: One evidence-pack/timeline/attestation-result contract shared by Rust producers and Python consumers. Title/ID: m27-audit-ledger-refresh Status: Complete — approved evidence basis recorded above Goal: Refresh audit blockers, exceptions, findings, and risk baselines so later hardening milestones cite current state. Inputs: docs/audit/, scripts/check-generated.sh, docs/BUILD_PLAN.md, current evidence-pack schema. Changes: - docs/audit/BLOCKERS.md — update blocker status and classify remaining issues by milestone owner. - docs/audit/EXCEPTIONS.md — remove contradictory `None` state when active exceptions exist and cross-link accepted-risk ids. - docs/audit/findings.csv + docs/audit/rust_risk_baseline.toml — align risk ids, counts, and accepted exceptions with current code. - docs/TEST_PLAN.md — add audit-ledger consistency check before 27a/27d closure. Commands: scripts/check-generated.sh && cargo test -p tests --test audit_ledgers Checks: Blockers, exceptions, findings, and risk baseline agree; stale audit snapshots cannot be cited as current closure evidence. Deliverables: Current, internally consistent audit ledgers for authority hardening and host-side AI milestones. Title/ID: m27-readonly-command-latency Status: Complete — approved evidence basis recorded above Goal: Add bounded latency coverage for read-only operator utilities without treating Milestone 27 as a full runtime benchmark gate. Inputs: apps/coh, tests/fixtures/traces/, representative evidence packs, docs/TEST_PLAN.md, docs/BENCHMARKS.md. Changes: - apps/coh/tests/operator_latency.rs — deterministic fixture-backed checks for inspect, diff, attest, and evidence-pack read latency. - docs/TEST_PLAN.md + docs/BENCHMARKS.md — classify the evidence as host-tool latency, separate from REST/QEMU/Pi throughput proof. Commands: cargo test -p coh --test operator_latency Checks: Representative artifact sizes stay within declared parse/read bounds; failures classify parser, evidence-pack, transport, or artifact-size overhead. Deliverables: Read-only operator utility latency evidence that later field and UI tools can cite without rerunning full hardware benchmarks. ``` ### Cross-Cutting Governance Value Contract for Milestones 27a-27f Milestones 27a-27f may add many host-facing integrations, but they form one governance product rather than a collection of substitute platforms. Cohesix owns bounded decisions, delegated authority, and evidence. Existing model servers, agent frameworks, Kubernetes/systemd, GPU runtimes, observability, FinOps, identity, and domain systems continue to own their native execution and data planes. Every task and public integration in Milestones 27a-27f, and every later consumer of those milestones, must preserve this common lifecycle: ```text observe -> preflight -> admit -> grant -> execute externally -> observe result -> verify -> receipt -> review/replay ``` The stages may collapse for a read-only operation, but no mutating projection may skip admission, call an executor directly, or manufacture a terminal result. Release A operator admission means authenticated explicit human approval plus generated allowlist, bounded ticket, idempotency/writer state, and receipt under 27a; it is recorded as `admission_mode=operator_approved`/`admission_id=unavailable` and cannot be described as 28a machine-checked admission. Release B governed or autonomous admission means the accepted 28a typed-intent, authoritative-fact, decision-bound-grant path. A profile cannot silently switch between them. Host APIs, OpenAI-compatible endpoints, MCP/A2A, Python, FUSE, exporters, and SwarmUI are replaceable projections over this lifecycle, not independent authority planes. Before a new provider, alias, protocol projection, optimizer, semantic view, agent feature, exporter, or workbench action is authorized, its owning task and generated 27b integration/use-case row must answer: 1. **Governed decision:** What consequential decision, resource, data boundary, or external action is being governed? Presentation or transport convenience alone is not a security or governance capability. 2. **Authority custody and bypass:** Which credential, capability, lease, actuator, or provider permission performs the action, who holds it, and what prevents the requesting application from bypassing Cohesix? A path that remains bypassable may ship as observation or recommendation, but it cannot claim non-bypassable enforcement. 3. **One authority spine:** Which existing generated ticket, policy, provider/action, idempotency, writer-epoch, and receipt contracts does the feature consume? A feature-specific authorization or executor shortcut is prohibited. 4. **Named external owner:** Which host executor or external data plane performs the work, and which conformance lane proves its observed terminal behavior? 5. **Bounds and failure posture:** What are the request, queue, cost, token, time, retry, retention, and evidence bounds, and does unavailability cause a deterministic refusal, an explicitly approved fixed route, a separately authorized and receipted human action, or read-only degradation? Silent fail-open, provider substitution, authority widening, and unrecorded fallback are prohibited. 6. **Fact and evidence boundary:** Which records are Cohesix authority or observation, provider/executor reports, client-only observations, inferred, unknown, or explicit non-claims? The shared 27b receipt/evidence vocabulary is reused; each feature must not invent a stronger local truth class. 7. **Coexistence value:** Why is this better than a hardened host-only adapter for the named use case, and what existing platform remains in place? If the answer is only feature breadth, keep the capability outside the Cohesix core or defer it. Any provider, routing, AI-run, or agent-protocol feature that can influence external execution must expose generated governance modes distinct from its mock/dry-run/live evidence state: - `observe` records only policy-permitted bounded inputs/metadata and the decision that would have been made without changing routing or execution; - `recommend` emits a non-authoritative, reviewable recommendation and reasons while the existing execution choice remains in control; - `enforce` may alter selection or submit an action only through accepted delegated authority and the generated provider/action path. Promotion to `enforce` requires a declared evaluation window, representative shadow evidence, compatibility and refusal results, policy-violation findings, and workload-relevant cost/latency/quality or verification measures. Shadow evidence is advisory and cannot satisfy external-execution, Worker, hardware, or production-use-case proof by itself. The seL4 target must remain outside token streams, bulk artifacts, hot telemetry, and provider-native data planes. Milestone 27e first proves exact per-request operator approval or, where selected, 28a governed admission plus durable reconciliation. A later optimization may introduce a short-lived multi-request routing or budget grant only through a separately versioned compiler-owned contract with one spender, exact policy/identity/ provider bounds, expiry and revocation, monotonic accounting, overspend prevention, crash reconciliation, mandatory receipts, and measured need. A generic host-local authority envelope or an optimization that weakens exact admission is not authorized by Milestone 27e. ## Milestone 27a — Authority Hardening: Delegated REST Identity, Fenced Failover, Idempotent Queen Intents [Milestones](#Milestones) **Delivery posture:** Release A authority floor. Delegated identity, strict idempotency, durable execution recovery, production secrets, audit/replay, and single-writer safety are required for the reference workflow. Multi-host failover and federation promotion evidence is required only for a profile that ships those features; it cannot block the single-Jetson reference profile. **Why now (risk closure):** Milestones 25g and 25h delivered host tickets, federation relay, and bounded WAL behavior. As-built deployments still have two critical exposure points: 1) REST callers collapse into one gateway-attached Queen principal, and 2) profiles that enable failover still depend on external fencing discipline rather than deterministic writer fencing in the control-plane path. This milestone closes those gaps using existing as-built mechanisms (`hive-gateway`, `cohsh-core` ticket claims, `/host/tickets/*`, relay WAL, manifest compiler) without introducing new VM protocols or relaxing single-writer semantics. **As-built alignment note:** The current REST gateway requires a gateway request-auth token for mutating routes, but REST writes still execute through the gateway's configured role/ticket rather than a delegated per-request capability ticket. Host-ticket idempotency by `id + idempotency_key` and relay dedupe exist, but writer-epoch fencing and strict Queen intent dedupe are not yet implemented. Milestone 27a hardens those specific gaps; it must not present current request-auth, relay dedupe, or host-ticket idempotency as delegated REST identity or failover fencing. Because the current upstream console session still authenticates as the gateway role/ticket, 27a must also distinguish **gateway-enforced caller delegation** from any future **VM-verified caller identity** claim. **Sequencing note:** Milestone 27a closes the host/gateway authority floor required by the Milestone 27b coexistence gate, Milestone 28a per-intent admission, and Milestones 27d, 28c, and 30b. Milestone 26e owns complete live Worker and baseline linked-driver cap authority and basic containment; a persistence-enabled Milestone 29 profile must also have accepted its `driver-storage` bundle under that same contract. Production Worker ticket/lease ledger binding, complete driver-inventory projection for every selected accepted runtime, and structured worker/driver quarantine evidence are split into Milestone 28b so the host actuation floor can ship without bundling that production ledger work into the same atomic gate. --- ## Goal Strengthen authority and failover guarantees while preserving current transport and grammar boundaries: 1. Require caller-scoped delegated authority for mutating REST operations. 2. Make Queen control intents replay-safe with deterministic idempotency keys. 3. Add explicit writer-epoch fencing for failover and relay paths. 4. Eliminate fixture/bootstrap secret usage from release profiles. 5. Ship production profiles with audit/replay enabled and bounded by manifest limits. 6. Establish the mandatory authority floor for Milestone 27b provider conformance, Milestone 27d host-side AI actuation, and Milestone 30b AI namespace projections. 7. Harden host-ticket execution so target/arg validation and replay durability are strong enough for host side effects. 8. Harden host bridge and debug surfaces that can otherwise bypass the authority story: GPU bridge authentication/frame bounds and root-console memory diagnostics. 9. Leave production Worker ticket/lease ledger binding, complete driver-inventory projection, and structured quarantine/evidence as the explicit Milestone 28b follow-on, not a hidden prerequisite inside the host/gateway write-safety gate or a reason to deny accepted pre-28b live cap authority from 26e and any selected, independently accepted Milestone 29 storage runtime. --- ## Non-Goals (Explicit) - No active/active multi-queen writers for one logical hive. - No in-VM HTTP services or new RPC channels. - No changes to ACK/ERR/END grammar or Secure9P transport framing. - No silent replacement of the existing `/queen/ctl` raw-command schema. Any strict intent envelope is introduced through a versioned compatibility path or the full breaking-change process: manifest schema bump, regenerated snippets, updated CLI fixtures, updated docs, and migration notes. - No best-effort reconciliation loops or autonomous remediation behavior. --- ## Deliverables ### 1) Caller-Scoped REST Delegation (No Undifferentiated Write Authority) **Purpose:** Preserve gateway multiplexing while restoring caller-level capability boundaries. Implementation requirements: - Mutating REST routes (`/v1/fs/echo` and equivalent write paths) require: - gateway request-auth token, and - delegated capability ticket header (`x-cohesix-ticket`), validated using existing ticket claims rules. - Gateway maintains caller identity and quota state keyed by delegated ticket identity (hash). The gateway's configured upstream role/ticket is a transport-authority ceiling, not the caller identity: a request is admitted only when the delegated ticket is valid and the concrete path/action is within both the delegated claims and the gateway ceiling. - If the VM console transport remains single-client or single-writer for the selected profile, the gateway serializes writes over the existing authenticated console path rather than opening parallel sessions or reattaching a shared session between callers. Audit/evidence records bind the delegated ticket hash, gateway credential class, concrete path/action, and upstream `ACK`/`ERR` result. - Delegated ticket claims (`role`, `subject`, `mount scopes`, `budgets`) constrain what each REST caller can mutate. Gateway-enforced delegation must not be described as VM-verified caller identity unless a separately versioned VM envelope/path actually carries and verifies the caller binding. - Read-only REST routes may remain gateway-role scoped in compatibility mode. The delegated-ticket requirement for mutating REST paths is an authority-contract change and must update `docs/API_GUIDELINES.md`, `docs/HOST_API.md`, OpenAPI fixtures, CLI/REST tests, and release notes in the same milestone work. As-built leverage: - Reuse `cohsh-core` ticket parsing/validation and existing ticket quota semantics. - Reuse deterministic permission errors (`EPERM`, `ELIMIT`) and existing audit logging surfaces. --- ### 2) Idempotent Queen Control Grammar **Purpose:** Ensure retries/replays never duplicate side effects for Queen control intents while preserving legacy `/queen/ctl` compatibility unless a breaking-change path is taken. Implementation requirements: - Introduce strict envelope schema for idempotent Queen intents: - required: `schema`, `id`, `idempotency_key`, `issued_unix_ms`, `cmd`. - Preserve existing `/queen/ctl` raw-command behavior in compatibility profiles, or introduce a new versioned path such as `/queen/intents/ctl` for strict envelopes. Production profiles may require strict envelopes only after the generated manifest schema and fixtures record that breaking authority posture. - Add bounded dedupe table in root-task authority path keyed by `id + idempotency_key`. - Duplicate intent behavior is deterministic: - no side effects repeated, - stable acknowledgement path, - audit line records dedupe decision. - Provide read-only introspection node for recent dedupe outcomes (bounded bytes/entries). As-built leverage: - Align with existing idempotency model used by `/host/tickets/spec`. - Keep all writes append-only and routed through existing authority flow. --- ### 3) Writer-Epoch Fencing and Failover Determinism **Purpose:** Replace implicit human/process fencing with explicit, verifiable writer epochs. Implementation requirements: - Add monotonic writer epoch to host control ticket flows and relay envelopes. - Host-ticket-agent and relay pipeline reject stale-writer intents deterministically. - Expose read-only writer-epoch/fence state for operator diagnostics and evidence correlation. - Update failover runbook to require epoch promotion before standby becomes writable. As-built leverage: - Reuse existing `/host/tickets/{spec,status,deadletter}` lifecycle and relay WAL. - Reuse existing failover active/standby model and single-writer policy. --- ### 4) Production Secret and Key Discipline **Purpose:** Remove bootstrap/fixture secret assumptions from release-grade configurations. Implementation requirements: - Replace literal ticket secrets and fixture CAS signing key usage in production manifests with secret references. - Reject placeholder credentials in every live client/provider, including SwarmUI and the GPU bridge, before any connection is attempted. Warning-only acceptance is fixture behavior, not a production degradation mode. - `coh-rtc` rejects release profiles that include: - fixture signing key paths, - bootstrap/default secret literals. - Release assembly never copies a private fixture signing key or wildcard host directory; selected bundles contain only the exact generated artifact set and public verification material. Historical release snapshots remain immutable but their insecure examples receive current errata. - Host tooling/docs define deterministic env/file resolution order for ticket secrets and CAS signing keys. - Add rotation tests proving key rollover works without protocol changes. As-built leverage: - Extend existing manifest validation and due-diligence secret-hygiene checks from Milestone 25b. --- ### 5) Production Audit/Replay Baseline **Purpose:** Make post-incident reconstruction and failover verification first-class in production profiles. Implementation requirements: - Production profile defaults: - `ecosystem.audit.enable = true` - `ecosystem.audit.replay_enable = true` - bounded retention values sized for fleet operations. - Evidence packs include writer-epoch and dedupe state snapshots. - Release gate fails if production profile disables audit/replay without explicit exception record. As-built leverage: - Use current `/audit/*`, `/replay/*`, `coh evidence pack`, and timeline tooling. --- ### 6) Host Ticket Validation and Durable Execution **Purpose:** Keep `/host/tickets/spec` as a safe host-side actuation lane rather than an under-validated side-effect queue. Implementation requirements: - Introduce provider-specific validated newtypes for host ticket targets, args, ids, and action fields. - Reject empty components, `..`, slash-bearing identifiers where a single token is expected, control characters, overlong values, leading option-like values where they become argv operands, and unsupported provider-specific fields. - Enforce manifest action allowlists before executor dispatch, not only after schema parsing. - Add durable execution WAL states such as `prepared`, `executed`, and `terminal`, keyed by `id + idempotency_key`. - A crash or writeback failure after host side effects must not cause silent duplicate execution on restart; recovery must either publish the terminal receipt or deadletter with explicit replay state. As-built leverage: - Reuse the existing host-ticket schema, relay WAL, receipts, and idempotency key model. --- ### 7) Host Bridge Auth/Frame Caps and Debug Memory Gates **Purpose:** Remove authority bypasses from host bridge and debug surfaces before they become production dependencies. Implementation requirements: - `gpu-bridge-host` must reject placeholder auth such as `changeme` outside explicit mock/test modes and require a configured token source for live publish paths. - `gpu-bridge-host` console/REST clients must cap frame length before allocating buffers from peer-controlled sizes; the cap must be documented and tested. - Root-console memory diagnostics such as arbitrary-address hexdump must be disabled in release/production profiles or restricted to HAL-classified diagnostic ranges. - Documentation must distinguish emergency bring-up diagnostics from production operator surfaces. As-built leverage: - Reuse existing cohsh placeholder-auth rejection patterns, Secure9P/console frame limits, HAL device coverage checks, and test-plan profile gates. --- ### 8) Production Ledger/Quarantine Follow-on Boundary **Purpose:** Keep 27a atomic around host/gateway authority while preserving the required VM authority hardening path. Implementation requirements: - Milestone 27a must emit generated profile gates and documentation that distinguish: - host tickets, REST delegated tickets, and provider/PEFT tickets as host authority records; - model/session-only roles with no VM authority; - the complete isolated Heartbeat/GPU/LoRA task-instance authority accepted by Milestone 26e, including basic fault containment and teardown but not production ticket/lease binding; - any selected Milestone 29 `driver-storage` bundle only after its own complete authority inventory, fault containment, teardown, and fresh-generation evidence is accepted; - production Worker ticket/lease binding, projection of the already complete applicable driver MMIO/DMA/shared-ring inventory, and structured quarantine/evidence as Milestone 28b requirements. - Target profiles must fail validation if they claim production ticket/lease cap-bundle binding or structured production fault/quarantine evidence before Milestone 28b evidence exists. They may describe accepted pre-28b task/driver authority only with the exact acceptance records from the milestone that owns each selected bundle. - Milestones 27d, 28c, and 30b may depend on 27a host/gateway delegated identity, idempotency, fencing, audit/replay, and host-ticket durability, and may consume accepted 26e Worker behavior where explicitly needed, but must not cite 28b production VM ticket/lease binding or quarantine closure before 28b completes. As-built leverage: - Reuse the accepted 26e isolated-task/acceptance terminology, any selected accepted Milestone 29 storage-runtime evidence, current driver applied-scheduling evidence, and 27a audit/replay profile gates without overclaiming 28b production ticket/lease binding. --- ### 9) Gateway authority performance guard **Purpose:** Prove delegated REST identity, idempotency, and writer-epoch fencing do not create hidden gateway backpressure or push operators toward unsafe retry masking. Implementation requirements: - Add a targeted gateway benchmark for read-only REST status, delegated mutating REST writes, duplicate-idempotency refusals, and stale-writer refusals. - Report p50/p95 latency, error/refusal counts, broker queue depth, backpressure responses, delegated-ticket cache behavior, and audit-line emission cost. - Compare against the accepted 26d rolling baseline for equivalent REST status reads and against a pre-27a local gateway authority baseline for write-path overhead. - This is a gateway/auth microbenchmark only. It must not be counted as fresh Pi hardware throughput proof unless the benchmark exposes a runtime-path regression that requires a full same-harness rerun. --- ### 10) Durable admission-correlation substrate **Purpose:** Preserve the durable identity, replay, idempotency, and fencing fields that Milestone 28a will bind to a machine-checked decision without overloading writer ownership as state freshness. Implementation requirements: - Version strict Queen intents, host tickets, execution WAL entries, terminal receipts, audit records, and evidence correlation so they can carry or bind `admission_id`, `intent_hash`, `policy_hash`, `state_epoch`, `resource_generation`, and `decision_expiry` when a later generated action requires admission. - Keep `writer_epoch` as the writer/authority-owner fence. It must not be replaced by, derived from, or overloaded as `state_epoch` or a resource generation. - Pre-28a compatibility actions retain their explicitly generated posture; 27a does not create or simulate an admission decision. Milestone 28a owns exact per-intent policy/state evaluation and decision-bound grant issuance. --- ## Commands - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `cargo test -p hive-gateway` - `cargo test -p coh` - `cargo test -p cohsh` - `cargo test -p gpu-bridge-host` - `cargo test -p host-ticket-agent` - `cargo test -p root-task` - `cargo test -p tests --test host_ticket_agent` - `cargo test -p tests --test failover` - `cargo test -p coh-rtc` - `scripts/cohsh/run_regression_batch.sh` - `scripts/ci/gateway_perf_probe.sh --scenario delegated-rest-authority --state-dir out/bench/m27a-gateway-authority` --- ## Checks (Definition of Done) - Mutating REST request without delegated ticket is denied deterministically and audited. - Delegated caller cannot exceed ticket scopes/quotas even when gateway is multiplexing many clients. - Generated profile state and evidence distinguish gateway-enforced delegation from VM-verified caller identity; the default single-console projection cannot claim the latter. - Duplicate strict Queen intent (`id + idempotency_key`) never repeats side effects. - Legacy `/queen/ctl` fixtures either continue to pass through compatibility mode or are updated under the full breaking-change process with schema-version evidence. - Stale writer epoch is rejected deterministically across local and relayed host tickets. - Production manifest/profile fails validation if fixture/default secrets are present. - Production profile surfaces `/audit/*` and `/replay/*`; evidence packs include epoch and dedupe state. - Strict intent, WAL, receipt, audit, and evidence schemas preserve bounded optional correlation for `admission_id`, `intent_hash`, `policy_hash`, `state_epoch`, `resource_generation`, and `decision_expiry` without treating missing pre-28a fields as a fabricated admission. - `writer_epoch` remains the writer fence and is checked independently from decision state freshness and resource generations. - Host ticket targets and args are provider-validated before side effects; unsupported or ambiguous values fail deterministically with no executor call. - Host ticket crash/restart tests prove no silent duplicate host side effects after an executor succeeds but status writeback fails. - `gpu-bridge-host` rejects placeholder auth in live mode and refuses oversized peer frames before allocation. - Root-console arbitrary memory diagnostics are unavailable in release/production profiles or constrained to HAL-classified diagnostic ranges. - Generated profiles and docs may claim exact accepted 26e Worker/baseline-driver live cap authority and accepted Milestone 29 storage-runtime authority and basic containment only with matching owner-milestone evidence; they do not claim production Worker ticket/lease binding, complete driver-inventory ledger projection, or structured quarantine evidence until 28b exists. - Milestone 27d host-side AI control cannot be enabled in target profiles unless delegated REST identity, writer-epoch fencing, and audit/replay requirements are all active. - Applicable regression pack preserves compatibility-mode contract outputs; any production-mode fixture update caused by delegated REST identity or strict Queen intent envelopes follows the documented breaking-change process. - Gateway authority benchmark evidence shows delegated REST identity, idempotency, writer-epoch refusal, and audit/replay emission stay bounded; any material status/read or write-path regression is classified before downstream MCP/A2A or AI host-control milestones depend on the gateway. --- ## Compiler touchpoints - `coh-rtc` schema/version update for: - delegated-ticket enforcement policy on REST mutating paths, - delegated-identity claim class (`gateway_enforced` versus a separately evidenced `vm_verified` path) and gateway transport-authority ceiling, - idempotent Queen intent envelope schema, compatibility mode, and dedupe bounds, - writer-epoch fencing policy and relay requirements, - bounded future admission correlation fields (`admission_id`, `intent_hash`, `policy_hash`, `state_epoch`, `resource_generation`, and `decision_expiry`) in strict intent, WAL, receipt, audit, and evidence schemas without implementing 28a evaluation, - production secret references, - audit/replay required defaults for release profiles, - host-ticket provider target/arg grammars and execution WAL policy, - live host-bridge auth and frame-length limits, - profile-gated debug diagnostic policy, - deferred production Worker ticket/lease, driver-inventory projection, and structured-quarantine profile gates consumed by Milestone 28b, - provider-registry and host-AI enablement dependency gates consumed by Milestone 27b, Milestone 27d, and Milestone 30b. - Generated snippets refreshed in: - `docs/INTERFACES.md` - `docs/ARCHITECTURE.md` - `docs/SECURITY.md` - `docs/FAILOVER.md` --- ## Task Breakdown ``` Title/ID: m27a-rest-delegated-identity Goal: Require delegated capability tickets for mutating REST operations while preserving gateway multiplexing. Inputs: apps/hive-gateway, apps/coh, apps/cohsh, docs/HOST_API.md, docs/API_GUIDELINES.md Changes: - apps/hive-gateway/src/main.rs — require x-cohesix-ticket on mutating routes, intersect delegated scope with the gateway transport-authority ceiling, serialize the single upstream console session, and correlate each write with its upstream ACK/ERR result. - apps/hive-gateway/src/auth.rs — delegated ticket validation + bounded cache keyed by ticket hash, with explicit gateway-enforced versus VM-verified claim classification. - apps/coh/src/rest.rs — pass delegated ticket header for mutating REST calls. - apps/cohsh/src/transport/rest.rs — propagate delegated ticket on write paths. - docs/HOST_API.md + docs/API_GUIDELINES.md + resources/openapi/hive-gateway.yaml — version and document the delegated REST authority contract. Commands: cargo test -p hive-gateway && cargo test -p coh && cargo test -p cohsh Checks: Writes without delegated ticket fail deterministically; writes with scoped tickets succeed only within the intersection of caller claims and gateway ceiling; single-console profiles do not claim VM-verified caller identity. Deliverables: Gateway writes are caller-scoped and attributable without overstating the identity visible to the VM. Title/ID: m27a-queen-ctl-idempotency Goal: Add deterministic idempotency for Queen intents without silently breaking legacy /queen/ctl fixtures. Inputs: apps/root-task, apps/nine-door, docs/INTERFACES.md Changes: - apps/root-task/src/control/queen_ctl.rs — strict envelope parser with required id/idempotency_key, bounded optional future admission correlation (`admission_id`, `intent_hash`, `policy_hash`, `state_epoch`, `resource_generation`, `decision_expiry`), and dedupe guard for the versioned intent path or compatibility-gated /queen/ctl mode. - apps/root-task/src/control/dedupe.rs — bounded dedupe table with deterministic eviction and audit lines that preserve admission correlation when present without treating it as the dedupe key or a locally issued decision. - apps/nine-door/src/host/proc.rs — read-only dedupe status surface for operators. Commands: cargo test -p root-task && cargo test -p nine-door Checks: Duplicate intent never repeats side effects; deterministic audit and /proc visibility prove dedupe behavior; admission correlation cannot change across a duplicate; legacy raw /queen/ctl behavior is either preserved or changed only with schema-bump fixtures. Deliverables: Replay-safe Queen intent grammar with bounded dedupe state and explicit compatibility posture. Title/ID: m27a-failover-epoch-fencing Goal: Enforce monotonic writer-epoch fencing across local and federated host ticket flows. Inputs: apps/host-ticket-agent, docs/FAILOVER.md, docs/INTERFACES.md Changes: - apps/host-ticket-agent/src/spec.rs — add writer_epoch validation plus bounded optional `admission_id`, `intent_hash`, `policy_hash`, `state_epoch`, `resource_generation`, and `decision_expiry` correlation to host-ticket schemas; validate writer ownership separately from decision freshness. - apps/host-ticket-agent/src/relay.rs — enforce stale epoch rejection and WAL replay ordering by epoch. - apps/host-ticket-agent/src/status.rs — expose bounded epoch/fence counters for evidence and diagnostics. - scripts/failover_watchdog.py — make production cutover a durable transaction: verify old-writer fence, promote the new writer epoch, require uniquely correlated terminal receipts, then and only then change routing/symlink state; missing hooks, optional fencing, ambiguous receipt, failed post-cutover health, or rollback uncertainty enters fail-safe stopped state rather than silently continuing. - docs/FAILOVER.md — describe the current optional-hook path as development-only until this gate passes and make fencing/promotion mandatory in production. Commands: cargo test -p host-ticket-agent && cargo test -p tests --test failover Checks: Stale writer epoch intents are rejected deterministically and deadlettered; the old writer is proven fenced before the promoted epoch can resume writes or routing changes; crash/restart at every cutover boundary converges to one writer or fail-safe stop; absent hooks never count as successful production fencing. Deliverables: Explicit, verifiable writer fencing for active/standby failover. Title/ID: m27a-production-secret-profile Goal: Remove fixture/default secrets from release-grade manifests and enforce secret-reference policy. Inputs: configs/root_task.toml, tools/coh-rtc, apps/swarmui, apps/gpu-bridge-host, scripts/release_bundle.sh, release manifests/docs, docs/SECURITY.md Changes: - tools/coh-rtc/src/validate.rs — reject fixture key paths and bootstrap/default secret literals in production profiles. - configs/root_task.toml — introduce secret-reference fields for ticket and CAS signing material. - apps/swarmui/src/lib.rs + tests — reject `changeme` and every generated placeholder before live TCP connection; permit fixture credentials only in an explicit mock/replay constructor and invert the warning-only success regression. - apps/gpu-bridge-host/** + other live host clients — use the shared secret-reference resolver and reject placeholder or missing live credentials before transport setup. - scripts/release_bundle.sh + release docs — remove the fixture CAS private key and placeholder-token examples, include only public verification material, and scan exact bundle contents for private-key/token canaries. Do not mutate historical release directories; publish current errata and reject them as current templates. - scripts/ci/due_diligence_gate.sh — extend hardcoded-secret checks to generated manifests/profiles, all tracked examples/READMEs, package manifests, and assembled release contents. Commands: cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json && cargo test -p swarmui --test tcp_console_warning && cargo test -p gpu-bridge-host && scripts/ci/due_diligence_gate.sh && scripts/release_bundle.sh --check-manifest --pi4-stage-dir out/pi4-sd Checks: Production profile generation and release assembly fail on fixture/default/private keys, placeholder tokens, warning-only live clients, or unreferenced secret literals and pass only with scoped secret references/public verification material. Deliverables: Release-manifest secret hygiene is compiler-enforced, not convention-only. Title/ID: m27a-audit-replay-production-default Goal: Ship production profile with audit/replay enabled and include fencing/dedupe state in evidence packs. Inputs: configs/root_task.toml, apps/coh, docs/TEST_PLAN.md Changes: - configs/root_task.toml — production profile audit/replay defaults and bounded retention values. - apps/coh/src/evidence.rs — include writer-epoch and dedupe status snapshots plus bounded admission/intention/policy/state/resource/expiry correlation when present, without creating a decision locally. - docs/TEST_PLAN.md — add production-profile gate assertions for /audit and /replay availability. Commands: cargo test -p coh && cargo test -p tests --test evidence && scripts/cohsh/run_regression_batch.sh Checks: Evidence includes audit/replay plus fencing/dedupe state and preserves any exact admission correlation; writer and state epochs remain distinct; regression pack remains byte-stable. Deliverables: Audit-first production baseline with deterministic incident reconstruction inputs. Title/ID: m27a-host-ticket-validation-replay Goal: Harden host-ticket target/arg validation and make host side-effect replay durable across crashes. Inputs: apps/host-ticket-agent, docs/INTERFACES.md, docs/SECURITY.md, docs/FAILOVER.md Changes: - apps/host-ticket-agent/src/claim.rs — parse provider-specific target and arg newtypes with strict component, length, and token validation. - apps/host-ticket-agent/src/executors/mod.rs — dispatch only after manifest allowlist and provider grammar validation pass. - apps/host-ticket-agent/src/wal.rs — record prepared/executed/terminal states keyed by id + idempotency_key while preserving immutable admission/intention/policy/state/resource/expiry correlation when the generated action requires it. - apps/host-ticket-agent/tests/replay.rs — simulate crash after executor success but before status writeback. - docs/INTERFACES.md + docs/SECURITY.md — document host-ticket validation, replay states, and deterministic refusal semantics. Commands: cargo test -p host-ticket-agent && cargo test -p tests --test host_ticket_agent Checks: Invalid target/arg values never reach executors; crash/restart replay publishes or deadletters existing execution state without duplicating side effects. Deliverables: `/host/tickets/spec` is a durable, grammar-checked actuation lane rather than a best-effort command queue. Title/ID: m27a-python-authority-contract-parity Milestone: Milestone 27a — Authority Hardening: Delegated REST Identity, Fenced Failover, Idempotent Queen Intents / Python authority contract parity Goal: Keep Python REST writes, Queen intents, host tickets, secret handling, and evidence capture compatible with the generated delegated-identity, idempotency, writer-epoch, and audit/replay contract. Inputs: `m27-python-evidence-contract-parity`, `m27a-rest-delegated-identity`, `m27a-queen-ctl-idempotency`, `m27a-failover-epoch-fencing`, `m27a-production-secret-profile`, `m27a-audit-replay-production-default`, `m27a-host-ticket-validation-replay`, generated 27a policy and fixtures, tools/cohesix-py/cohesix/{auth.py,backends.py,orchestration.py,evidence.py}, tools/cohesix-py/tests/. Changes: - tools/cohesix-py/cohesix/backends.py + tools/cohesix-py/tests/test_rest_backend_auth.py — resolve and send gateway request authentication and a separate delegated capability ticket on mutating REST routes while preserving the existing read behavior unchanged until `m27b-read-visibility-classes`. Reject locally missing, placeholder, or malformed required credentials before mutation, and surface the gateway/agent's exact typed refusal for insufficient, overbroad, stale, or otherwise unauthorized delegated authority rather than claiming client-side authority adjudication. - tools/coh-rtc/src/codegen/cohesix_py.rs + tools/cohesix-py/cohesix/orchestration.py + tools/cohesix-py/tests/test_orchestration.py — consume the codegen-owned strict Queen-intent compatibility mode, id/idempotency-key requirements, writer-epoch bounds, provider target/arg schemas, and deterministic stale-writer or legacy-path refusals rather than hand-maintaining a looser Python envelope or editing `generated.py` directly. - tools/cohesix-py/cohesix/{auth.py,evidence.py} + tools/cohesix-py/tests/{test_auth.py,test_evidence_receipts.py} — reject placeholder live credentials, capture bounded writer-epoch/dedupe/audit/replay state using canonical evidence fields, and keep client observations distinct from authoritative target/provider receipts. - docs/PYTHON_SUPPORT.md + tools/cohesix-py/README.md — document delegated REST configuration, compatibility profiles, writer-epoch behavior, typed refusals, and the fact that Python does not gain identity or replay authority beyond the generated gateway/target contract. Commands: - python3 -m pytest -q tools/cohesix-py/tests/test_rest_backend_auth.py tools/cohesix-py/tests/test_orchestration.py tools/cohesix-py/tests/test_evidence_receipts.py tools/cohesix-py/tests/test_auth.py - scripts/check-generated.sh Checks: Python cannot issue a production REST mutation without both request authentication and a delegated ticket; the gateway/agent rejects insufficient, overbroad, stale, or wrong-scope authority and Python preserves that typed refusal; Python cannot omit, regress, or reuse a stale required writer epoch; preserves legacy intent behavior only where the generated profile explicitly permits it; validates structural provider-specific ticket targets/args before append; preserves the pre-27a read contract until 27b; and reports epoch/dedupe evidence without inventing authority, successful execution, or an authoritative receipt. Deliverables: Python clients remain protocol-faithful and fail closed under the complete Milestone 27a host/gateway authority floor. Title/ID: m27a-gpu-bridge-auth-frame-caps Goal: Enforce live GPU bridge auth discipline and bounded peer frame allocation. Inputs: apps/gpu-bridge-host, docs/HOST_TOOLS.md, docs/GPU_NODES.md, docs/SECURITY.md Changes: - apps/gpu-bridge-host/src/main.rs — reject placeholder auth outside mock/test mode and require explicit token/env resolution for live publish. - apps/gpu-bridge-host/src/console.rs — cap length-prefixed frames before allocation and return deterministic errors on oversize input. - apps/gpu-bridge-host/tests/auth_frame_bounds.rs — placeholder-auth and oversized-frame negative tests. - docs/HOST_TOOLS.md + docs/GPU_NODES.md — document live auth requirements and frame-size limits. Commands: cargo test -p gpu-bridge-host && cargo test -p coh --features mock Checks: Live bridge cannot start with placeholder auth; malicious or corrupted frame lengths are rejected without unbounded allocation. Deliverables: GPU bridge remains a bounded host-side projection of Cohesix authority. Title/ID: m27a-console-debug-memory-gate Goal: Gate arbitrary memory diagnostics behind explicit bring-up policy and HAL-classified ranges. Inputs: apps/root-task/src/kernel.rs, apps/root-task/src/hal, docs/SECURITY.md, docs/HARDWARE_BRINGUP.md Changes: - apps/root-task/src/kernel.rs — compile or profile gate raw hexdump commands out of production/release console builds. - apps/root-task/src/hal/mod.rs — expose diagnostic-range classification for allowed bring-up memory reads where needed. - apps/root-task/tests/console_debug_gate.rs — prove release profile rejects hexdump and bring-up profile bounds addresses/lengths. - docs/SECURITY.md + docs/HARDWARE_BRINGUP.md — document emergency diagnostic scope and production refusal behavior. Commands: cargo test -p root-task --test console_debug_gate && cargo test -p root-task Checks: Production console cannot read arbitrary memory; bring-up diagnostics are range-bounded and audited. Deliverables: Debug memory access is no longer an unbounded operator surface. Title/ID: m27a-deferred-vm-authority-gates Goal: Add explicit validation/docs gates that separate model-only, accepted pre-28b task/driver authority, and 28b production ticket/lease plus driver-bundle/quarantine claims. Inputs: accepted 26e Worker/linked-driver evidence, conditional accepted Milestone 29 storage-runtime evidence, tools/coh-rtc/src/**, docs/WORKER_TICKETS.md, docs/SECURITY.md, docs/TEST_PLAN.md, docs/BUILD_PLAN.md. Changes: - tools/coh-rtc/src/** — profile states for model/session-only roles, accepted 26e isolated-task and linked-driver authority, conditional accepted Milestone 29 storage-runtime authority, 27a host-authority readiness, and 28b production Worker ticket/lease binding plus driver-inventory/structured-quarantine closure; no active endpoint-only compatibility tier. - docs/WORKER_TICKETS.md + docs/SECURITY.md + docs/TEST_PLAN.md — document that 26e owns complete Worker task containment and baseline linked-driver authority and Milestone 29 owns its selected storage-runtime containment, while production Worker ledger binding, complete selected-driver inventory projection, and structured quarantine remain pending until 28b evidence exists. Commands: - cargo test -p coh-rtc - scripts/check-generated.sh Checks: - Profiles cannot claim 28b production Worker ticket/lease binding, driver-inventory ledger projection, or structured quarantine authority from 27a alone, cannot reduce executable 26e Worker/driver authority to endpoint-only metadata compatibility, and cannot select a Milestone 29 storage runtime without its owner-milestone containment evidence. Deliverables: - Honest dependency gate for 27c/27d/27e/28c/30b host semantic, inference, and actuation work plus 28b VM authority closure. Title/ID: m27a-gateway-authority-performance Goal: Prove delegated REST identity, idempotency, writer-epoch fencing, and audit/replay emission stay bounded in the gateway path. Inputs: apps/hive-gateway, apps/host-ticket-agent, scripts/rest_perf_harness.py, docs/BENCHMARKS.md, docs/TEST_PLAN.md. Changes: - scripts/ci/gateway_perf_probe.sh — targeted gateway benchmark scenarios for read-only status, delegated writes, duplicate-idempotency refusal, stale-writer refusal, and audit/replay emission cost. - docs/BENCHMARKS.md + docs/TEST_PLAN.md — classify gateway authority benchmark evidence separately from Pi/QEMU throughput proof. Commands: - scripts/ci/gateway_perf_probe.sh --scenario delegated-rest-authority --state-dir out/bench/m27a-gateway-authority Checks: - Read/status latency, delegated write latency, refusal counts, broker queue depth, ticket-cache behavior, and audit emission cost remain bounded or are classified before 27c/27d/27e/28c depend on the gateway. - Probe evidence preserves no-retry accounting and does not count as fresh Pi hardware throughput proof unless it exposes a runtime-path regression that triggers the full REST harness. Deliverables: - Gateway authority performance ledger for downstream MCP/A2A and AI-host-control milestones. ``` --- ## Outcome After Milestone 27a: - REST multiplexing retains convenience without collapsing caller identity. - Failover safety relies on deterministic writer fencing, not operator luck. - Queen control retries are safe by construction. - Release profiles enforce key hygiene and enable audit-grade reconstruction by default. - Production coexistence is still not complete until Milestone 27b turns the hardened authority floor into provider schemas, identity mapping, deployment artifacts, and conformance evidence. - Host-side AI supervisors gain no special bypass: they inherit delegated identity, idempotency, fencing, and audit/replay before any live actuation is allowed. - Milestone 28a can bind its per-intent decisions to durable 27a identity, idempotency, fencing, WAL, audit, and replay records without overloading `writer_epoch` as state freshness. - Production Worker ticket/lease bundle binding, projection of the already complete applicable driver MMIO/DMA/shared-ring inventory, and structured quarantine/evidence remain explicitly pending for Milestone 28b rather than being buried inside the host/gateway authority floor; complete basic Worker task containment already belongs to 26e. ## Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance [Milestones](#Milestones) **Delivery posture:** Release A implements one narrow reference slice, not the entire catalogue. Required live rows are `jetson`, `network`, `nvidia`, `cuda`, `nvml`, `gpu.workload`, `peft`, `model_registry`, `systemd`, and `docker`, plus the exact `coh`, Python, gateway, host-ticket-agent, evidence, release-bundle, and SwarmUI surfaces used by the walkthrough. The selected Jetson workflow proves a hardened systemd execution unit and a digest-pinned NVIDIA-container lane rather than treating service or container presence as execution evidence. Optional Triton or Transformers executor rows are selected by the reference profile. Kubernetes, Apple ML, FUSE, federation, SIEM/OTel exporters, OT/industry protocols, and unrelated playbooks remain generated as disabled or typed unavailable until a named use case funds their complete conformance. Their absence does not block Release A. **Why now (coexistence floor):** Milestone 25g delivered the host-ticket mechanism and high-value adapters. Milestone 27a makes writes attributable, replay-safe, fenced, durable, and audit-first. The remaining adoption gap is broader: Cohesix needs one compiler-owned provider/action contract, real conformance evidence for each ecosystem it claims to coexist with, and installable host-side deployment shapes that do not smuggle new authority or heavy stacks into the VM. This milestone turns the hardened authority floor into a production coexistence gate before semantic extraction, AI run control, inference interoperability, MCP/A2A, or AI namespace work can depend on those providers. **As-built alignment note:** Current host tools already project some live GPU/CUDA/NVML inventory, host-side PEFT/model lifecycle files, host sidecar state, host tickets, REST gateway access, evidence packs, and SIEM exports. Kubernetes, systemd, Docker, launchd/macOS, NVIDIA/CUDA/NVML/MIG, Apple GPU runtimes, PEFT, FUSE, federation, and sidecar flows have an uneven mix of real commands, fixtures, mock/dry-run coverage, and known production gaps. In particular, current GPU publication is not GPU execution/device-isolation proof; MIG exists only in the Python mock; `coh run` and the vadd/matmul job path execute locally or synthesize status without binding CUDA; live model publication can fall back to fixture models and an implicit active model; Python can author its own “receipts”; PEFT examples create literal fake adapter bytes; FUSE does not yet prove the canonical `/shard` view on every supported host; federation is not yet a durable end-to-end receipt relay; systemd/Kubernetes/NVIDIA “discovery” can read target-preseeded topology; Jetson/network providers are success no-ops; MODBUS/DNP3 delivery is an in-memory model; all nine built-in playbooks stop after generic control writes/probes; SwarmUI's Playwright lane injects a fake Tauri bridge; and evidence/SIEM/release helpers do not yet provide one strict proof and package boundary. Cohesix therefore does **not** yet have one generated integration dependency and provider/action contract shared by host-ticket-agent, REST, Python, FUSE, UI, later semantic extractors, inference gateways, MCP/A2A, docs, packaging, release checks, and tests. It also lacks ecosystem-wide live conformance, production install bundles, identity-federation mappings, Prometheus/OpenTelemetry projections, and a use-case evidence matrix that separates executable-Worker proof from real external execution. Milestone 26e freezes the compiler-owned `host-integration-dependency/v1` graph and proves direct executable Worker control plus fixture-backed GPU and PEFT result-to-Worker receipt paths. This milestone extends that same graph; it must not create a parallel hand-maintained catalog. A 26e `worker-runtime` release is a prerequisite for any use-case row that names an executable Worker, but it is not by itself production provider, data-plane, or use-case acceptance. **Prerequisites** - Milestone **27** completed for read-only inspect, attest, evidence, and audit-ledger refresh. - Milestone **27a** completed for delegated REST identity, idempotent intents, writer-epoch fencing, production audit/replay defaults, host-ticket durable execution, live bridge auth/frame caps, and production debug gates. - Milestone **26e** completed for executable Heartbeat/GPU/LoRA Workers, strict version-2 Worker action/result schemas, crash-safe local result delivery, and accepted QEMU/Pi Worker integration evidence. - Milestone **25g** and **25h** remain compatibility inputs, but their earlier ticket/relay implementation is not production coexistence proof. Federation timeout, WAL ordering, pending retention, and terminal-receipt return must pass this milestone's conformance gate before federation may be enabled in a production use-case row. - Milestone **29** is additionally required for any use-case row that claims VM restart persistence. Milestone **28b** is additionally required for any row that claims production ticket/lease binding to a live deployed Worker bundle. **Goal** Define and prove the production coexistence contract: 1. Extend the 26e integration dependency graph with one provider/action and integration-surface registry from compiler IR, and use it everywhere host-side actuation, semantic extraction, inference, or projection is described, validated, displayed, packaged, or exposed. 2. Map enterprise, Kubernetes, and host identities into delegated Cohesix tickets without making an identity provider part of the VM TCB. 3. Prove provider and external-executor conformance for the selected reference slice first: Jetson/network state, NVIDIA/CUDA/NVML, real bounded GPU workloads, PEFT/model registry, and the selected inference reload path. Additional providers are independently promoted only with a complete use case and do not enlarge the first release gate. 4. Prove only the non-provider surfaces that complete the selected workflow: direct console/`cohsh`, REST/gateway, Python, SwarmUI, CAS, evidence/release, and the Jetson/network sidecars. Other generated surfaces remain explicitly unavailable until accepted. 5. Package gateway, host-ticket-agent, sidecar bridges, GPU bridge, evidence exporters, exact Worker-compatible schemas, and doctor checks as installable host-side bundles for realistic coexistence deployments. 6. Turn every playbook selected for the reference release into a generated `preflight -> admit -> execute -> observe -> verify -> recover` workflow with explicit node topology and named provider/data-plane owners. Unselected built-in playbooks are retained only as typed unavailable templates and cannot claim ecosystem support. The use-case evidence matrix prevents any public scenario, demo, or runbook from claiming an integration without its executable-Worker tier, external executor/data-plane owner, generated policy, tests, deployment instructions, failure recovery, and evidence-pack reconstruction. Generic schedule/lease/export writes never constitute workflow success. 7. Classify every ecosystem-facing read projection as public, delegated-ticket scoped, or admin-only before REST, MCP, A2A, FUSE, Python, or UI clients can expose it. 8. Make the Cohesix ticket id the shared correlation key across native provider objects, logs, metrics, traces, artifacts, checkpoints, and receipts while preserving the rule that labels, annotations, environment fields, and provider metadata are correlation only and never authority. 9. Give operators one generated ticket-centred lifecycle across providers: `plan -> apply -> watch -> explain -> verify -> recover`, with evidence-pack reconstruction and compensation using the same provider/action graph rather than ecosystem-specific scripts or client-invented state. 10. Make each evidence pack a cross-system evidence graph keyed by one Cohesix ticket. Offline, that ticket must answer: who requested the action; why it was allowed; what actually ran; which resources it reserved and consumed; whether it worked; and how an authorized operator can reproduce or reverse it. Every answer resolves to validator-accepted records and immutable refs, or to an explicit `missing|unavailable|unverified` result—never inference from file presence, native labels, or an apparently successful transcript. **Non-Goals (Explicit)** - No in-VM Kubernetes, Docker, systemd, CUDA/NVML, PEFT, NeMo, Prometheus, OpenTelemetry, DICOM, CCSDS, MODBUS, CAN, DNP3, IEC-104, or other ecosystem runtime. - No POSIX compatibility layer, libc facade, process supervisor, shell command executor, package manager, or mutable general-purpose filesystem inside Cohesix. - No direct host executor calls from REST, Python, MCP, A2A, FUSE, or UI code. Side effects still resolve to validated Cohesix control files or `/host/tickets/spec`. - No provider-specific schema maintained only in docs, Python, OpenAPI, MCP, or an executor crate. Provider action truth comes from generated manifests and checked registry output. - No write-capable OT/industry sidecar action until the corresponding read-only evidence, safety policy, failure mapping, and operator approval flow are proven. - No identity claim, group, service account, or model prompt text is authorization by itself. All authority resolves to delegated Cohesix tickets and manifest-scoped actions. - No Cohesix replacement for systemd supervision, the Docker Engine, Kubernetes scheduling/controllers, CUDA execution/profiling, PEFT training, NeMo orchestration, or their hot data planes. Native metadata carries correlation; only validated Cohesix ticket/grant and provider-result chains carry Cohesix authority. ## Deliverables **Release A acceptance boundary:** The registry and matrix remain extensible, but Release A completion is determined only by the selected Jetson/Linux reference rows above. Long provider lists in the deliverables are catalogue schema requirements or later conformance candidates; they are not an instruction to implement every provider before the first useful AI release. ### 1) Generated provider action and integration-surface registry **Purpose:** Extend the 26e dependency graph so provider actions and all workflow-facing host surfaces have one compiler-owned contract instead of hand-aligned adapters. Implementation requirements: - Extend `coh-rtc` with `providers.*` IR for: - provider id, version, enablement profile, action names, target selectors, dry-run/live mode, idempotency requirements, writer-epoch requirements, policy approval requirements, receipt schema, redaction rules, and evidence refs. - a common provider-adapter lifecycle for `discover`, `preflight`, `execute`, `observe`, `verify`, `compensate`, and `export_evidence`, including the phase owner, timeout, idempotency/fencing rule, expected postcondition, compensation boundary, and typed unavailable behavior. Provider-specific code implements this generated contract; it cannot redefine lifecycle or receipt semantics. - canonical native identity and correlation fields, including provider object UID/generation or invocation/container/job identity, Cohesix ticket and evidence ids, native event cursor/range, artifact digest, selected evidence profile, and observation source/time/TTL. A mutable native label, annotation, environment field, or job name is never sufficient to validate authority or terminal success. - admission metadata for every side-effecting action: `intent_schema_ref`, `required_fact_schema_ref`, `policy_id`, `decision_requirement`, `maximum_grant_scope`, `state_freshness_bound`, `reservation_or_recheck_mode`, and `decision_receipt_schema_ref`. Release A live actions explicitly generate `decision_requirement = unavailable`, `admission_mode = operator_approved`, and `operator_approval_required = true`; read-only/non-consequential actions may generate `decision_requirement = not_required`. Release B governed actions generate the exact 28a requirement. Callers cannot select or weaken any posture. - supported and selected `observe|recommend|enforce` governance modes, authority/credential custodian, bypass posture, failure/fallback posture, shadow-evidence requirement, and the exact generated decision/grant/receipt contracts used by each mode. Evidence mode and governance mode remain orthogonal: a live observer is not an enforcing authority. - initial families: `systemd`, `launchd`, `docker`, `k8s`, `nvidia`, `cuda`, `nvml`, `mig`, `apple_ml`, `jetson`, `network`, `gpu.lease`, `gpu.workload`, `peft`, `model_registry`, `mac_release`, `endpoint_compliance`, `siem`, `prometheus`, `otel`, `modbus`, `dnp3`, `can`, `iec104`, `dicom`, and `ccsds`. - optional future families, including semantic extractors/stores and inference gateways/providers, may be reserved but must generate unavailable status until their owning Milestone 27c or 27e implementation and tests exist. - Extend the same IR with `integration_surfaces.*` records for: - `direct_console`, `cohsh`, `coh`, `host_ticket_agent`, `hive_gateway`, `rest`, `fuse_direct`, `fuse_rest`, `python_sdk`, `swarmui`, `federation`, `fleet`, `gpu_bridge`, `host_sidecar`, `cas`, `evidence`, `release_bundle`, `siem`, `prometheus`, `otel`, `jetson`, and `network`; - surface owner, transport/topology, read/write posture, required provider actions, required Worker roles and evidence tier, identity/secret requirements, durability owner, package artifacts, conformance runner, and explicit `live`, `fixture`, `mock`, `dry_run`, `disabled`, `missing`, or `unknown` observed mode; - `jetson` and `network` have real host-native read providers when selected: bounded Jetson board/JetPack/power/thermal/clock/CUDA observations and bounded macOS/Linux interface/link/address/route/error-counter snapshots. Unsupported hosts return typed unavailable; no-op success is prohibited. - Each 27b record extends a stable 26e integration row and preserves its `integration_id`; a provider or surface may not silently replace, rename, or weaken the 26e role-required receipt rows. - Generate or check the registry for: - `host-ticket-agent` validators/executors, - `coh` and `cohsh` host-tool help, - Python SDK integration defaults, - OpenAPI/REST docs, - later semantic extractor/object schemas, inference compatibility/provider profiles, MCP tool schemas, and A2A skill schemas, - docs snippets and test fixtures. - Generate a language-neutral provider-adapter ABI/conformance vector set plus the Rust and Python bindings required by selected profiles. Kubernetes or other ecosystem-native controllers may consume generated schemas in their implementation language, but no independently maintained action catalogue or receipt vocabulary is permitted. - Reject provider actions with free-form shell commands, arbitrary host paths, raw provider credentials, unbounded payloads, or target grammars that cannot be validated before executor dispatch. - Fail generation when a public scenario, playbook, demo, runbook, package, or host binary references an unregistered provider/surface, or when an enabled surface lacks an exact package artifact and conformance owner. ### 2) Ecosystem conformance matrix **Purpose:** Distinguish real coexistence from mock-only or aspirational support. Implementation requirements: - Add a checked matrix covering each enabled provider: - supported host OS/profile, - provider version bounds or unavailable state, - auth mode, - mock, dry-run, and live-safe coverage, - negative cases, - expected receipt fields, - evidence-pack reconstruction path, - failure and rollback behavior. - Add the corresponding integration-surface columns for topology/transport, required Worker evidence tier, external executor or data-plane owner, identity/secrets, durability/retention, packaging, recovery/fail-safe behavior, and read projection. - Minimum acceptance families: - systemd status/start/stop/restart through the Manager D-Bus API, plus selected bounded transient-unit execution, exact unit/invocation identity, hardened resource/sandbox properties, structured journal correlation, and observed service result; `systemctl` text and command exit are not proof, - launchd status/start/stop/kickstart plus macOS package/service identity, - Docker status/stop/restart through a version-negotiated Engine API, with digest-pinned image/container identity, ticket/evidence labels used only for correlation, filtered event capture, final inspect/health/exit/OOM verification, and bounded log refs. An optional Engine authorization plugin is independently classified and cannot claim enforcement for protocol paths the plugin does not intercept, - Kubernetes cordon/drain/lease-sync/RBAC-to-ticket translation plus an optional generated `CohesixAction` custom-resource/controller profile whose immutable spec and status subresource expose the same ticket lifecycle. Prefer native CEL admission for bounded object checks, use webhooks only where native policy is insufficient, and version-gate DRA/ResourceClaim or device-allocation support rather than making it a baseline dependency, - NVIDIA/CUDA/NVML physical and MIG inventory, parent/child topology and generation, GPU lease projection, separately from GPU execution/device isolation, - bounded GPU workload submit/cancel/observe against an allowlisted host CUDA executor, with exact physical/MIG lease binding and no arbitrary shell/inline code. Use the ticket id as the native GPU job/correlation id; collect bounded NVML/CUDA observations everywhere supported, DCGM job/health data on profiles that provide it, and CUPTI/NVTX traces only in an explicit overhead-bounded deep-evidence profile, - optional Apple-Silicon MPS/MLX/Metal provider/executor profiles for playbooks that explicitly select local Apple GPU execution; Mac controller/remote-CUDA profiles never probe local NVML, - PEFT/model registry export/import/activate/rollback receipts, separately from training, evaluation, scanning, and inference-runtime reload, - SIEM export, - Prometheus/OpenTelemetry read-only export, - live MODBUS/DNP3 provider conformance from reopened Milestone 18, with read-only defaults and separately approved write/control actions, - CAN/IEC-104/DICOM/CCSDS explicitly staged as read-only or not-enabled until their bridge contracts land. - Unsupported providers must produce deterministic `not_enabled` or `not_implemented` diagnostics; silent omission is not acceptable for documented use cases. ### 2a) External executor and data-plane conformance **Purpose:** Ensure a receipt describes an observed external outcome, not merely a successful host-tool call. Implementation requirements: - Define generated conformance contracts for external executors/data planes that remain outside the Cohesix TCB: - `gpu_executor`: selected physical or MIG device identity and topology generation, memory and stream admission, lease epoch/TTL, revoke/preempt behavior, device/context isolation, allowlisted artifact/entrypoint, observed start/finish/failure/cancel, CAS output hashes, and correlation to the exact WorkerGpu/provider receipt; - `peft_pipeline`: artifact export, training/fine-tuning handoff, evaluation thresholds, safety/format scan, content-addressed import, atomic activation, inference-runtime reload/canary, and rollback, correlated to the exact WorkerLora receipt; - `service_executor`: systemd/Docker/Kubernetes target identity, admission/fencing, observed terminal state, timeout, and recovery; - `federation_relay`: WAL-before-forward, enforced timeout, non-evictable pending intent, target terminal receipt return, source correlation, and recovery after process restart. - Provider discovery and publication are separate from execution. Live NVML/CUDA inventory, `/gpu/models`, or a successful lease projection cannot satisfy `gpu_executor`; local PEFT filesystem mutation cannot satisfy training, evaluation, scan, or runtime reload. - Production GPU workload actions are generated `submit|cancel|observe` records over the existing host-ticket authority. They accept bounded CAS/artifact and entrypoint references, never free-form commands or inline arbitrary PTX; direct `subprocess.run`, `echo ok`, vadd/matmul descriptor synthesis, and status breadcrumbs remain diagnostics/fixtures and cannot satisfy execution. - A use case may remain `integration_pattern`, `fixture`, `mock`, `dry_run`, or `not_enabled` without a reference executor. It may become `production_proven` only when a named external executor/data-plane implementation, deployment profile, failure/recovery tests, and live evidence are shipped or explicitly supplied and accepted by the conformance runner. - Milestone 27c owns semantic object/extractor/capsule implementation and Milestone 27d owns the production PEFT/training/evaluation/reload transaction. Milestone 27e owns the compatible inference wire, provider adapters, and inference receipts. This milestone owns their common registry floor, system/GPU/provider conformance, federation closure, and the fail-closed classification used by every use case. ### 2b) Jetson Orin Nano live reference profile **Purpose:** Make the physical-GPU and Jetson provider lanes executable on the current ARM64 edge reference without pretending that datacenter-only features exist on the device. Implementation requirements: - Add a generated `jetson-orin-nano-jp7` host profile whose initial accepted reference is Jetson Orin Nano 8GB, AArch64 Ubuntu 24.04, Jetson Linux/L4T 39.2.1, JetPack 7.2.1, CUDA 13.2.1, compute capability 8.7, and the exact installed NVIDIA package/runtime versions captured by conformance evidence. These values identify this reference, not open-ended compatibility bounds; another JetPack/L4T combination requires its own tested profile or typed unavailable status. - Treat Orin Nano memory as shared system/GPU memory. Discovery records total device-visible memory, current free memory, reserved host headroom, admitted bytes, and the observation time/TTL. Workload admission uses the bounded available budget, never the marketed 8GB module size or a stale inventory value. - The Orin Nano reference has one physical CUDA device and no MIG, DLA, or PVA. MIG discovery and execution must return generated `not_supported` for this profile and cannot block the physical-GPU lane or produce MIG evidence. DLA and PVA are not GPU-workload fallbacks. - NVML feature limitations are expected on this profile. Inventory and doctor must exercise the deterministic NVML-to-CUDA fallback and still report exact driver/runtime, memory, SM count, and device identity. CUDA 13 sonames and the unversioned toolkit symlink must be covered without removing older supported CUDA profiles. - Record read-only Jetson board identity, L4T/JetPack package versions, active power mode, clocks, throttling/thermal state, kernel, NVIDIA container runtime, and NVMe-backed model/cache/runtime roots. Conformance must not change `nvpmodel`, force clocks, restart networking/VNC, or reboot the host unless a separately selected disruptive test profile explicitly authorizes and restores that state. - Run real bounded vector-add and matrix-multiply references from NVMe-backed CAS/build storage. Live negative coverage includes wrong-device, over-budget memory admission, timeout, cancel, revoke, bridge restart, stale inventory, and output-hash mismatch. It must not deliberately exhaust the Nano's shared RAM; CUDA OOM mapping uses an isolated memory-capped child or deterministic fault injection, while the live oversized request is rejected before allocation. - Keep native-process and NVIDIA-container execution as separate provider observations. A selected container lane pins the image digest and proves GPU access through the installed NVIDIA Container Runtime; container presence or `docker info` alone is not CUDA execution evidence. ### 3) Read visibility classification **Purpose:** Ensure read-only projections do not leak cross-caller state. Implementation requirements: - Generate or check a visibility class for every provider, evidence, ticket, audit, replay, telemetry, and `/proc` read exposed to REST, Python, FUSE, UI, later MCP, or later A2A surfaces: - `public` for non-sensitive version/capability summaries, - `ticket_scoped` for caller-owned tickets, receipts, provider status, run/checkpoint state, and evidence refs, - `admin_only` for global provider state, deadletters, audit/replay internals, identity-mapping diagnostics, and raw conformance snapshots. - Read-only REST compatibility mode may remain gateway-role scoped only for paths explicitly classified as public or admin-only under the configured gateway role. Ticket-scoped reads require delegated identity before they can be exposed through multi-caller surfaces. - Negative tests must prove a caller cannot read another caller's host tickets, provider receipts, evidence artifacts, task state, or identity-mapping diagnostics through REST, Python, FUSE, MCP, A2A, or UI projections. ### 4) Enterprise identity and subject mapping **Purpose:** Let existing identity systems coexist with Cohesix without entering the VM TCB. Implementation requirements: - Add host-side subject mappers for OIDC/JWT claims, SPIFFE IDs, Kubernetes service accounts/RBAC, and local host identities where enabled. - Mappers produce delegated Cohesix ticket requests or ticket references; they do not mint authority outside the existing Cohesix ticket rules. - Generated policy defines accepted issuer/audience/subject/group mappings, TTL bounds, role scopes, provider action scopes, and audit subject normalization. - Forged, expired, overbroad, wrong-audience, or unmapped claims fail before any mutation reaches REST, `/queen/ctl`, or `/host/tickets/spec`. ### 5) Packaging and deployment profiles **Purpose:** Make coexistence deployable without bespoke host assembly. Implementation requirements: - Add installable host-side profiles for: - local macOS operator, - Linux/systemd edge node, - GPU host/Jetson-compatible host sidecar mode, - Kubernetes-adjacent gateway/agent deployment using Helm, Kustomize, or plain YAML. - Each profile has an exact generated artifact manifest rather than a non-empty-directory check. As applicable it names `coh`, `cohsh`, `hive-gateway`, `host-ticket-agent`, `host-sidecar-bridge`, `sidecar-bus`, `gpu-bridge-host`, FUSE helpers, CAS/evidence/export tools, Python extras, OpenAPI, generated provider/integration registries, service manifests, and doctor checks; a selected missing or wrong-version artifact fails packaging. - Each artifact is checked for expected type, target architecture, version, digest, feature/provider registry, and signature/SBOM membership; unexpected files are rejected. Python ships from a clean wheel/sdist manifest rather than a recursive source-tree copy. Private fixture keys, placeholder tokens, mock-only data, compiled stub binaries, and unregistered executables are forbidden. - Systemd units, launchd examples, container manifests, and Kubernetes manifests must run with least privilege, explicit secret refs, loopback-by-default network posture, and documented non-loopback risk overrides. - FUSE packages must prove the canonical `/shard//worker//...` namespace through both direct and REST backends on each supported host; a legacy `/worker` allowlist or documented macOS write `EINVAL` is not production acceptance. - Kubernetes packages must define service-account/RBAC mapping, secret refs, readiness/liveness, disruption/restart behavior, writer fencing, and exactly-once ticket recovery; systemd and container packages must provide equivalent identity, secret, restart, and state-directory ownership. - Selected systemd packages use the Manager D-Bus API and hardened persistent or transient units with explicit credential, device, filesystem, network, memory/CPU/runtime, notification/watchdog, and journal-correlation posture. Selected Docker packages use API-version negotiation and least-privilege socket/proxy access; selected Kubernetes packages ship generated CRD, controller, status/condition, CEL policy, RBAC, and `kubectl`-plugin assets only when that provider row is independently promoted. - Hardened units/manifests exist for every selected gateway, ticket agent, GPU bridge/executor, sidecar, bus provider, and exporter; the current single minimally configured gateway unit cannot satisfy a deployment profile. - Offline release documentation must not depend on CDN assets. The OpenAPI document and any Swagger/viewer assets are bundled or the offline viewer is disabled with a deterministic local alternative. - `coh doctor` reports installed provider status, missing optional providers, native API/version and capability negotiation, auth configuration, ticket scope, registry version, evidence export availability, and packaging drift. ### 6) Observability and compliance projections **Purpose:** Fit existing monitoring/compliance systems without replacing them. Implementation requirements: - Extract one schema-versioned evidence/receipt validator shared by Rust host tools, the Python SDK, SwarmUI, release checks, CI, and exporters. It verifies the evidence manifest, file hashes, signatures/attestations when configured, identity and manifest bindings, sequence/epoch/TTL, chronology, and the ticket -> admission -> Worker/provider/executor -> terminal-result graph. File presence, non-zero size, a local command transcript, or a client-created JSON object cannot satisfy an authoritative receipt or evidence check. - Prometheus and OpenTelemetry exporters are host-side read-only projections from `/proc`, audit, replay, telemetry, provider receipts, and evidence-pack summaries. - SIEM exports remain bounded, redacted, schema-versioned JSONL/NDJSON with stable field names. - Exporters consume only records accepted by the shared validator and preserve source identity, cursor, registry/schema version, and authoritative/non- authoritative classification. Malformed, unverifiable, stale, or partially correlated records are rejected or emitted to a bounded diagnostic lane, never silently upgraded. - SIEM delivery has a generated field allowlist and redaction/hash policy plus a durable bounded cursor/WAL, TLS and credential references, retry/backoff, backpressure, deadletter handling, and destination acknowledgement receipts. A copied local file is fixture evidence, not live SIEM delivery proof. - Exporters must not expose raw tickets, ticket payloads, secret refs, provider credentials, large payloads, PHI, model weights, gradients, or prompt transcripts unless a documented profile explicitly authorizes the field and redaction policy. - Evidence packs include provider registry version, conformance matrix snapshot, identity-mapping decision refs, packaging profile, exporter schema version, and provider receipt correlation. - Preserve the deterministic directory pack, but make its manifest a bounded causal evidence graph over intent, fact snapshot, decision/approval, grant, native execution object, observations, verification, terminal receipt, and compensation/recovery. Large logs, traces, checkpoints, model artifacts, and native event exports remain in NVMe-backed CAS or configured object storage; the pack carries hashes, bounded summaries, cursors, and durable refs. - Define generated evidence profiles such as `standard`, `incident`, `performance`, and `deep_gpu`. A provider cannot silently escalate capture cost or data sensitivity. Optional host-side in-toto statements, SLSA provenance for genuine build actions only, OpenTelemetry spans, and CloudEvents are derived projections from validator-accepted graph records; they never replace the Cohesix receipt or become authority. ### 7) OT and industry sidecar staging **Purpose:** Keep industrial/health/science integrations as host-side bridges with explicit safety posture. Implementation requirements: - MODBUS and DNP3 use the real host-only codecs, transports, durable acknowledgement-aware spool, target maps, and safety allowlists delivered by reopened Milestone 18; 27b registers, packages, and proves those exact implementations instead of adding read-only aliases or a second bridge. - CAN, IEC-104, DICOM, and CCSDS adapters remain host-side sidecars only and stay explicitly `not_implemented` until their real bounded bridge contract, package, and conformance lane land. - Read-only inventory/status/event capture must land before write/control actions for each provider family. - Any write-capable action requires a separate provider action, explicit policy approval, target grammar, safety interlock description, dry-run fixture, live-safe refusal case, and evidence-pack reconstruction. - DICOM and other sensitive-domain adapters must default to metadata and evidence refs only; raw PHI or large payload publication is disabled unless a later profile explicitly approves the redaction and retention model. ### 8) Use-case evidence matrix and release gate **Purpose:** Prevent documentation from outrunning implementation. Implementation requirements: - Generate stable `use_case_id` rows and check every public claim source, including `README.md`, `docs/USE_CASES.md`, `docs/HOST_TOOLS.md`, `docs/GPU_NODES.md`, `docs/PYTHON_SUPPORT.md`, `docs/HOST_API.md`, `docs/INTERFACES.md`, `docs/API_GUIDELINES.md`, `docs/ARCHITECTURE.md`, `docs/SECURITY.md`, `docs/TEST_PLAN.md`, every post-Milestone-24 activity/runbook in this plan, release documentation, OpenAPI examples, and all built-in Python playbooks. - The initial inventory must include the six AI Hive scenarios; all nine built-in playbooks (`mac-release-factory`, `mac-private-peft-grid`, `mac-endpoint-compliance`, `jetson-traffic-safety`, `jetson-manufacturing-safety`, `jetson-critical-infra`, `mixed-closed-loop-ai-factory`, `mixed-medical-edge-ai`, and `mixed-logistics-digital-twin`); the Security Evidence, Operator-First, LeJEPA, and Jetson Gesture Language activities; and Milestone 18 industrial patterns. - Classify each row as exactly one of `current_primitive`, `integration_pattern`, `workflow_template`, `mock_only`, `read_only`, `not_enabled`, `planned`, or `production_proven`. A playbook that runs against a mock backend remains `workflow_template` or `mock_only`, never `production_proven`. - Each row records milestone prerequisites; target/profile; Worker tier (`model_or_session`, `m26e_executable`, or `m28b_production_bundle`); topology/transport; required host tools and exact package artifacts; provider actions and read surfaces; external executor/data-plane owner; authority/identity/secret refs; authority/credential custodian and bypass posture; supported and selected governance mode; shadow-evidence/promotion refs where selection or actuation is automated; durability/retention owner; rollback/recovery/fail-safe behavior; observability/evidence; and proof class. - Conditional validation is fail-closed: a row claiming an executable Worker requires accepted 26e target evidence; restart-persistent VM state requires Milestone 29; a production ticket/lease bound to a deployed Worker requires Milestone 28b; a semantic-context claim requires accepted Milestone 27c snapshot/capsule evidence; a PEFT training-to-runtime claim requires the Milestone 27d transaction; and an auditable compatible-inference claim requires accepted Milestone 27e provider/receipt evidence. - Each production-proven row must link to: - provider registry action(s), - delegated authority requirement, - package/deployment profile, - identity mapping where relevant, - observability/export surface, - failure-mode fixture, - evidence-pack reconstruction path. - Every shipped built-in playbook must resolve to a generated staged workflow with explicit `preflight`, `admit`, `execute`, `observe`, `verify`, and `recover` nodes; each node names its host, target hive, Worker role when any, provider action, external data-plane owner, input/output refs, timeout, cancellation/idempotency rule, and authoritative terminal evidence. The Mac controller, remote CUDA/Jetson nodes, optional local Apple GPU executor, and deployment-supplied domain applications must never be inferred from the machine running the CLI. Missing executors or applications yield typed unavailable and cannot be replaced by a successful generic schedule, lease, export, or probe. - Scan commands, YAML, unit files, examples, and runbooks for credentials or tokens in argv, manifests, logs, or evidence; use secret refs, protected files, stdin, or platform secret stores instead. - Release gates fail if any public surface claims production coexistence without the exact integration graph rows, generated policy, executable-Worker tier, live external executor where required, tests, package manifest, identity/security posture, failure recovery, and evidence reconstruction. ### 9) Provider/exporter performance guard **Purpose:** Prove provider conformance, read-visibility checks, identity mapping, and exporter projections remain bounded without turning coexistence validation into a full runtime throughput gate. Implementation requirements: - Add a targeted provider/exporter timing mode to the conformance runner for registry lookup, target validation, read-visibility refusal, identity-mapping refusal, receipt rendering, and Prometheus/OpenTelemetry/SIEM export over representative evidence packs. - Report per-provider p50/p95, refusal counts, exporter row/byte counts, and artifact-size bounds. - Compare against the accepted 26d rolling baseline only for shared REST/read status context; provider/exporter results are host-side coexistence evidence, not Pi hardware proof. **Commands** - `cargo test -p coh-rtc` - `cargo test -p host-ticket-agent` - `cargo test -p coh` - `cargo test -p cohsh` - `cargo test -p hive-gateway` - `cargo test -p gpu-bridge-host -p host-cuda -p host-sidecar-bridge -p sidecar-bus` - `python -m pytest tools/cohesix-py/tests/test_integrations.py` - `python -m pytest tools/cohesix-py/tests/test_evidence_receipts.py` - `python -m pytest tools/cohesix-py/tests/test_playbooks.py` - `scripts/check-generated.sh` - `scripts/ci/check_host_integration_inventory.py --registry configs/generated/host_integration_dependency.json` - `scripts/ci/provider_conformance_run.sh --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m28b` - `scripts/ci/provider_conformance_run.sh --native-providers --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-native` - `scripts/ci/provider_conformance_run.sh --provider gpu.workload --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-gpu-workload` - `scripts/ci/provider_conformance_run.sh --provider jetson --host-profile jetson-orin-nano-jp7 --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-jetson-orin` - `scripts/ci/provider_conformance_run.sh --provider gpu.workload --host-profile jetson-orin-nano-jp7 --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-jetson-gpu` - `scripts/ci/provider_conformance_run.sh --perf-only --matrix configs/provider_conformance.toml --state-dir out/bench/m27b-provider-overhead` - `scripts/ci/use_case_gate.sh --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m28b` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m27b-coexistence` **Checks (Definition of Done)** - Provider actions, the common adapter lifecycle, native identity/correlation fields, evidence profiles, and integration surfaces extend the 26e dependency graph; host-ticket-agent, REST/OpenAPI docs, FUSE, Python defaults, native controllers, SwarmUI, packages, host tools, and later MCP/A2A schema inputs cannot drift independently. - Every side-effecting provider action carries one compiler-owned 28a admission contract covering intent/fact schemas, policy, decision requirement, maximum grant scope, freshness, reservation/recheck mode, and decision receipt; Rust, Python, REST, host-ticket-agent, later MCP/A2A, docs, tests, and packages consume the same metadata. - Every REST/Python/FUSE/UI read projection is classified as public, ticket-scoped, or admin-only; cross-caller ticket, provider, evidence, audit, replay, and identity reads fail deterministic negative tests. - Invalid provider target, action, argument, auth, writer epoch, idempotency key, dry-run/live-mode, or identity claim fails before executor dispatch. - Every documented production provider has mock, dry-run, negative, and at least one live-safe conformance path or an explicit not-enabled status. - GPU discovery/publication and GPU execution/device isolation are separately evidenced; PEFT filesystem lifecycle and the full export/train/evaluate/scan/import/activate/reload transaction are separately evidenced; neither may borrow the other's proof. - The `jetson-orin-nano-jp7` lane proves the physical CUDA path with exact JetPack/L4T/package/device/power/thermal identity, bounded shared-memory admission, and deterministic NVML fallback. MIG/DLA/PVA remain typed unsupported, and no negative test intentionally exhausts shared system RAM or mutates the operator's power, network, display, or boot state. - The selected Jetson systemd and Docker lanes bind immutable unit invocation, image/container, CUDA device/job, event cursor, output, and ticket/receipt identities. Kubernetes CRD/controller, webhook, DRA, DCGM, CUPTI, and Docker authorization-plugin capabilities remain independently versioned and cannot be inferred from adjacent provider presence. - FUSE proves canonical `/shard` behavior and supported-host read/write/error semantics; federation proves WAL-before-forward, enforced timeout, retained pending intent, target terminal receipt return, and restart recovery; selected Jetson/network providers return real bounded host-native observations, while unsupported profiles return typed unavailable and no no-op can report success. - Kubernetes RBAC, OIDC/JWT, SPIFFE, and local-host subject mappings produce bounded delegated ticket scopes and deterministic audit lines. - Packaging artifacts deploy only host-side tools and preserve loopback defaults, least privilege, secret references, and delegated-ticket write requirements. - Prometheus/OpenTelemetry/CloudEvents/in-toto/SLSA/SIEM outputs are read-only, bounded, redacted, schema-versioned, source-correlated, and reconstructable from validator-accepted Cohesix evidence without becoming authority; SLSA is emitted only for real build actions, and live SIEM delivery additionally proves durable cursor/WAL, retry/backpressure/deadletter, TLS/credential refs, and destination acknowledgement. - OT/industry sidecars remain host-only, read-only-first, and profile-gated; write-capable actions are refused unless explicitly admitted by provider policy and approval flow. - Evidence packs retain their deterministic directory shape and include a validator-checked causal manifest over provider registry, conformance matrix, identity mapping, approval/decision/grant, native execution objects, observations, verification, provider/Worker receipts, recovery, packaging profile, exporter schemas, and content-addressed external refs. - Given only an evidence pack and ticket id, the offline verifier answers who, why, what ran, reserved/observed resource use, verified outcome, and reproducibility/reversal for that action with exact source refs. A required missing or ambiguous causal node fails acceptance; reproduce and reverse are rendered as bounded authorized plans with exact artifacts, configuration, preconditions, idempotency state, and compensation target, never executed by opening or inspecting the pack. - One generated ticket-centred host-tool journey can plan, apply, watch, explain, verify, recover, and export the same workflow without parsing native CLI text or inventing ecosystem-specific authority state. - Every public scenario, playbook, demo, runbook, and example has one stable use-case row. A row can reach `production_proven` only when its Worker tier, provider/surface modes, external executor, package artifacts, authority, recovery, and live evidence all satisfy the generated graph. - Provider/exporter performance evidence shows registry lookup, validation/refusal, identity mapping, receipt rendering, and exporter projection remain bounded; material regressions are classified as host provider overhead, gateway/auth overhead, or evidence-pack size overhead before 27c/27d/27e/28c/30b depend on the coexistence registry. - `docs/USE_CASES.md`, `docs/HOST_TOOLS.md`, `docs/API_GUIDELINES.md`, `docs/INTERFACES.md`, `docs/ARCHITECTURE.md`, `docs/SECURITY.md`, and `docs/TEST_PLAN.md` describe support levels exactly as proven. **Compiler touchpoints** - `coh-rtc` extends `host-integration-dependency/v1` and emits provider registry artifacts, provider-adapter lifecycle/ABI vectors, canonical native identity/correlation/event fields, evidence profiles, integration-surface records, external-executor contracts, stable use-case rows, provider availability snippets, provider action schemas, 28a intent/fact/policy/decision/scope/freshness/reservation metadata, supported/selected governance modes, authority-custody and bypass posture, failure/fallback posture, shadow-promotion requirements, read visibility classes, identity-mapping bounds, conformance matrix defaults, exporter schema bounds, and exact package profile metadata. - `coh-rtc` also emits native discovery-source/TTL contracts, GPU physical/MIG topology and workload-action bounds, authoritative receipt/evidence correlation schemas, exporter delivery/redaction policy, and generated playbook DAG/topology/recovery records; clients may format these records but cannot define parallel truth. - Manifest validation rejects enabled provider actions without target grammar, authority scope, idempotency policy, receipt schema, redaction policy, and evidence mapping. Enforced selection or actuation additionally fails generation without an authority custodian, bypass and failure posture, accepted provider/executor conformance, and the required shadow-promotion reference. - Generated docs distinguish current primitives, integration patterns, workflow templates, mock-only, read-only, not-enabled, planned, and production-proven integrations without conflating executable Workers with external execution. ## Task Breakdown ``` Title/ID: m27b-provider-action-registry Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-provider-action-registry Goal: Extend the 26e integration dependency graph with the compiler-owned provider/action registry used by host tickets, REST/OpenAPI docs, Python, host tools, and later MCP/A2A schemas. Inputs: configs/generated/host_integration_dependency.json, tools/coh-rtc, apps/host-ticket-agent, apps/coh, apps/cohsh, tools/cohesix-py, docs/INTERFACES.md, docs/HOST_API.md. Changes: - tools/coh-rtc/src/ir.rs — `providers.*` schema for action names, targets, evidence modes, supported/selected governance modes, authority and credential custodian, bypass and failure/fallback posture, shadow-promotion requirements, receipts, redaction, evidence refs, and the shared 28a `intent_schema_ref`, `required_fact_schema_ref`, `policy_id`, `decision_requirement`, `maximum_grant_scope`, `state_freshness_bound`, `reservation_or_recheck_mode`, and `decision_receipt_schema_ref` fields for side-effecting actions. Each action additionally generates its `discover|preflight|execute|observe|verify|compensate|export_evidence` lifecycle, canonical native target identity, expected postcondition, native correlation/event-cursor fields, and evidence profile. - tools/coh-rtc/src/codegen/{docs,rust,cohesix_py}.rs — generated provider registry artifacts, language-neutral adapter ABI/conformance vectors, Python defaults, and snippets. - apps/host-ticket-agent/src/registry.rs — consume generated provider/action metadata before executor dispatch. - apps/coh/src/provider.rs + apps/cohsh/src/provider.rs — display generated provider action availability without hand-maintained lists. - tools/cohesix-py/cohesix/integrations.py + tools/cohesix-py/tests/test_integrations.py — consume the coh-rtc-generated Python provider output for action ids, target schemas, modes, bounds, receipt refs, and typed unavailable state; reject any handwritten Python provider-action catalogue, direct edit of `generated.py`, or client-selected promotion to `live`. Commands: cargo test -p coh-rtc && cargo test -p host-ticket-agent && cargo test -p coh && cargo test -p cohsh && python3 -m pytest -q tools/cohesix-py/tests/test_integrations.py -k provider_registry Checks: Provider action schemas, adapter lifecycle, native identity/correlation, evidence profiles, and admission metadata cannot drift between executor validation, Rust/Python host tools, ecosystem-native controllers, REST, docs, packages, and future gateway protocol schema inputs; Python exposes the same generated availability, governance mode, decision requirement, grant ceiling, freshness/recheck posture, bypass/failure posture, promotion state, and refusals; no client can promote itself from observe/recommend to enforce, weaken required admission, or treat mutable native metadata as a grant. Deliverables: Single source of truth for host-side ecosystem action and adapter lifecycle semantics across Rust, Python, and selected native-controller consumers. Title/ID: m27b-integration-surface-registry Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-integration-surface-registry Goal: Register every host projection, package, and workflow dependency against the same integration graph as provider actions and executable Workers. Inputs: m26e-production-surface-truth-and-stub-retirement, m26e-host-integration-dependency-contract, configs/generated/{implementation_surface_inventory,host_integration_dependency}.json, all Cargo targets/features, Python packages/examples, scripts, nested READMEs, canonical/generated docs, release assets, resources/openapi/hive-gateway.yaml, packaging, and scripts/release_bundle.sh. Changes: - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/codegen/{docs,rust}.rs — `integration_surfaces.*` schema and generated surface/package/dependency records. - configs/host_integration_acceptance.toml — extend stable 26e ids with 27b provider, surface, executor, package, and proof obligations. - scripts/ci/check_host_integration_inventory.py — consume the 26e implementation-surface inventory and inspect host binaries and libraries exposed as products, projections, packages, Python APIs/examples, scenarios, playbooks, demos, runbooks, generated files, nested READMEs, and release assets; fail on unregistered, silently omitted, production-reachable fixture/stub/no-op, or unowned surfaces. - docs/HOST_TOOLS.md + docs/INTERFACES.md — generated availability and trust-boundary tables. Commands: cargo test -p coh-rtc && scripts/ci/check_host_integration_inventory.py --registry configs/generated/host_integration_dependency.json && scripts/check-generated.sh Checks: Direct console, REST, FUSE, Python, SwarmUI, federation, fleet, CAS, evidence/release, telemetry/exporters, GPU/sidecar bridges, and Jetson/network surfaces have explicit owners, modes, packages, Worker tiers, and conformance lanes; no-op adapters, mock-only examples, retired binaries, or undocumented library entrypoints cannot report live or enter a production package. Deliverables: Exhaustive compiler-owned host integration inventory extending the 26e graph. Title/ID: m27b-public-surface-live-mode-gate Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-public-surface-live-mode-gate Goal: Ensure every public host command, example, report, service, and package declares its real execution/proof mode and can never fall through from live operation to a fixture. Inputs: m26e-production-surface-truth-and-stub-retirement, m27b-integration-surface-registry, generated implementation/integration inventories, apps/{coh,cohsh,hive-gateway,host-ticket-agent,host-sidecar-bridge,gpu-bridge-host,swarmui}/**, tools/cohesix-py/**, scripts/cohsh/run_demo.coh, demo/**, all public READMEs/docs/examples, service definitions, scripts/release_bundle.sh. Changes: - generated surface metadata — project every public entrypoint onto the existing implementation/observed/proof classes, including explicit fixture/host-model/dry-run, live-host, live-QEMU, live-Pi, unavailable, deferred, and retired states; do not invent a second authority or evidence vocabulary. - host CLI/service selection — production/default invocations require an explicit generated live profile/endpoint or fail typed unavailable. Mock backends require an explicit flag and fixture-capable build/profile; remove `cohsh`'s implicit mock default and environment-only mock switches such as a service silently honoring `HIVE_GATEWAY_MOCK` in a production unit. - public examples/demos — move queue/status fabrication such as `scripts/cohsh/run_demo.coh` and fake PEFT adapter assets into clearly named fixtures, or replace the public path with the real ticket -> admission -> provider/executor -> Worker terminal flow owned by 27b/27d. Every output/report embeds mode, source identity, graph version, and proof class. - package/docs gate — exclude fixture keys, placeholder credentials, synthetic topology/artifacts, test-only binaries, retired stubs, and mock-only examples from live packages; nested READMEs/help/current release docs describe the selected implementation mode and exact owner. Historical releases remain immutable and receive current errata only. - scripts/ci/check_public_surface_modes.py — scan compiled feature closures, CLI defaults/help, environment selection, examples, reports, service manifests, docs, and release contents against the generated inventories. Commands: cargo test -p coh -p cohsh -p hive-gateway -p host-ticket-agent -p host-sidecar-bridge -p gpu-bridge-host && python -m pytest tools/cohesix-py/tests && python3 scripts/ci/check_public_surface_modes.py --implementation configs/generated/implementation_surface_inventory.json --integrations configs/generated/host_integration_dependency.json && scripts/release_bundle.sh --check-manifest --pi4-stage-dir out/pi4-sd Checks: No release/default command or service starts a mock backend implicitly; no fixture, fabricated state, client-authored receipt, placeholder credential, mock-only demo, or synthetic artifact can produce a live-host/QEMU/Pi or production-use-case record; explicit fixture/dry-run lanes remain deterministic and useful. Deliverables: Fail-closed public mode selection and packaging, with retained mocks visibly and mechanically isolated from live Cohesix claims. Title/ID: m27b-external-executor-conformance Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-external-executor-conformance Goal: Prove that provider receipts correlate to observed external effects rather than discovery, publication, or command dispatch alone. Inputs: provider/integration registries, apps/host-ticket-agent, apps/gpu-bridge-host, crates/host-cuda, PEFT/model-registry tools, systemd/Docker/Kubernetes fixtures, scripts/ci/provider_conformance_run.sh, m26e Worker integration evidence. Changes: - tools/coh-rtc/src/ir.rs — generated GPU, PEFT pipeline, service executor, and federation relay conformance contracts. - apps/host-ticket-agent/src/providers/ — strict observed-result correlation for systemd, launchd, Docker, Kubernetes, GPU, and declared external executors; discovery or dispatch success alone is non-terminal. - apps/gpu-bridge-host/** + crates/host-cuda/** — execute generated bounded workload actions on the exact admitted physical/MIG device and topology generation, and return observed cancellation/revocation/terminal state plus CAS output hashes; GPU hardware access remains in `gpu-bridge-host`. - scripts/ci/provider_conformance_run.sh — separate discovery/publication, dispatch, terminal outcome, isolation, timeout, revoke, restart, and recovery evidence. - docs/GPU_NODES.md + docs/HOST_TOOLS.md — distinguish live inventory, lease projection, execution, isolation, and Worker receipt proof. Commands: cargo test -p host-ticket-agent && cargo test -p gpu-bridge-host && scripts/ci/provider_conformance_run.sh --executors-only --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-executors Checks: Live GPU execution names the device/MIG instance, topology generation, memory/stream admission, isolation, lease epoch/TTL, revoke/cancel, output refs, and observed terminal result; service executors prove fenced terminal state; PEFT pipeline rows remain integration-pattern/not-enabled until 27d supplies the full transaction. Deliverables: Fail-closed external execution evidence tied to exact Worker receipts. Title/ID: m27b-native-provider-discovery-and-actions Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-native-provider-discovery-and-actions Goal: Replace target-preseeded topology and success no-ops with real bounded host-native discovery and terminal action observation for every selected host provider. Inputs: provider/integration registries, apps/host-sidecar-bridge/**, apps/host-ticket-agent/**, tools/cohesix-py/cohesix/integrations.py, apps/gpu-bridge-host/**, macOS launchd/Xcode tooling, Linux systemd/Docker/Kubernetes APIs, Jetson host interfaces, docs/HOST_TOOLS.md, docs/USE_CASES.md. Changes: - host provider implementations — read systemd, launchd, Docker, Kubernetes, NVIDIA/CUDA/NVML, Jetson board/JetPack/power/thermal/clock, and macOS/Linux network interface/link/address/route/error-counter state from the selected host's native bounded APIs or allowlisted structured utilities; never treat target-preseeded `/host` data as discovery input. - systemd provider — use the Manager D-Bus API for discovery and lifecycle, support selected hardened transient units for bounded external work, bind exact unit/invocation identity and properties, consume `sd_notify` state where provided, and capture a bounded structured-journal cursor range. `systemctl` display text or zero exit status is never terminal evidence. - Docker provider — use a version-negotiated Engine API, exact image digest and container identity, filtered ticket-labelled events, final inspect, health/exit/OOM state, and bounded log refs. Labels are correlation only; optional Engine authorization-plugin conformance remains a separately enabled enforcement surface with its protocol limitations recorded. - Kubernetes provider — use canonical object UID/resourceVersion/generation, status conditions, audit identity, and watch cursors. When selected, ship a generated `CohesixAction` CRD/controller projection and native CEL admission checks for digest, grant-ref, service-account, and resource bounds; webhook or version-gated DRA support remains independently enabled and evidenced. - apps/host-ticket-agent/** — execute only generated allowlisted actions, bind the exact native target and writer/idempotency fence, observe the provider's terminal state, and emit an authoritative provider result; command exit alone is not success. - macOS providers — add launchd lifecycle, explicit Mac-controller versus remote-CUDA/Jetson versus optional local-Apple-GPU topology, Xcode build/test/archive plus codesign/notary/App Store Connect release steps, and endpoint-compliance observation through generated credential/secret refs. A Mac controller does not probe local NVML unless a local NVIDIA provider is explicitly selected. - provider snapshot publication — publish authenticated versioned source/sequence/epoch/time/TTL records into the target's generated host snapshot interface; expiry or source failure withdraws state instead of retaining a healthy fixture. - conformance — run macOS-native, Linux/systemd, Kubernetes, NVIDIA GPU, and Jetson/network live lanes where selected; unsupported provider/host combinations return typed unavailable. Commands: cargo test -p host-ticket-agent && cargo test -p host-sidecar-bridge && python -m pytest tools/cohesix-py/tests/test_integrations.py && scripts/ci/provider_conformance_run.sh --native-providers --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-native Checks: No selected provider reports success from `Ok(())`, target-preseeded data, CLI display text, mutable label/annotation state, a fixture, or command dispatch alone; each live state/action names its native source, immutable target identity and generation/invocation, event cursor/range, observation time/TTL, verified postcondition, terminal outcome, and authoritative receipt, and stale state becomes unavailable. Deliverables: Real host-native discovery/action providers for the advertised macOS, Linux, Kubernetes, NVIDIA, Jetson, and network profiles. Title/ID: m27b-gpu-workload-and-mig-executor Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-gpu-workload-and-mig-executor Goal: Replace synthetic GPU job status and mock-only MIG topology with a real bounded CUDA executor and exact physical/MIG lease enforcement in `gpu-bridge-host`. Inputs: provider/executor registries, apps/gpu-bridge-host/**, crates/host-cuda/**, apps/host-ticket-agent/**, apps/coh/src/{gpu.rs,run.rs}, CAS tools, accepted WorkerGpu v2 receipt path, live NVIDIA/MIG test hosts, docs/GPU_NODES.md, docs/SECURITY.md. Changes: - crates/host-cuda/** + apps/gpu-bridge-host/** — enumerate live NVML MIG GPU/compute instances with parent/child UUIDs, profile, memory, placement, and topology generation; fence stale generations and bind lease/execution to the exact physical device or MIG instance. - apps/gpu-bridge-host/** — implement generated bounded `gpu.workload.submit|cancel|observe` execution for allowlisted CAS artifacts/entrypoints, including memory/stream admission, context/process isolation, deadline, lease TTL/epoch, revoke/preempt, cancellation, CUDA failure mapping, output CAS hashes, and one correlated terminal provider/WorkerGpu record. CUDA/NVML access remains exclusively in this host tool. - NVIDIA evidence adapters — use the Cohesix ticket id as the external GPU job and trace-correlation key; export bounded CUDA/NVML identity and health on every supported profile, DCGM job/health/energy/utilisation/error summaries where DCGM is available, and an opt-in CUPTI/NVTX trace hash only for an explicit `deep_gpu` evidence profile with declared overhead and profiling- resource coordination. Missing DCGM/CUPTI is typed capability state, not a failure of a valid Jetson CUDA path. - apps/host-ticket-agent/** + generated local provider ABI — validate the Cohesix ticket/action and forward the admitted request to `gpu-bridge-host` through a compiler-declared authenticated bounded host-local transport; it cannot submit raw commands, inline PTX, arbitrary paths, or bypass lease/MIG fencing. - apps/coh/src/{gpu.rs,run.rs} — expose the generated workload lifecycle and classify plain local subprocess execution separately as a non-authoritative host operation report; `echo ok`, vadd/matmul descriptors, breadcrumbs, or a successful lease cannot satisfy GPU execution. - conformance/evidence — prove real vector-add and matrix-multiply reference workloads plus cancel, timeout, revoke, over-budget admission, CUDA OOM mapping, stale-MIG-generation, wrong-device, bridge restart, and output-hash cases on physical and MIG-capable profiles where advertised. Shared-memory Jetson profiles reject oversized live requests before allocation and test CUDA OOM mapping only through an isolated memory-capped child or deterministic fault injection. Commands: cargo test -p host-cuda && cargo test -p gpu-bridge-host && cargo test -p host-ticket-agent && cargo test -p coh --test gpu_workload && scripts/ci/provider_conformance_run.sh --provider gpu.workload --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-gpu-workload Checks: A live GPU result is impossible without observed CUDA execution on the exact lease-bound physical/MIG target and generation, and reconstructs admission, native job identity, isolation, cancellation/revoke, outputs, bounded health/resource observations, terminal status, and exact WorkerGpu correlation; fixture descriptors remain test-only, DCGM cannot substitute for execution, and CUPTI capture is never silently enabled. Deliverables: Real CUDA/MIG workload execution and evidence, distinct from discovery, model publication, and lease projection. Title/ID: m27b-jetson-orin-nano-live-conformance Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-jetson-orin-nano-live-conformance Goal: Prove the generated Jetson provider and physical CUDA executor on the maintained Jetson Orin Nano 8GB reference host without requiring unsupported accelerators or disruptive host changes. Inputs: m27b-native-provider-discovery-and-actions, m27b-gpu-workload-and-mig-executor, `jetson-orin-nano-jp7` generated profile, JetPack/L4T package inventory, CUDA driver/runtime APIs, NVIDIA Container Runtime, `/mnt/nvme` reference layout, docs/GPU_NODES.md, docs/HOST_TOOLS.md, docs/TEST_PLAN.md. Changes: - configs/provider_conformance.toml + generated provider/profile records — exact AArch64, Ubuntu, L4T, JetPack, CUDA, compute-capability, shared-memory, physical-device, unsupported-MIG/DLA/PVA, power/thermal observation, container-runtime, and NVMe evidence requirements. - crates/host-cuda/** + apps/gpu-bridge-host/** — CUDA 13-compatible discovery and bounded native physical-device workload execution with live free-memory/headroom admission; retain older supported CUDA/NVML profiles. - apps/host-sidecar-bridge/** — bounded read-only Jetson board, package, power, clock, thermal/throttle, and storage observations from allowlisted native sources, with typed unavailable fields where the SKU exposes no source. - scripts/ci/provider_conformance_run.sh — `--host-profile jetson-orin-nano-jp7 --live-reference` routing, exact-host preflight, non-disruptive default, native/container lane separation, safe negative cases, raw log redaction, and evidence capture under the selected NVMe state directory. - systemd/Docker reference execution — launch the accepted bounded workload through a hardened systemd unit and a digest-pinned NVIDIA-container lane, bind unit invocation, container/image, CUDA device/job, ticket, CAS output, and receipt identities, and retain large container/journal/trace artifacts under the selected NVMe evidence root. - docs/GPU_NODES.md + docs/HOST_TOOLS.md + docs/TEST_PLAN.md — operator prerequisites, non-disruptive default, unsupported-feature behavior, exact commands, and proof boundaries. Commands: cargo test -p host-cuda && cargo test -p gpu-bridge-host && cargo test -p host-sidecar-bridge && scripts/ci/provider_conformance_run.sh --provider jetson --host-profile jetson-orin-nano-jp7 --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-jetson-orin && scripts/ci/provider_conformance_run.sh --provider gpu.workload --host-profile jetson-orin-nano-jp7 --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-jetson-gpu Checks: Exact live inventory and doctor fallback pass; bounded native vector-add and matrix-multiply execute on the admitted physical Orin device and produce verified CAS outputs; the selected systemd and digest-pinned NVIDIA-container lanes correlate native invocation/container/event identity to the same ticket and terminal CUDA result; cancel/timeout/revoke/restart/wrong-device/stale- inventory/over-budget cases fail safely; MIG/DLA/PVA and unsupported DCGM features report typed unavailable; the run does not reboot, change power mode, force clocks, restart network/VNC, or consume unsafe shared-memory headroom. Deliverables: Repeatable, non-disruptive Jetson Orin Nano live provider and physical-GPU conformance evidence that cannot be mistaken for MIG, datacenter-GPU, QEMU, Pi, or NeMo acceptance. Title/ID: m27b-authoritative-receipt-and-evidence-core Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-authoritative-receipt-and-evidence-core Goal: Stop clients from manufacturing receipts and make every host/UI/export/release proof consumer validate the same authoritative result graph. Inputs: root-admitted ticket/action and Worker v2 records, provider/executor terminal records, apps/coh/src/{gpu.rs,run.rs,evidence.rs,evidence_timeline.rs}, tools/cohesix-py/cohesix/{client.py,receipts.py}, apps/hive-gateway/**, apps/swarmui/**, release/CI evidence checks, schemas/fixtures/docs. Changes: - shared host evidence/receipt crate — parse and verify schema/version, canonical bytes, manifest and component hashes, configured signature/attestation chain, source identity, ticket/subject/action/idempotency/writer epoch, target manifest, sequence/epoch/TTL, Worker/provider/executor correlation, terminal uniqueness, and chronology with bounded inputs and typed errors. - apps/coh/** + tools/cohesix-py/** — consume root-admitted and Worker/provider/executor terminal records as authoritative receipts. Rename locally assembled ACK/argument/snapshot summaries to a versioned non-authoritative operation report; they cannot use a receipt schema, enter an authoritative evidence graph, or promote a use case. Apply the required schema/fixture/docs migration atomically. - apps/hive-gateway/** + apps/swarmui/** + exporters/release/CI — use the shared Rust implementation or generated language-neutral conformance vectors; reject missing, stale, forged, partially correlated, duplicate-terminal, wrong-manifest, or client-created records consistently. - apps/coh/src/evidence.rs + evidence timeline — hash every included file, bind the implementation/provider/use-case graph versions, record authoritative versus derived artifacts, and verify the complete graph before an evidence pack is accepted or exported. Preserve the deterministic directory layout while materialising a bounded causal graph over intent, facts, approval/decision, grant, native execution object, observations, verification, terminal receipt, and compensation. Large journal/container/Kubernetes/CUDA/PEFT artifacts remain in NVMe-backed CAS or configured object storage and enter the pack only through validated hashes, summaries, cursors, and refs. - derived attestation/telemetry projections — generate optional in-toto statements, SLSA provenance only for genuine build actions, OpenTelemetry spans, and CloudEvents from validator-accepted graph records. Preserve the authoritative/derived distinction and never accept an imported projection as a Cohesix receipt. Commands: cargo test -p coh --test receipts && cargo test -p coh --test evidence_pack && cargo test -p hive-gateway && cargo test -p swarmui && python -m pytest tools/cohesix-py/tests/test_evidence_receipts.py && scripts/ci/provider_conformance_run.sh --evidence-only Checks: Rust, Python, REST/UI, CI, release, and exporter vectors agree byte-for- byte; no local transcript, arguments, file-presence check, client JSON, native label/annotation, OTel span, CloudEvent, or imported attestation can pass as an authoritative receipt; every accepted terminal result has one validated causal chain to admitted authority and exact target/provider/Worker/executor identity, and missing native evidence is explicit rather than inferred. Deliverables: One strict authoritative receipt/evidence core, a deterministic causal evidence manifest with content-addressed external refs, and an honest separately named local operation-report/derived-export format. Title/ID: m27b-federation-conformance Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-federation-conformance Goal: Close federation durability and receipt-correlation gaps before multi-hive workflows can be production-proven. Inputs: apps/host-ticket-agent, its relay/WAL modules, federation manifests/fixtures, provider/integration registries, docs/SECURITY.md, docs/TEST_PLAN.md. Changes: - apps/host-ticket-agent/src/relay/** + apps/host-ticket-agent/src/wal/** — WAL-before-forward, enforced deadlines, non-evictable pending intents, target terminal receipt return, source correlation, and restart replay/fencing. `sidecar-bus` remains the Milestone 18 field-bus provider and is not the federation authority owner. - scripts/ci/provider_conformance_run.sh — federation fault injection for timeout, disconnect, duplicate, target refusal, full queue, and process restart. - docs/INTERFACES.md + docs/SECURITY.md — terminal receipt, durability, and fail-closed federation contract. Commands: cargo test -p host-ticket-agent && scripts/ci/provider_conformance_run.sh --provider federation --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-federation Checks: No intent is forwarded before durable WAL, no pending entry is evicted, configured timeout is enforced, and the source receives the uniquely correlated target terminal receipt after normal and restart paths. Deliverables: Federation may be enabled only with durable, replay-safe, end-to-end receipt evidence. Title/ID: m27b-live-reference-workflows Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-live-reference-workflows Goal: Replace generic-write/probe playbook endings with complete generated workflows and explicit host/target/data-plane topology for every shipped built-in playbook. Inputs: provider/integration/use-case registries, tools/cohesix-py/cohesix/{playbooks.py,playbook_cli.py}, tools/cohesix-py/examples/use_case_playbook.py, all nine built-in playbooks, GPU/MIG executor, native providers, deployment packages, evidence core, docs/USE_CASES.md. Changes: - tools/coh-rtc/src/** + generated playbook records — define bounded staged DAG nodes for `preflight`, `admit`, `execute`, `observe`, `verify`, and `recover`, including controller host, target hive/node, Worker role, provider action, external application/data-plane owner, refs, deadline, cancellation/idempotency/fencing, compensation, and authoritative evidence. - apps/coh/** + generated CLI records — provide one ticket-centred operator journey equivalent to `plan`, `apply`, `watch`, `explain`, `verify`, `recover`, and ticket-scoped `evidence pack`. Existing command families may host the generated subcommands, but every surface must render the same lifecycle nodes, native identities, refusal reason, expected postcondition, compensation state, and authoritative/derived evidence classification. - tools/cohesix-py/cohesix/playbooks.py — implement those generated stages for `mac-release-factory`, `mac-private-peft-grid`, `mac-endpoint-compliance`, all three Jetson workflows, and all three mixed-fleet workflows. Mac release uses launchd/Xcode/codesign/notary/App Store Connect providers; Mac PEFT selects remote CUDA or an explicit Apple provider; Jetson/medical/safety/logistics domain applications are named signed deployment dependencies and return typed unavailable when absent. - tools/cohesix-py/examples/** — keep mock/dry-run examples as explicit workflow fixtures and add live configuration examples that reference secret stores and deployment manifests, never embedded credentials or synthetic terminal records. - recovery/evidence tests — inject provider, Worker, gateway, network, executor, and verification failures at each stage and prove bounded cancel/compensate/retry behavior plus one reconstructable terminal result. Commands: python -m pytest tools/cohesix-py/tests/test_playbooks.py && python -m cohesix.playbook_cli --list && scripts/ci/provider_conformance_run.sh --playbooks --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27b-playbooks && scripts/ci/use_case_gate.sh --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m27b-playbooks Checks: Every shipped playbook traverses the generated stages in live mode, names every node and external owner, is inspectable through one ticket-centred host-tool timeline, and fails closed when a provider/application/evidence dependency is missing; schedule, lease, export, probe, native-object creation, or local mock success cannot become workflow success. Deliverables: Nine complete, topology-explicit, fail-closed host workflows with mock fixtures and real-provider acceptance lanes kept distinct, plus one shared operator lifecycle for planning, following, explaining, verifying, recovering, and exporting evidence for them. Title/ID: m27b-ecosystem-conformance-matrix Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-ecosystem-conformance-matrix Goal: Add provider conformance fixtures and evidence lanes for production coexistence claims. Inputs: configs/provider_conformance.toml, scripts/ci/, docs/TEST_PLAN.md, docs/USE_CASES.md. Changes: - configs/provider_conformance.toml — provider version, profile, auth, mock/dry-run/live-safe, negative, receipt, and evidence requirements. - scripts/ci/provider_conformance_run.sh — deterministic matrix runner. - docs/TEST_PLAN.md — provider conformance stage and evidence paths. - docs/USE_CASES.md — support-level mapping for each documented ecosystem integration. Commands: scripts/ci/provider_conformance_run.sh --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m28b Checks: Every claimed production provider has passing conformance evidence or an explicit not-enabled status. Deliverables: Production coexistence matrix tied to release evidence. Title/ID: m27b-read-visibility-classes Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-read-visibility-classes Goal: Classify every ecosystem-facing read projection before multi-caller REST, Python, FUSE, MCP, A2A, or UI clients expose it. Inputs: tools/coh-rtc, apps/hive-gateway, apps/coh, apps/cohsh, apps/swarmui, tools/cohesix-py, docs/SECURITY.md, docs/API_GUIDELINES.md. Changes: - tools/coh-rtc/src/ir.rs — read visibility class for provider, evidence, ticket, audit, replay, telemetry, and `/proc` paths. - apps/hive-gateway/src/auth.rs — enforce delegated identity for ticket-scoped reads and admin-only policy for global reads. - apps/coh/src/read_scope.rs + apps/cohsh/src/read_scope.rs — preserve read-scope refusals in host tools. - tools/cohesix-py/cohesix/backends.py + tools/cohesix-py/tests/test_rest_backend_auth.py — propagate delegated caller identity for ticket-scoped REST reads, preserve public/admin-only classification, and prove cross-caller denial before returning bytes. - docs/SECURITY.md + docs/API_GUIDELINES.md — document public, ticket-scoped, and admin-only read behavior. Commands: cargo test -p coh-rtc && cargo test -p hive-gateway && cargo test -p coh && cargo test -p cohsh && python3 -m pytest -q tools/cohesix-py/tests/test_rest_backend_auth.py -k read_visibility Checks: Cross-caller ticket, provider receipt, evidence, audit/replay, task, and identity diagnostics reads fail deterministically before data is returned through Rust, REST, Python, or UI projections. Deliverables: Read-only ecosystem projections, including Python, are scoped with the same rigor as writes. Title/ID: m27b-identity-mapping Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-identity-mapping Goal: Map external identities into delegated Cohesix tickets without adding an identity provider to the VM. Inputs: apps/hive-gateway, apps/coh, tools/cohesix-py, tools/coh-rtc, docs/SECURITY.md. Changes: - apps/hive-gateway/src/identity.rs — validate configured OIDC/JWT, SPIFFE, Kubernetes service account, and local-host subject claims. - tools/coh-rtc/src/validate.rs — issuer/audience/subject/group/TTL/action-scope mapping validation. - tools/cohesix-py/cohesix/identity.py — reference host-side subject mapping helpers. - docs/SECURITY.md + docs/API_GUIDELINES.md — identity-to-ticket mapping and refusal semantics. Commands: cargo test -p hive-gateway && cargo test -p coh-rtc && python -m pytest tools/cohesix-py/tests/test_identity.py Checks: Forged, expired, wrong-audience, overbroad, or unmapped claims fail before mutation and emit deterministic audit evidence. Deliverables: Enterprise identity coexistence without expanding the VM TCB. Title/ID: m27b-packaging-deployment-profiles Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-packaging-deployment-profiles Goal: Ship least-privilege host-side deployment shapes for real coexistence environments. Inputs: m27b-public-surface-live-mode-gate, scripts/install/, packaging/, apps/hive-gateway, apps/host-ticket-agent, apps/host-sidecar-bridge, apps/sidecar-bus, apps/gpu-bridge-host, apps/coh, apps/cohsh, FUSE helpers, Python package/extras, resources/openapi/hive-gateway.yaml, scripts/release_bundle.sh, docs/audit/checklists/RELEASE_EVIDENCE_CHECKLIST.md. Changes: - packaging/systemd/ — hardened unit templates for gateway, ticket agent, sidecar bridge, GPU bridge, and exporters. - packaging/launchd/ — macOS operator launchd examples. - packaging/k8s/ — Helm/Kustomize or plain YAML for gateway/agent sidecar deployments; selected profiles additionally ship the generated `CohesixAction` CRD/controller, status conditions, CEL policies, least- privilege RBAC, `kubectl` plugin, upgrade/version bounds, and deterministic unavailable behavior for unselected webhook/DRA features. - packaging/systemd/ + packaging/container/ — selected executor profiles ship hardened transient/persistent unit properties, credential and device policy, structured journal fields, Docker Engine API/version policy, least-privilege socket/proxy access, ticket/evidence correlation labels, and exact state/CAS ownership under caller-supplied roots. - packaging/manifests/ — generated exact artifact type/architecture/version/digest/signature/SBOM/config/schema/secret-ref manifests and unexpected-file refusal for every selected deployment profile. - Python packaging — build and inspect clean wheel/sdist artifacts from an explicit package manifest; never recursively copy the source tree, tests, caches, fixture keys, or local credentials into a release. - FUSE packaging/tests — canonical `/shard` parity for direct and REST mounts, supported-host read/write/error behavior, and no legacy-only allowlist. - resources/openapi/ + scripts/release_bundle.sh — self-contained offline OpenAPI and docs assets; selected missing binaries/assets fail closed. - apps/coh/src/doctor.rs — provider registry, package profile, auth, secret-ref, and exporter health checks. - docs/HOST_TOOLS.md — install and risk guidance for each deployment profile. Commands: cargo test -p coh --test doctor && scripts/ci/provider_conformance_run.sh --packaging-only && scripts/release_bundle.sh --check-manifest --pi4-stage-dir out/pi4-sd Checks: Packages install only the exact registered host-side artifacts, preserve least privilege and loopback defaults, prove direct/REST FUSE `/shard` parity, contain self-hosted docs assets, fail on missing, unexpected, wrong-kind/architecture/version/digest/signature/SBOM artifacts, contain no private fixture key or compiled stub, and report optional missing providers deterministically. Deliverables: Repeatable host deployment profiles that coexist with existing systems instead of replacing them. Title/ID: m27b-observability-exporters Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-observability-exporters Goal: Add host-side Prometheus/OpenTelemetry/SIEM projections that consume strictly validated authoritative evidence and provide production delivery semantics without becoming authority. Inputs: m27b-authoritative-receipt-and-evidence-core, apps/coh, apps/hive-gateway, tools/cohesix-py, release/CI evidence checks, provider/integration registries, docs/HOST_TOOLS.md, docs/SECURITY.md, docs/TEST_PLAN.md. Changes: - shared host evidence/receipt core — consume only validator-accepted records and preserve authoritative/derived classification, source identity, cursor, and graph/schema versions across all exporter projections. - apps/coh/src/export/prometheus.rs — bounded read-only metrics projection. - apps/coh/src/export/otel.rs — bounded OpenTelemetry projection. - apps/coh/src/export/cloudevents.rs + attestation export — bounded CloudEvents and in-toto projections over validated ticket lifecycle nodes; emit SLSA provenance only for registered actions that actually build an artifact. All projections preserve source graph/version/ref and remain non-authoritative. - apps/coh/src/export/siem.rs — generated field allowlist/redaction/hash policy plus durable cursor/WAL, TLS/credential refs, retry/backoff, backpressure, deadletter, and destination acknowledgement receipts. - tools/cohesix-py/** + release/CI checks — consume the shared validation vectors and reject file-presence, client-authored JSON, or locally reconstructed transcripts as authoritative proof. - docs/HOST_TOOLS.md + docs/SECURITY.md — redaction and authority posture. Commands: cargo test -p coh --test export && scripts/ci/provider_conformance_run.sh --observability-only Checks: Exporters accept only validator-approved records, are read-only, bounded, redacted, schema-versioned, and reconstructable from evidence packs; OTel/CloudEvents/in-toto/SLSA projections cannot be re-imported as authority; SIEM live mode survives disconnect/restart without loss or unbounded duplication and proves destination acknowledgement, while raw tickets/payloads never leave the allowlist. Deliverables: Observability and portable evidence projection without in-VM monitoring stacks or a competing receipt format. Title/ID: m27b-industry-sidecar-contracts Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-industry-sidecar-contracts Goal: Integrate the real Milestone 18 field-bus providers and stage later OT, healthcare, and science sidecars as host-only, read-only-first families without aliases or fake delivery. Inputs: reopened Milestone 18 live MODBUS/DNP3 evidence, apps/sidecar-bus, apps/host-sidecar-bridge, tools/coh-rtc, docs/USE_CASES.md, docs/SECURITY.md. Changes: - apps/sidecar-bus/** + provider registry — package and prove the exact real MODBUS RTU/TCP and DNP3 codecs/transports, generated target maps/allowlists, durable acknowledgement-aware spool, typed protocol failures, and separately approved write/control actions from reopened Milestone 18. - apps/host-sidecar-bridge/src/providers/ — real bounded read-only contracts for CAN, IEC-104, DICOM metadata, and CCSDS telemetry only when implemented; otherwise emit typed `not_implemented` and ship no alias/no-op provider. - tools/coh-rtc/src/ir.rs — provider gating and write-action refusal defaults for safety-critical sidecars. - docs/SECURITY.md + docs/INTERFACES.md — read-only-first and sensitive-data redaction posture. Commands: cargo test -p host-sidecar-bridge && cargo test -p coh-rtc Checks: Protocol code stays host-side; a MODBUS/DNP3 `Delivered` result has a remote protocol acknowledgement and durable terminal record; later provider families cannot report live until real I/O, bounded reads, redaction, packaging, and conformance exist; write-capable actions require exact policy admission. Deliverables: Clear bridge contracts for broader industry coexistence without TCB expansion. Title/ID: m27b-use-case-release-gate Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-use-case-release-gate Goal: Prevent public use-case claims from exceeding implementation and evidence. Inputs: m27b-public-surface-live-mode-gate, m27b-live-reference-workflows, m27b-authoritative-receipt-and-evidence-core, README.md, docs/USE_CASES.md, docs/HOST_TOOLS.md, docs/GPU_NODES.md, docs/PYTHON_SUPPORT.md, docs/HOST_API.md, docs/INTERFACES.md, docs/API_GUIDELINES.md, docs/ARCHITECTURE.md, docs/SECURITY.md, docs/TEST_PLAN.md, docs/BUILD_PLAN.md post-M24 activities, tools/cohesix-py/cohesix/playbooks.py, resources/openapi/hive-gateway.yaml, packaging, scripts/release_bundle.sh, provider/integration registries, executable Worker evidence, external-executor evidence, evidence packs. Changes: - tools/coh-rtc/src/ir.rs + generated docs — stable use-case rows with proof class, Worker tier, topology, host tools, provider/surface dependencies, external executor/data plane, authority/secrets, authority custodian and bypass posture, supported/selected governance mode, shadow-promotion refs, durability/recovery, package, and evidence obligations. - docs/USE_CASES.md — checked support-level matrix covering all six scenarios, all nine built-in playbooks, Milestone 18 patterns, and all post-M24 demo/runbook activities. - scripts/ci/use_case_gate.sh — inventory every public claim source, validate conditional 26e/27/27c/27d/27e/28b dependencies, scan examples/manifests for argv or embedded secrets, and require exact integration/evidence/package links. - generated playbook records — consume the accepted `m27b-live-reference-workflows` DAG/evidence records and reject missing stages, controller/target topology, provider/data-plane ownership, recovery, or authoritative terminal correlation. - apps/coh/src/evidence.rs — include provider registry and conformance snapshots in evidence packs. Commands: scripts/ci/use_case_gate.sh --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m28b && cargo test -p coh --test evidence_pack Checks: No scenario, playbook, demo, runbook, example, OpenAPI description, or release document can claim production coexistence without the exact Worker tier, provider/surface and governance modes, external executor, node topology, generated policy, authority custodian/bypass posture, required shadow-promotion evidence, tests, deployment profile, authority/recovery posture, and evidence reconstruction; generic control-write or probe success cannot skip workflow stages. Deliverables: Cohesix adoption claims stay honest and auditable. Title/ID: m27b-provider-exporter-performance Milestone: Milestone 27b — Host Integration Registry + Provider/Executor + Use-Case Conformance / m27b-provider-exporter-performance Goal: Add targeted provider/exporter timing evidence without requiring a full Pi/QEMU throughput benchmark. Inputs: configs/provider_conformance.toml, scripts/ci/provider_conformance_run.sh, docs/BENCHMARKS.md, docs/TEST_PLAN.md. Changes: - scripts/ci/provider_conformance_run.sh — perf-only mode for registry lookup, provider validation/refusal, identity mapping, receipt rendering, and exporter projection over representative evidence packs. - docs/BENCHMARKS.md + docs/TEST_PLAN.md — classify coexistence overhead separately from REST hardware performance. Commands: scripts/ci/provider_conformance_run.sh --perf-only --matrix configs/provider_conformance.toml --state-dir out/bench/m27b-provider-overhead Checks: Provider/exporter timing stays bounded by generated limits and reports artifact-size context; failures classify host-provider, gateway/auth, or evidence-pack overhead. Deliverables: Provider/exporter overhead evidence for downstream semantic, AI, inference, and gateway protocol work. ``` ## Outcome After Milestone 27b: - Cohesix has a production coexistence contract, not only individual host adapters. - Provider actions, integration surfaces, exact package contents, external-executor obligations, and public use-case claims extend one compiler-owned graph shared by host tickets, REST, FUSE, Python, SwarmUI, docs, tests, release tooling, and later MCP/A2A schemas. - A ticket is the shared correlation key across systemd, Docker, optional Kubernetes, CUDA/NVIDIA, artifacts, native event streams, and evidence, while mutable ecosystem metadata remains non-authoritative. - Operators can follow one generated lifecycle from plan through verified receipt and recovery, and export a portable causal evidence graph without replacing the native execution or monitoring systems. - Existing ecosystems stay outside the VM TCB while still gaining delegated authority, receipts, evidence, deployment profiles, identity mapping, and observability exports. - Executable Worker proof remains distinct from CUDA/NVML discovery, real GPU execution/isolation, PEFT training/reload, and service/federation side effects; each production use case names and proves every required layer. - Semantic extraction, 28a intent admission, AI run control, inference interoperability, and MCP/A2A interop can build on proven provider and integration schemas instead of inventing action catalogs or silently treating mock workflows as live. ## Milestone 27c — Persistent Semantic Object Fabric + Context Capsules (Host-Side) [Milestones](#Milestones) **Delivery posture:** Release A requires the Context Capsule core only: immutable source/artifact snapshot ids, bounded selected spans, explicit selection and omission reasons, visibility/provenance enforcement, deterministic rendering, and render receipts over the existing CAS/evidence substrate. A general typed code graph, AST/CFG/ownership materialization, security/benchmark history graph, custom query engine, or broad extractor catalogue is a demand-gated extension and does not block 27d, 27e, or 27f. **Why now (semantic substrate):** Milestone 27b establishes the compiler-owned provider, integration-surface, visibility, package, and evidence graph that every host-facing ecosystem projection must consume. Milestone 27d already plans durable AI runs, retrieval manifests, checkpoints, context budgets, and prefix reuse, but those records otherwise have no canonical semantic substrate beneath them. Treating repositories, compiler outputs, tests, findings, proofs, and benchmark history as repeatedly concatenated text would preserve the same prompt duplication and provenance ambiguity that the AI run model is intended to remove. This milestone introduces a host-side, content-addressed semantic object fabric before AI run control. It turns repository and analysis inputs into immutable, typed, provenance-bound objects and edges, then emits deterministic Context Capsules containing only the admitted views needed for a task. Cohesix remains the authority, evidence, and policy layer: source manifests, compilers, test systems, and external analyzers remain authoritative for their own outputs, and the semantic fabric records and relates those outputs without replacing them. **As-built alignment note:** Cohesix already has content-addressed artifacts, evidence packs, generated manifests, provider/integration records, bounded host tools, and read-visibility classes. It does **not** yet have a semantic object schema, immutable repository snapshot manifest, typed semantic edge model, extractor registry, rebuildable object index, Context Capsule schema, deterministic capsule planner/renderer, or semantic-selection conformance evidence. No current `/proc`, `/models`, `/updates`, evidence-pack, Python, or host-tool surface may be relabelled as that implementation. This milestone is host-only and must not add an in-VM semantic parser, graph database, or namespace root. **Prerequisites** - The Milestone **27b Release A reference slice** completed for the generated provider/integration rows, visibility classes, identity mapping, package profile, authoritative receipt/evidence core, and use-case maturity rules consumed by the capsule core. Unselected provider rows remain unavailable. - Milestone **27** completed for deterministic inspect, evidence bundle, timeline, diff, and attestation utilities that semantic provenance extends rather than replaces. - Milestone **28** claim/evidence vocabulary available for any formal or assurance statement attached to proofs, analyzer results, or generated manifests. Semantic extraction must not strengthen the evidence class of an imported artifact. **Goal** Create a persistent host-side knowledge substrate that lets Cohesix select, authorize, render, and audit the semantic working set used by AI and operator workflows: 1. Represent source entities, interfaces, tests, documentation, findings, proofs, benchmarks, models, services, devices, and capabilities as typed, immutable semantic objects with explicit provenance. 2. Represent callers, callees, ownership, test coverage, documentation, benchmark, security, proof, model, service, and capability relationships as typed, versioned edges. 3. Materialize expensive views such as AST, CFG, ownership/borrow summaries, call relationships, test links, benchmark history, and security history once per exact source/toolchain/extractor identity. 4. Produce deterministic `context-capsule/v1` manifests containing ordered object-view references, selection reasons, omissions, truncations, authority constraints, budgets, and renderer identity. 5. Reuse Milestone 27b visibility and delegated-identity policy so a derived object or edge never reveals more authority than its inputs. 6. Expose local host tooling and generated SDK helpers for snapshot, inspect, query, capsule plan/render, verification, evidence, and health checks without requiring users to learn 9P or a new graph query language. 7. Measure semantic paging directly: objects considered/materialized/selected, bytes and estimated tokens submitted or avoided, cache/invalidation reasons, query/capsule latency, and provenance/evidence overhead. **Core completion boundary:** Release A completion requires immutable snapshot and artifact manifests, a bounded object/view subset sufficient for selected source spans and run artifacts, deterministic capsule plan/render/verify, visibility and provenance checks, evidence integration, and measured capsule latency/token avoidance. Goals involving complete relationship graphs, expensive compiler views, generalized queries, or broad history remain conditional extensions and must be reported as unavailable. **Non-Goals (Explicit)** - No semantic parsing, repository checkout, graph index, compiler frontend, vector database, embedding model, or LLM inside the VM or root-task. - No in-VM `/semantic`, `/functions`, `/objects`, or Context Capsule namespace root in this milestone. - No replacement for Git, compiler IR, rust-analyzer, SCIP, SARIF, test frameworks, benchmark harnesses, SBOMs, proof tools, or Cohesix generated manifests. Imported data retains its original authority and evidence class. - No public custom graph query protocol, ad-hoc RPC, mutable POSIX-like object tree, or requirement that ecosystem clients speak Secure9P. - No generic prompt/blob store and no opaque transcript as semantic truth. Prompt text may be rendered transiently under policy but is not the canonical object representation. - No inference execution, model routing, provider API compatibility, token streaming, or model-result claim. Milestone 27e owns the inference boundary. - No model-controlled mutation of source, semantic objects, extractor policy, visibility, or capabilities. - No database engine as an authority source. Any query index is rebuildable from immutable object packs and manifests. - No automatic promotion from semantic availability to implementation, provider, Worker, security, formal-proof, or use-case acceptance. **Deliverables** ### 1) Canonical semantic objects, views, edges, and snapshots **Purpose:** Establish one compiler-owned contract so extractors, host tools, AI runs, inference, MCP, A2A, evidence, and later namespace projections cannot invent incompatible knowledge records. Implementation requirements: - Add versioned schemas: - `semantic-snapshot/v1` - `semantic-object/v1` - `semantic-view/v1` - `semantic-edge/v1` - `semantic-extractor-receipt/v1` - `context-capsule/v1` - `context-render/v1`. - Each immutable object/view records source snapshot, stable logical key, content digest, object type, source span or artifact ref where applicable, extractor id/version/config hash, toolchain/profile identity, parent inputs, visibility class, required delegated scope, evidence class, and explicit unavailable/partial state. - Separate stable logical identity from immutable materialization identity. Renames, source edits, extractor upgrades, toolchain changes, generated manifest changes, and policy changes create new versions and never mutate an accepted historical object in place. - A snapshot records Git tree/commit identity when committed. Dirty worktrees, generated outputs, and external artifact sets use explicit content manifests and may not masquerade as the clean commit. - Edge records are typed, directed where applicable, provenance-bound, and versioned. An edge may not outlive or silently rebind either endpoint. ### 2) Extractor registry, immutable object packs, and rebuildable indexes **Purpose:** Ingest common ecosystem outputs without requiring bespoke project formats or making the query engine authoritative. Implementation requirements: - Provide bounded host extractors for: - Git repository snapshots and diffs, - Rust compiler/rust-analyzer and SCIP-compatible symbol/reference data, - source, signature, documentation, AST, CFG, ownership/borrow, caller, and callee views when the selected extractor can prove them, - unit/integration/test-result and coverage summaries, - benchmark history, - SARIF/security findings, - SBOM, attestation, verification-claim, Cohesix manifest, provider receipt, and evidence-pack references. - Every extractor is registered through the 27b integration graph with version, accepted input types, output schema ids, resource limits, secret and redaction posture, package owner, conformance runner, and observed mode. - Store immutable object packs and manifests using existing CAS/evidence discipline. Maintain a bounded, rebuildable host-side index for lookup and traversal; deleting or corrupting the index must not destroy canonical objects or change their digests. - Incremental extraction invalidates only objects whose exact source, tool, extractor, configuration, dependency, or policy inputs changed. Cross-snapshot edges and cache reuse require an explicit compatibility proof. - Missing extractor support returns typed unavailable/partial state; it never fabricates an AST, CFG, ownership graph, test link, finding, or proof. ### 3) Deterministic Context Capsule planning and rendering **Purpose:** Page knowledge by task and authority rather than concatenate whole repositories into every prompt. Implementation requirements: - A Context Capsule contains: - snapshot and dependency-graph identities, - task-intent hash/ref and requesting run/task/step identity when present, - ordered object/view refs, - selection reason and bounded relevance evidence for every selected view, - candidate-set digest, - explicitly excluded, unavailable, stale, truncated, or budget-evicted refs, - byte and estimated-token budgets, - visibility/delegated-scope decision refs, - renderer/schema/tool-profile hashes, - prefix/cache eligibility inputs, - capsule digest and creation receipt. - Planning is deterministic for identical objects, policy, task descriptor, budgets, extractor versions, and planner version. Tie-breaking and ordering are explicit and fixture-tested. - Rendering supports bounded text plus structured JSON/CBOR views for downstream consumers. The rendered payload receives its own digest linked to the capsule; it never replaces the capsule as the source of context provenance. - Selection may use lexical, graph, compiler, test, finding, and optional embedding-derived signals, but each signal source and score normalization is recorded. Embeddings are derived indexes, not authority. - Capsule expansion is explicit and produces a successor capsule linked to its predecessor; agents cannot silently widen context or authority. ### 4) Capability, visibility, provenance, and redaction enforcement **Purpose:** Make fine-grained semantic access safer than handing every agent a repository checkout. Implementation requirements: - Reuse the Milestone 27b `public`, `ticket_scoped`, and `admin_only` visibility classes plus generated delegated scopes for every object and view. - Derived visibility is at least as restrictive as every contributing input. Names, relationships, hashes, scores, omissions, and object existence are treated as potentially sensitive metadata, not automatically public. - Context planning filters unauthorized candidates before ranking, rendering, token estimation, or payload construction so side channels do not reveal inaccessible objects. - Evidence records the normalized caller, ticket hash, policy decision, selected capsule/view ids, redaction profile, and refusal reason without raw credentials or secret-bearing payloads. - A capsule is immutable and transferable only within its recorded audience, TTL, snapshot, and policy constraints. A capsule ref is not itself authority. ### 5) Host tools, SDK helpers, packaging, and operator workflow **Purpose:** Make the semantic substrate usable without exposing its storage implementation or requiring new agent-framework code. Implementation requirements: - Add host-only `coh semantic` commands for: - `snapshot` - `status` - `inspect` - `query` - `capsule plan` - `capsule render` - `verify`. - Extend `coh doctor` with generated checks for extractor availability and version, store/index integrity, schema compatibility, source/toolchain identity, visibility policy, evidence export, and optional embedding capability. Missing optional extractors remain typed unavailable. - Add `cohesix` Python read-only helpers for snapshots, object/view inspection, capsule planning/rendering, and receipt verification. Python consumes generated schema ids, bounds, and fixtures and cannot author authoritative semantic objects or receipts. - Add a batch-oriented `semantic-index-host` binary and shared `cohesix-semantic-core` library. The indexer has no VM component or public listener; later gateways consume the same core/store contract rather than a second schema. - Package exact extractor/runtime versions, schema registry, default policy, service/job definitions where applicable, doctor checks, and conformance fixtures in the existing 27b host deployment profiles. - Update `docs/HOST_TOOLS.md`, `docs/PYTHON_SUPPORT.md`, `docs/ARCHITECTURE.md`, `docs/INTERFACES.md`, `docs/SECURITY.md`, `docs/TEST_PLAN.md`, and `docs/OPERATOR_WALKTHROUGH.md` with the host-only topology, canonical commands, trust boundaries, failure recovery, and evidence workflow. - `cohsh` gains no semantic command or grammar in this milestone. It remains a consumer of existing target paths; semantic access is host-side until later generated projections are separately accepted. ### 6) Semantic conformance, evidence, and performance **Purpose:** Prove that semantic compression comes from justified selection, not silent omission or lossy untraceable summarization. Implementation requirements: - Add checked fixture repositories and imported analyzer/test/benchmark/finding artifacts with stable expected objects, edges, unavailable states, and capsules. - Conformance covers clean and dirty snapshots, rename/edit/incremental invalidation, extractor/version drift, stale/corrupt index rebuild, path and symlink attacks, unauthorized edge traversal, redaction, deterministic ordering, budget eviction, and capsule expansion. - Evidence packs and timelines include snapshot, extractor, object-pack, capsule, render, visibility, and refusal receipts while retaining original analyzer/test/proof evidence classes. - Add benchmarks for cold snapshot extraction, incremental refresh, object/view lookup, bounded graph traversal, capsule planning/rendering, index rebuild, and evidence export. Report object/edge counts, bytes, estimated tokens, cache hits/misses, invalidation reasons, p50/p95 latency, and artifact sizes. - Semantic benchmarks are host-side. They do not prove Pi/QEMU runtime performance, LLM quality, inference determinism, or provider cache hits. **Commands** - `cargo test -p cohesix-semantic-core` - `cargo test -p semantic-index-host` - `cargo test -p coh --test semantic` - `cargo test -p coh --test semantic_evidence` - `cargo test -p coh-rtc` - `python3 -m pytest -q tools/cohesix-py/tests/test_semantic.py` - `scripts/ci/semantic_conformance_run.sh --state-dir out/semantic/m28c` - `scripts/ci/semantic_perf_probe.sh --state-dir out/bench/m27c-semantic` - `scripts/check-generated.sh` - `scripts/ci/test_plan_run.sh --state-dir out/test-plan/m27c-semantic` **Checks (Definition of Done)** - Identical snapshot, extractor, toolchain, configuration, policy, planner, and budget inputs produce byte-identical object packs, indexes after rebuild, capsules, renders, and receipts. - Dirty, stale, partial, unsupported, mismatched-toolchain, or mismatched-extractor state is explicit and cannot pass as a clean accepted snapshot. - Source/compiler/analyzer/test/benchmark/finding/proof authority and evidence classes remain distinct; a semantic edge or capsule never upgrades them. - Unauthorized objects and relationships are removed before ranking or payload construction, and negative tests show no metadata, size, score, or existence disclosure across visibility boundaries. - An unavailable extractor yields typed unavailable views; no synthetic AST, CFG, ownership, test, security, benchmark, or proof object can enter a production capsule. - The canonical store survives index deletion/rebuild and detects corrupt, forged, missing, duplicate, or cross-snapshot objects and edges. - Context Capsules record exact selected and omitted views, reasons, budgets, policy, renderer, and lineage; expansion creates a new linked capsule rather than mutating the original. - `coh`, Python, evidence tools, generated docs, packages, and future gateway schema inputs consume one schema registry and agree on bounds and receipts. - `coh doctor` distinguishes required failures from optional unavailable extractors and reports enough identity to reproduce a snapshot/capsule. - Host performance evidence demonstrates bounded incremental refresh, lookup, planning, rendering, and evidence overhead at representative repository scales. Token/byte avoidance is reported without claiming model-quality or inference-speed improvement that was not measured downstream. - No VM dependency, listener, namespace root, console verb, Secure9P verb, provider mutation, inference call, or agent-framework authority is added. **Compiler touchpoints** - `coh-rtc` extends the Milestone 27b graph with semantic extractor, store, planner, renderer, host-tool, package, and evidence surfaces. Each record has stable ids, version/profile bounds, visibility, redaction, schema outputs, observed mode, conformance owner, and explicit unavailable behavior. - `coh-rtc` emits the semantic schema registry, object/view/edge type tables, extractor allowlists, snapshot and capsule bounds, visibility rules, renderer profiles, metric/evidence bounds, Python defaults, `coh` defaults, doctor checks, package manifests, and documentation snippets. - Validation rejects unknown object/view/edge types, unregistered extractors, mutable accepted objects, unbounded graph walks, visibility weakening, capsule refs without snapshot/policy identity, hand-maintained Python schema catalogs, and enabled public surfaces without packages/conformance evidence. - Generated semantic records extend, and never fork, the existing `host-integration-dependency/v1` and use-case graph. **Task Breakdown** ``` Title/ID: m27c-semantic-ir-and-object-contract Milestone: Milestone 27c — Persistent Semantic Object Fabric + Context Capsules (Host-Side) / semantic IR and object contract Goal: Define compiler-owned semantic snapshot, object, view, edge, extractor-receipt, capsule, and render schemas with stable identity and authority rules. Inputs: Milestone 27b provider/integration/visibility/evidence registries, tools/coh-rtc/src/**, existing CAS and evidence schemas, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md. Changes: - tools/coh-rtc/src/ir.rs + validation/codegen — semantic types, extractor registry, snapshot/capsule/render bounds, visibility/redaction derivation, and generated Rust/Python/docs outputs. - crates/cohesix-semantic-core/src/schema.rs — canonical host-side types and strict validators generated or checked against `coh-rtc`. - tests/fixtures/semantic/** — canonical valid, invalid, partial, stale, cross-snapshot, and visibility fixtures. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURITY.md — object identity, source-of-truth, authority, provenance, redaction, and host/VM boundaries. Commands: - cargo test -p coh-rtc - cargo test -p cohesix-semantic-core - scripts/check-generated.sh Checks: Every semantic type and bound is compiler-owned; logical and immutable identities cannot be conflated; unknown, mutable, cross-snapshot, unproven, or visibility-weakened records fail closed. Deliverables: One generated semantic schema registry shared by all later extractors, host tools, AI runs, inference, MCP/A2A, and evidence consumers. Title/ID: m27c-extraction-store-and-index Milestone: Milestone 27c — Persistent Semantic Object Fabric + Context Capsules (Host-Side) / extraction, immutable packs, and rebuildable index Goal: Materialize common repository and analysis outputs into immutable semantic packs with deterministic incremental invalidation and a non-authoritative rebuildable index. Inputs: m27c-semantic-ir-and-object-contract, Git/source fixtures, compiler/rust-analyzer/SCIP outputs, test/coverage/benchmark/SARIF/SBOM/verification/evidence fixtures, existing CAS helpers. Changes: - crates/cohesix-semantic-core/src/{extract,store,index}.rs — bounded extractor contract, object-pack verification, atomic publication, deterministic index build/rebuild, and incremental invalidation. - apps/semantic-index-host/src/** — batch snapshot/extraction/index command with exact tool/extractor identity, resource bounds, and typed partial/unavailable results. - scripts/ci/semantic_conformance_run.sh + fixtures — cross-extractor, corruption, stale-index, symlink/path, rename/edit, and deterministic rebuild coverage. - docs/HOST_TOOLS.md + docs/TEST_PLAN.md — extractor availability, operation, recovery, and conformance guidance. Commands: - cargo test -p cohesix-semantic-core - cargo test -p semantic-index-host - scripts/ci/semantic_conformance_run.sh --only extraction,index --state-dir out/semantic/m27c-extraction Checks: Canonical packs are immutable and content-addressed; index loss is recoverable; changed inputs invalidate exact dependents; unsupported extractors are explicit; no imported evidence class is strengthened. Deliverables: Persistent host semantic snapshots that can be incrementally refreshed and independently verified. Title/ID: m27c-context-capsule-planner Milestone: Milestone 27c — Persistent Semantic Object Fabric + Context Capsules (Host-Side) / deterministic Context Capsule planning and rendering Goal: Select and render the smallest authorized semantic working set that satisfies explicit task and budget inputs while preserving exact omissions and lineage. Inputs: m27c-extraction-store-and-index, generated visibility policy, representative repo-analysis task fixtures, token estimators and renderer profiles. Changes: - crates/cohesix-semantic-core/src/{planner,capsule,render}.rs — deterministic candidate construction, authority filtering, ranking, budget eviction, expansion lineage, text/JSON/CBOR rendering, and receipt generation. - tests/fixtures/semantic/capsules/** — stable selection, tie-break, omission, truncation, unavailable, expansion, and renderer fixtures. - scripts/ci/semantic_perf_probe.sh — capsule planning/render and semantic-paging measurements at representative scales. - docs/INTERFACES.md + docs/BENCHMARKS.md — capsule contract, semantic paging metrics, and non-claims. Commands: - cargo test -p cohesix-semantic-core --test context_capsules - scripts/ci/semantic_perf_probe.sh --state-dir out/bench/m27c-semantic Checks: Identical admitted inputs produce byte-identical capsules/renders; unauthorized candidates are filtered before scoring; every inclusion, omission, expansion, and truncation is reconstructable. Deliverables: Auditable Context Capsules suitable for 27d AI runs and 27e inference without repository-wide prompt assembly. Title/ID: m27c-host-tools-sdk-and-evidence Milestone: Milestone 27c — Persistent Semantic Object Fabric + Context Capsules (Host-Side) / host tools, Python helpers, doctor, and evidence Goal: Make semantic snapshots and Context Capsules operable through existing Cohesix host-tool and evidence workflows without creating new authority. Inputs: m27c-context-capsule-planner, apps/coh/src/{main.rs,doctor.rs,evidence.rs,evidence_timeline.rs}, tools/cohesix-py/cohesix/**, tools/coh-rtc generated host defaults, packaging profiles, canonical host-tool docs. Changes: - apps/coh/src/semantic.rs + CLI wiring — `snapshot`, `status`, `inspect`, `query`, `capsule plan`, `capsule render`, and `verify`. - apps/coh/src/{doctor,evidence,evidence_timeline}.rs — semantic store/extractor/schema checks plus snapshot/object/capsule/render/refusal evidence reconstruction. - tools/cohesix-py/cohesix/{semantic.py,context.py,evidence.py} + tests — generated read-only helpers and canonical receipt validation; Python cannot mint authoritative objects/capsules/receipts. - tools/coh-rtc/src/codegen/{coh,cohesix_py,docs}.rs + package manifests — generated defaults, doctor checks, examples, exact binary/extractor contents, and docs snippets. - docs/HOST_TOOLS.md + docs/PYTHON_SUPPORT.md + docs/OPERATOR_WALKTHROUGH.md + docs/TEST_PLAN.md — end-to-end operator workflow and failure recovery. Commands: - cargo test -p coh --test semantic - cargo test -p coh --test semantic_evidence - python3 -m pytest -q tools/cohesix-py/tests/test_semantic.py - scripts/check-generated.sh Checks: Rust and Python render the same generated schemas/bounds and verify the same fixtures; doctor distinguishes missing optional extractors from corrupt required state; evidence reconstruction needs no raw prompt or secret. Deliverables: Installable, diagnosable semantic host tools and SDK helpers integrated with existing Cohesix evidence workflows. Title/ID: m27c-semantic-acceptance Milestone: Milestone 27c — Persistent Semantic Object Fabric + Context Capsules (Host-Side) / conformance, performance, and release acceptance Goal: Prove the semantic substrate is deterministic, bounded, authority-preserving, package-complete, and ready for 27d/27e consumers. Inputs: all m28c tasks, generated provider/integration/package records, semantic fixtures, docs/BENCHMARKS.md, docs/TEST_PLAN.md, release evidence checklist. Changes: - scripts/ci/semantic_conformance_run.sh — complete extractor/store/index/capsule/visibility/redaction/evidence matrix with archived summaries. - scripts/ci/semantic_perf_probe.sh — cold/incremental/index-rebuild/query/capsule/render/evidence timing and size ledger. - scripts/ci/use_case_gate.sh + release packaging — require accepted semantic dependencies only for use cases that claim semantic context; preserve typed unavailable mode elsewhere. - docs/BENCHMARKS.md + docs/TEST_PLAN.md + release checklist — semantic acceptance lane, thresholds, artifacts, and explicit inference/model-quality non-claims. Commands: - scripts/ci/semantic_conformance_run.sh --state-dir out/semantic/m28c - scripts/ci/semantic_perf_probe.sh --state-dir out/bench/m27c-semantic - scripts/ci/test_plan_run.sh --state-dir out/test-plan/m27c-semantic Checks: Conformance, package, authority, evidence, and performance artifacts all bind the same schema/snapshot/toolchain identities; no mock, partial, dirty, stale, or unsupported state is promoted. Deliverables: Accepted semantic object and Context Capsule substrate for Milestone 28a and Milestones 27d, 27e, 28c, and 30b. ``` ## Outcome After Milestone 27c: - Cohesix has a persistent host-side semantic object fabric without adding AI runtimes, compiler frontends, graph databases, or listeners to the VM. - Repository, compiler, analyzer, test, benchmark, finding, proof, provider, and evidence inputs remain distinct and provenance-bound while becoming queryable through one generated object/edge contract. - Context Capsules make the exact authorized semantic working set, omissions, budgets, renderer, and lineage explicit and reproducible. - `coh`, `coh doctor`, Python helpers, evidence packs, timelines, packages, and downstream gateway schemas consume one generated semantic contract. - Milestone 28a can bind semantic refs where relevant without treating capsule contents as authoritative operational facts; Milestone 27d can then build run/checkpoint policy on admitted immutable capsule refs, and Milestone 27e can measure actual inference efficiency and audit receipts without treating text prompts as the semantic source of truth. ## Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT [Milestones](#Milestones) **Delivery posture:** Release A flagship workflow with a Release B governed- autonomy extension. Release A is a single-user, operator-directed Jetson reference profile: live side effects use explicit operator approval, the 27a authority floor, generated provider allowlists, idempotent host tickets, durable execution, and authoritative receipts. It does not claim 28a machine-checked admission and does not permit model-initiated activation, promotion, rollback, service control, or authority changes. Any task below that requires an `admission_id` belongs to the Release B extension. The named flagship is the **Verified Private LoRA Release**: one ticket-centred workflow binds base model and dataset provenance, PEFT training/evaluation, systemd and digest-pinned Docker execution, CUDA resource evidence, adapter scan/import, runtime reload/canary, rollback, WorkerLora correlation, and one reconstructable evidence graph. Kubernetes and NeMo reuse this envelope as independently promoted provider profiles rather than changing its semantics. **Why now (bridge):** Milestone 27a makes writes attributable, replay-safe, fenced, and audit-first. The Milestone 27b reference slice freezes the selected provider actions, identity, package, visibility, and conformance evidence. The Milestone 27c core adds immutable references and deterministic Context Capsules without creating a second authority plane. Milestone 28a later adds the machine-checked bridge from typed intent and authoritative current state to a decision-bound grant for consequential autonomy. Cohesix first needs the bounded operator-directed host-only proving ground refined here: 1. Cohesix is the trusted execution, evidence, and governance layer beneath agent frameworks, not a replacement for them. 2. Long-context cost is dominated by repeated prefill, duplicated prompt state, and lossy summarization. 3. The highest-leverage fix is to keep durable run state, Context Capsule references, retrieval manifests, approvals, and evidence outside the live prompt, then route each run to the right host-side inference strategy under ticketed authority. This milestone uses existing host-side surfaces (`/host/tickets/*`, delegated REST, selected 27b provider/integration rows, the accepted 27c core contracts, evidence packs, GPU leases, telemetry ingest, Python playbooks, and accepted 28a decisions where the Release B extension is enabled) plus the accepted 26e executable Worker/receipt substrate. It adds no VM AI roots. **As-built alignment note:** Python orchestration currently provides typed schedule, lease, export, host-ticket, federation, and Kubernetes coexistence helpers over existing control files. Cohesix also has host-side PEFT filesystem helpers and, after 26e, an executable WorkerLora receipt path. Those substrates are useful leverage, but they are not yet the AI run/task graph envelope, checkpoint model, context-budget contract, prefix/hotset lifecycle, NeMo provider family, or production PEFT transaction described here. The accepted 27c substrate supplies semantic objects and Context Capsules, but it does not itself admit AI runs, select providers, invoke inference, or prove PEFT lifecycle execution. In particular, no existing mock playbook, local registry mutation, `/gpu/models` publication, WorkerLora receipt, semantic snapshot, or capsule proves training, evaluation, artifact scanning, inference-runtime reload, or rollback. Milestone 27d extends the 27b integration/use-case graph and consumes 27c artifacts by reference; it must not re-label generic orchestration, semantic extraction, or 26e fixture receipts as completed AI run control. **Prerequisites** - The Milestone **27a Release A authority floor** completed for delegated REST identity, idempotency, selected-profile writer safety, host-ticket durable execution, audit/replay defaults, and production secret/debug gates. - Milestone **26e** completed for executable WorkerLora and strict, crash-safe version-2 PEFT result-to-Worker receipts on QEMU and Pi 4. - The Milestone **27b Release A reference rows** completed for the selected external executor, read visibility, identity, package, conformance, and use-case evidence. - The Milestone **27c core** completed for immutable snapshot/artifact refs, provenance/redaction, deterministic Context Capsules, render/verify tooling, and selected semantic evidence. The full graph is not a prerequisite. - Milestone **28a** completed only for Release B governed or autonomous action families. Release A records `admission_mode=operator_approved` and an explicit `admission_id=unavailable`; that mode cannot satisfy a 28a claim. **Goal** Add a host-side AI run substrate that lets external supervisors and agent frameworks coordinate long-context workflows through delegated tickets and existing host-ticket flows while preserving Cohesix's single-writer, append-only, audit-first discipline: 1. Make run/task/step identity and context budget explicit. 2. Keep checkpoints, exact constraints, Context Capsule and semantic snapshot references, retrieved spans, and tool receipts durable outside the prompt. 3. Route workloads to host-side inference backends by recall/cost policy rather than one fixed attention strategy. 4. Reuse warmed prefixes and hotsets across related runs within bounded quotas and TTLs. 5. Expose TTFT, decode, cache-hit, and resume metrics as first-class evidence. 6. Represent multi-agent work as explicit task graphs and handoffs, not as an opaque shared transcript or hidden message bus. 7. Consume the accepted 26e executable WorkerHeart/WorkerGpu/WorkerLora contracts without weakening their image, capability, notification, MCS scheduling, fault, revocation, QEMU, or Pi evidence requirements; `ATTACH` remains session-only and is never substituted for task creation. 8. Deliver the complete host-side PEFT lifecycle—export, data/base-model provenance, train/fine-tune, evaluate, scan, import, activate, inference-runtime reload/canary, and rollback—with crash-safe transactions and exact WorkerLora receipt correlation before AI run control treats it as dependable actuation. 9. Re-evaluate and promote the 27b AI/PEFT use-case rows only from live external-provider, executable-Worker, package, recovery, and evidence records; mock/dry-run playbooks remain workflow templates. 10. Keep provider strategy, run admission, and PEFT actuation in this milestone, while Milestone 27e owns the public OpenAI-compatible wire contract, streaming behavior, provider-neutral inference receipts, and compatibility conformance. 11. In the Release B extension, adapt every governed live AI side effect into a 28a typed intent and require the exact accepted `admission_id`. In Release A, only an authenticated operator may initiate an allowlisted live side effect through explicit approval and the existing host-ticket path; AI may propose intent but cannot trigger it, activate policy, declare extracted facts authoritative, or convert confidence into an admission result. 12. Make the Verified Private LoRA Release operable through the 27b ticket-centred `plan -> apply -> watch -> explain -> verify -> recover` lifecycle and emit a SwarmUI-ready causal graph projection without making the UI, Python callback, training framework, native label, or observability export authoritative. **Release A completion boundary:** The flagship journey requires run/task/step identity, status/stream/cancel/resume, durable checkpoints and artifact refs, one selected inference executor, measurable TTFT/throughput/queue behavior, and one real PEFT train/evaluate/scan/register/canary/activate/rollback transaction on the Jetson reference profile. General multi-agent orchestration, advanced attention routing, reusable prefix/hotset policy, optional NeMo, additional frameworks, and provider parity are enabled only when needed by that journey and individually proven; they do not block Release A. **Non-Goals (Explicit)** - No in-VM transformer kernels, sparse-attention implementations, KV-compression implementations, or CUDA/NVML changes. - No in-VM model weights, datasets, training/evaluation/scanning frameworks, inference runtime, or adapter-byte transfer. WorkerLora validates bounded lifecycle work and records correlated receipts; all PEFT data-plane work remains in the declared host executor. - No direct many-agent writes to raw `/queen/ctl`; multi-agent host automation writes through delegated REST and/or `/host/tickets/spec`. - No active/active multi-queen control for one logical hive. - No live AI, PEFT, NeMo, Kubernetes, Docker, systemd, CUDA/NVML, or model-registry mutation from Python, adapters, playbooks, or framework integrations unless it appends a validated host ticket and is executed by `host-ticket-agent` under the generated provider action registry. - No autonomous or model-initiated live AI side effect in Release A. A live operator-directed action must use explicit approval, the generated provider allowlist, an idempotent durable host ticket, and an authoritative receipt, and must state that 28a admission is unavailable. Once a provider action is configured as governed, no live side effect is permitted without its accepted 28a admission. Dry-run creates no authority grant. - No AI activation or modification of policy, no model self-classification of extracted facts as authoritative, and no use of model confidence as an admission verdict. - No generic mutable `/store`, vector database, or prompt blob sink divorced from existing evidence/CAS discipline. - No reimplementation of the 27c semantic store, extractor registry, object graph, capsule planner, or renderer inside AI orchestration. - No public OpenAI-compatible endpoint, SDK compatibility claim, or provider-neutral streaming/usage contract in this milestone; those belong to Milestone 27e. - No new 9P verbs, no console grammar changes, and no hidden RPC behind file names. - No claim that Cohesix replaces agent planners/orchestrators; it remains the authority, evidence, and actuation layer beneath them. - No opaque prompt transcript as the source of truth for agent state, approvals, retrieval, or tool output. - No hidden inter-agent mailbox or side-channel coordination surface outside delegated tickets, durable artifacts, and existing evidence flows. - No NeMo-specific control plane, namespace grammar, or provider lock-in semantics; NeMo support must remain an optional host-side provider family under the same Cohesix authority/evidence contract as other backends. - No framework callback, NeMo rail/action, Kubernetes status condition, Docker label, systemd notification, CUDA trace, or locally assembled model card may mint a Cohesix grant or authoritative terminal receipt. These are bounded provider observations consumed by the shared verifier. - No claim that VM worker-gpu, worker-lora, or worker-heart kernel binaries are full task implementations unless their selected executable contracts and exact QEMU/Pi task evidence are accepted under 26e. `ATTACH` remains session-only and does not instantiate a task. Claims that a production ticket or lease is bound one-to-one to that live bundle additionally require 28b. **Deliverables** ### 1) AI run/task graph envelope and context-budget contract (host-only) **Purpose:** Make long-context cost, dependency ordering, and handoff policy explicit instead of burying them inside prompts. Implementation requirements: - Add typed host-run envelope fields for AI ticket/playbook flows: - `run_id`, `parent_run_id`, `task_id`, `step_id`, `attempt` - `context_budget_tokens`, `latency_slo_ms`, `recall_mode`, `loss_tolerance` - `prefix_group`, `dataset_refs`, `artifact_refs`, `deadline_unix_ms`, `human_owner` - Add explicit task-graph and handoff fields: - `depends_on`, `handoff_ref`, `instruction_ref`, `retrieval_manifest_ref` - `semantic_snapshot_ref`, `context_capsule_ref`, `context_render_profile_ref` - `provider_profile_hash`, `prefix_cache_key` - `max_parallel_agents`, `human_attention_budget` - Live mutating AI flows inherit Milestone 27a safety requirements: delegated ticket, `id`, `idempotency_key`, and `writer_epoch` where applicable. - Every Release B governed live AI side effect carries the accepted 28a `admission_id`, `intent_hash`, `policy_hash`, `state_epoch`, resource generations, granted scope, and decision expiry required by its generated provider action. Release A operator-approved actions instead carry the authenticated operator subject, approval record, provider action, exact target, idempotency/writer state, and `admission_id=unavailable`. - Dry-run and mock playbooks validate budget/policy mismatches before any host side effect. They may render a proposed intent and simulated decision but cannot mint or reserve a grant. As-built leverage: - Reuse `cohesix` Python orchestration APIs and `/host/tickets/spec` idempotent lifecycle. --- ### 2) Durable checkpoints instead of prompt-only memory **Purpose:** Reduce prompt bloat and resume cost without relying on lossy summarization. Implementation requirements: - Record structured checkpoints containing: - exact constraints/instructions, - immutable semantic snapshot, Context Capsule, render-profile, retrieval manifest, and selected-span references, - approvals/policy receipts, - tool receipts/artifact refs, - resume cursor and prior-step linkage. - Retrieval manifests remain first-class artifacts, but are inputs to or subrecords of the accepted 27c Context Capsule contract rather than a competing context source of truth. They record what was considered or retrieved, while the capsule and render receipt record what was selected and delivered. - Large tool outputs and retrieved corpora are offloaded into bounded host-side artifacts with hashes, redacted previews, and exact refs instead of being re-inlined into every prompt. - Checkpoints are host-side artifacts and evidence inputs, not a new VM filesystem or opaque prompt cache. - Evidence/timeline tooling can reconstruct why a run acted without replaying the entire prompt transcript. As-built leverage: - Reuse existing evidence pack/timeline flows, audit redaction, and telemetry ingest. --- ### 3) Attention routing and prefix/hotset reuse **Purpose:** Let operators choose the right long-context strategy per workload instead of paying full attention cost by default, while making cache eligibility and invalidation explainable. Implementation requirements: - Host-only provider policy classifies requests as bounded strategy hints, for example: - `full` - `retrieval-first` - `sparse-preferred` - `compression-preserve` - `needle-sensitive` - Prefix groups and hotsets can be warmed, leased, resumed, and evicted through bounded host tickets with TTL/quota enforcement. - Prefix reuse eligibility and miss reasons are recorded using bounded evidence fields such as model/provider profile hash, instruction hash/ref, semantic snapshot hash/ref, Context Capsule hash/ref, render-profile hash/ref, retrieval-manifest hash/ref, tool-schema hash, TTL expiry, and quota eviction cause. - GPU lease and provider selection remain host-side and reuse existing lease/publish flows. As-built leverage: - Reuse GPU lease control, host-ticket executor model, and telemetry/evidence surfaces. --- ### 4) AI run metrics and guardrails **Purpose:** Make long-context efficiency measurable and auditable. Implementation requirements: - Collect bounded per-run metrics: - TTFT, - decode tokens/sec, - prompt bytes/tokens submitted, - prompt bytes/tokens avoided via checkpoint/prefix reuse, - semantic objects selected/omitted and estimated prompt tokens avoided by capsule selection, - prefix hit/miss counts, - prefix invalidation/miss reasons, - retrieval miss rate, - resume count, - GPU lease pressure/provider queue wait, - handoff count and checkpoint restart count. - Metrics remain read-only exports and evidence inputs; they do not become a second source of truth for control. - Policy gating remains mandatory for high-risk live mutations initiated by AI supervisors. - Add a targeted AI run-cost benchmark for dry-run/mock playbooks that records checkpoint/resume overhead, prefix/hotset hit/miss behavior, prompt bytes avoided, receipt/evidence export cost, and provider queue-wait simulation. This is host-side AI evidence, not a full Pi/QEMU runtime benchmark. As-built leverage: - Reuse `/queen/telemetry/*`, existing evidence packs, and host snapshots. --- ### 5) Framework coexistence, not framework replacement **Purpose:** Make Cohesix usable beneath agent supervisors without inventing another agent framework. Implementation requirements: - Provide Python-side adapters/examples for long-context supervisors to submit delegated host tickets and consume receipts/checkpoints plus immutable Context Capsule references and render receipts. - Provide a common Python run context and framework callback contract that maps framework-native run, checkpoint, evaluation, artifact, cancellation, and terminal events onto generated ticket/checkpoint observations. Callbacks may request an allowlisted ticket or stop a local loop after refusal, but cannot call a provider directly, mint authority, or author an authoritative receipt. - Ship at least one reference playbook that coordinates repo-scale analysis or closed-loop AI factory work in dry-run/mock mode before any live actuation. - Reference adapters and playbooks must model explicit delegation/handoff chains over the run envelope and checkpoint model; they must not rely on implicit shared transcript state. - Export receipts/checkpoints in derived, host-side forms suitable for downstream observability tooling; exports remain non-authoritative. As-built leverage: - Reuse `cohesix-playbook`, mock backend, and host-only REST/filesystem backends. --- ### 6) Worker Boundary and Documentation Closure **Purpose:** Prevent host-side AI orchestration from depending on stronger worker claims than the VM implementation and generated evidence actually support. Implementation requirements: - Audit worker-heart, worker-gpu, and worker-lora kernel entrypoints against README, GPU, worker-ticket, role/scheduling, and interface docs. - Verify each Heartbeat/GPU/LoRA role against its accepted 26e executable image/READY/IPC or durable-completion, lifecycle notification, complete teardown/revoke, cap-backed endpoint, applied MCS scheduling, fault, and exact-target evidence. Model/session helpers remain separately classified, WorkerBus remains model-only, and task creation is never inferred from `ATTACH`. - If a host-side AI flow claims production ticket/lease-to-bundle authority, require 28b production ledger evidence as an additional gate; otherwise it may consume accepted 26e task behavior only as explicitly classified target evidence. - Add tests that prevent future docs from claiming worker spawn/lease semantics not backed by code and generated manifest truth. - Host-side AI run envelopes must reference host-ticket/provider receipts, not undocumented VM worker behavior. As-built leverage: - Reuse role-scoped ticket docs, worker crates, host-ticket receipts, and evidence-pack schemas. --- ### 7) Production PEFT Pipeline, Registry Transaction, and Provenance Closure **Purpose:** Support every declared PEFT/LoRA use case through one crash-safe host transaction without moving ML runtimes or artifacts into the VM. Implementation requirements: - Define one generated, phase-journaled transaction for `export`, `train`, `evaluate`, `scan`, `import`, `activate`, `runtime_reload`, `canary`, and `rollback`. Every phase has an idempotency key, input/output CAS refs, provider/executor identity, deadline, terminal receipt, recovery rule, and exact run/task/WorkerLora correlation. - Bind each selected phase to the 27b native execution identity: systemd unit and invocation, Docker image digest/container/events, optional Kubernetes object UID/generation/conditions, CUDA device/job, provider event cursor, and ticket/evidence id. Native metadata remains correlation only until the shared verifier proves the phase postcondition. - Validate base-model identity/license ref, dataset snapshot/provenance/consent refs, adapter/LoRA configuration, framework/provider profile, model and LoRA ids, artifact formats and hashes, training/evaluation metrics, threshold policy, safety/format scan, source job refs, signatures/attestations where configured, and target inference-runtime compatibility before promotion. - For the Hugging Face reference adapter, record read-only Trainer callback observations at train begin, checkpoint save, evaluation, and train end; hash and validate `adapter_model.safetensors`, `adapter_config.json`, the base model id/revision/digest, tokenizer/config, PEFT/Transformers/PyTorch/CUDA versions, resolved training configuration, dataset manifest, measured metrics, and model-card ref. Pickle-backed adapter artifacts are rejected by the live profile unless a separately approved migration path converts and verifies them before import. - Add registry locking, canonical-path confinement, symlink rejection, unique same-filesystem temp files, file and directory fsync/rename ordering, compare-and-swap activation generation, and rollback-safe activation records. Crash/restart recovery resumes or compensates from the phase journal without duplicating training, import, activation, or Worker receipts. - Ship bounded host executor adapters for at least one fully tested open PEFT path and the generic generated provider contract; optional Hugging Face PEFT/TRL and NeMo customization adapters use the same receipt schema. No adapter may accept arbitrary shell, unrestricted paths, raw credentials, or unvalidated framework arguments. - Ship a real CUDA reference profile using a supported open PEFT training stack and a real compatible inference runtime. If a use case advertises local Apple Silicon training or inference, ship an equivalent bounded MPS/MLX/Metal profile and conformance lane; otherwise that use case must name a remote CUDA/Jetson executor explicitly and local Apple execution remains unavailable. Provider selection is topology, not an implicit property of the CLI host. - Training/evaluation/scanning outputs are content-addressed host artifacts. Only bounded metadata, hashes, metrics summaries, status, and refs cross Cohesix control surfaces; adapter bytes, datasets, gradients, weights, and prompt/training corpora never enter the VM or general telemetry. - Activation records host-registry generation, `/gpu/models/*` publication/ack, inference-runtime reload/canary observation, WorkerLora receipt, and rollback target as one recoverable transaction. Publication alone is not activation; activation alone is not a successful runtime reload. - Negative/live tests cover bad provenance, unsupported base/runtime combinations, path traversal/symlink races, corrupt or oversized artifacts, failed training/evaluation/scan, lost ticket agent, duplicate result, host crash at every phase boundary, partial publish, failed reload/canary, lease expiry/revocation, and rollback after process restart. - Evidence packs include the bounded phase journal, registry generations, provider/executor receipts, evaluation/scan decisions, activation/canary/rollback results, CAS refs, and exact WorkerLora correlation, redacted where needed. - The PEFT evidence manifest presents the transaction as one causal graph from operator approval and GPU admission through native launch, framework callbacks, adapter artifact, evaluation/scan, activation/reload/canary, and rollback. Full logs, checkpoints, CUDA traces, and adapter bytes remain in NVMe-backed CAS or configured object storage; the pack carries bounded hashes, summaries, cursors, and refs. - Public examples and live playbooks must obtain adapter artifacts from the declared executor and verify their framework/base-model compatibility, provenance, signature/hash, evaluation, scan, and runtime behavior. Literal `adapter-bytes`, synthetic metrics, fabricated job ids, and local client- authored receipts are permitted only in explicitly named test fixtures and cannot enter a live package or use-case proof. - Update the 27b integration and use-case rows for Model Rollout, Private LoRA Foundry, `mac-private-peft-grid`, closed-loop AI factory, medical/Jetson demos, Operator-First, LeJEPA, Gesture Language, and any other PEFT consumer. A row remains non-production until its named executor/framework, target runtime, package, secrets, recovery, and live evidence pass. - Direct PEFT/NeMo/provider activation remains host-side and ticket-scoped; Cohesix records authority/evidence and bounded lifecycle state, not training internals. As-built leverage: - Reuse `coh peft`, `/gpu/models`, host-ticket-agent, evidence timeline, and Milestone 27a audit/replay defaults. --- ### 8) Optional NeMo runtime family (host-only, governed, cross-provider) **Purpose:** Support NVIDIA NeMo where it creates clear operational leverage over simpler direct-serving alternatives, while keeping Cohesix as the authority, evidence, and policy layer. Implementation requirements: - Treat NeMo as an optional host-side provider family under the Milestone 27d run-envelope contract, not as a new runtime plane: - `nemo.infer` for NIM / NeMo Export-Deploy / Triton / TensorRT-LLM-backed inference - `nemo.guardrails` for safety policy evaluation and refusal receipts - `nemo.evaluate` for model / RAG / agent evaluation jobs and score receipts - optional `nemo.retrieve` and `nemo.customize` only when they remain host-side and ticket-scoped - Add host capability probes that discover NeMo endpoints, deployed model profiles, guardrail policy ids, evaluator availability, and deployment state without making NeMo the source of truth. - Add a NeMo Run executor adapter that binds the resolved experiment/config, executor/cluster identity, image and source digests, model/data/artifact refs, checkpoints, cancellation/recovery, evaluations, and terminal state to the same generated run/ticket/evidence envelope as the baseline provider. - Add a NeMo Guardrails execution-rail adapter for consequential custom action and tool invocations: the before-action rail requests or validates the exact Cohesix ticket/grant and refuses on missing/stale/widened authority; the after-action rail records the bounded native result for shared verification. A guardrail verdict is policy evidence, not itself a Cohesix authority grant or provider-success receipt. - Live NeMo-backed actuation remains ticketed and fenced: - all mutating NeMo actions flow through delegated host tickets, - all actions carry `id`, `idempotency_key`, and `writer_epoch` where applicable, - unsupported or unauthorised NeMo actions fail deterministically with no side effects. - Guardrail and evaluator outputs become first-class receipts and evidence inputs: - `guardrail_policy_hash`, - `guardrail_decision`, - `evaluation_profile_hash`, - `evaluation_job_ref`, - `evaluation_summary_ref`, - `deployment_config_hash`. - Cohesix must remain more valuable than direct NeMo or direct vLLM use: - the same run envelope, delegated ticket model, evidence pack, and policy gates must work against NeMo and at least one alternate provider family, - NeMo support must not introduce NeMo-only authoritative state or bypasses that other providers cannot satisfy. - NeMo execution in this milestone remains a generated host-ticket provider action. Milestone 27e later normalizes it behind the same public compatibility API and provider-neutral inference receipt contract as every other accepted backend. - NeMo Agent Toolkit, MCP, or A2A features may be consumed only as downstream host integrations behind existing Cohesix auth and evidence boundaries; they must not become public control surfaces or authoritative coordination channels. ### 8a) Jetson Orin Nano NeMo reference topology **Purpose:** Make optional NeMo support testable on the maintained 8GB Jetson without assuming that every NeMo component, container, or model is available on AArch64 or fits in shared memory. Implementation requirements: - Extend the generated `jetson-orin-nano-jp7` profile with independently selected capabilities for `local_infer`, `remote_infer`, `guardrails`, `evaluate`, `retrieve`, and `customize`. A profile may legitimately enable only local edge inference while using remote guardrail/evaluator/customization services; missing capabilities return typed `not_enabled`, `not_installed`, `incompatible`, or `unreachable`, never an inferred healthy aggregate. - Probe NeMo Framework/Export-Deploy, NIM, Triton, TensorRT/TensorRT-LLM, Guardrails, Evaluator, and alternate providers separately. Do not assume a datacenter NIM or NeMo container supports Jetson AArch64 merely because Docker and the NVIDIA runtime are installed. Capture package or OCI digest, API and model-profile version, architecture, JetPack/L4T/CUDA compatibility, endpoint identity, auth-ref presence, deployment config hash, and observed capability. - The local Jetson reference uses an isolated, reproducible venv or digest-pinned NVIDIA-container profile under the generated NVMe storage root; it never mutates the system Python environment or stores raw credentials in argv, manifests, logs, or evidence. Model, engine, tokenizer, adapter, and evaluation artifacts are content-addressed and include license/provenance metadata. - Live local acceptance requires at least one selected licensable quantized reference model and engine whose weights, runtime workspace, KV/cache budget, and bounded batch-1 request fit beneath the live 27b Jetson GPU admission ceiling with reserved OS headroom. An 8B 4-bit edge model may be selected only after this measured preflight; model size or quantization labels alone are not proof that the workload fits or completes. - A full NeMo training stack is not mandatory on the 8GB Nano. The generated topology explicitly identifies training/customization as local, remote, or unavailable. A remote training/PEFT transaction may promote a Jetson use case only when the returned artifact is provenance-checked and the exact Jetson inference runtime completes reload, canary, rollback, and WorkerLora receipt correlation. - Live inference evidence records cold model load, peak device-visible and system memory, engine/workspace identity, request bounds, TTFT, bounded completion, output digest/summary, temperature/throttling observations, and cleanup. The run fails safely before allocation when the selected model or context budget exceeds current shared-memory headroom; no test deliberately drives the host into system OOM or changes power/network/display state. - The currently unconfigured Jetson is a mandatory negative reference: with no NeMo/PyTorch/Transformers/Triton package, image, process, or endpoint selected, capability probes must return the complete stable unavailable shape and issue no pulls, installs, model downloads, provider calls, or host mutations. As-built leverage: - Reuse `host-ticket-agent`, `cohesix-py` orchestration/playbooks, evidence packs, telemetry exports, GPU lease flows, and production audit/replay defaults from Milestone 27a. **Commands** - `cargo test -p host-ticket-agent` - `cargo test -p coh` - `python -m pytest tools/cohesix-py/tests/test_orchestration.py` - `python -m pytest tools/cohesix-py/tests/test_playbooks.py` - `python -m pytest tools/cohesix-py/tests/test_evidence_receipts.py` - `python -m pytest tools/cohesix-py/tests/test_integrations.py -k nemo` - `python -m pytest tools/cohesix-py/tests/test_playbooks.py -k nemo` - `cargo test -p tests --test host_ticket_agent -- nemo` - `cohesix-playbook --playbook long-context-agent-factory --dry-run --mock` - `cohesix-playbook --playbook long-context-agent-factory --dry-run --mock --metrics-out out/bench/m27d-ai-run-cost.json` - `cargo test -p worker-gpu && cargo test -p worker-lora && cargo test -p worker-heart` - `cargo test -p coh --test peft && cargo test -p coh --test peft_registry_transactions` - `scripts/ci/provider_conformance_run.sh --provider peft --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-peft-live` - `scripts/ci/use_case_gate.sh --promote-milestone 27d --only peft --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m27d-peft-live` - `scripts/ci/provider_conformance_run.sh --provider nemo --host-profile jetson-orin-nano-jp7 --capability-only --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-nemo-jetson-unavailable` - `scripts/ci/provider_conformance_run.sh --provider nemo --host-profile jetson-orin-nano-jp7 --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-nemo-jetson-live` - `scripts/ci/use_case_gate.sh --promote-milestone 27d --only nemo-jetson --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m27d-nemo-jetson` **Checks (Definition of Done)** - Multi-agent host workflows never require an undifferentiated shared Queen writer. - A run can restart from checkpoint/evidence with the same authoritative constraints and receipts, without reconstructing a full prompt transcript. - Evidence-only reconstruction preserves task graph ordering, handoff lineage, semantic snapshot, Context Capsule, render-profile, retrieval-manifest identity, native execution and framework-callback correlation, verification, recovery, and offloaded tool-artifact references. - AI orchestration consumes accepted 27c semantic artifacts by immutable reference; it cannot silently rebuild, mutate, or substitute an unreceipted capsule. - Prefix/hotset reuse is bounded by TTL/quota, attributable to a caller, and visible in evidence. - Prefix cache hits and misses are explainable from bounded semantic-snapshot/capsule/render/provider eligibility and invalidation fields rather than hidden provider behavior. - Strategy selection and long-context cost metrics are observable per run/step. - High-risk live AI mutations remain policy-gated and ticket-scoped. - Worker-role documentation and generated snippets consume the accepted 26e executable contracts and match actual kernel/host implementation boundaries; no AI task depends on undocumented VM Worker behavior or a session-only `ATTACH`. - PEFT export, train, evaluate, scan, import, activation, inference-runtime reload/canary, and rollback are one idempotent, crash-recoverable, provenance-complete host transaction with exact systemd/Docker/CUDA, framework-callback, artifact/base-model, and WorkerLora correlation; publication, a callback, a native label/notification, or a registry rename alone cannot pass. - At least one open PEFT executor and target inference runtime pass live end-to-end conformance. Other framework/provider families remain explicitly integration-pattern, mock, dry-run, or not-enabled until they pass the same generated contract. - Every declared PEFT/LoRA consumer resolves to a named live reference topology and complete transaction; CUDA is shipped as the baseline real provider, local Apple execution is real and packaged wherever advertised, and otherwise the Mac playbook names a remote CUDA/Jetson executor. Literal adapter bytes, synthetic metrics/job ids, and client-authored receipts remain fixture-only and cannot pass. - Every AI/PEFT scenario, playbook, and post-M24 activity is reclassified in the 27b use-case matrix from actual executor, Worker, package, recovery, and evidence records; no mock workflow is promoted by documentation alone. - The Verified Private LoRA Release passes as one ticket-centred Jetson journey that an operator can plan, apply, watch, explain, verify, recover, and export; its SwarmUI-ready graph is derived from the same validated evidence manifest and cannot create or promote proof. - Optional NeMo support remains host-side, ticket-scoped, writer-fenced, and evidence-backed; disabling NeMo leaves the baseline 27d substrate intact. - The same Cohesix run envelope and evidence model works against NeMo and at least one alternate provider family, proving NeMo support adds governed lifecycle value rather than vendor-specific lock-in. - A selected NeMo Run executor preserves resolved experiment/executor/artifact, checkpoint, cancel/recovery, evaluation, and terminal identity; Guardrails before/after execution rails fail closed around consequential tools and remain policy observations rather than Cohesix grants or provider receipts. - The `jetson-orin-nano-jp7` NeMo profile passes both the mutation-free unconfigured capability lane and a separately provisioned live-reference lane before any Jetson NeMo use case is promoted. Local inference, remote services, guardrails, evaluation, retrieval, and customization remain independent capabilities; Docker/NVIDIA runtime presence, a downloaded model, or a successful generic CUDA job cannot promote any of them. - Guardrail and evaluator receipts can gate live promotion or actuation decisions deterministically in dry-run/mock tests before any real provider mutation is allowed. - AI run-cost evidence records checkpoint/resume, semantic-object selection, capsule rendering, prefix/hotset reuse, prompt bytes avoided, provider queue-wait simulation, and evidence export overhead for the dry-run/mock playbook; material regressions are classified as semantic selection, host orchestration, provider adapter, evidence-pack, or gateway overhead before 27e or 30b depends on the run model. Actual provider TTFT, streaming, usage, cache, and completion evidence is accepted only under 27e. - No new in-VM listeners, runtime, or control protocols are introduced. **Compiler touchpoints** - `coh-rtc` emits generated host-tool defaults for AI run envelope limits, task-graph/handoff bounds, context budget ceilings, accepted 27c semantic snapshot/Context Capsule/render-profile reference bounds, retrieval-manifest and artifact-ref bounds, prefix/hotset TTLs, metrics bounds, and the phase-journaled PEFT executor/transaction contract under the existing host policy/codegen path. It consumes and references the 27c schemas; it does not redefine them. - `coh-rtc` also emits framework-callback event bounds, native execution correlation requirements, PEFT safetensors/config/base-model bindings, evidence-profile/ref limits, and optional NeMo Run/Guardrails execution-rail mappings under the 27b provider-adapter contract. - Manifest validation rejects AI host-control enablement when Milestone 27a delegated identity or audit/replay requirements are disabled in the target profile. - Manifest validation rejects AI host-control enablement when Milestone 27b provider registry, read visibility, identity mapping, provider conformance, or use-case evidence requirements are missing for a side-effecting provider action. - Selected live-provider mutation tests prove that the Release A Python, inference, PEFT, and model-registry adapters cannot bypass `/host/tickets/spec`, `host-ticket-agent`, generated provider action validation, delegated ticket scope, idempotency, writer epoch, and evidence receipts. NeMo, Kubernetes, Docker, systemd, and other unselected helpers prove typed unavailable behavior until their own provider rows are promoted. - Manifest/docs validation rejects worker-role claims that exceed the current code/generated worker implementation boundary. - `coh-rtc` emits PEFT/model registry transaction/provenance bounds, allowed framework/provider profiles, artifact/ref formats, evaluation/scan gates, runtime reload/canary requirements, recovery rules, WorkerLora correlation, and use-case promotion obligations consumed by host tools and evidence exports. - Generated PEFT profiles also declare execution topology, CUDA or Apple provider/runtime compatibility, exact package extras, live-reference dataset/base-model licences and hashes, and whether a use case is unavailable when its external domain application is absent. - `coh-rtc` additionally emits optional provider-family policy for NeMo capability probes, action allowlists, endpoint/auth refs, deployment/evaluation/guardrail bounds, and alternate-provider parity requirements. - Canonical interface/architecture docs refreshed in: - `docs/INTERFACES.md` - `docs/ARCHITECTURE.md` - Generated host-tool/docs snippets refreshed in: - `docs/PYTHON_SUPPORT.md` - `docs/HOST_TOOLS.md` - `docs/SECURITY.md` - `docs/TEST_PLAN.md` **Task Breakdown** ``` Title/ID: m27d-ai-intent-adapter Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / AI intent adapter Delivery: Release B governed-autonomy extension; not a Release A blocker. Goal: Convert AI-supervisor proposals into 28a typed intents and require accepted decision-bound grants for every governed live AI side effect without creating an AI-specific guardrail path. Inputs: accepted 27c semantic/capsule schemas, accepted 28a intent/fact/decision/grant contracts, 27b provider/action admission metadata, 27a host-ticket identity/idempotency/fencing/WAL, AI run/PEFT/checkpoint/prefix action schemas. Changes: - tools/coh-rtc/src/ir.rs + codegen — generated mappings from AI run, checkpoint, prefix, PEFT, model-promotion, and supervisor action records to exact 28a intent schemas, required fact sources, policy ids, grant ceilings, freshness/recheck modes, and receipt fields. - host AI adapters and host-ticket-agent integration — accept model-drafted bounded fields as untrusted intent input, resolve authoritative facts through registered sources, attach the accepted `admission_id`, and refuse policy activation/modification, self-authoritative model facts, confidence-as-verdict, grant widening, or stale decisions. - dry-run/evidence fixtures — show proposed intent plus predicted/simulated outcome without reservation or grant; bind every governed live side effect and high-risk PEFT promotion to the accepted 28a decision in addition to existing 27d transaction evidence. - docs/ARCHITECTURE.md + docs/INTERFACES.md + docs/SECURITY.md + docs/PYTHON_SUPPORT.md — AI proposal/admission boundary and exact live versus dry-run semantics. Commands: - cargo test -p coh-rtc - cargo test -p host-ticket-agent --test ai_admission - python3 -m pytest -q tools/cohesix-py/tests/test_integrations.py -k ai_intent - scripts/check-generated.sh Checks: - AI can draft only schema-valid intent fields; it cannot select/modify policy or promote assertions; model confidence is never a verdict; dry-run creates no grant; every governed live AI/PEFT/model-promotion side effect carries an accepted non-stale `admission_id` and uses the existing host-ticket/provider executor path. Deliverables: - One 28a-backed AI intent adapter shared by all 27d live action families. Title/ID: m27d-ai-run-envelopes Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-ai-run-envelopes Goal: Add typed host-side AI run/task/step envelopes with explicit handoff, dependency, and context-budget contracts. Inputs: accepted Milestone 27c semantic snapshot, Context Capsule, and render receipt contracts; tools/cohesix-py/cohesix/orchestration.py, tools/cohesix-py/cohesix/playbooks.py, docs/PYTHON_SUPPORT.md, docs/SECURITY.md Changes: - tools/cohesix-py/cohesix/orchestration.py — RunRequest, RunTask, RunStep, HandoffRef, SemanticSnapshotRef, ContextCapsuleRef, ContextRenderProfileRef, RetrievalManifestRef, and ContextBudget validators for delegated AI ticket flows. - tools/cohesix-py/cohesix/playbooks.py — `long-context-agent-factory` dry-run/mock playbook with explicit task graph, delegation, and handoff receipts. - tools/cohesix-py/cohesix/receipts.py — typed derived receipts for run/task/step/handoff identity. - tools/cohesix-py/tests/test_orchestration.py + tools/cohesix-py/tests/test_playbooks.py — budget, idempotency, and dry-run coverage. Commands: python -m pytest tools/cohesix-py/tests/test_orchestration.py && python -m pytest tools/cohesix-py/tests/test_playbooks.py Checks: Invalid budget/policy/reference combinations fail before writes; dry-run outputs show run/task/step identity, dependencies, handoffs, capsule/render identity, and budgets deterministically. Deliverables: Host-side AI runs become explicit, typed, replay-addressable, and suitable for delegated multi-agent coordination without hidden state. Title/ID: m27d-host-ticket-ai-actions Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-host-ticket-ai-actions Goal: Extend the host ticket plane with bounded AI control actions for inference runs, checkpoints, and prefix lifecycle. Inputs: accepted Milestone 27a operator-approval/identity/idempotency/WAL contracts, optional accepted m27d-ai-intent-adapter for Release B governed mode, apps/host-ticket-agent, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/HOST_TOOLS.md Changes: - apps/host-ticket-agent/src/lib.rs — allowlist and schema validation for `infer.run|resume|abort`, `context.checkpoint|resume|evict`, and `prefix.warm|evict`; Release A consumes authenticated operator approval and emits `admission_id=unavailable`, while Release B governed mode consumes the generated 28a `admission_id` and immutable intent/policy/state/grant bindings. Neither mode defines a separate AI guardrail. - apps/host-ticket-agent/src/status.rs — bounded lifecycle/state counters for AI run, checkpoint, and prefix operations. - apps/host-ticket-agent/src/executors/infer.rs — host-only provider adapter contract; no VM-side model runtime. - docs/INTERFACES.md — canonical host-ticket AI action envelopes, receipt fields, semantic snapshot/Context Capsule/render/retrieval refs, and refusal semantics. - docs/ARCHITECTURE.md — authority flow for delegated AI runs, checkpoints, prefix lifecycle, task handoffs, and evidence correlation. Commands: cargo test -p host-ticket-agent && cargo test -p tests --test host_ticket_agent Checks: AI host tickets stay idempotent, allowlist-gated, stale-writer safe, and bound either to the selected Release A authenticated operator approval or a non-stale accepted 28a admission in governed mode; unsupported or ambiguous mode, missing approval/admission, widened grant, or stale-state actions fail deterministically with no side effects; handoff/checkpoint references remain bounded and attributable. Deliverables: `/host/tickets/spec` becomes the canonical AI actuation path before 30b VM roots exist. Title/ID: m27d-ai-evidence-checkpoints Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-ai-evidence-checkpoints Goal: Extend evidence pack/timeline flows to reconstruct AI runs from checkpoints, receipts, and cost telemetry. Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, apps/coh/tests/evidence_pack.rs, apps/coh/tests/evidence_timeline.rs, docs/TEST_PLAN.md Changes: - apps/coh/src/evidence.rs — include run envelopes, checkpoint manifests, immutable semantic snapshot/Context Capsule/render receipts, retrieval manifests, offloaded tool-artifact refs, prefix reuse stats, and provider receipts with redaction. - apps/coh/src/evidence_timeline.rs — correlate run/task/step/handoff/checkpoint/prefix events into a deterministic operator timeline. - evidence graph projection — join approval/decision/grant, native systemd/Docker/Kubernetes/CUDA execution identities, framework callbacks, artifacts, verification, terminal receipts, and recovery into the 27b causal manifest; expose a bounded SwarmUI-ready graph projection while retaining the evidence core as authority. - apps/coh/tests/evidence_pack.rs + apps/coh/tests/evidence_timeline.rs — restart/resume reconstruction tests from evidence-only inputs. Commands: cargo test -p coh --test evidence_pack && cargo test -p coh --test evidence_timeline Checks: Evidence-only reconstruction preserves authoritative constraints, handoff lineage, semantic snapshot/capsule/render/retrieval identity, native execution/callback correlation, verification, recovery, and receipts; sensitive keys stay redacted, omitted external artifacts remain explicitly missing, and UI/OTel/CloudEvents/attestation projections cannot become authority. Deliverables: Long-context AI runs become auditable and resumable without prompt archaeology or transcript dependence. Title/ID: m27d-ai-policy-and-metrics Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-ai-policy-and-metrics Goal: Generate host defaults and bounded metrics for AI context budgets, prefix reuse, and run efficiency. Inputs: accepted Milestone 27c bounds and generated schemas; tools/coh-rtc, configs/root_task.toml, apps/coh/src/telemetry.rs, tools/cohesix-py/cohesix/generated.py, docs/PYTHON_SUPPORT.md, docs/TEST_PLAN.md Changes: - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/validate.rs — host AI budget/TTL/metrics bounds, 27c semantic snapshot/capsule/render reference use, retrieval/offload bounds, task-graph/handoff bounds, and dependency on 27a safety gates without redefining the 27c object schemas. - apps/coh/src/telemetry.rs — bounded run-efficiency metric export helpers. - tools/cohesix-py/cohesix/generated.py — generated defaults consumed by Python orchestration/playbooks. Commands: - cargo test -p coh-rtc - cargo test -p coh - python -m pytest tools/cohesix-py/tests/test_evidence_receipts.py - cohesix-playbook --playbook long-context-agent-factory --dry-run --mock --metrics-out out/bench/m27d-ai-run-cost.json Checks: Generated defaults bind accepted 27c references and bound AI runs consistently across CLI/Python flows; cache eligibility/invalidation fields and metrics stay bounded and byte-stable; dry-run/mock run-cost evidence reports semantic selection, capsule rendering, checkpoint/resume, prefix reuse, prompt bytes avoided, and evidence export overhead without invoking live providers. Deliverables: Context budgets, retrieval/offload bounds, and efficiency metrics are compiler-aligned rather than ad hoc. Title/ID: m27d-framework-adapters Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-framework-adapters Goal: Provide host-side reference adapters that let external supervisors coexist with Cohesix through delegated tickets, Context Capsules, checkpoints, and evidence exports. Inputs: accepted Milestone 27c Python helpers and Context Capsule contract; tools/cohesix-py/cohesix/integrations.py, tools/cohesix-py/examples/, docs/PYTHON_SUPPORT.md, docs/HOST_TOOLS.md Changes: - tools/cohesix-py/cohesix/integrations.py — reference supervisor adapter helpers for immutable capsule selection/inspection, delegated submission, receipt polling, checkpoint lookup, and evidence export. Include a generated `ticketed_run` context and read-only framework callback interface for run/checkpoint/evaluation/artifact/cancel/terminal observations; callbacks submit only validated ticket requests and cannot call native providers or author authoritative receipts. - tools/cohesix-py/examples/ — bounded examples for repo-scale analysis and dry-run delegated handoff flows. - docs/PYTHON_SUPPORT.md + docs/HOST_TOOLS.md — integration contract for external supervisors over delegated tickets and evidence receipts. Commands: python -m pytest tools/cohesix-py/tests/test_integrations.py && python -m pytest tools/cohesix-py/tests/test_examples_ci_siem.py Checks: Reference adapters use accepted semantic/capsule refs, delegated tickets, explicit handoff/checkpoint refs, generated provider actions, and evidence exports only; no hidden side-channel state, direct `/queen/ctl` mutation, direct provider API mutation, or direct host executor call is required or accepted. Deliverables: Cohesix remains the authority/evidence layer beneath supervisor frameworks instead of becoming one. Title/ID: m27d-worker-boundary-closure Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-worker-boundary-closure Goal: Verify Worker role documentation, generated snippets, and AI run references consume the accepted 26e executable Worker boundary without replacing it with session/model state. Inputs: accepted 26e Worker image/ABI/QEMU/Pi component and integration records, the 27b provider/integration/use-case graph, and, only for production ticket/lease-to-bundle claims, accepted 28b ledger evidence; apps/worker-heart, apps/worker-gpu, apps/worker-lora, docs/GPU_NODES.md, docs/WORKER_TICKETS.md, docs/ROLES_AND_SCHEDULING.md, docs/INTERFACES.md Changes: - apps/worker-heart/src/kernel.rs + apps/worker-gpu/src/kernel.rs + apps/worker-lora/src/lib.rs — verify every enabled executable target contract against the accepted capability, notification, MCS scheduling, fault, revocation, and exact-target evidence; keep model/session helpers clearly non-authoritative. - docs/GPU_NODES.md + docs/WORKER_TICKETS.md + docs/ROLES_AND_SCHEDULING.md — describe executable Worker roles exactly as built while separating Worker lifecycle/receipts from host GPU/PEFT execution and session-only `ATTACH`. - tools/coh-rtc/src/validate.rs — reject generated worker-spawn claims that do not match enabled worker implementation status. - apps/root-task/tests/worker_docs_alignment.rs — guard documented worker paths and generated role state against implementation drift. Commands: cargo test -p worker-heart && cargo test -p worker-gpu && cargo test -p worker-lora && cargo test -p root-task --test worker_docs_alignment Checks: Docs neither overclaim nor undercut Worker behavior; executable roles and session-only `ATTACH` remain explicit; every executable-task claim used by AI run control is backed by code, generated manifest state, target-created objects, cap-backed authority, durable completion/notification lifecycle, applied MCS scheduling, complete fault/revocation evidence, exact QEMU/Pi records, and tests; only production ticket/lease-to-bundle claims require and cite 28b. Deliverables: Host-side AI orchestration has an honest worker boundary and cannot cite undocumented or stale worker semantics. Title/ID: m27d-peft-registry-transactions Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-peft-registry-transactions Goal: Make the complete PEFT export/train/evaluate/scan/import/activate/runtime-reload/canary/rollback lifecycle transactional, provenance-complete, and WorkerLora-correlated. Inputs: accepted 26e WorkerLora receipt path, m27b-authoritative-receipt-and-evidence-core, 27b PEFT/external-executor/use-case rows, apps/coh/src/peft, apps/coh/src/evidence.rs, apps/host-ticket-agent, apps/gpu-bridge-host, tools/cohesix-py, CAS/evidence tools, docs/GPU_NODES.md, docs/SECURITY.md, docs/TEST_PLAN.md Changes: - tools/coh-rtc/src/ir.rs + generated provider/integration records — bounded PEFT phase schemas, artifact/provenance refs, provider/framework profiles, evaluation/scan gates, runtime compatibility, recovery, WorkerLora correlation, explicit operator-approval requirements for Release A, and 28a decision requirements for governed promotion and high-risk live phases in Release B. - apps/coh/src/peft/mod.rs — phase journal, registry lock, canonical-path/symlink confinement, unique same-filesystem temp files, file/directory fsync and rename ordering, CAS artifacts, metadata validation, compare-and-swap generations, and rollback-safe transaction records. - apps/coh/src/peft/activate.rs — correlate registry generation, `/gpu/models/*` publish/ack, inference-runtime reload/canary observation, WorkerLora receipt, and rollback target as one recoverable activation transaction. - apps/host-ticket-agent/src/executors/peft.rs — execute generated `peft.export|train|evaluate|scan|import|activate|runtime_reload|canary|rollback` phases through named host providers with crash-safe idempotency and exact 26e WorkerLora result delivery. - tools/cohesix-py/cohesix/integrations.py — bounded reference adapter for at least one open PEFT executor plus optional Hugging Face PEFT/TRL and NeMo provider profiles under the same schema; never arbitrary shell or paths. The Hugging Face profile provides a read-only Trainer callback for train- begin, checkpoint-save, evaluation, and train-end observations and binds genuine `adapter_model.safetensors`, `adapter_config.json`, base-model revision/digest, tokenizer/config, framework/CUDA versions, dataset manifest, resolved training configuration, measured metrics, and model-card ref. - apps/coh/src/evidence.rs + apps/coh/src/evidence_timeline.rs — include bounded phase journal, native execution and framework-callback correlation, provenance, evaluation/scan, activation/reload/canary/rollback, CAS, provider, and WorkerLora receipts as one causal evidence graph. - docs/GPU_NODES.md + docs/HOST_TOOLS.md + docs/PYTHON_SUPPORT.md + docs/USE_CASES.md + docs/SECURITY.md + docs/TEST_PLAN.md — document the full transaction, host/VM data boundary, package/provider requirements, failure recovery, and use-case promotion. Commands: cargo test -p coh --test peft && cargo test -p coh --test peft_registry_transactions && cargo test -p host-ticket-agent && python -m pytest tools/cohesix-py/tests/test_integrations.py -k peft && scripts/ci/provider_conformance_run.sh --provider peft --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-peft Checks: A live reference path completes every phase with verified provenance, native systemd/Docker/CUDA identity, callback/checkpoint correlation, safetensors/config/base-model compatibility, thresholds, scan, CAS refs, runtime observation, exact WorkerLora receipt, and evidence; injected crash/ timeout/duplicate/revocation/partial-publish/reload failure at every phase boundary resumes or compensates without duplicate effects; unsupported providers stay non-production, and callback or native metadata alone never satisfies a phase. Deliverables: The selected Release A PEFT/LoRA use case has one complete operator-approved host-side transaction; the same transaction consumes 28a decision-bound grants when promoted to governed Release B operation. Title/ID: m27d-live-peft-reference-paths Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-live-peft-reference-paths Goal: Replace synthetic PEFT examples with one packaged Jetson live training-to-runtime reference path for the selected Release A use case while preserving the real WorkerLora boundary. Inputs: m27d-peft-registry-transactions, m27b-public-surface-live-mode-gate, m27b-gpu-workload-and-mig-executor, m27b-live-reference-workflows, tools/cohesix-py/examples/peft_roundtrip.py, tools/cohesix-py/cohesix/{integrations.py,playbooks.py}, provider/package registries, CUDA and optional Apple ML provider hosts, reference base models/dataset manifests, supported inference runtimes, accepted WorkerLora evidence. Changes: - CUDA reference profile — package and pin a bounded open PEFT training/evaluation stack, base-model and dataset manifest, adapter format, scanner, and compatible inference runtime; execute the full export/train/evaluate/scan/import/activate/reload/canary/rollback transaction through generated host tickets and the live GPU executor. - systemd/Docker launch profile — run the selected training/evaluation and runtime canary through a hardened systemd unit and digest-pinned NVIDIA container, correlating unit invocation, image/container/events, CUDA device/job, callback checkpoints, artifacts, and terminal receipts. A later Kubernetes profile substitutes its accepted CRD/controller execution shape without changing the workflow or receipt schema. - Apple and other reference profiles — report typed unavailable in Release A. Promote a local Apple MPS/MLX/Metal or remote profile only through its own named use case, package, phase/receipt contract, and live evidence. - tools/cohesix-py/examples/peft_roundtrip.py — separate explicit mock fixture mode from live mode. Live mode consumes a genuine executor-produced adapter and measured metrics, validates provenance/signature/hash/framework/base/runtime compatibility, and never writes literal adapter bytes or authors its own authoritative receipt. - tools/cohesix-py/cohesix/playbooks.py + use-case graph — bind the selected Release A **Verified Private LoRA Release** walkthrough to its Jetson executor/framework/runtime/package/recovery/evidence profile and the 27b ticket-centred plan/watch/explain/verify/recover lifecycle. Model Rollout, Private LoRA Foundry, `mac-private-peft-grid`, closed-loop factory, medical/Jetson, Operator-First, LeJEPA, Gesture Language, and every other unselected PEFT consumer remain typed unavailable rather than simulated. - packages/tests/evidence — ship exact Python/provider extras and model/runtime compatibility metadata; use small licensable reference inputs for deterministic functional tests, plus selected live-provider acceptance evidence and crash/failure injection at every phase. Commands: python -m pytest tools/cohesix-py/tests/test_integrations.py -k peft && python -m pytest tools/cohesix-py/tests/test_playbooks.py -k peft && scripts/ci/provider_conformance_run.sh --provider peft --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-peft-live && scripts/ci/use_case_gate.sh --promote-milestone 27d --only peft --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m27d-peft-live Checks: The selected Release A PEFT/LoRA row resolves to and passes a complete genuine adapter lifecycle on Jetson; systemd/Docker/CUDA execution identity, callback checkpoints, safetensors/config/base-model binding, measured metrics, evaluation/scan results, reload/canary, rollback, CAS hashes, provider identity, and WorkerLora terminal record are observed and correlated in one ticket graph. Mock artifacts and synthetic metrics remain isolated fixtures, and every unselected Kubernetes, NeMo, Apple, or other row remains unavailable. Deliverables: One real packaged Verified Private LoRA Release on Jetson with a live CUDA/PEFT/systemd/Docker execution and evidence path; additional provider shapes remain independent future promotions over the same envelope. Title/ID: m27d-ai-use-case-promotion Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-ai-use-case-promotion Goal: Promote selected AI and PEFT scenarios only when their complete executable-Worker, provider, data-plane, package, recovery, and evidence chains are live. Inputs: m27d-peft-registry-transactions, m27d-live-peft-reference-paths, AI run/checkpoint/provider tasks, configs/generated/use_case_evidence.json, all 27b AI/PEFT rows, live conformance records, release manifests. Changes: - scripts/ci/use_case_gate.sh — 27d promotion mode for AI run and PEFT pipeline dependencies, including reference executor/runtime and exact WorkerLora receipt evidence. - docs/USE_CASES.md + post-M24 activity blocks — generated maturity classifications that promote only the selected Release A inference/PEFT walkthroughs and leave every other AI/PEFT consumer unavailable or at its previously proven lower tier. - apps/coh/src/evidence.rs — bind use-case id and dependency-graph hash to AI/PEFT evidence packs. Commands: scripts/ci/use_case_gate.sh --promote-milestone 27d --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m28d && cargo test -p coh --test evidence_pack Checks: A mock/dry-run workflow, registry-only mutation, model publication, or Worker receipt alone cannot promote a use case; each production row reconstructs the full live chain and exact failure recovery. Deliverables: Public AI/PEFT claims are machine-gated by actual end-to-end implementation. Title/ID: m27d-nemo-capability-probes Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-nemo-capability-probes Goal: Detect and classify optional NeMo runtime capabilities without making NeMo the source of truth. Inputs: tools/cohesix-py/cohesix/integrations.py, tools/cohesix-py/cohesix/generated.py, docs/PYTHON_SUPPORT.md, docs/HOST_TOOLS.md Changes: - tools/cohesix-py/cohesix/integrations.py — `probe_nemo_runtime`, `probe_nemo_guardrails`, and `probe_nemo_evaluator` helpers that resolve configured local packages/containers and remote endpoints/auth refs, deployed model profiles, architecture/runtime compatibility, and independent capability summaries without pulling images, downloading models, or mutating the host. - tools/cohesix-py/cohesix/generated.py — generated NeMo capability defaults and bounded endpoint/profile limits from `coh-rtc`. - docs/PYTHON_SUPPORT.md + docs/HOST_TOOLS.md — operator-visible NeMo capability probe contract and failure semantics. Commands: python -m pytest tools/cohesix-py/tests/test_integrations.py -k nemo_probe Checks: Capability probes are read-only, bounded, deterministic, and return the same shape whether NeMo is unavailable, partially configured, or fully available. Deliverables: Cohesix can reason about NeMo availability and profile shape before choosing provider strategy or issuing any host-ticket mutation. Title/ID: m27d-nemo-provider-family Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-nemo-provider-family Goal: Add NeMo-backed provider adapters under the same delegated ticket, checkpoint, and evidence contract as other AI backends. Inputs: accepted Milestone 27c Context Capsule contract; apps/host-ticket-agent/src/executors/infer.rs, tools/cohesix-py/cohesix/orchestration.py, docs/ARCHITECTURE.md, docs/INTERFACES.md Changes: - apps/host-ticket-agent/src/executors/infer.rs — optional NeMo provider adapters for `nemo.infer`, `nemo.guardrails`, and `nemo.evaluate`, plus a NeMo Run executor binding resolved experiment/config, executor/cluster, source/image/model/data/artifact identity, checkpoints, cancel/recovery, evaluations, and terminal state to the common run/ticket envelope; include Context Capsule refs, deterministic refusal mapping, and bounded provider- action receipt fields. - tools/cohesix-py/cohesix/orchestration.py — provider-family selection hints and host-ticket provider receipt normalization for NeMo vs alternate backends. - docs/INTERFACES.md + docs/ARCHITECTURE.md — host-ticket NeMo action envelopes, receipt fields, and authority mapping back to delegated tickets, capsules, and checkpoints; reserve public compatibility and provider-neutral inference receipt semantics for Milestone 27e. Commands: cargo test -p host-ticket-agent && cargo test -p tests --test host_ticket_agent -- nemo_provider Checks: NeMo-backed actions are idempotent, allowlist-gated, writer-fenced, and produce the same internal host-ticket provider receipt contract as alternate providers; unsupported NeMo features fail deterministically with no side effects; no public API compatibility claim is made before 27e. Deliverables: NeMo becomes an optional provider family beneath Cohesix rather than a special-case control plane. Title/ID: m27d-nemo-guardrails-and-eval Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-nemo-guardrails-and-eval Goal: Make NeMo guardrail and evaluator results first-class policy receipts that can gate live AI actions. Inputs: apps/coh/src/evidence.rs, apps/coh/src/evidence_timeline.rs, tools/cohesix-py/cohesix/playbooks.py, docs/SECURITY.md, docs/TEST_PLAN.md Changes: - apps/coh/src/evidence.rs + apps/coh/src/evidence_timeline.rs — include guardrail policy hashes, decisions, evaluation refs/summaries, and deployment config hashes in evidence and timeline correlation. - NeMo Guardrails integration — add a bounded execution-rail adapter for consequential custom actions/tools. The before-action rail validates the exact ticket/grant and the after-action rail submits a bounded native result for shared verification; neither rail can mint authority or terminal proof. - tools/cohesix-py/cohesix/playbooks.py — dry-run/mock playbooks that require successful NeMo guardrail/evaluator receipts before promotion or live mutation steps become admissible. - docs/SECURITY.md + docs/TEST_PLAN.md — policy-gating contract for NeMo-backed guardrails/evaluations and additive regression expectations. Commands: cargo test -p coh --test evidence_pack && cargo test -p coh --test evidence_timeline && python -m pytest tools/cohesix-py/tests/test_playbooks.py -k nemo_gate Checks: Guardrail/evaluator receipts are durable, redacted where needed, correlated to run/task/step and exact tool-action identity, and can deterministically block promotion or actuation in mock and evidence-only reconstruction paths; before/after rail ordering, timeout, refusal, duplicate, and missing-after-action cases fail closed, and a guardrail decision never substitutes for provider verification. Deliverables: NeMo safety and evaluation add operational value to Cohesix instead of existing as unaudited provider-side metadata. Title/ID: m27d-nemo-policy-and-parity Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-nemo-policy-and-parity Goal: Enforce that optional NeMo support remains governed, bounded, and more valuable than direct backend-specific alternatives. Inputs: tools/coh-rtc/src/ir.rs, tools/coh-rtc/src/validate.rs, tools/cohesix-py/cohesix/generated.py, docs/BUILD_PLAN.md, docs/HOST_TOOLS.md Changes: - tools/coh-rtc/src/ir.rs + tools/coh-rtc/src/validate.rs — optional NeMo endpoint/auth refs, action allowlists, receipt-field bounds, and alternate-provider parity requirements under the host AI policy path. - tools/cohesix-py/cohesix/generated.py — compiler-aligned NeMo policy defaults consumed by orchestration and probes. - docs/HOST_TOOLS.md — operational guidance stating that NeMo support is optional, host-side, and governed by the same Cohesix authority/evidence model as other providers. Commands: cargo test -p coh-rtc && python -m pytest tools/cohesix-py/tests/test_integrations.py -k nemo_policy Checks: Invalid NeMo policy, missing delegated-authority prerequisites, or NeMo-only authoritative semantics are rejected at validation time; the same run envelope/evidence contract remains valid with NeMo disabled or replaced by another provider family. Deliverables: NeMo support is compiler-governed, optional, and demonstrably cross-provider rather than a lock-in path. Title/ID: m27d-nemo-jetson-reference-profile Milestone: Milestone 27d — Host-Side AI + PEFT Coexistence: Delegated Runs, Durable Context, Production PEFT / m27d-nemo-jetson-reference-profile Goal: Prove optional NeMo capabilities on the maintained Jetson Orin Nano 8GB topology with exact resource, package, model, runtime, authority, and evidence boundaries. Inputs: accepted m27b-jetson-orin-nano-live-conformance evidence, accepted 27c Context Capsule and 28a admission contracts, m27d-nemo-capability-probes, m27d-nemo-provider-family, m27d-nemo-guardrails-and-eval, m27d-nemo-policy-and-parity, generated `jetson-orin-nano-jp7` profile, NVIDIA runtime/package compatibility metadata, NVMe model/runtime storage, docs/HOST_TOOLS.md, docs/GPU_NODES.md, docs/TEST_PLAN.md. Changes: - configs/provider_conformance.toml + generated NeMo policy/profile records — independent local/remote inference, guardrail, evaluator, retrieval, and customization capability selection; exact AArch64/JetPack/L4T/CUDA/package-or-image compatibility; shared-memory/context ceilings; endpoint/auth refs; artifact/license/provenance requirements; and stable unavailable reasons. - tools/cohesix-py/cohesix/integrations.py — mutation-free Jetson unavailable probe plus configured local-container/venv and remote-endpoint probes with bounded timeouts, redaction, version negotiation, and no ambient credential discovery. - apps/host-ticket-agent/src/executors/infer.rs — admitted Jetson NeMo dispatch through the generated provider record, exact 27b GPU lease/executor and model-engine identity, bounded request/context, deterministic refusal mapping, cancellation/deadline, and normalized terminal receipt. - packaging/reference assets — one digest-pinned, licensable quantized edge model/runtime profile that passes measured 8GB admission, and an optional remote-service profile for guardrail/evaluator/customization capabilities that are not selected locally. Artifacts and caches use the generated NVMe root; no model or mutable image layer enters a release bundle unintentionally. - scripts/ci/provider_conformance_run.sh + scripts/ci/use_case_gate.sh — `--host-profile jetson-orin-nano-jp7` capability-only and live-reference lanes, exact-host preflight, model/runtime compatibility checks, safe memory refusal, cold/warm inference, cancel/timeout/restart, guardrail/evaluator refusal and success, evidence reconstruction, and promotion gating. - docs/HOST_TOOLS.md + docs/GPU_NODES.md + docs/TEST_PLAN.md + docs/USE_CASES.md — exact setup, storage, topology, resource ceilings, supported/unavailable capabilities, test commands, recovery, and proof boundaries. Commands: python -m pytest tools/cohesix-py/tests/test_integrations.py -k 'nemo and jetson' && cargo test -p host-ticket-agent -- nemo_provider && scripts/ci/provider_conformance_run.sh --provider nemo --host-profile jetson-orin-nano-jp7 --capability-only --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-nemo-jetson-unavailable && scripts/ci/provider_conformance_run.sh --provider nemo --host-profile jetson-orin-nano-jp7 --live-reference --matrix configs/provider_conformance.toml --state-dir out/provider-conformance/m27d-nemo-jetson-live && scripts/ci/use_case_gate.sh --promote-milestone 27d --only nemo-jetson --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m27d-nemo-jetson Checks: The unconfigured host produces a complete mutation-free unavailable record; the configured profile proves one real bounded inference and its exact model/engine/GPU/ticket/Worker/evidence chain; selected guardrail/evaluator capabilities gate promotion with durable receipts; remote services are identified separately from local execution; over-budget, incompatible, unauthorised, stale, timeout, cancellation, restart, and rollback cases fail safely; full local training, NIM, Triton, TensorRT-LLM, retrieval, or customization remain unavailable unless that exact component passes its own profile and live evidence. Deliverables: A repeatable Jetson NeMo conformance lane that is useful on 8GB hardware, honest about unsupported components, and interchangeable with the same governed alternate-provider run envelope. ``` ## Outcome After Milestone 27d: - Cohesix is positioned as the trusted actuation, evidence, and governance layer beneath agent frameworks. - Release A proves operator-directed live AI execution with explicit approval, allowlisted durable host tickets, and authoritative receipts while refusing model-initiated side effects. The Release B extension binds governed live side effects to accepted 28a admission ids; model confidence, extracted assertions, and dry-run predictions remain non-authoritative in both modes. - WorkerLora participates as an executable, MCS-scheduled, receipt-bearing Cohesix task while datasets, frameworks, training/evaluation, adapters, weights, and inference runtimes remain in named host executors outside the TCB. - Every declared PEFT lifecycle is covered by one crash-safe export/train/evaluate/scan/import/activate/runtime-reload/canary/rollback transaction, and public AI/PEFT use-case maturity is generated from its live evidence rather than examples. - The Verified Private LoRA Release is the concrete flagship: one operator- directed ticket joins Jetson systemd/Docker/CUDA execution, genuine PEFT callbacks and artifacts, evaluation/scan, activation/reload/canary, rollback, WorkerLora, and a portable causal evidence graph through one host-tool lifecycle. - Long-context AI runs stop treating the prompt as the sole system of record. - Attention strategy becomes a schedulable, measurable host-side concern instead of a hidden model-side accident. - Delegation, retrieval admission, cache eligibility, and handoff lineage become explicit artifacts rather than implicit prompt behavior. - Optional NeMo capabilities can be used where they materially improve guardrails, evaluation, deployment, or retrieval workflows, without becoming a second control plane or displacing Cohesix authority. - NeMo Run and Guardrails execution rails reuse the same provider-adapter, ticket, verification, and evidence contracts as alternate providers; Kubernetes can later substitute its accepted native controller execution shape without changing the workflow's authority or receipt semantics. - Milestone 27e can expose a provider-neutral, auditable inference boundary over the accepted run, capsule, ticket, and receipt semantics. - Milestone 30b can expose stable AI namespace roots based on proven host-side semantics rather than speculation. ## Milestone 27e — Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) [Milestones](#Milestones) **Delivery posture:** Release A flagship boundary. The first release supports authenticated, operator-directed, fixed-model requests on the selected Jetson profile with bounded streaming, cancellation, usage, errors, Context Capsule refs, and authoritative receipts. Policy aliases, automatic provider/model routing, and model-initiated calls are Release B governed features and require 28a. Optional Embeddings and additional providers are enabled only when the reference walkthrough uses and proves them. **Why now (inference ecosystem boundary):** The Milestone 27c core provides immutable references and Context Capsules. Milestone 28a provides machine-checked intent admission and state-bound grants for the later governed mode. Milestone 27d provides delegated run/task/checkpoint policy, host-ticket AI actions, prefix/hotset lifecycle, provider selection hints, and the production PEFT transaction. The remaining adoption and audit gap is the model-serving boundary itself: existing applications expect familiar inference HTTP APIs, streaming, tool-call results, embeddings, provider errors, and SDK behavior, while Cohesix needs exact admission, context, cache, provider, output, and evidence receipts. This milestone adds an optional host-only OpenAI-compatible inference boundary without making Cohesix a model runtime. Applications can adopt it by changing a base URL or using thin SDK middleware; model servers and cloud providers remain external executors. The public wire is a compatibility projection over generated Cohesix run, Context Capsule, provider, authority, and receipt contracts. It does not create a second action plane, and provider credentials never become caller authority. **As-built alignment note:** `hive-gateway` currently exposes bounded REST/OpenAPI projections of Cohesix file operations. Milestone 27d plans provider-specific `infer.run|resume|abort` host-ticket actions and optional NeMo adapters, but neither current code nor that plan defines an OpenAI-compatible client endpoint, streaming proxy, provider compatibility matrix, canonical inference request/receipt schema, effective-parameter evidence, Context Capsule transport extension, or inference-specific OTLP mapping. No current `coh run`, GPU breadcrumb, model publication, PEFT reload, mock playbook, Python receipt, or provider log may be relabelled as an auditable inference gateway. **Prerequisites** - The Milestone **27a Release A authority floor** completed for delegated caller identity, request authentication, idempotency, writer-epoch fencing, durable execution WAL, audit/replay defaults, and production secret/debug policy. - The exact Milestone **27b Release A rows** completed for the selected provider/action, external executor, visibility, identity, host package, and authoritative evidence rules. - The Milestone **27c core** completed for accepted snapshot/artifact refs, Context Capsules, render receipts, visibility enforcement, host tools, and selected conformance/performance evidence. - Milestone **28a** completed only for governed inference, policy aliases, enforced routing, or autonomous callers. Release A fixed-model requests record `admission_mode=operator_approved` and cannot claim 28a admission. - The Milestone **27d Release A slice** completed for delegated AI run/task/step envelopes, `infer.run|resume|abort` host actions, checkpoint and prefix lifecycle, selected provider policy, and the reference PEFT activation/reload evidence. **Goal** Provide a frictionless, provider-neutral inference interface that makes efficiency and audit evidence first-class without moving models into Cohesix: 1. Accept a generated, pinned OpenAI-compatible subset for Models discovery, Chat Completions, Responses, streaming, tool-call results, and optional Embeddings. 2. Preserve compatible SDK behavior while mapping every request to an accepted 27d run/task/step and allowlisted host-ticket action; governed requests also require an accepted 28a admission. 3. Accept an optional Context Capsule reference through a generated, backwards-compatible header or metadata extension; requests without one remain transcript-input calls and cannot claim semantic selection. 4. Render only admitted capsule views, record the exact rendered-request digest, and never silently expand context or rewrite client messages. 5. Produce canonical inference receipts binding caller, authority, capsule, render, provider/model, effective parameters, cache decisions, stream/output digests, usage, timing, errors, and downstream verification/action refs. 6. Preserve token streaming with bounded gateway overhead and explicit cancellation, partial-stream, ambiguous-completion, retry, and backpressure semantics. 7. Export OpenTelemetry-compatible traces/metrics from receipt data while keeping telemetry read-only, redacted, and non-authoritative. 8. Ship `coh`, `coh doctor`, Python, package, provider-conformance, and operator tooling so the boundary is installable and diagnosable on supported host profiles. 9. Preserve explicit model requests as fixed-selection compatibility calls, and stage policy-selected aliases through generated `observe`, `recommend`, and `enforce` modes with measurable promotion evidence. 10. In Release B, bind every governed provider call or enforced routing decision to the accepted `admission_id`, intent/policy hashes, exact provider/model or alias decision, Context Capsule or transcript-input identity, state and provider- profile generations, deadline, and requested/granted limits. **Release A completion boundary:** Accept Models discovery plus the smallest widely usable Chat Completions and streaming/cancellation subset against one selected Jetson executor, with Context Capsule refs, deterministic error mapping, usage/timing, and canonical receipts. Responses, Embeddings, provider-specific extensions, policy aliases, automatic routing, broad SDK matrices, and complete OpenTelemetry projection are independently promoted extensions. A compatible surface not selected by the release returns a stable unsupported response and cannot be advertised as implemented. **Non-Goals (Explicit)** - No transformer, embedding, reranking, guardrail, training, CUDA/NVML, KV cache, tokenizer, or model runtime inside the VM or Cohesix TCB. - No in-VM inference HTTP listener, `/v1` endpoint, TLS stack, model weights, prompt store, or provider credentials. - No claim that the OpenAI API is Cohesix's canonical internal schema. It is a pinned compatibility projection over generated Cohesix records. - No direct provider call before Cohesix admission in governed mode. `inference-gateway-host` is a declared host executor and may contact only the provider/profile authorized by the exact admitted request digest. - No generic or host-local multi-request routing grant in governed mode. Exact per-request 28a admission remains mandatory for governed calls; a later grant optimization requires the separately versioned, single-spender, bounded-accounting contract and measured justification defined by the cross-cutting Milestone 27 governance value contract. - No forwarding of caller API keys, OAuth tokens, capability tickets, or MCP credentials to inference providers. Provider credentials resolve separately from generated secret refs. - No arbitrary provider URL, model path, shell command, filesystem path, extension field, generation configuration, or tool executor supplied by the inference request. - No execution of model-produced tool calls. Tool calls are untrusted outputs; any real action requires a separate typed intent, accepted 28a admission, and existing Cohesix ticket/provider path. - No silent prompt summarization, semantic expansion, provider fallback, model substitution, output reuse, or cache sharing across identity/tenant/ ticket boundaries. - No promise of deterministic model output from an audit receipt. A receipt can prove the admitted inputs and observed output; reproducibility additionally requires a provider/model/mode that actually guarantees it. - No provider, inference, semantic, Worker, PEFT, or use-case promotion from wire compatibility, a successful HTTP status, or client-authored telemetry. - No new `cohsh` or `.coh` grammar. Target-visible inference control remains deferred to Milestone 30b and uses existing verbs only. **Deliverables** ### 1) Generated compatibility and provider contract **Purpose:** Prevent client compatibility, provider adapters, Cohesix host actions, and receipts from drifting into separate inference APIs. Implementation requirements: - Add versioned generated schemas: - `inference-client-request/v1` - `inference-admission/v1` - `inference-routing-decision/v1` - `inference-provider-profile/v1` - `inference-receipt/v1` - `inference-stream-receipt/v1` - `inference-cache-decision/v1`. - Each governed request and routing record binds the 28a `admission_id`, `intent_hash`, `policy_hash`, exact fixed-model or alias selection, Context Capsule/render identity or transcript-input identity, `state_epoch`, provider-profile generation, deadline, limits, and grant expiry. - Pin the accepted OpenAI-compatible Models, Chat Completions, Responses, and optional Embeddings paths, fields, streaming event forms, tool-call/result shapes, usage fields, cancellation behavior, error mapping, JSON Schema dialect, and optional provider-extension allowlists in generated policy and compatibility fixtures. - Preserve an explicit client model identifier as a fixed-selection request: it may resolve only to a conforming deployment of that model unless the request names a generated policy alias. Require each generated policy alias to resolve through a versioned policy id/hash, supported governance modes, candidate provider/model classes, data-handling and cost/resource bounds, compatibility requirements, fallback/refusal posture, endpoint secret refs, tokenizer/profile identity, context/output limits, supported modalities/features, extension allowlist, and observed conformance mode. Alias spelling is not authority and cannot select an undeclared provider. - Provider/model profiles separately record or type unknown the runtime build/image/region, accelerator class, model revision/weight digest, quantization, adapter chain, tokenizer/chat-template identity, determinism mode, and supply-chain attestation refs. Provider-reported fields never become Cohesix-observed facts without a verified adapter signal. - Canonical request hashing preserves ordered messages, content parts, tools, response formats, and sampling parameters. Canonicalization is for identity and evidence; forwarding must preserve accepted client semantics. - Sensitive transcript-input identities use a generated keyed/blinded digest profile so receipt correlation does not create a low-entropy prompt hash oracle. Unkeyed content hashes are emitted only when their visibility and disclosure policy explicitly permits them. - Unknown or unsupported fields fail or follow an explicitly generated pass-through rule. A provider-specific extension can never widen authority, choose an undeclared endpoint, or bypass receipt fields. ### 2) Host gateway, admission, streaming, and provider execution **Purpose:** Make one base-URL change sufficient while preserving the existing host-ticket authority and executor boundary. Implementation requirements: - Add `inference-gateway-host` as an optional host process with loopback-only default, bounded queues/body sizes/concurrency/deadlines, explicit non-loopback exposure policy, and compatible streaming responses. - Accept the conventional SDK base URL plus bearer/API-key-shaped gateway authentication configuration so existing clients need no request rewrite; the presented value authenticates only to Cohesix and is never reused as a provider credential. - Implement generated routing governance modes: - `observe` preserves the existing explicit provider/model route and records the policy-selected candidate plus reasons, compatibility, predicted bounds, and uncertainty without provider substitution; - `recommend` returns or records the same non-authoritative recommendation through a bounded opt-in surface while the caller's existing selection remains in control; - `enforce` permits a generated policy alias to select only a conforming provider/model candidate after an accepted machine-checked 28a decision. - `observe` and `recommend` cannot change the route, reserve a resource, create a grant, or satisfy execution-authority evidence. Explicit fixed-model requests remain fixed-selection admissions. - An explicit model request and a policy-alias request remain distinguishable in request identity, admission, receipt, metrics, errors, and evidence. - Authenticate the client at the gateway, normalize it through 27a delegated identity mapping, and append or resolve the exact 27d `infer.run` host-ticket record with request id, idempotency key, writer epoch, run/task/step, capsule/render refs, provider profile, model alias, limits, and deadline. - The gateway may contact a provider only after `host-ticket-agent` admits the exact request/provider digest and returns the generated execution grant/state. The gateway is the registered streaming executor for that action; it does not decide authority or call a different provider after admission. - Provider, model, endpoint, effective parameters, tools, Context Capsule or transcript-input identity, state/provider generation, deadline, and limits cannot change after admission. Any change requires a new typed intent and decision. - Stream forwarding is incremental and bounded. Record a digest chain and byte/ event counters without retaining full content unless an explicit encrypted content-retention profile authorizes it. - Cancellation, client disconnect, provider disconnect, timeout, retryable refusal, partial output, and ambiguous completion reconcile through the execution WAL. No blind replay may duplicate a possibly completed inference. - SDK middleware may record a direct-provider call as `client_observation_only`, but that record is non-authoritative and cannot satisfy governed inference, provider, cache, action, or use-case evidence. ### 3) Context compilation and inference efficiency **Purpose:** Turn semantic selection into measurable prefill and cache savings without making unverified provider behavior authoritative. Implementation requirements: - Compatibility requests without a capsule preserve client messages and record a transcript-input manifest. They receive no semantic-selection or omitted- repository claim. - Capsule mode verifies snapshot, audience, TTL, policy, renderer, tool schema, model/tokenizer profile, and run/task/step before rendering. - Record prompt bytes/tokens submitted, semantic bytes/tokens considered and avoided, selected/omitted object counts, render latency, provider queue wait, TTFT, decode rate, total latency, and usage source. - Prefix/cache keys bind provider/model profile, capsule/render digest, instruction and tool-schema hashes, authority scope, tokenizer identity, and TTL/quota. Cache reuse across callers or tenants is prohibited unless a generated sharing policy proves equivalent authority and data classification. - Provider-reported prefix/KV hits, cached-token counts, or effective defaults are evidence only when the adapter can capture and normalize them. Otherwise the receipt records unknown/unverified rather than inferring a hit. - Optional exact-result reuse is disabled by default and requires an explicit generated policy, deterministic-compatible provider mode, exact dependency hash, audience equivalence, TTL, and a receipt that clearly marks reuse. ### 4) Inference receipts, evidence, and OpenTelemetry **Purpose:** Reconstruct exactly what was admitted, sent, observed, and acted upon without requiring raw prompt retention. Implementation requirements: - Each authoritative receipt binds: - receipt/request/run/task/step/attempt ids, - normalized caller and delegated-ticket hash, - admission, idempotency, writer-epoch, and policy decision refs, - capsule and render ids or transcript-input manifest, - provider profile, endpoint identity, model alias and returned model id, - routing governance mode, requested fixed model or policy id/hash, considered candidate set digest, selected/recommended provider/model, selection reasons, shadow comparison refs, and fallback/refusal outcome, - runtime/build/region/accelerator, weight revision/digest, quantization, adapter, tokenizer/template, determinism, batching/speculation, and supply-chain identities with a fact source or explicit unknown state, - accepted and effective parameter/tool/response-format hashes, - prefix/cache eligibility, decision, hit/miss source, and invalidation reason, - request, stream-chain, output, and optional content-retention digests, - token/byte usage and provenance of those counts, - queue, admission, render, TTFT, decode, total, cancellation, and retry timing, - terminal class (`completed`, `partial`, `failed`, `refused`, `cancelled`, or `ambiguous`), - verification, guardrail/evaluation, artifact, and later action refs, - trace/span ids, redaction profile, evidence class, and explicit non-claims. - Receipts reuse the accepted 27b authoritative receipt signing/verification core and bind schema version, signing key id/attestation ref, predecessor or stream-chain digest, and verification status without inventing an inference-only trust root. - Full input/output/tool content is excluded from general logs, metrics, and evidence by default. Hashes, bounded redacted previews, or encrypted retained content require distinct policy. - Emit OpenTelemetry-compatible GenAI spans/metrics using bounded normalized attributes plus Cohesix receipt/capsule refs. OTLP is a projection and cannot create or modify a receipt. - Evidence packs and timelines can verify request-to-admission-to-provider-to- terminal-output lineage and distinguish gateway observation, provider claims, Cohesix authority, verification, and downstream actions. ### 5) Host tools, SDK compatibility, packaging, and operations **Purpose:** Make the new boundary easy to install, inspect, and support without turning SDK wrappers into authority. Implementation requirements: - Add host-only `coh inference` commands for: - `providers` - `status` - `receipt show` - `receipt verify` - `request inspect` - `conformance`. - Extend `coh doctor` with generated checks for gateway version, bind/exposure posture, client auth, identity-to-ticket mapping, semantic store/capsule availability, host-ticket agent, provider/model profile, secret refs, streaming capability, OTLP delivery, receipt verification, and package drift. - Add Python helpers for configuring the compatible base URL, supplying an optional capsule ref, reading the returned receipt id/trace context, polling status, and verifying receipts. Helpers consume generated schemas and never mint authority or authoritative provider results. - Add a generated read-only discovery record so `hive-gateway`, later MCP/A2A, `coh doctor`, and packaging can locate the selected inference gateway and receipt surface without duplicating provider/model catalogs. - Package `inference-gateway-host`, exact provider adapters, generated compatibility fixtures, launchd/systemd definitions, signed host binaries and/or OCI/Helm artifacts for the selected profile, doctor checks, secret-ref templates, and conformance metadata for supported macOS/Linux/Kubernetes host profiles. No inference component enters VM packages. - Update `docs/HOST_API.md`, `docs/API_GUIDELINES.md`, `docs/HOST_TOOLS.md`, `docs/PYTHON_SUPPORT.md`, `docs/ARCHITECTURE.md`, `docs/INTERFACES.md`, `docs/SECURITY.md`, `docs/BENCHMARKS.md`, `docs/TEST_PLAN.md`, and `docs/OPERATOR_WALKTHROUGH.md`. - `cohsh` remains unchanged. Later namespace reads may display bounded receipt projections through existing `LS`/`CAT`/`TAIL`; no host inference command is tunneled through new console grammar. ### 6) Provider/client conformance, security, and performance **Purpose:** Prove compatibility and bounded overhead without converting a protocol smoke test into provider-quality or production-use-case proof. Implementation requirements: - Ship at least one packaged open local reference profile, such as vLLM, for live compatible request, streaming, cancellation, tool-call output, usage, model identity, error, and receipt tests. Other providers remain fixture, dry-run, not-enabled, or separately live-proven according to the generated matrix. - Test common official-compatible Python/HTTP client behavior without custom forks. Provider-specific extras require explicit generated fixtures. - Conformance covers conventional base-URL/API-key environment configuration, `/v1/models` discovery, non-streaming and streaming calls, cancellation, error shapes, usage, tool-call output, and receipt/trace response metadata. - Adoption conformance covers fixed-selection compatibility plus policy-alias `observe`, `recommend`, and `enforce` modes. Promotion evidence compares the recommendation with the unchanged actual route over a declared representative window and reports compatibility mismatches, false refusals, policy findings, latency/cost deltas, and workload-specific quality or verification outcomes without treating estimates as observed facts. - Negative tests cover oversized/malformed bodies, unknown fields, arbitrary endpoints/models, credential/token passthrough, context-scope widening, forged/stale capsules, duplicate ids, stale writer epochs, provider fallback, prompt/tool injection, cross-tenant cache keys, stream truncation, ambiguous completion, receipt tampering, telemetry content leakage, and direct provider-executor bypass. - Add performance probes for admission, capsule verification/rendering, streaming proxy overhead, TTFT delta, sustained stream throughput, cancellation, queue/backpressure, prefix/cache evidence, receipt signing/ export, and OTLP delivery. - Report gateway overhead separately from provider/model compute, semantic extraction, VM runtime, and network topology. A compatible response is not a quality, safety, determinism, cache-hit, or production-use-case claim. **Commands** - `cargo test -p cohesix-inference-core` - `cargo test -p inference-gateway-host` - `cargo test -p host-ticket-agent` - `cargo test -p coh --test inference_receipts` - `cargo test -p coh --test inference_doctor` - `cargo test -p coh-rtc` - `python3 -m pytest -q tools/cohesix-py/tests/test_inference.py` - `scripts/ci/inference_conformance_run.sh --matrix configs/inference_conformance.toml --state-dir out/inference/m28e` - `scripts/ci/inference_perf_probe.sh --state-dir out/bench/m27e-inference` - `scripts/check-generated.sh` - `scripts/ci/test_plan_run.sh --state-dir out/test-plan/m27e-inference` **Checks (Definition of Done)** - Compatible clients can change only their base URL/auth configuration and complete admitted non-streaming and streaming reference requests with standards-shaped responses plus a bounded Cohesix receipt reference. - Every governed provider call has a prior exact Cohesix admission record and execution grant; provider, model, request, capsule/render, authority, and deadline cannot change after admission. - A Release A operator-approved request record includes authenticated subject, approval, fixed model/provider profile, host-ticket identity, transcript or capsule identity, deadline, limits, and `admission_id=unavailable`. A governed admission record instead includes the 28a `admission_id`, intent/policy hashes, fixed-model or alias decision, state/provider-profile generations, deadline, limits, and grant expiry. Any mismatch or stale generation in the selected mode fails before provider contact. - Observe/recommend modes cannot change provider execution, mint authority, or satisfy governed-execution proof. Enforce mode is unavailable until its generated alias/policy, provider conformance, bypass posture, failure posture, and representative shadow-promotion evidence are accepted. - Explicit model requests cannot be silently converted into policy-selected routing; policy aliases record the exact policy and considered/selected candidate identities. - Client credentials and delegated tickets are never passed to providers; provider secrets never enter request bodies, receipts, telemetry, or client responses. - Requests without a Context Capsule are not described as semantically selected. Capsule requests fail before provider contact when snapshot, audience, TTL, policy, renderer, tokenizer/model profile, or tool schema is stale or wrong. - Model-produced tool calls are returned as untrusted output only and cause no host/VM action without a separate admitted Cohesix ticket. - Receipts distinguish admitted facts, provider-reported facts, observed facts, unknown values, partial/ambiguous completion, and non-claims. A successful HTTP status alone cannot produce a terminal authoritative receipt. - Full prompt/output/tool content is absent from default logs, OTLP, evidence, and error messages; content retention and redacted previews obey generated policy and negative tests. - Prefix/KV/cache hits and effective provider defaults are reported only from verified adapter evidence. No cross-authority cache reuse, silent fallback, or unrecorded output reuse occurs. - `coh`, Python, `coh doctor`, gateway discovery, evidence/timeline tools, provider adapters, packages, and future MCP/A2A inputs agree on the generated inference schemas, profiles, bounds, and receipt fixtures. - Conformance passes for the packaged open reference runtime and records exact unsupported differences for every other selected provider; no provider is promoted from fixture or protocol-shape success. - Performance evidence reports admission/render/proxy/receipt/OTLP overhead and actual prompt-token/TTFT/cache measurements separately. It does not substitute for Pi/QEMU, model-quality, safety, or production workflow evidence. - No VM package, root-task code, console/9P grammar, model runtime, provider credential, or second provider/action registry is introduced. **Compiler touchpoints** - `coh-rtc` extends the 27b graph with inference client, gateway, provider, model, semantic-capsule, receipt, OTLP, host-tool, package, and conformance surfaces while preserving stable integration/use-case ids. - `coh-rtc` emits compatibility paths/fields/events, provider/model profiles, Context Capsule transport extension, request/admission/receipt schemas, client/auth/secret mappings, streaming/body/queue/deadline bounds, cache/prefix policy, content-retention/redaction policy, OTLP fields, Python defaults, `coh` defaults, doctor checks, package manifests, and docs snippets. - Validation rejects unregistered endpoints/models/extensions, provider credentials in client inputs, missing 27a/27b/27c/27d prerequisites, authority-changing fallback, provider calls without exact admission, cross-scope cache reuse, client-authored authoritative receipts, content leakage, and compatibility claims without conformance evidence. - The generated compatibility model is a projection. Canonical authority remains in the existing provider/action graph, host-ticket records, Context Capsules, run/checkpoint state, and evidence receipts. **Task Breakdown** ``` Title/ID: m27e-inference-ir-and-compatibility-contract Milestone: Milestone 27e — Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) / inference IR and compatibility contract Goal: Define one generated request, provider-profile, admission, stream, cache-decision, and receipt contract plus a pinned OpenAI-compatible projection. Inputs: accepted 27b provider/integration graph, 27c Context Capsule schemas, 28a intent/fact/decision/grant contracts, 27d run/host-ticket/provider contracts, tools/coh-rtc/src/**, docs/HOST_API.md, docs/INTERFACES.md, docs/SECURITY.md. Changes: - tools/coh-rtc/src/ir.rs + validation/codegen — Models/Chat Completions/Responses/Embeddings endpoint/field/event schemas, fixed-selection and policy-alias routing modes, versioned routing decisions, provider/model/runtime/weight/tokenizer profiles, capsule extension, caller/provider auth separation, 28a admission bindings, keyed digest policy, bounds, cache/content policy, shadow-promotion evidence, receipts, Python/coh/docs outputs. - crates/cohesix-inference-core/src/schema.rs — strict generated or checked host-side request/admission/receipt types. - tests/fixtures/inference/** — model discovery, valid, unsupported, provider-extension, keyed/unkeyed identity, streaming, tool-call, partial, ambiguous, cache, runtime/model fact-source, and tamper fixtures. - docs/HOST_API.md + docs/INTERFACES.md + docs/SECURITY.md — compatibility, authority, provider, receipt, content, and non-claim contract. Commands: - cargo test -p coh-rtc - cargo test -p cohesix-inference-core - scripts/check-generated.sh Checks: Client compatibility cannot redefine provider actions or receipts; unknown endpoints/models/extensions, credential passthrough, authority widening, or schema drift fail generation and fixtures. Deliverables: Compiler-owned inference compatibility and receipt contract shared by gateway, providers, host tools, SDK helpers, OTLP, and later MCP/A2A. Title/ID: m27e-gateway-admission-and-streaming Milestone: Milestone 27e — Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) / host gateway admission and streaming Goal: Serve the compatible host API with bounded streaming while every governed provider call remains bound to an exact 28a admission decision and the existing 27d host-ticket execution path. Inputs: m27e-inference-ir-and-compatibility-contract, accepted 28a decision/grant contracts, apps/host-ticket-agent, 27d `infer.run|resume|abort` actions, accepted 27a gateway identity/fencing/WAL behavior, provider fixtures. Changes: - apps/inference-gateway-host/src/** — compatible Models/request/stream handling, conventional base-URL/bearer configuration, explicit fixed-model versus policy-alias requests, generated observe/recommend/enforce behavior, loopback/exposure policy, bounded queues, cancellation, digest chaining, backpressure, and response headers carrying receipt/trace refs. - apps/host-ticket-agent/src/executors/infer.rs — exact 28a request/provider admission reference, fixed-model or enforced-alias grant validation, state/provider-generation recheck, execution WAL reconciliation, idempotency, writer fencing, cancellation, and terminal/ambiguous state. - crates/cohesix-inference-core/src/{canonical,stream,errors}.rs — stable request identity, incremental stream digest, and deterministic client/provider/Cohesix error mapping. - apps/inference-gateway-host/tests/** — non-streaming, streaming, cancellation, disconnect, ambiguous completion, duplicate, stale-writer, and provider-substitution fixtures. Commands: - cargo test -p inference-gateway-host - cargo test -p host-ticket-agent - cargo test -p cohesix-inference-core Checks: No provider request precedes an accepted non-stale 28a admission; observe/recommend cannot change the existing route or create authority; enforce requires an accepted generated alias, machine-checked decision, and shadow-promotion evidence; explicit model requests are never silently substituted; any provider/model/endpoint/parameter/tool/context/generation/limit change requires a new intent; stream state reconciles durably; retries cannot duplicate ambiguous work; client/provider credentials and authority remain separate. Deliverables: Drop-in compatible host inference endpoint that preserves Cohesix ticket, fencing, durability, and executor discipline. Title/ID: m27e-context-efficiency-and-cache-evidence Milestone: Milestone 27e — Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) / capsule compilation and cache evidence Goal: Compile admitted Context Capsules into exact provider inputs and measure semantic/prefix/cache efficiency without unverified reuse claims. Inputs: m27e-gateway-admission-and-streaming, accepted 27c capsule/store/renderer, 27d prefix/hotset policy, provider tokenizer/cache adapters, docs/BENCHMARKS.md. Changes: - crates/cohesix-inference-core/src/{context,cache,metrics}.rs — capsule verification, provider rendering, transcript-input manifests, exact cache keys, eligibility/invalidation, usage-source normalization, and bounded metrics. - apps/inference-gateway-host/src/context.rs + provider adapters — capsule/header/metadata handling, message-preserving compatibility mode, verified provider cache/default evidence, and no silent fallback. - scripts/ci/inference_perf_probe.sh — prompt bytes/tokens, objects selected/omitted, render cost, provider queue, TTFT, decode, cache, streaming, and receipt overhead. - docs/BENCHMARKS.md + docs/TEST_PLAN.md — inference efficiency lanes and model-quality/cache non-claims. Commands: - cargo test -p cohesix-inference-core --test context_cache - cargo test -p inference-gateway-host --test context - scripts/ci/inference_perf_probe.sh --state-dir out/bench/m27e-inference Checks: Transcript and capsule modes are explicit; capsule inputs cannot widen after admission; cache keys bind all authority/model/context/tool inputs; only verified provider evidence can claim hits/defaults. Deliverables: Measured semantic paging and prefix/cache behavior at the actual inference boundary. Title/ID: m27e-inference-receipts-otel-and-evidence Milestone: Milestone 27e — Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) / authoritative inference receipts and telemetry Goal: Bind each request, stream, output, provider fact, timing, and downstream verification/action reference into redaction-safe evidence and OTLP projections. Inputs: m27e-gateway-admission-and-streaming, m27e-context-efficiency-and-cache-evidence, m27b-authoritative-receipt-and-evidence-core, apps/coh/src/{evidence.rs,evidence_timeline.rs}, OTLP exporter contract. Changes: - crates/cohesix-inference-core/src/receipt.rs — authoritative receipt construction/verification, stream-chain digest, fact-source classification, terminal/non-claim states, and content-retention policy. - apps/coh/src/{evidence.rs,evidence_timeline.rs} — request-to-admission-to-provider-to-output-to-verification/action reconstruction. - host OTLP exporter integration — bounded GenAI trace/metric projection with receipt/capsule refs and no default prompt/output content. - apps/coh/tests/inference_receipts.rs + canonical Rust/Python fixtures — tamper, partial, ambiguous, provider-claim, redaction, and telemetry-reconstruction cases. Commands: - cargo test -p cohesix-inference-core --test receipts - cargo test -p coh --test inference_receipts - python3 -m pytest -q tools/cohesix-py/tests/test_inference.py -k receipt Checks: Receipts distinguish Cohesix, provider, observed, unknown, and client-only facts; default telemetry/evidence contains no raw prompt/output/tool content; OTLP cannot author authority. Deliverables: Portable, verifiable inference evidence suitable for audits, MCP/A2A artifacts, and later namespace receipts. Title/ID: m27e-host-tools-provider-conformance-and-packaging Milestone: Milestone 27e — Inference Interoperability + Auditable Receipts (OpenAI-Compatible Host Boundary) / host tools, conformance, packaging, and operator acceptance Goal: Ship and prove the inference boundary through Cohesix host tools, Python helpers, doctor, provider/client matrices, supported deployment profiles, and operator evidence. Inputs: all m28e tasks, apps/coh/src/{main.rs,doctor.rs}, tools/cohesix-py/cohesix/**, hive-gateway generated metadata, 27b package/provider registries, open reference runtime, docs/OPERATOR_WALKTHROUGH.md. Changes: - apps/coh/src/inference.rs + CLI wiring — provider/status/receipt/request/conformance inspection and offline receipt verification. - apps/coh/src/doctor.rs + tools/coh-rtc generated checks — gateway/auth/identity/ticket/store/provider/model/secret/stream/OTLP/receipt/package diagnostics. - tools/cohesix-py/cohesix/inference.py + tests/examples — compatible base URL, optional capsule ref, receipt/trace lookup, status, and verification helpers with no authority minting. - apps/hive-gateway metadata + release packaging/service profiles — read-only discovery of the selected inference surface and exact signed binary/OCI/Helm, launchd/systemd, adapter, fixture, and secret-ref contents. - scripts/ci/inference_conformance_run.sh — conventional base-URL/API-key client plus provider/security/receipt matrix with a packaged open live reference profile, fixed-selection and alias-routing observe/recommend/enforce lanes, shadow-promotion evidence, and explicit evidence modes for every alternate provider. - docs/HOST_TOOLS.md + docs/PYTHON_SUPPORT.md + docs/API_GUIDELINES.md + docs/OPERATOR_WALKTHROUGH.md + docs/TEST_PLAN.md — installation, one-base-URL adoption, diagnostics, refusal, recovery, evidence, and non-claims. Commands: - cargo test -p coh --test inference_doctor - python3 -m pytest -q tools/cohesix-py/tests/test_inference.py - scripts/ci/inference_conformance_run.sh --matrix configs/inference_conformance.toml --state-dir out/inference/m28e - scripts/ci/test_plan_run.sh --state-dir out/test-plan/m27e-inference - scripts/check-generated.sh Checks: A supported client and live open reference runtime interoperate without a client fork; fixed model requests retain their route; observe/recommend produce bounded non-authoritative comparisons; enforce remains unavailable until its promotion gate passes; doctor and packages expose exact prerequisites; alternate providers retain honest modes; `cohsh` and VM packages remain unchanged. Deliverables: Installable, diagnosable, provider-conformant host inference boundary ready for MCP/A2A projection. ``` ## Outcome After Milestone 27e: - Existing inference applications can adopt Cohesix through a familiar host API while model runtimes and credentials remain outside the VM and Cohesix TCB. - Every governed request is bound to delegated identity, an exact host-ticket action, an accepted 28a admission id, exact intent/policy/state/provider bindings, a provider/model profile, and a durable terminal or ambiguous receipt. - Existing fixed-model clients can adopt the compatible boundary without accepting automatic routing; policy aliases progress from observe to recommend to enforce only through generated promotion evidence. - Context Capsule selection, rendered inputs, prompt savings, prefix/cache evidence, TTFT, streaming, output digests, and downstream verification/action lineage are measurable without default raw-content retention. - `coh`, `coh doctor`, Python helpers, gateway discovery, evidence/timeline tools, OTLP, packages, and provider adapters consume one generated contract. - Milestone 28c can expose semantic resources and inference receipts/tools to MCP/A2A clients without defining a second inference protocol or authority path. ## Milestone 27f — SwarmUI Community Showcase: Spectrum Workbench + Live AI Hive [Milestones](#Milestones) **Delivery posture:** Release A flagship experience and community-energy deliverable. This is not optional polish. It is the clearest public expression of Cohesix's architecture and must make the real Jetson AI workflow, seL4 authority boundary, live Worker state, external execution, and evidence chain immediately understandable and visually memorable. The showcase slice ships in Release A; governed intent/grant/quarantine views expand in Release B; broad enterprise desks remain demand-gated. **Why now (operator workflow and community energy):** Milestone 20c/20d proved SwarmUI as a host-only, ticket-scoped UI and PixiJS Live Hive renderer. Milestone 24e added REST/gateway mode so SwarmUI can share the sole console client through `hive-gateway`. Milestone 27 gives Cohesix the read-only inspect, trace, bundle/evidence, diff, and attest substrate operators need. The remaining gap is not merely workflow shape: Cohesix needs a showpiece that lets a new user, seL4 developer, or potential contributor see the Queen/Worker system, Jetson GPU execution, policy/evidence boundary, and failure behavior without first learning every namespace. SwarmUI is still organized like a dense dashboard. This milestone redesigns it around familiar desktop navigation, Spectrum Web Components, deterministic evidence workflows, and a visually ambitious PixiJS Live AI Hive without changing Cohesix authority or protocol semantics. **As-built alignment note:** Current SwarmUI is a Tauri host UI with Rust-owned transport/session/cache/replay semantics, vendored Spectrum Web Components, and a PixiJS Live Hive renderer. Existing generated SwarmUI defaults still use `/worker` roots while the canonical worker namespace is `/shard//worker//telemetry` with `/worker//telemetry` available only when `sharding.legacy_worker_alias = true`. Current read models can also infer role/lifecycle from ids or model/session state rather than carrying independent generated declaration, executable lifecycle, receipt, and proof axes. The current Playwright suite injects a fake Tauri invoke bridge before every frontend test, including Live Hive, so it proves a valuable deterministic UI fixture but not the packaged native application, Rust command bridge, gateway authentication, or a live accepted QEMU session. This milestone must present canonical paths and those axes correctly; it must not hard-code legacy aliases or synthesize an executable/production Worker from labels, tickets, GPU/model publication, PEFT registry state, UI cache, or fake bridge responses. **Prerequisites** - Milestone **20c** complete for SwarmUI Tauri, ticket-scoped sessions, transcript parity, and bounded offline cache. - Milestone **20d** complete for PixiJS Live Hive rendering, replay fixtures, design tokens, and no UI-owned control logic. - Milestone **24e** complete for REST/gateway mode so desktop multi-tool workflows use `hive-gateway` rather than direct concurrent TCP clients. - The Milestone **27 Release A core** complete for shared read-only inspect, trace, evidence-pack/timeline, diff, and truthful attestation status reused by the workbench. Shell/layout work may proceed concurrently after those shared schemas are frozen, but cannot invent their outputs. - Milestone **27a** is required before enabling any new delegated mutating REST workflow beyond existing console-projected `LS`/`CAT`/`ECHO` semantics. Before 27a, mutating desktop affordances may only render command previews, transcript proof, or existing console-compatible actions already admitted by the active profile. - The selected Milestone **27b Release A rows** are required for generated integration-surface availability, read visibility, exact package contents, and use-case maturity shown by the showcase. Unselected providers remain visibly unavailable. Matching 26e evidence is required to display an executable Worker badge; matching 28b evidence is additionally required for production bundle/quarantine status. - `m27b-authoritative-receipt-and-evidence-core` is required before a native UI lane may display a receipt/evidence-backed live state; frontend fixtures remain non-authoritative. - The accepted **27c core** and **27d/27e Release A slices** are required for the live Context Capsule, AI-run, PEFT, and inference-receipt story. Those panels may land incrementally as their owner schemas freeze. Milestone 28c is not a Release A prerequisite; MCP/A2A views are omitted or visibly typed unavailable. No unavailable owner contract is inferred or simulated. **Goal** Redesign SwarmUI into a desktop-style operator workbench and community showcase that uses Spectrum for shell chrome, controls, forms, menus, dialogs, status, and workflow affordances while retaining PixiJS/Live Hive as the primary high-performance visualization surface. The UI must make the live AI journey and the seL4 authority/evidence boundary visually obvious, while keeping Secure9P namespaces, evidence packs, replay, tickets, policy gates, and gateway state navigable through familiar desktop patterns without introducing a new authority plane. Significant frontend redesign and refactoring is explicitly in scope. The implementation may replace the current single-dashboard layout, split the large frontend controller into workbench/view/state modules, rebuild CSS around Spectrum density and layout primitives, and restructure Playwright coverage around the new desktop model. The stability boundary is the Rust-owned protocol/session/replay/evidence semantics, generated defaults, transcript grammar, and PixiJS Live Hive renderer contract, not the current HTML panel arrangement. **Non-Goals (Explicit)** - No new Cohesix console verbs, Secure9P verbs, in-VM TCP listeners, ad-hoc RPC, or UI-owned control semantics. - No replacement of PixiJS Live Hive with DOM, SVG, D3, Spectrum charts, or a generic graph library. - No second evidence-pack, replay, trace, or bundle format distinct from the canonical `cohsh-core` trace stack and `coh evidence pack` layout. - No UI-owned semantic graph, capsule planner/store, inference protocol, provider call, or receipt format. SwarmUI may inspect accepted immutable artifacts and submit already-admitted actions only through their existing host surfaces. - No default display or persistence of raw prompts, model outputs, retrieved source content, credentials, or model-produced tool calls. - No hidden background watchers when a desktop view is closed, inactive, or offline. - No generalized window manager, plugin host, web browser shell, or arbitrary host filesystem explorer. - No CDN dependency, network font dependency, or unbounded Spectrum dependency expansion; all UI assets remain vendored/offline-safe. - No change to ACK/ERR/END grammar, generated path defaults, namespace roots, or ticket policy unless routed through manifest IR, `coh-rtc`, docs, fixtures, and regression tests in the same scoped change. ### Release A Community Showcase Experience The Release A experience tells one truthful story rather than exposing every internal table at once: ```text Queen admits the operator-directed run -> selected Worker/control path becomes active -> Jetson external executor receives bounded work -> GPU/model/PEFT phases progress with live metrics -> receipt and evidence return to Cohesix -> operator inspects, replays, promotes, rolls back, or refuses ``` - **Live AI Hive:** extend the PixiJS world model with visually distinct Queen, seL4 Worker, Pi/QEMU target, Jetson host, external model/runtime, artifact, and evidence nodes. Animated flow, pulse, and completion effects may make work feel alive, but topology, state, direction, and evidence source come only from accepted records. - **Run Story:** a selected inference or PEFT run unfolds as a synchronized task graph and timeline: queued, approved, dispatched, GPU-active, checkpointed, evaluated, canaried, activated/rolled back, receipted, failed, or cancelled. Selecting a phase reveals its exact provider, Worker, artifact, receipt, and evidence refs. - **Jetson Flight Deck:** a focused view presents board/profile identity, runtime/provider state, GPU utilization, memory pressure, temperature/power where available, selected model/adapter, queue wait, TTFT, decode rate, and NVMe-backed artifact/cache health. Missing sensors or provider facts remain `unknown` or `unavailable`; the UI never fabricates activity. - **Evidence Ribbon:** a compact visual chain follows intent or operator approval, ticket, Worker claim where applicable, external execution, receipt, artifact, and replay evidence. Each segment carries a visible proof class and opens the exact source rather than collapsing into one green badge. - **Showcase Mode:** a presentation-safe, full-canvas layout prioritizes Live AI Hive, Run Story, the strongest current fact, and the most important blocker. It uses large readable type, smooth bounded transitions, restrained visual effects, keyboard control, and no hidden mutation. - **Replay as a feature:** ship one deterministic, tamper-checked reference replay of the complete Release A walkthrough so anyone can experience the story without hardware. `LIVE`, `REPLAY`, `FIXTURE`, and `OFFLINE` remain persistent, high-contrast mode labels; replay can never look live by omission. - **Failure is visible:** cancellation, refusal, stale authority, provider timeout, Worker fault, GPU pressure, rollback, and missing evidence have designed states as polished as success. The visual language must make the containment boundary and recovery path understandable rather than merely turning the canvas red. - **Community assets:** the release gate produces a hero screenshot, a short deterministic showcase capture, and an operator walkthrough generated from the same packaged application and replay/live evidence used by acceptance. Marketing assets cannot use a private fake topology or UI-only success state. The visual direction should feel distinctive and energetic, but never become a sci-fi skin over ambiguous data. Motion communicates execution and causality; color communicates state and proof class; labels and inspectors retain exact truth for technical reviewers. Reduced-motion, keyboard navigation, contrast, and legible presentation-scale rendering are release requirements. **Desktop Model** - **Application frame:** compact desktop top bar with transport mode, role/ticket state, lifecycle, gateway health, pressure, replay/offline status, and active evidence target. - **Navigation dock:** Spectrum action buttons or tab rail for `Hive`, `Namespaces`, `Tickets`, `Policy`, `Evidence`, `Replay`, `Console`, and `Settings`. - **Workspace:** tabbed or split document area where each selected tool opens as a stable workbench view, not a stacked marketing/dashboard section. - **Inspector:** right-side details for the selected worker, namespace path, semantic object, Context Capsule, inference receipt, ticket receipt, evidence pack, replay frame, or policy denial. - **Transcript drawer:** bottom proof pane showing exact `OK`/`ERR`/`END` lines for every backend action and preserving console parity. - **Command palette:** bounded local launcher for existing workbench actions and known paths; it must not execute arbitrary new commands or bypass role/ticket checks. **Frontend Architecture Expectations** - Split the current frontend controller into small modules for workbench routing, session/transport state, transcript state, namespace explorer state, evidence/replay state, Live Hive coordination, and shared Spectrum component wrappers. - Keep DOM updates incremental and keyed for high-churn areas such as telemetry overlays, namespace listings, schedule/lease tables, and transcripts. - Keep Live Hive canvas rendering independent from Spectrum layout reflows; workbench panels may select or inspect Live Hive entities, but must not make per-frame DOM updates. - Preserve accessibility and keyboard efficiency: visible focus rings, keyboard navigation for dock/tabs/menus, command palette search, copy-path shortcuts, and screen-reader labels for status, transcript, and dialogs. - Treat performance budgets as product requirements: bounded polling, no hidden watchers, no layout thrash in high-frequency paths, nonblank canvas proof, release-bundle asset proof, and deterministic replay screenshots. - Existing element IDs may change when the desktop model requires it, but Playwright tests must migrate to stable user-facing roles, labels, test IDs, and replay fixtures instead of fragile dashboard layout assumptions. **Spectrum Design-System Use** - Use Spectrum components for desktop chrome and operator workflows: - `sp-action-button`, `sp-action-group`, or equivalent local wrappers for dock and toolbar commands. - `sp-tabs` or a Spectrum-styled tab rail for workspace switching. - `sp-menu`, `sp-popover`, and context menus for namespace entries, workers, evidence files, and replay artifacts. - `sp-dialog` for ticket minting, evidence export setup, policy approval preview, replay open, and risky write confirmation. - `sp-field-label`, `sp-textfield`, `sp-picker`, `sp-checkbox`, and `sp-switch` for structured forms. - Spectrum status/alert patterns for lifecycle, gateway health, policy denials, backpressure, offline/replay, and tamper rejection. - Inventory the current vendored Spectrum bundle before adding components. Any new Spectrum component must be self-hosted, tested in the release bundle, and covered by the dependency policy. - Spectrum tokens become the primary source for HTML UI density, spacing, focus rings, control states, and accessible contrast. PixiJS may mirror semantic colors through generated or documented tokens, but must remain a renderer over bounded telemetry state. **Live Hive Continuity** - PixiJS remains the owner of the Live Hive canvas, world model, LOD/degrade behavior, selection hooks, and replay rendering. - Spectrum frames the Live Hive as a desktop document view: - toolbar controls for connect/start/stop, fit/reset, detail toggle, replay speed, and snapshot source; - status strip for frame cap, polling cadence, replay/live source, and degraded mode; - inspector for selected worker, canonical namespace path, role, lease, schedule state, and bounded telemetry detail; - transcript drawer for the exact `tail`, `cat`, `ls`, replay, or attach proof that produced visible state. - Live Hive state remains reconstructable from streams, traces, and CBOR snapshots. Restarting SwarmUI must not require hidden UI state to rebuild the view. **Release A completion boundary:** Release A requires the Spectrum application frame, Live AI Hive, Run Story, Jetson Flight Deck, Evidence Ribbon, Showcase Mode, focused namespace inspection, Evidence/Replay workflow, packaged native application proof, and community assets for the accepted reference journey. Full ticket administration, policy authoring, broad settings, semantic graph browsing beyond the capsule core, MCP/A2A views, and unselected provider desks remain unavailable or read-only placeholders and do not block the showcase. **Deliverables** - Release A Live AI Hive, Run Story, Jetson Flight Deck, Evidence Ribbon, Showcase Mode, failure-state language, deterministic reference replay, hero screenshot, and short showcase capture described above. - Desktop shell refactor for `apps/swarmui/frontend/` with Spectrum-backed app frame, dock/tab rail, workspace, inspector, and transcript drawer. - Namespace Explorer workbench: - path breadcrumb and tree/list split for `/proc`, `/queen`, `/shard`, `/worker` when enabled, `/log`, `/gpu`, `/host`, `/policy`, `/actions`, `/audit`, and `/replay` as allowed by generated roots and role policy; - explicit read-only, append-only, control-file, generated, legacy-alias, and unavailable-provider labels; - bounded `cat`, `tail`, copy-path, reveal-in-transcript, and open-in-replay affordances. - Evidence Desk: - front-end workflow over existing `coh evidence pack`, `coh evidence timeline`, CI summary, and SIEM NDJSON export; - visible pack contents, manifest/policy hashes, trace references, redaction state, and deterministic output path; - no second pack schema or UI-owned evidence serializer. - Semantic and Inference Inspector, enabled only when its owner milestones are accepted: - browse bounded 27c object views/edges/provenance, Context Capsule manifests, selection reasons, render profiles, and render receipts through accepted 28c read-only resources or shared owner libraries; - show 27e request/admission/provider/cache/stream/output-digest fact classifications and receipt verification without presenting unknown or client-observed fields as Cohesix facts; - offer copy-ref, open-in-evidence, verify, and separately authorized inference-submit affordances; never call a provider, execute returned tool calls, or retain raw prompt/output content by default. - Replay Desk: - open trace, Hive CBOR snapshot, and evidence pack artifacts offline; - show tamper/replay validation, trace limits, frame/ACK counts, selected timeline event, and Live Hive replay source; - network access remains disabled in offline/replay mode. - Tickets and Policy Desk: - read-only ticket status/deadletter, idempotency key, relay fields, policy rules, pressure, audit, and approval queue views; - optional command-preview forms for existing host-ticket or approval lines, with submit disabled unless the active milestone/profile admits the write path. - Live Hive desktop integration: - preserve PixiJS renderer and replay fixtures; - update canvas framing, toolbar, inspector, worker selection, canonical shard path display, and `No telemetry yet` remediation flow. - render declaration, session, executable lifecycle, provider receipt, external-executor result, 26e target proof, and optional 28b production-binding/quarantine as separate fields. Missing or mock integration rows display their generated mode and never collapse into a generic healthy/ready badge. - UI performance gate: - add deterministic source and release-bundle checks for Live Hive frame cadence, pending-event backlog, inactive-view polling, replay rendering, and layout thrash under fixture load; - record UI render/backlog metrics separately from REST or Pi hardware performance; UI regressions do not reopen driver/runtime performance unless the transcript or gateway evidence shows backend slowdown. - Native application integration gate: - retain the injected-Tauri Playwright suite as the fast deterministic frontend fixture lane, but add a separately labelled packaged native-Tauri lane that launches the real Rust/WebView command bridge and connects through an authenticated `hive-gateway` to an accepted QEMU image; - exercise login/secret-ref refusal, canonical `/shard` browsing, executable/model-only Worker distinctions, authoritative provider/Worker receipts, Live Hive updates/backpressure, disconnect/reconnect, replay/offline isolation, and clean shutdown without injecting `window.__TAURI__`, canned command replies, or target topology; - run the same lane against the release-bundle application and bind results to app, gateway, registry, and QEMU image identities. - Documentation updates: - `docs/USERLAND_AND_CLI.md` describes the SwarmUI desktop workbench, Spectrum/PixiJS split, namespace navigation, evidence desk, replay desk, and non-goals. - `docs/INTERFACES.md` records that the UI remains a projection of existing Secure9P/console/evidence/replay semantics. - `docs/TEST_PLAN.md` records Rust, generated-drift, replay, and Playwright validation. **Commands** - `cargo fmt --all -- --check` - `cargo test -p swarmui` - `cargo test -p swarmui --test transcript` - `cargo test -p swarmui --test console_parity` - `cargo test -p swarmui --test security` - `cargo test -p swarmui --test cache` - `cargo test -p swarmui --test trace` - `cargo test -p swarmui --test replay` - `cargo test -p coh --test evidence` - `cargo test -p cohsh --test trace` - `scripts/check-generated.sh` - `cd tools/swarmui-ui-tests && npm ci` - `cd tools/swarmui-ui-tests && npx playwright install webkit` - `cd tools/swarmui-ui-tests && npm test` - `cd tools/swarmui-ui-tests && npm test -- --grep live-hive-performance` - `scripts/ci/swarmui_native_e2e.sh --target qemu --state-dir out/swarmui-native/m28h` - `SWARMUI_RELEASE_DIR=../../releases/ npm test` from `tools/swarmui-ui-tests` during release-bundle validation. **Checks (DoD)** - A first-time viewer can follow one accepted inference or PEFT run from operator approval through Jetson execution to receipt/evidence and can open the exact supporting record from every visual phase. - Visual flow, pulse, completion, and fault effects are derived from immutable event/receipt ordering; animation timing, cached UI state, screenshots, or replay controls cannot create readiness, execution, success, or proof. - Showcase Mode, the hero screenshot, and the short capture visibly retain `LIVE`, `REPLAY`, `FIXTURE`, or `OFFLINE` mode plus host-only/QEMU/Pi proof classification and the strongest missing evidence. - Jetson Flight Deck reports only registered provider/host facts and preserves `unknown` or `unavailable` sensors, runtime capabilities, and evidence. - SwarmUI uses Spectrum for desktop shell, controls, forms, menus, dialogs, status, focus, and workflow chrome while PixiJS remains the only Live Hive rendering engine. - The frontend is refactored into coherent workbench modules; `app.js` does not remain a monolithic controller for every view, transcript, and Live Hive interaction. - UI actions preserve byte-stable `OK`/`ERR`/`END` transcripts for equivalent `cohsh` operations; no ACK grammar, NineDoor error, `/proc` format, trace, or evidence-pack schema drift occurs. - Namespace Explorer rejects relative paths, `.`, `..`, NUL, over-depth walks, unsupported roots, and paths outside role/ticket scope before reaching provider logic. - Canonical `/shard//worker//telemetry` is preferred in labels and inspectors; legacy `/worker//telemetry` is shown only as a generated compatibility alias when enabled. - Evidence Desk invokes/reuses canonical evidence-pack and timeline internals and never serializes a UI-specific pack format or raw auth tokens/tickets. - Replay Desk rejects tampered traces and oversized artifacts, disables network access in offline/replay mode, and reconstructs Live Hive state from trace/CBOR/evidence artifacts only. - Ticket/Policy Desk shows status and denials without granting new authority; any write-capable affordance is explicitly gated by active profile/milestone state and emits transcript proof. - Worker/provider/use-case state comes from the generated 27b graph and correlated evidence records. UI ids, labels, tickets, `/gpu/models`, PEFT registry entries, telemetry, or cached snapshots cannot independently create executable, live-provider, production-bundle, or production-use-case status. - Semantic objects, Context Capsules, render receipts, and inference receipts are displayed from accepted 27c/27e schemas and immutable ids. UI cache, labels, MCP discovery, or screenshots cannot author or strengthen their provenance, visibility, provider, cache, completion, or authority claims. - Any inference submission uses the existing 27d admission and 27e endpoint; model-produced tool calls remain inert until a separate generated action is explicitly authorized. Raw prompt/output content is absent from default UI state, logs, screenshots, replay, and evidence. - Direct TCP mode clearly warns about single-client console ownership; REST/gateway mode presents gateway health, request-auth state, and backpressure counters before operators tune publish rates. - No hidden polling or background watchers run when a workbench view is inactive, stopped, or offline; Live Hive polling remains bounded by generated defaults. - Playwright desktop and narrow screenshots are updated intentionally, with checks for nonblank PixiJS canvas, visible legends/status, text fit, no overlapping controls, keyboard/focus behavior, and accessible labels. - Live Hive UI performance evidence records frame cadence, pending/backlog bounds, inactive-view polling state, and replay render stability for source and release-bundle runs; failures are fixed in the UI/render loop unless backend transcript evidence proves a runtime regression. - Release-bundle UI tests pass against the latest bundle assets, not only source files. - The native-Tauri source and release lanes use the actual packaged app, Rust command bridge, authenticated gateway, and accepted QEMU image; placeholder auth fails before connection, injected/canned bridge state is absent, and identity-bound evidence covers namespace, Worker/integration truth, Live Hive pressure/reconnect, replay isolation, and shutdown. **Compiler touchpoints** - `coh-rtc` remains the source for SwarmUI path roots, cache limits, trace limits, Live Hive frame/LOD limits, line caps, ticket scope, and any new desktop-workbench defaults. - `coh-rtc` generates SwarmUI views of 27b integration/use-case rows, referenced 27c semantic/capsule visibility and schema axes, referenced 27e inference fact/receipt axes, and 26e/28b Worker evidence axes; frontend code may format but not reclassify them. - If additional UI roots, Spectrum component allowlists, evidence-desk defaults, replay-desk defaults, or workbench view limits are needed, add manifest IR and regenerate `apps/swarmui/src/generated.rs`, `docs/snippets/swarmui_defaults.md`, docs snippets, and tests in the same change. - Generated docs must be refreshed before implementation patches land; stale embedded snippets in `docs/USERLAND_AND_CLI.md` or other canonical docs block merge. **Task Breakdown** ``` Title/ID: m27f-swarmui-scope-and-drift Goal: Establish the desktop-workbench scope and clear generated-doc/grammar drift before changing UI layout. Inputs: AGENTS.md, docs/BUILD_PLAN.md, docs/USERLAND_AND_CLI.md, docs/snippets/*.md, tools/coh-rtc/tests/swarmui_docs.rs, apps/swarmui/src/generated.rs, crates/cohsh-core/src/verb.rs, apps/cohsh/src/lib.rs, apps/swarmui/src/lib.rs Changes: - docs/USERLAND_AND_CLI.md — refresh generated snippets and document the desktop-workbench non-goals. - tools/coh-rtc/tests/swarmui_docs.rs — keep generated SwarmUI snippet checks authoritative. - docs/INTERFACES.md — record Spectrum/PixiJS split and no-new-semantics guardrails. Commands: - scripts/check-generated.sh - cargo test -p swarmui --test transcript - cargo test -p swarmui --test console_parity Checks: - Embedded generated snippets match docs/snippets and generated Rust. - Echo grammar documentation agrees with actual parser/help or the mismatch is resolved through the manifest/compiler path. - No protocol, ACK, path, ticket, or evidence semantics change in this task. Deliverables: - Clean scope baseline for the SwarmUI desktop redesign. Title/ID: m27f-integration-truth-model Milestone: Milestone 27f — SwarmUI Community Showcase: Spectrum Workbench + Live AI Hive / m27f-integration-truth-model Goal: Replace inferred Worker/provider health with generated declaration, lifecycle, receipt, executor, proof, and use-case axes. Inputs: 27b host-integration/use-case registries, accepted 26e Worker evidence, optional 28b production binding/quarantine evidence, apps/swarmui/src/**, apps/swarmui/frontend/hive/**, replay fixtures. Changes: - apps/swarmui/src/** — parse and correlate generated integration/use-case rows plus 26e/28b evidence without deriving role or maturity from ids, model/session entries, tickets, or telemetry. - apps/swarmui/frontend/hive/** + inspector views — render declaration, session, executable lifecycle, provider receipt, external outcome, target proof, production binding, quarantine, and use-case maturity independently. - apps/swarmui/tests/** + tools/swarmui-ui-tests/** — negative fixtures for model-only sessions, mock providers, stale receipts, mismatched target proof, absent 28b binding, and cached/replay state. Commands: - cargo test -p swarmui - cd tools/swarmui-ui-tests && npm test -- --grep integration-truth Checks: - No UI path synthesizes executable Worker, live provider/executor, production bundle, or production use-case state; absent/stale/mismatched evidence is visible and deterministic in live and replay modes. Deliverables: - SwarmUI communicates the real end-to-end integration state without collapsing independent proof layers. Title/ID: m27f-spectrum-desktop-shell Goal: Rebuild SwarmUI chrome around Spectrum-backed desktop primitives and split the frontend into maintainable workbench modules while preserving backend protocol semantics. Inputs: apps/swarmui/frontend/index.html, apps/swarmui/frontend/app.js, apps/swarmui/frontend/styles/**, apps/swarmui/frontend/components/**, apps/swarmui/frontend/vendor/spectrum.bundle.js, tools/swarmui-ui-tests/** Changes: - apps/swarmui/frontend/index.html — introduce app frame, navigation dock/tab rail, workspace, inspector, and transcript drawer. - apps/swarmui/frontend/app.js — split monolithic controller behavior into workbench routing, state, transcript, namespace, evidence/replay, and Live Hive coordination modules. - apps/swarmui/frontend/styles/** — align layout, density, focus, status, and form styling with Spectrum tokens and remove dashboard-specific layout assumptions. - apps/swarmui/frontend/components/** — add reusable workbench, toolbar, status, dialog, menu, command-palette, and inspector wrappers around vendored Spectrum components. - tools/swarmui-ui-tests/** — update UI-only desktop/narrow tests and screenshots to target stable user-facing roles, labels, test IDs, and replay fixtures. Commands: - cargo test -p swarmui - cd tools/swarmui-ui-tests && npm test Checks: - Existing Tauri command names and backend semantics remain stable even if frontend module boundaries and DOM structure change substantially. - `app.js` is no longer the owner of all workbench, transcript, namespace, evidence/replay, and Live Hive UI behavior. - Spectrum components render offline from vendored assets with no CDN or network dependency. - Desktop and narrow layouts have no overlapping controls, clipped text, unreachable focus targets, or keyboard traps. Deliverables: - Spectrum-backed SwarmUI workbench shell. Title/ID: m27f-namespace-explorer Goal: Replace the root picker with a desktop namespace explorer that makes Secure9P paths familiar and safe. Inputs: apps/swarmui/src/lib.rs, apps/swarmui/src-tauri/main.rs, apps/swarmui/frontend/**, configs/root_task.toml, docs/ROLES_AND_SCHEDULING.md, docs/SECURE9P.md, tests/fixtures/traces/trace_v0.trace Changes: - apps/swarmui/src/lib.rs — add read-only list/cat/tail helpers if needed without changing command grammar or provider semantics. - apps/swarmui/frontend/** — add breadcrumb, tree/list split, preview/tail pane, path copy, transcript reveal, and path metadata labels. - docs/USERLAND_AND_CLI.md — document canonical shard navigation and legacy `/worker` alias presentation. Commands: - cargo test -p swarmui --test security - cargo test -p swarmui --test trace - cd tools/swarmui-ui-tests && npm test Checks: - Absolute-path, walk-depth, role/ticket, legacy-alias, and unsupported-root behavior is enforced and visible. - `ls`, `cat`, and `tail` transcript order remains byte-stable with `cohsh`. Deliverables: - Secure9P namespace explorer suitable for day-to-day operator browsing. Title/ID: m27f-evidence-and-replay-desks Goal: Make evidence packs, timelines, traces, snapshots, and replay first-class desktop workbench flows using canonical artifacts only. Inputs: apps/coh evidence internals, apps/swarmui/src/cache.rs, apps/swarmui/src/hive.rs, apps/swarmui/src-tauri/main.rs, crates/cohsh-core/src/trace.rs, tools/cohesix-py/examples/ci_evidence_pack.py, tools/cohesix-py/examples/siem_export_ndjson.py, docs/OPERATOR_WALKTHROUGH.md Changes: - apps/swarmui/src/** — expose host-side wrappers or shared read-only internals for evidence/timeline/replay metadata where milestone 27 provides them. - apps/swarmui/frontend/** — add Evidence Desk and Replay Desk views with pack contents, hashes, validation, timeline, SIEM/CI export, and Live Hive replay source selection. - docs/USERLAND_AND_CLI.md + docs/TEST_PLAN.md — document evidence/replay workflows and validation. Commands: - cargo test -p swarmui --test cache - cargo test -p swarmui --test replay - cargo test -p swarmui --test trace - cargo test -p coh --test evidence - cd tools/swarmui-ui-tests && npm test Checks: - Evidence Desk reuses canonical pack/timeline output and does not leak raw tickets or auth tokens. - Replay Desk rejects tampered/oversized traces and keeps network disabled in offline/replay mode. - Live Hive replay remains deterministic from trace-adjacent `.hive.cbor` and snapshot CBOR artifacts. Deliverables: - Desktop evidence and replay workflows ready for audit, support, CI, and demos. Title/ID: m27f-semantic-inference-inspector Milestone: Milestone 27f — SwarmUI Community Showcase: Spectrum Workbench + Live AI Hive / m27f-semantic-inference-inspector Goal: Add optional read-only semantic, Context Capsule, and inference receipt inspection without creating UI-owned truth or a direct provider path. Inputs: accepted 27c semantic/capsule schemas and fixtures, accepted 27e inference receipt schemas and fixtures, accepted 28c read-only resources, crates/cohesix-semantic-core, crates/cohesix-inference-core, apps/hive-gateway, apps/swarmui/src/**, apps/swarmui/frontend/**, docs/SECURITY.md, docs/TEST_PLAN.md Changes: - apps/swarmui/src/** — bounded read/verify adapters for accepted semantic object, capsule, render, and inference receipt refs using shared owner libraries or 28c read-only gateway resources; no duplicate parsers or schemas. - apps/swarmui/frontend/** — optional inspector/workbench views for object views/edges/provenance, capsule selection/render receipts, inference fact sources/status/timing/digests, and copy/open-in-evidence actions. - apps/swarmui/tests/** + tools/swarmui-ui-tests/** — visibility, tamper, stale/missing artifact, unknown/provider/client-only fact, raw-content absence, and model-returned tool-call inertness fixtures. - docs/USERLAND_AND_CLI.md + docs/SECURITY.md + docs/TEST_PLAN.md — document conditional availability, read-only ownership, explicit inference admission, content-retention defaults, and evidence boundaries. Commands: - cargo test -p swarmui --test semantic_inference - cargo test -p cohesix-semantic-core - cargo test -p cohesix-inference-core - cd tools/swarmui-ui-tests && npm test -- --grep semantic-inference Checks: - Missing owner milestones hide or type the views unavailable. - Every displayed artifact verifies against its owner schema/hash and obeys visibility policy; the UI cannot author, mutate, or strengthen a fact. - No provider call, returned tool execution, or raw prompt/output retention occurs through the inspector. Deliverables: - Auditable desktop inspection for semantic context and inference receipts using the same host contracts as CLI, Python, MCP/A2A, and evidence tools. Title/ID: m27f-live-ai-community-showcase Milestone: Milestone 27f — SwarmUI Community Showcase: Spectrum Workbench + Live AI Hive / m27f-live-ai-community-showcase Goal: Turn the exact Release A Jetson inference and PEFT walkthrough into a visually compelling, deterministic, truth-preserving Live AI Hive story and community demo. Inputs: accepted 26e QEMU/Pi Worker evidence; selected 27b Jetson/NVIDIA/GPU/ PEFT/provider rows; accepted 27c capsule-core records; accepted 27d run, checkpoint, artifact, PEFT, and receipt records; accepted 27e inference and stream receipts; Milestone 27 case/timeline output; PixiJS Live Hive renderer; packaged SwarmUI and deterministic replay fixtures. Changes: - apps/swarmui/frontend/hive/** — add distinct Queen, seL4 Worker, target, Jetson host, external runtime/model, artifact, and evidence visual entities plus bounded flow/pulse/completion/failure effects driven only by accepted records. - apps/swarmui/frontend/** — add Run Story, Jetson Flight Deck, Evidence Ribbon, Showcase Mode, persistent live/replay/fixture/offline labelling, reduced-motion support, and designed cancellation/refusal/fault/rollback/ missing-evidence states. - apps/swarmui/src/** — consume shared generated integration, run, receipt, evidence, and hardware/provider snapshots without adding a UI receipt, health classifier, provider client, or success state. - tools/swarmui-ui-tests/** + apps/swarmui/tests/** — deterministic complete- journey, false-promotion, mode-label, reduced-motion, presentation-layout, failure-state, evidence-correlation, and replay-tamper coverage. - scripts/ci/swarmui_showcase_capture.sh + release assembly — produce the hero screenshot and short deterministic showcase capture from the packaged application and accepted replay/live inputs; no private fake topology. - docs/OPERATOR_WALKTHROUGH.md + docs/USERLAND_AND_CLI.md + release notes — explain the visible story, proof classes, live/replay distinction, and exact reference journey. Commands: - cargo test -p swarmui --test live_ai_showcase - cd tools/swarmui-ui-tests && npm test -- --grep live-ai-showcase - scripts/ci/swarmui_native_e2e.sh --target qemu --state-dir out/swarmui-native/m28h - scripts/ci/swarmui_showcase_capture.sh --source replay --state-dir out/swarmui-showcase/m28h Checks: - A viewer can distinguish Queen, seL4 Worker, Pi/QEMU target, Jetson host, external AI runtime, artifact, and evidence ownership without opening a debug table; the inspector provides the exact identities and refs. - The full inference/PEFT story is reconstructable from accepted records and the same evidence pack; UI animation order cannot become execution truth. - Live, replay, fixture, offline, host-only, QEMU, Pi, and unavailable states remain persistently and accessibly labelled in the application, screenshot, and capture. - Cancellation, refusal, stale state, timeout, fault, rollback, and missing evidence are polished deterministic states and never collapse into generic failure or false readiness. - Presentation mode remains responsive, readable, bounded, keyboard usable, reduced-motion compatible, and free of hidden mutation or network access during replay. Deliverables: - Packaged Live AI Hive showcase, deterministic reference replay, hero screenshot, short capture, and operator walkthrough that make Cohesix's real architecture exciting without weakening its evidence discipline. Title/ID: m27f-live-hive-continuity Goal: Preserve PixiJS Live Hive while integrating it into the desktop workbench with Spectrum toolbar and inspector controls. Inputs: apps/swarmui/frontend/hive/**, apps/swarmui/frontend/app.js, apps/swarmui/frontend/styles/hive.css, apps/swarmui/tests/replay.rs, tools/swarmui-ui-tests/tests/swarmui.spec.js Changes: - apps/swarmui/frontend/hive/** — preserve PixiJS renderer, world model, LOD, and debug hooks while accepting workbench selection/inspector events. - apps/swarmui/frontend/** — add Spectrum toolbar, source status, replay speed, fit/reset, detail toggle, and selected-worker inspector. - tools/swarmui-ui-tests/** — assert canvas is nonblank, responsive, and framed correctly across desktop/narrow modes. Commands: - cargo test -p swarmui --test replay - cd tools/swarmui-ui-tests && npm test - cd tools/swarmui-ui-tests && npm test -- --grep live-hive-performance Checks: - PixiJS remains the rendering engine; Spectrum does not replace canvas rendering. - Selection, overlays, details, replay, and degraded-mode indicators remain bounded and reconstructable. - Canvas pixel checks, screenshots, and Live Hive performance checks prove nonblank rendering, bounded frame cadence/backlog, inactive-view polling state, and no UI overlap. Deliverables: - Live Hive preserved as the high-performance visualization inside the desktop workbench. Title/ID: m27f-native-tauri-live-e2e Milestone: Milestone 27f — SwarmUI Community Showcase: Spectrum Workbench + Live AI Hive / m27f-native-tauri-live-e2e Goal: Prove the real packaged Tauri application, Rust command bridge, authenticated gateway, and accepted QEMU runtime work together without injected frontend responses. Inputs: m27b-authoritative-receipt-and-evidence-core, accepted QEMU image/evidence, apps/swarmui/{src,src-tauri,frontend,tauri.conf.json}, apps/hive-gateway, generated integration/use-case registries, tools/swarmui-ui-tests fixture lane, release application bundle, docs/TEST_PLAN.md. Changes: - scripts/ci/swarmui_native_e2e.sh + native harness — build/launch the real Tauri app and gateway, provision auth through secret refs, bind exact app/gateway/registry/QEMU identities, drive the actual WebView-to-Rust command path, collect bounded logs/screenshots/evidence, and terminate all processes deterministically. - native scenarios — validate placeholder/missing auth refusal, canonical `/shard` navigation, model-only versus executable Worker rendering, authoritative and stale/mismatched receipt handling, Live Hive state/pressure/backpressure, disconnect/reconnect, replay/offline network isolation, and clean shutdown against accepted QEMU state. - tools/swarmui-ui-tests/** — retain injected Tauri responses only in the explicitly classified frontend fixture lane; make test output and evidence metadata state `fixture` versus `native_live`, and forbid fixture output from satisfying this task or release acceptance. - release gate — repeat the native scenarios from the packaged SwarmUI/gateway artifacts with offline assets and exact manifest verification. Commands: - cargo test -p swarmui - scripts/ci/swarmui_native_e2e.sh --target qemu --state-dir out/swarmui-native/m27f-source - scripts/ci/swarmui_native_e2e.sh --target qemu --release-dir releases/ --state-dir out/swarmui-native/m27f-release Checks: - No native-live scenario injects `window.__TAURI__`, canned invoke replies, fake topology, placeholder credentials, or fixture receipts. - Source and packaged lanes exercise the same real command/session/reconnect/evidence paths and bind every result to immutable app, gateway, registry, and QEMU identities. - The deterministic Playwright fixture lane remains fast and useful but cannot promote native integration or release status. Deliverables: - Native SwarmUI integration evidence across the actual application, host gateway, and Cohesix runtime. Title/ID: m27f-release-bundle-ui-regression Goal: Prove the redesigned workbench works from source and the latest release bundle without hidden runtime or asset assumptions. Inputs: m27f-native-tauri-live-e2e, tools/swarmui-ui-tests/**, releases//ui/swarmui/**, apps/swarmui/frontend/**, docs/TEST_PLAN.md Changes: - tools/swarmui-ui-tests/** — add desktop workbench regression coverage for dock, tabs, namespace explorer, evidence desk, replay desk, Live Hive, console, and dialogs. - docs/TEST_PLAN.md — update SwarmUI UI regression commands and screenshot policy. Commands: - cd tools/swarmui-ui-tests && npm ci - cd tools/swarmui-ui-tests && npx playwright install webkit - cd tools/swarmui-ui-tests && npm test - cd tools/swarmui-ui-tests && npm test -- --grep live-hive-performance - cd tools/swarmui-ui-tests && SWARMUI_RELEASE_DIR=../../releases/ npm test - cd tools/swarmui-ui-tests && SWARMUI_RELEASE_DIR=../../releases/ npm test -- --grep live-hive-performance - scripts/ci/swarmui_native_e2e.sh --target qemu --release-dir releases/ --state-dir out/swarmui-native/m27f-release Checks: - Source and release-bundle frontend tests pass with deterministic fixtures, and the separate native release lane passes without injected bridge state. - Screenshots are intentionally updated and stable. - Release bundle includes all Spectrum, icon, font, and PixiJS assets needed for offline operation. - Source and release-bundle Live Hive performance checks record frame cadence, pending/backlog bounds, inactive-view polling state, and replay stability separately from backend REST/Pi performance. Deliverables: - Replay-first UI regression gate for the SwarmUI desktop workbench. ``` **Outcome** After Milestone 27f: - SwarmUI is the primary desktop operator workbench for Cohesix, not a dense single-page dashboard. - Operators can browse Secure9P namespaces with file-manager familiarity while still seeing exact role/ticket/path bounds. - Evidence packs, timelines, traces, snapshots, and Live Hive replay are first-class, deterministic desktop workflows. - When accepted by their owner milestones, immutable semantic objects, Context Capsules, and inference receipts are inspectable through the same generated host contracts as CLI, Python, MCP/A2A, and evidence tooling. - Spectrum owns the desktop interaction language; PixiJS Live Hive remains the rendering engine for hive state. - Cohesix gains usability without increasing the VM TCB, adding protocols, weakening transcript parity, or creating a second evidence/replay format. ## Milestone 28 — Formal Verification Baseline + Proof-Carrying Manifests [Milestones](#Milestones) **Delivery posture:** Staged. The Release B core consists of the claim register, generated authority witnesses, Secure9P bounds, HAL/resource checks, and the restricted policy-IR foundation consumed by 28a. Broad TLA+/PlusCal models, NIST mapping, persistence-specific proofs, and exhaustive bounded checking are conditional extensions tied to a named assurance claim; they do not block Release A or the Release B core. **Why now (assurance):** After Milestone 26e gives Cohesix one accepted QEMU/Pi task and authority topology, consequential production actions need stronger assurance than regression tests and evidence packs alone. Milestone 28 establishes the first formal-verification baseline around the actual Cohesix authority model: generated manifests, Secure9P/NineDoor bounds, HAL admission, driver-task ABI/resource grants, ticket/namespace confinement, and selected replayable state transitions. It does not claim full end-to-end formal verification of the whole OS or physical hardware behavior. A selected Milestone 29 persistence profile extends this baseline with its own storage claims after M29 evidence exists; persistence is not a prerequisite for the base witness model. **As-built alignment note:** Cohesix already has strong verification hooks: compiler-generated manifests, Secure9P red lines, no-unsafe protocol crates, HAL ownership rules, staged regression plans, evidence packs, and seL4 as the upstream kernel proof base. It does **not** yet have machine-checked Cohesix-specific proof artifacts, proof-carrying manifest witnesses, TLA+/PlusCal state models, Kani/Miri proof jobs, or a CI verification gate that binds those artifacts to generated Rust and docs. Milestone 28 introduces those surfaces; older prose must not describe Cohesix as formally verified until the claims in this milestone have passing evidence. **Non-negotiable constraints** - No proof claim may exceed the checked artifact. QEMU proof, Pi 4 hardware evidence, static analysis, bounded model checking, TLA+ state exploration, and inherited seL4 kernel assumptions must remain separate. - Do not claim full seL4-style refinement proof from Cohesix spec to binary unless that proof exists. The accepted claim for this milestone is bounded, machine-checked verification of selected Cohesix contracts plus explicit assumptions. - Later milestones may cite 28 only through named claim ids and evidence classes. A downstream production, semantic-extraction, AI, inference, MCP/A2A, or AWS task must state whether it depends on inherited seL4 assumptions, Cohesix static/generated checks, bounded model checks, state-model exploration, QEMU/staged evidence, fresh Pi 4 evidence, host-provider evidence, or target-specific AWS evidence. Importing a proof or assurance artifact into a semantic object, Context Capsule, or inference receipt never strengthens its original evidence class. - Formal models must describe generated/as-built interfaces, not desired future behavior. If a model and generated manifest disagree, the fix is IR/codegen/docs alignment, not weakening the model. - Verification tooling must be deterministic on macOS ARM64 and CI-friendly; heavyweight tools may be optional locally only if CI has a bounded equivalent or checked artifact. - No new runtime protocols, namespace roots, ticket semantics, or HAL bypasses are permitted under the banner of verification. - Verification witnesses are generated artifacts or generated-adjacent evidence; they must not become a hand-maintained second source of truth. - Physical Pi 4 hardware behavior remains evidence-based. Formal verification can prove the admission/resource/ABI contracts that precede hardware execution, not that a device actually behaves correctly on the board. - Cohesix checks over MCS manifests, admission arithmetic, Reply/donation lifecycles, and timeout policy must not be described as upstream AArch64 or SMP+MCS kernel verification. The selected architecture remains outside the tag-pinned verified configuration unless upstream proof coverage says otherwise for the exact build. ### Prerequisite - Milestone **26e**, including `m26e-mcs-smp-target-acceptance`, completed so witnesses describe the one accepted SMP+MCS QEMU/Pi task topology rather than a hypothetical or dual-scheduler design. - Milestone **29** completed only for a profile whose 28 claim set includes VM-local persistence. Non-persistent profiles omit those witness fields and claims rather than blocking the base 28 core. - Milestones **26a** and **26b**, plus Milestones **26c** and **26d**, completed or explicitly scoped where their artifacts are inputs to the proof surface: driver-task substrate, HAL admission, isolated runtime descriptors, 26b benchmark evidence, target-qualified tests, and refreshed seL4 baseline evidence. ### Goal Establish a machine-checkable verification baseline for the highest-value Cohesix contracts: 1. manifest/compiler invariants and generated proof witnesses, 2. Secure9P codec/session/path/fid/append-only bounds, 3. ticket, namespace, and role confinement, 4. HAL-only hardware authority and driver-task resource admission, 5. pointer-free, bounded Pi 4 driver-task ABI descriptors, 6. selected Queen/Worker, policy, audit, replay, and persistence state machines, 7. MCS scheduling-context/core ownership, offline admission, Reply/donation return, timeout, cancellation, fault, and revoke invariants, 8. explicit proof assumptions, residual gaps, and non-claims, 9. a claim ladder that downstream milestones can cite without collapsing static proof, model checking, QEMU evidence, Pi 4 evidence, and AWS target evidence into one assurance label. 10. a version-pinned NIST SP 800-53 LOW assessment layer that consumes named Cohesix claims and test-plan evidence without presenting a crosswalk as certification. 11. a restricted policy-IR proof foundation whose accepted fragment, consistency/non-vacuity checks, generated solver/evaluator correspondence, verifier identity, and proof terminology can be consumed by Milestone 28a without issuing runtime authority. The Release B core is satisfied by goals 1-5, 8-9, and the bounded foundation in goal 11 for the selected consequential actions. Goals 6-7 and 10, plus broader state exploration or persistence proof, remain separately activated claim extensions. No unchecked extension may be implied by completion of the core. ### Deliverables #### A) Verification claim register - Add `docs/FORMAL_VERIFICATION.md` as the canonical register of checked claims, proof assumptions, trusted bases, non-claims, and residual gaps. - Distinguish: - inherited upstream seL4 assumptions, - Rust type/memory-safety assumptions, - Cohesix static checks, - bounded model-checking results, - state-model exploration results, - QEMU/staged evidence, - fresh Pi 4 hardware evidence. - Define allowed external wording for Cohesix assurance claims so release docs, audit reports, and operator utilities do not overstate proof scope. - Define a stable claim-ladder vocabulary and claim-id format. Each claim records `claim_id`, `evidence_class`, `trusted_base`, `assumption_ref`, `artifact_ref`, `target_profile`, and `non_claim` fields so later milestones can cite exactly what was proven and what remains evidence-based. #### B) Proof-carrying manifest witnesses - Extend `coh-rtc` to emit a deterministic verification witness for each resolved manifest profile, including: - Secure9P `msize`, walk-depth, path, and fid constraints, - namespace roots, mutability, role permissions, and append-only controls, - ticket inventory and role/path/verb authority matrix, - HAL storage, MMIO, DMA, IRQ, and driver-task resource grants, - driver-image ABI bounds, runtime resource windows, and non-overlap checks, - persistence bounds and data-at-rest identity binding, - scheduling-context/core ownership, budget/period/refills, per-core admitted demand and reserves, Reply-object cardinality, donation depth, timeout routing, overrun policy, and consumed-time evidence, - claim ids and evidence-class tags consumed by downstream production, semantic-object, AI, inference, MCP/A2A, Pi 4, and AWS milestone gates. - Add a verifier that checks the witness against the resolved manifest and generated Rust tables, failing closed on drift. - Witnesses must be regenerated from IR; hand-editing witness output is invalid. #### C) Secure9P formal and bounded verification - Add bounded proofs for `secure9p-codec` and `secure9p-core` covering: - length-prefix and `msize` handling, - walk depth and path rejection (`..`, invalid UTF-8, NUL where rejected), - fid creation, clunk retirement, and no reuse after clunk, - tag/window/queue limits, - append-only read/write bound helpers, - deterministic error mapping for malformed frames. - Use Kani or an equivalent bounded model checker where practical, plus fuzz corpus regression for parser edge cases. - Keep existing Rust tests as regression evidence; proofs do not replace fixtures. #### D) HAL and driver-task authority checks - Add a static authority checker that rejects direct physical-address discovery, device-untyped retyping, DMA allocation/publish, IRQ binding, cache maintenance, or ad-hoc MMIO outside approved HAL modules. - Check that driver-task bootstrap grants only declared CSpace, VSpace, endpoint, notification, fault/timeout endpoint, Reply object, scheduling context, stack, IPC, ring, MMIO, DMA, shared-buffer, and IRQ resources from generated manifests; SchedControl remains root-owned. - Check that driver tasks do not receive Secure9P authority, broad namespace state, ticket secrets, or catch-all `KernelHal` authority. - Verify `pi4-driver-abi` descriptors are pointer-free, layout-stable, bounded, and incapable of representing overlapping undeclared resource windows. #### E) State-machine models - Add small TLA+/PlusCal or equivalent models for: - Secure9P session/fid lifecycle, - ticket issuance, use, revoke, and denial, - Queen/Worker lifecycle and namespace visibility, - policy apply/rollback and audit/replay ordering, - persistence spool append/read/ack crash behavior, - driver-task admission and fail-closed service turns, - MCS Reply/donated-SC return across timeout, cancellation, fault, revoke, and task restart without cross-epoch reuse. - Model outputs must map back to generated manifest fields and checked Rust fixtures. Models that cannot be tied to as-built fields are design notes, not verification closure. #### F) CI verification gate and evidence archive - Add `scripts/ci/verification_gate.sh` to run the deterministic verification subset: - generated-artifact drift guard, - proof-witness generation and verification, - Secure9P bounded proofs or CI-approved bounded substitutes, - state-model checks at documented bounds, - HAL/driver-task authority checker, - fuzz corpus regression, - existing Rust tests for touched proof surfaces. - Emit evidence under `out/verification//` with machine-readable summaries and human-readable logs. - Update `docs/TEST_PLAN.md` so formal verification augments, but does not replace, the staged Test Plan and hardware proof gates. #### G) NIST assessment-evidence integrity - Reintegrate `tools/security-nist` as an assessment-evidence consumer of the verification claim register, generated manifest witnesses, staged Test Plan, and target-qualified evidence archive. It must not become an independent authority for runtime behavior or proof claims. - Pin the registry to the selected NIST SP 800-53, SP 800-53A, and SP 800-53B releases, including source provenance and digests. Use the official machine-readable OSCAL content to validate identifiers and LOW-baseline membership; builds and release checks must not depend on an unpinned live network fetch. - Require the tailored registry to account for every selected LOW-baseline control and enhancement with an implementation disposition of `implemented`, `inherited`, `planned`, or `not_applicable`, plus a separate assessment result of `satisfied`, `failed`, or `not_assessed`. Record explicit tailoring rationale, implementation responsibility, and assessment methods. Absence is an error, not implicit tailoring. - Replace path-existence and documentation-phrase evidence with typed records that identify a verification claim id or Test Plan action, assessment objective, target/profile, manifest or image identity, result artifact, evidence class, and freshness rule. A generic smoke script or existing file cannot by itself satisfy multiple unrelated implemented controls. - Preserve proof-layer separation: static checks, bounded model checking, QEMU, Pi 4, host, and inherited-provider evidence are not interchangeable. Missing, expired, wrong-profile, or identity-mismatched evidence produces `not_assessed` or a failed objective without silently changing or validating the separately recorded implementation disposition. - Generate the human-readable NIST report and a machine-readable, OSCAL-compatible component/assessment-results projection from the same registry and reviewed run evidence. Generated reports must be regenerated and compared in CI and must state that the output is a tailored evidence index, not certification or authorization. - Run fast registry/schema/report-drift checks on affected pull requests and a target-qualified assessment during scheduled or release verification. Physical-hardware objectives require fresh Pi 4 evidence only when the assessed claim requires hardware; routine host/QEMU changes must not fabricate or silently inherit that proof. #### H) Restricted policy-IR proof foundation - Define the accepted bounded policy fragment, policy consistency and non-vacuity checks, and generated solver/evaluator correspondence claims used by later runtime admission. - Keep decision witnesses, explanation cores, and independently checkable proof artefacts as distinct evidence classes. Record verifier name/version, accepted checker, bounds, assumptions, and claim id for every proof claim. - Fail CI deterministically when policy source, generated solver constraints, deterministic evaluator, test vectors, verifier identity, or checked artefacts drift. - This foundation owns static policy and proof vocabulary only. It does not issue tickets, leases, provider actions, grants, or runtime decisions; Milestone 28a consumes it for exact per-intent admission. ### Commands - `scripts/check-generated.sh` - `cargo test -p coh-rtc` - `cargo test -p security-nist` - `cargo test -p secure9p-codec` - `cargo test -p secure9p-core` - `cargo test -p pi4-driver-abi` - `scripts/ci/verification_gate.sh` ### Checks (DoD) - `coh-rtc` emits verification witnesses for active QEMU and Pi 4 profiles, and the verifier proves they match generated Rust and resolved manifests. - Secure9P codec/core proofs or bounded checks pass for the documented contract set. - HAL/static authority checker has no bypass findings outside approved HAL modules and documented test fixtures. - Driver-task ABI/resource checks prove no undeclared resource windows, pointer-bearing descriptors, overlapping arenas, or broad authority grants. - MCS witnesses and state models prove generated SC/core ownership, per-core admission totals/reserves, bounded donation depth, Reply return, timeout routing, and no donated-SC or Reply-object reuse across revoke/restart. - State models run at documented bounds and any counterexample is either fixed or recorded as a blocker with a named later milestone. - `docs/FORMAL_VERIFICATION.md` states exact claims, assumptions, and non-claims, including that Pi 4 hardware behavior still requires fresh board evidence. - Verification evidence is reproducible and archived under `out/verification//`. - The NIST LOW registry is complete for its pinned baseline, every positive assessment result resolves to current typed evidence for the exact claim/profile/identity, and the Markdown and machine-readable reports are deterministic and drift-checked. - No NIST output upgrades a documentation phrase, file-existence check, stale run, QEMU result, inherited assertion, or unsigned measurement into stronger proof or a certification claim. ### Compiler touchpoints - `coh-rtc` emits proof witnesses from the same IR used for generated Rust, docs snippets, policies, and manifests. - Manifest schema changes that affect authority, namespace layout, persistence, Secure9P bounds, or driver resources must update the witness schema and verifier in the same change. - Generated docs may summarize witness contents, but canonical proof truth is the resolved manifest plus generated witness plus verifier output. ### Task Breakdown ``` Title/ID: m28-claim-register Goal: Define Cohesix formal-verification claims, assumptions, and non-claims before adding proof tooling. Inputs: AGENTS.md, docs/BUILD_PLAN.md, docs/ARCHITECTURE.md, docs/SECURITY.md, docs/TEST_PLAN.md. Changes: - docs/FORMAL_VERIFICATION.md — proof scope, trusted bases, checked claims, non-claims, residual gaps, and acceptable release wording. Commands: - git diff --check docs/FORMAL_VERIFICATION.md docs/BUILD_PLAN.md Checks: - The document separates inherited seL4 assumptions, Cohesix machine checks, staged evidence, and Pi 4 hardware proof. Deliverables: - Canonical assurance-claim register for later verification tasks. Title/ID: m28-proof-witness-ir Goal: Generate and verify proof-carrying manifest witnesses from compiler IR. Inputs: tools/coh-rtc, configs/root_task*.toml, apps/root-task/src/generated, configs/generated/. Changes: - tools/coh-rtc/src/verify.rs — witness schema and verifier. - tools/coh-rtc/src/codegen/* — witness emission beside resolved manifests. - docs/snippets/* — generated witness summaries where appropriate. Commands: - cargo test -p coh-rtc - scripts/check-generated.sh Checks: - Witnesses match resolved manifests and generated Rust; hand-edited or stale witnesses fail closed. Deliverables: - Proof-carrying manifest witness pipeline for QEMU and Pi 4 profiles. Title/ID: m28-secure9p-proofs Goal: Add bounded machine checks for Secure9P codec/session invariants. Inputs: crates/secure9p-codec, crates/secure9p-core, scripts/cohsh/*, docs/USERLAND_AND_CLI.md. Changes: - crates/secure9p-codec/proofs/ — bounded frame/decoder proof harnesses. - crates/secure9p-core/proofs/ — fid/session/window/append-only proof harnesses. - docs/FORMAL_VERIFICATION.md — Secure9P proof claim updates. Commands: - cargo test -p secure9p-codec - cargo test -p secure9p-core - scripts/ci/verification_gate.sh --secure9p-only Checks: - Secure9P red lines are machine-checked and regression fixtures still pass unchanged. Deliverables: - Reproducible Secure9P proof evidence. Title/ID: m28-hal-authority-checker Goal: Enforce HAL-only device authority and driver-task resource confinement statically. Inputs: apps/root-task/src/hal, apps/root-task/src/cspace, apps/root-task/src/kernel.rs, crates/pi4-driver-abi. Changes: - tools/verify-cohesix/src/hal_authority.rs — static scanner/checker for HAL bypass and broad authority grants. - crates/pi4-driver-abi/proofs/ — ABI layout/bounds checks. Commands: - cargo test -p pi4-driver-abi - cargo run -p verify-cohesix -- hal-authority --manifest configs/generated/root_task_resolved.json Checks: - MMIO/DMA/IRQ/resource grants appear only through approved HAL paths; driver descriptors are pointer-free and bounded. Deliverables: - HAL and driver-task authority verification gate. Title/ID: m28-state-models Goal: Model and check selected Cohesix authority/state machines. Inputs: Secure9P session semantics, ticket policy, worker lifecycle, policy/audit/replay, persistence spool, driver-task admission, and the accepted 26e MCS scheduling/IPC topology. Changes: - specs/secure9p_session.tla — session/fid lifecycle model. - specs/ticket_authority.tla — issue/use/revoke/deny model. - specs/driver_task_admission.tla — generated resource grant and fail-closed service model. - specs/persistence_spool.tla — crash-safe append/read/ack model. - specs/mcs_reply_donation.tla — SC/Reply ownership, timeout, cancel, fault, revoke, and restart model. Commands: - scripts/ci/verification_gate.sh --models-only Checks: - Models run at documented bounds and counterexamples are either fixed or recorded as blockers. Deliverables: - State-machine model evidence tied to generated Cohesix fields. Title/ID: m28-verification-ci Goal: Add the deterministic formal-verification gate to CI and the staged Test Plan. Inputs: scripts/ci/, docs/TEST_PLAN.md, proof harnesses, witness verifier, HAL checker, model runner. Changes: - scripts/ci/verification_gate.sh — deterministic verification runner. - docs/TEST_PLAN.md — formal-verification stage and evidence paths. Commands: - scripts/ci/verification_gate.sh Checks: - The gate emits stable evidence under `out/verification//` and fails closed on drift, proof failures, or unsupported proof claims. Deliverables: - CI-ready verification baseline that later milestones can cite. Title/ID: m28-nist-assessment-evidence-integrity Milestone: Milestone 28 — Formal Verification Baseline + Proof-Carrying Manifests / NIST assessment-evidence integrity Goal: Reintegrate the dormant NIST harness as a version-pinned, target-qualified assessment-evidence gate over canonical Cohesix claims and Test Plan results. Inputs: tools/security-nist, docs/nist/controls.toml, docs/nist/REPORT.md, docs/SECURITY_NIST_800_53.md, docs/FORMAL_VERIFICATION.md, configs/test_plan_actions.toml, scripts/ci/test_plan_run.sh, scripts/ci/verification_gate.sh, generated manifest witnesses, pinned official NIST SP 800-53/53A/53B and OSCAL release metadata. Changes: - tools/security-nist — validate pinned catalog/baseline provenance, complete tailored LOW-baseline accounting, typed assessment objectives, claim/Test Plan bindings, target/profile and manifest/image identity, evidence freshness, and deterministic Markdown plus OSCAL-compatible output; add unit and negative tests. - docs/nist/controls.toml — add release metadata, tailoring rationale, implementation responsibility, assessment methods/objectives, typed evidence bindings, target classes, and freshness rules without making it a second source of generated Cohesix behavior. - scripts/ci/verification_gate.sh + configs/test_plan_actions.toml — add fast structural/report-drift checks and scheduled/release target-qualified assessment actions with bounded archived evidence. - docs/nist/REPORT.md — regenerate only from the registry and reviewed run artifacts, including explicit gaps, stale/unavailable evidence, non-claims, and the no-certification disclaimer. - docs/SECURITY_NIST_800_53.md + docs/TEST_PLAN.md — document tailoring, assessment cadence, proof-class separation, inherited-control assumptions, report provenance, and the distinction between automated evidence and human review. Commands: - cargo test -p security-nist - scripts/ci/verification_gate.sh --nist-only --state-dir out/verification/m28-nist - scripts/check-generated.sh Checks: - Every control and enhancement in the pinned tailored LOW baseline is explicitly accounted for; unknown, duplicate, omitted, or release-mismatched identifiers fail closed. - Every positive automated objective resolves to a passing named claim or Test Plan action for the exact target/profile and manifest/image identity within its freshness window. - Missing, stale, wrong-profile, inherited-without-provider, documentation-only, and QEMU-for-hardware substitutions remain visible gaps and cannot produce an implemented assessment result. - Consecutive report generation is byte-stable; committed Markdown and machine-readable outputs drift-fail in CI; tests cover malformed registries, stale artifacts, profile mismatches, incomplete baselines, and evidence-strength downgrades. - Reports describe a tailored evidence assessment, never certification, accreditation, authorization, or proof beyond the underlying Cohesix claim. Deliverables: - Tested NIST assessment harness, complete version-pinned LOW registry, deterministic human and machine-readable reports, and archived target-qualified assessment evidence. Title/ID: m28-policy-ir-proof-foundation Milestone: Milestone 28 — Formal Verification Baseline + Proof-Carrying Manifests / restricted policy-IR proof foundation Goal: Define and machine-check the bounded policy fragment and proof vocabulary that Milestone 28a will consume for runtime per-intent admission without issuing runtime authority in 28. Inputs: tools/coh-rtc/src/{ir.rs,lib.rs,codegen/**}, docs/FORMAL_VERIFICATION.md, scripts/ci/verification_gate.sh, generated manifest witnesses, policy fixtures. Changes: - tools/coh-rtc/src/ir.rs + validation/codegen — accepted Boolean, bounded-integer, enum, registry-identifier, bounded-set, linear-comparison, Boolean-composition, and required-fact policy fragment plus deterministic canonicalization and rejection of unsupported constructs. - verification tooling + canonical fixtures — policy consistency, non-vacuity, counterexample, solver/evaluator correspondence, verifier-version, and generated-output drift checks. - docs/FORMAL_VERIFICATION.md + docs/TEST_PLAN.md — proof-versus-witness terminology, evidence classes, checked bounds, trusted checker, assumptions, non-claims, and deterministic CI failure contract. Commands: - cargo test -p coh-rtc - scripts/ci/verification_gate.sh --policy-ir-only --state-dir out/verification/m28-policy-ir - scripts/check-generated.sh Checks: - The accepted fragment and verifier identity are versioned; inconsistent, vacuous, unsupported, or drifted policies fail closed; generated solver constraints and deterministic evaluators pass canonical correspondence vectors. - A decision witness, explanation core, and proof artefact are never conflated, and no 28 output can issue a runtime ticket, lease, provider action, or authority grant. Deliverables: - Checked policy-IR and proof-vocabulary foundation consumed by Milestone 28a per-intent admission. ``` ## Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority [Milestones](#Milestones) **Delivery posture:** Release B, initially limited to consequential actions. The first accepted set is GPU lease, PEFT/model canary, activation or rollback, and explicitly selected service-control actions. Read-only inspection, operator-directed inference in the single-user Release A profile, dry-run, and capsule rendering do not wait for this milestone and cannot claim an admitted autonomous action. New action families require their own authoritative facts, policy, grant ceiling, stale-state behavior, and receipt evidence. **Why now (authority admission bridge):** Milestone 28 supplies the formal-verification vocabulary, generated proof witnesses, selected state models, static checks, verification gates, and the restricted policy-IR proof foundation. Milestone 27a supplies delegated identity, idempotency, writer fencing, durable execution, audit, and replay. Milestone 27b supplies the compiler-owned provider/action registry, authoritative receipt validation, external-executor contracts, identity mapping, and visibility rules. Milestone 27c supplies immutable semantic snapshots and Context Capsules with provenance and visibility controls. Before Milestone 27d permits live AI-supervisor or agent-framework actions, Cohesix needs one reusable bridge from untrusted intent to bounded authority: ```text untrusted intent -> typed intent -> authoritative fact snapshot -> machine-checked policy decision -> state-bound authority grant -> ticket, lease, provider action, or later Worker authority -> authoritative outcome receipt ``` The central rule is that a model, operator, workflow, MCP client, or A2A peer may propose an action, but it must not receive executable authority until the exact typed intent has been evaluated against versioned policy and authoritative current state. This is a Cohesix authority and admission primitive, not generic AI safety middleware. It applies equally to operator automation, GPU leases, remediation, model promotion, inference routing, MCP tools, A2A tasks, and later Worker ticket or lease binding. **As-built alignment note:** Cohesix already has generated policy rules, single-use approvals, capability tickets, host-ticket schemas, provider action allowlists, leases, audit/replay, evidence packs, and target/provider receipts. It does **not** yet have the typed-intent, authoritative-fact-snapshot, seven-verdict admission, decision-witness, or state-bound-grant contracts in this milestone. Existing policy approval, ticket validation, model confidence, provider success, semantic extraction, Context Capsules, or an SMT verdict string must not be relabelled as machine-checked intent admission. This milestone does not place an LLM, SMT solver, general policy engine, graph database, or new protocol inside the VM. **Prerequisites** - The Milestone **28 core**, including `m28-policy-ir-proof-foundation`, completed for the accepted policy fragment, consistency/non-vacuity checks, generated solver/evaluator correspondence evidence, claim vocabulary, verifier identity, and proof-class separation. - The Milestone **27a Release A authority floor** completed for delegated identity, strict idempotency, writer-epoch fencing, durable execution, audit/replay, evidence correlation, and production secret discipline. - The exact Milestone **27b** provider/action rows completed for the selected consequential actions, including external-executor and authoritative-receipt contracts, identity mapping, packaging, and conformance evidence. - The Milestone **27c core** completed only when an action's policy consumes a semantic snapshot or Context Capsule. Semantic snapshot or capsule references remain optional for non-semantic operations and cannot be made a blanket admission prerequisite. **Goal** 1. Convert untrusted requests into bounded, versioned typed intents. 2. Evaluate each typed intent against compiler-owned policy and an exact authoritative fact snapshot. 3. Return exactly one of `proved`, `refuted`, `under_specified`, `inconsistent`, `indeterminate`, `invalid_input`, or `stale_state`. 4. Permit authority issuance only for `proved`. 5. Bind each successful decision to the exact intent, subject, target, policy id/hash, manifest hash, fact snapshot, state epoch, relevant resource generations, requested and granted scopes, expiry, idempotency state, and writer epoch where applicable. 6. Issue authority equal to or narrower than the admitted scope and limits. 7. Preserve Queen/root authority as the final target-side mutation and authority boundary; host admission never creates a parallel executor or target authority path. 8. Produce deterministic evidence reconstructable through audit, replay, evidence packs, timelines, provider receipts, and later Worker receipts. 9. Keep static verification, runtime admission, formal proof artefacts, QEMU, Pi 4 hardware evidence, and host-provider evidence as separate proof classes. **Non-negotiable constraints** - No LLM output is authority. Model confidence is never an admission result. - Caller assertions and model-extracted assertions are not authoritative facts. Context Capsule contents are semantic inputs, not automatically operational facts. - An admission record is not transferable between intents, targets, policies, manifests, subjects, state epochs, resource generations, scopes, or expiries. - An SMT `SAT` or `UNSAT` string from a host process is not sufficient target authority. An unsat core is an explanation artefact; it is not automatically minimal and is not automatically a proof object. - A decision witness, explanation core, and formal proof artefact are distinct evidence classes. Proof claims may not exceed the exact checked artefact and declared checker. - Large solver and model runtimes remain host-side. A target path may use a generated bounded deterministic evaluator or verify a genuinely checkable certificate; it must not blindly trust a host verdict string. - No new console verb, Secure9P verb, in-VM listener, RPC authority path, mutable policy path, or alternate ticket path is introduced. Existing provider, ticket, lease, host-executor, audit, replay, evidence, and Worker authority paths remain canonical. - Missing data, stale state, contradiction, unsupported policy, verifier timeout, verifier `unknown`, verifier failure, resource exhaustion, and malformed input fail closed. - `writer_epoch` identifies the current writer or authority owner. `state_epoch` and resource generations identify the state against which the decision was made. They remain separate fields with separate validation. - QEMU, Pi 4, host provider, static verifier, bounded model-checking, and inherited seL4 evidence remain separate proof classes. ### 1) Canonical intent, fact, decision, witness, and grant contracts **Purpose:** Establish one compiler-owned contract shared by policies, providers, tickets, leases, host tools, later protocols, evidence, and Worker binding. Implementation requirements: - Add versioned schemas or schema families with canonical generated names equivalent to: - `intent-request/v1` - `intent-subject/v1` - `intent-target/v1` - `authoritative-fact/v1` - `authoritative-fact-snapshot/v1` - `policy-evaluation/v1` - `admission-decision/v1` - `decision-witness/v1` - `authority-grant/v1`. - An intent request includes or cryptographically binds `intent_id`, `intent_schema`, `intent_hash`, `subject`, `requested_action`, `target`, `requested_scope`, `requested_limits`, `idempotency_key`, `writer_epoch`, `deadline`, `source_protocol`, and, when relevant, `semantic_snapshot_ref` and `context_capsule_ref`. - An admission decision includes or binds `admission_id`, `intent_hash`, `policy_id`, `policy_version`, `policy_hash`, `manifest_hash`, `fact_snapshot_hash`, `state_epoch`, `resource_generations`, `verdict`, `reason_codes`, `explanation_core`, `proof_artifact_ref`, `requested_scope`, `granted_scope`, `grant_expiry`, and `evidence_class`. - Non-semantic operations must not be forced to invent a semantic snapshot or Context Capsule reference. Unknown optional refs remain absent, not empty evidence. ### 2) Restricted policy IR and generated correspondence **Purpose:** Generate every checked policy representation from one bounded source rather than hand-maintain solver and runtime logic. Implementation requirements: - Initially admit only Booleans, bounded integers, enums, generated registry identifiers, bounded sets, linear comparisons, conjunction, disjunction, negation, and explicit required-fact declarations. - Exclude or defer unrestricted strings, quantifiers, arbitrary code, user-supplied expressions, arbitrary solver theories, dynamic policy execution, and free-form natural-language policy as runtime truth. - One policy source generates or checks the canonical policy representation, host-side solver constraints for consistency checks and counterexamples, deterministic Rust evaluator, target-compatible `no_std` policy tables or evaluator where required, canonical positive/negative vectors, documentation snippets, policy hashes, decision/evidence schemas, and provider-action admission metadata. - Differential/correspondence checks cover every generated representation. Hand-maintained solver logic and runtime evaluator logic may not drift independently. - Establish base-fact and policy consistency before attempting claim proof or refutation. Reject inconsistent or vacuous policy according to the declared policy class and evidence rules. ### 3) Authoritative fact snapshots **Purpose:** Bind admission to current accepted Cohesix state rather than caller or model assertions. Implementation requirements: - Every fact records fields equivalent to `source_id`, `source_class`, `subject_or_resource`, `sequence`, `state_epoch`, `resource_generation`, `observed_at`, `expires_at`, `value`, and `evidence_ref`. - Classify authoritative facts, provider-reported facts, caller assertions, model-extracted assertions, derived facts, unknown facts, stale facts, and contradictory facts without silently promoting one class into another. - Authoritative facts may come from accepted generated manifest state, Worker lifecycle/generation, tickets and leases, policy approvals, provider registry state, validator-accepted provider receipts, GPU/resource inventory, target `/proc` state, configured attestation evidence, and bounded target/provider counters. - A model may propose an intent or extract candidate fields, but it cannot mark those values authoritative. Provider-reported facts become authoritative only through the exact accepted validator/adapter rule for that policy. - Snapshot construction detects missing, wrong-source, forged, stale, reordered, duplicate, wrong-generation, and contradictory facts before evaluation. ### 4) Deterministic verdict engine **Purpose:** Make refusal semantics explicit and prevent solver uncertainty or incomplete information from becoming authority. | Verdict | Required meaning | Authority result | | --- | --- | --- | | `proved` | Available authoritative facts establish the policy predicate. | Grant may proceed. | | `refuted` | Available authoritative facts establish the predicate is false. | Deny. | | `under_specified` | Available facts permit both acceptance and rejection. | Deny. | | `inconsistent` | Base facts or policy assumptions conflict. | Deny. | | `indeterminate` | Timeout, unsupported fragment, solver unknown, verifier failure, or resource bound. | Deny. | | `invalid_input` | Intent, facts, policy selection, or bounds are malformed. | Deny. | | `stale_state` | Relevant state changed or expired before grant or execution. | Deny or re-evaluate. | Only `proved` may lead to a grant. The engine first checks base-fact and policy consistency, then evaluates proof/refutation/under-specification. It must not collapse results into an incorrect three-state partition. ### 5) State-bound authority issuance **Purpose:** Prevent a correct decision over old state from becoming authority over new state. Implementation requirements: - Use an atomic or state-bound pattern appropriate to the action: ```text evaluate + reserve + issue ``` ```text evaluate -> compare-and-swap against state/resource generation -> issue ``` ```text evaluate -> recheck bounded runtime predicates -> issue or execute ``` - Enforce invariants equivalent to: ```text grant.scope <= admitted.scope grant.target = admitted.target grant.subject = admitted.subject grant.policy_hash = admitted.policy_hash grant.intent_hash = admitted.intent_hash grant.state_epoch = admitted.state_epoch grant.resource_generation = admitted.resource_generation grant.expiry <= admitted.expiry ``` Here `<=` means set/subscope containment, not string-prefix matching. - If relevant state changes, the grant fails, expires, or is re-evaluated. A successful decision cannot be replayed against a different resource generation. - Queen/root remains the final target-side mutation and authority boundary. Host-side admission authorizes only the existing bounded ticket, lease, or provider-action path selected by the generated registry. ### 6) Decision evidence, audit, replay, and receipts **Purpose:** Extend the existing Cohesix evidence graph instead of creating a second admission ledger. Terminology is normative: - **Decision witness:** canonical facts, policy identity, bindings, result, and state needed to reproduce the decision. - **Explanation core:** a bounded subset of relevant assertions or predicates explaining denial, contradiction, or inconsistency. It need not be minimal. - **Proof artefact:** an independently machine-checkable derivation accepted by a declared checker. Do not call every admission result a proof. “Proof-Carrying Intent” may be used as an external description only for policy classes that actually carry an independently checked proof artefact; the normative primitive remains Machine-Checked Intent Admission. Evidence reconstructs: ```text caller -> typed intent -> authoritative facts -> policy identity -> admission decision -> authority grant -> provider, executor, or Worker outcome ``` Integrate admission records with `/audit/decisions`, `/replay/*`, evidence packs, evidence timelines, host-ticket receipts, provider/executor receipts, inference receipts, later Worker receipts, and applicable NIST/assurance evidence refs. Secrets, raw tickets, provider credentials, and sensitive payloads remain redacted. Tamper, proof-reference mismatch, missing predecessor, and identity mismatch fail verification. ### 7) Bounded reference admission actions **Purpose:** Prove the contract on one resource-allocation action and one host remediation action before later consumers broaden adoption. #### GPU lease admission - Check that the selected Worker or provider is ready; the requested GPU or accelerator exists; inventory generation is current; no conflicting lease exists; memory/capacity and duration are within limits; subject quota is sufficient; model/workload/action class is approved; and ticket/lifecycle scopes are valid. - Reconstruct `intent -> GPU/Worker/inventory/quota/lease facts -> admission decision -> lease grant -> provider execution or lease observation -> provider and, where applicable, Worker receipt`. #### Bounded host remediation - Use the existing allowlisted `systemd.restart` provider action; never accept an arbitrary shell command. - Check that the unit is registered and allowlisted, subject remediation scope is sufficient, provider state is fresh, unit state permits restart, restart budget is not exhausted, maintenance/policy window permits the action, writer epoch is current, and target generation has not changed. ### 8) Security, performance, and documentation ownership **Purpose:** Bound abuse and record exact implementation ownership without promoting planned documentation to as-built state. Implementation requirements: - Measure policy evaluation, fact snapshot construction, state recheck or reservation, grant issuance, evidence emission, solver/verifier overhead, and target evaluator overhead separately. - Do not classify host admission measurements as Pi hardware throughput proof unless the exact Pi target path is exercised with fresh evidence. - Negative tests cover prompt injection, caller claims marked authoritative, untrusted policy selection, arbitrary expression injection, oversized/fact- count overflow, contradictory/stale/reordered facts, decision replay, grant widening, proof substitution, solver timeout, verifier crash, target/host disagreement, and secret leakage. - Implementation tasks later update `docs/ARCHITECTURE.md`, `docs/INTERFACES.md`, `docs/SECURITY.md`, `docs/FORMAL_VERIFICATION.md`, `docs/ROLES_AND_SCHEDULING.md`, `docs/WORKER_TICKETS.md`, `docs/TEST_PLAN.md`, `docs/BENCHMARKS.md`, `docs/HOST_API.md`, `docs/HOST_TOOLS.md`, and `docs/PYTHON_SUPPORT.md` as their owned surfaces land. This planning edit does not claim those documents are already updated. **Deferred consumers** - Milestone **27d** owns admission for AI runs, PEFT, model promotion, checkpoints, prefixes, and agent-supervisor actions. - Milestone **27e** owns inference-request, provider/model routing, and inference-receipt admission. - Milestone **28c** owns MCP/A2A projection of admitted actions. - Milestone **28b** owns production binding from an admission decision to the live Worker ticket/lease, capability bundle, generation, fault lifecycle, and quarantine state. Milestone 28a alone is not production Worker authority proof. - Milestone **30b** owns bounded read-only namespace projections of admission state and adds no AI-specific write path. **Commands** - `cargo test -p coh-rtc` - `cargo test -p host-ticket-agent` - `cargo test -p coh --test admission_evidence` - `python3 -m pytest -q tools/cohesix-py/tests/test_admission.py` - `scripts/ci/verification_gate.sh --policy-ir-only --state-dir out/verification/m28a-policy` - `scripts/ci/admission_conformance_run.sh --state-dir out/admission/m28a` - `scripts/ci/admission_perf_probe.sh --state-dir out/bench/m28a-admission` - `scripts/check-generated.sh` - `scripts/ci/test_plan_run.sh --state-dir out/test-plan/m28a-admission` **Checks (Definition of Done)** - One compiler-owned intent, fact, policy, decision, witness, and grant contract is consumed by Rust, Python, providers, host tools, evidence, and later protocol projections. - Identical admitted inputs produce byte-identical decisions and deterministic evidence outputs. - Unsupported, stale, inconsistent, malformed, unknown, and under-specified cases fail closed; only `proved` creates a grant. - Grants cannot exceed the admitted action, scope, target, subject, limits, or expiry, and a state/resource generation change prevents stale issuance. - The target does not blindly trust host verdict text. Solver constraints and runtime evaluators derive from one restricted IR and pass correspondence checks. - Every authoritative fact has source, sequence, freshness, generation, and evidence metadata. Caller/model assertions remain non-authoritative unless a generated policy explicitly admits that assertion class as a non-operational input; it cannot silently upgrade it to an authoritative fact. - GPU lease and bounded `systemd.restart` admission pass end to end with exact state-generation binding, provider receipt correlation, deterministic denial, and stale-state cases. - Evidence packs and timelines reconstruct the intent-to-outcome chain without conflating decision witness, explanation core, and proof artefact. - No new in-VM solver, LLM, listener, protocol, provider runtime, shell executor, mutable policy engine, or alternate authority path is introduced. - No current or planned feature becomes implemented, accepted, target- qualified, or production-proven merely because this plan exists. **Compiler touchpoints** - Extend the current `tools/coh-rtc/src/ir.rs`, `lib.rs`, and `codegen/{rust,coh,cohesix_py,docs}.rs` structure with the restricted policy, intent, fact, decision, witness, grant, provider-admission metadata, validation, hashes, fixtures, and deterministic generated outputs. A later internal module split must not create a second source of truth. - Generated Rust and target-required tables remain `no_std`; host solver and verifier adapters remain host-side. - Validation rejects unknown schemas/facts/policies/actions, unsupported fragments, caller-selected policy authority, policies whose required-fact declarations are missing or inconsistent, decision/grant substitution, scope widening, stale generations, duplicate authority, hand-edited generated output, and provider actions lacking an accepted admission policy. At runtime, an absent declared fact produces the specified fail-closed `under_specified`, `invalid_input`, or `stale_state` verdict according to the exact schema/state condition; it is never silently assumed. - Generated admission records extend the existing 27b `host-integration-dependency/v1`, provider/action, authoritative-receipt, and evidence graphs. They do not create parallel policy, provider, or evidence registries. **Task Breakdown** ``` Title/ID: m28a-intent-policy-ir Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / compiler-owned intent and policy contracts Goal: Define compiler-owned intent, subject, target, fact, policy-evaluation, admission-decision, decision-witness, and authority-grant schemas. Inputs: accepted m28-policy-ir-proof-foundation, tools/coh-rtc/src/{ir.rs,lib.rs,codegen/**}, 27a authority records, 27b provider/action registry, 27c semantic/capsule schemas, docs/INTERFACES.md, docs/SECURITY.md. Changes: - tools/coh-rtc/src/ir.rs + validation/codegen — versioned bounded schema families, canonical hashes, required/optional semantic refs, provider admission metadata, Rust/Python/manifest/docs outputs, and negative validation. - generated Rust/Python/docs fixtures — canonical valid, malformed, unsupported, cross-policy, cross-target, and cross-subject vectors without hand-edited generated catalogs. - docs/INTERFACES.md + docs/SECURITY.md — implementation-stage schema, authority, redaction, and refusal contract. Commands: - cargo test -p coh-rtc - scripts/check-generated.sh Checks: - All schema ids, fields, bounds, hashes, and provider mappings are compiler-owned; unknown, malformed, overbroad, caller-selected-policy, or drifted records fail closed. Deliverables: - One generated intent-to-grant contract for all later consumers. Title/ID: m28a-authoritative-fact-snapshots Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / authoritative fact snapshots Goal: Bind policy inputs to exact source, sequence, state epoch, resource generation, TTL, provenance, and evidence class. Inputs: m28a-intent-policy-ir, generated manifest/lifecycle/ticket/lease/provider registries, accepted provider receipts, target `/proc` fixtures, attestation and bounded-counter fixtures. Changes: - admission core fact modules + generated source registry — canonical fact ingestion, source/sequence/freshness/generation checks, deterministic snapshots, contradiction detection, and evidence refs. - canonical fixtures — authoritative, asserted, derived, unknown, stale, contradictory, missing, wrong-source, wrong-generation, forged, duplicate, and reordered facts. - docs/ARCHITECTURE.md + docs/SECURITY.md + docs/TEST_PLAN.md — source authority, freshness, contradiction, redaction, and evidence-class rules. Commands: - cargo test -p cohesix-admission-core --test facts - scripts/ci/admission_conformance_run.sh --only facts --state-dir out/admission/m28a-facts Checks: - Only registered accepted sources can supply authoritative facts; every snapshot is deterministic and binds source, sequence, epoch, generation, expiry, and evidence; forged or ambiguous provenance fails closed. Deliverables: - Reconstructable authoritative fact snapshots that never promote caller/model assertions. Title/ID: m28a-policy-compiler-and-evaluator Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / policy compiler and deterministic evaluator Goal: Generate host solver constraints, deterministic Rust and target-compatible evaluators, canonical fixtures, policy hashes, and correspondence checks from one restricted IR. Inputs: m28-policy-ir-proof-foundation, m28a-intent-policy-ir, tools/coh-rtc, verifier adapters, canonical policy fixtures. Changes: - tools/coh-rtc/src/ir.rs + codegen — restricted policy AST, required-fact declarations, canonicalization, hashes, host constraints, deterministic Rust/`no_std` tables, docs, and positive/negative vectors. - verification tooling — consistency, non-vacuity, unsupported-fragment, counterexample, differential, and target/host correspondence checks. - generated-output guard — reject hand-edited solver constraints, evaluator tables, hashes, docs, and vectors. Commands: - cargo test -p coh-rtc - scripts/ci/verification_gate.sh --policy-ir-only --state-dir out/verification/m28a-policy - scripts/check-generated.sh Checks: - Generated outputs agree for every canonical vector; solver/evaluator disagreement, unsupported fragment, vacuous or inconsistent policy, and hand-edited output fail deterministically. Deliverables: - One restricted policy source with checked host and target representations. Title/ID: m28a-admission-verdict-engine Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / seven-verdict admission engine Goal: Implement all seven verdict classes with deterministic fail-closed semantics. Inputs: m28a-authoritative-fact-snapshots, m28a-policy-compiler-and-evaluator, canonical intent/fact/policy vectors. Changes: - crates/cohesix-admission-core/src/{evaluate,verdict}.rs — base consistency, proof, refutation, under-specification, invalid-input, indeterminate, and stale-state evaluation with bounded reason codes. - host and target evaluator fixtures — deterministic verdict, timeout, unknown, verifier-failure, and resource-bound parity. - docs/FORMAL_VERIFICATION.md + docs/INTERFACES.md — verdict meaning, checker identity, witness/proof distinction, and non-claims. Commands: - cargo test -p cohesix-admission-core --test verdicts - scripts/ci/admission_conformance_run.sh --only verdicts --state-dir out/admission/m28a-verdicts Checks: - Base inconsistency, proof, refutation, under-specification, timeout/unknown, invalid input, and stale state map to exactly the declared verdict; only `proved` can proceed to issuance. Deliverables: - Deterministic seven-verdict engine with bounded refusal evidence. Title/ID: m28a-decision-bound-authority Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / state-bound grant issuance Goal: Bind proved decisions to exact tickets, leases, provider actions, targets, scopes, epochs, generations, expiries, idempotency keys, and writer epochs. Inputs: m28a-admission-verdict-engine, 27a idempotency/fencing/WAL records, 27b provider registry, ticket/lease schemas, Queen/root mutation paths. Changes: - admission grant/reservation modules + host-ticket-agent integration — evaluate/reserve/CAS/recheck patterns, scope containment, exact target/subject/policy/intent binding, expiry, idempotency, writer/state epoch separation, and stale-generation refusal. - canonical race/replay fixtures — evaluation-to-grant races, duplicate requests, writer failover, target/subject substitution, scope widening, expired decisions, and cross-resource replay. - docs/ROLES_AND_SCHEDULING.md + docs/WORKER_TICKETS.md + docs/SECURITY.md — grant/ticket distinction and final Queen/root authority boundary. Commands: - cargo test -p cohesix-admission-core --test grants - cargo test -p host-ticket-agent - scripts/ci/admission_conformance_run.sh --only grants --state-dir out/admission/m28a-grants Checks: - Scope widening, target/subject substitution, expired decision, stale generation, duplicate request, stale writer, issuance race, and replay against another resource fail before authority is created. Deliverables: - State-bound grants that can authorize only existing canonical authority paths. Title/ID: m28a-evidence-replay-and-proof-claims Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / evidence, replay, and proof claims Goal: Add decision witnesses, explanation cores, optional proof references, audit/replay correlation, evidence-pack integration, and exact evidence classifications. Inputs: m28a-admission-verdict-engine, m28a-decision-bound-authority, 27b receipt/evidence core, apps/coh/src/{evidence.rs,evidence_timeline.rs}, `/audit/decisions`, `/replay/*`, NIST/assurance claim registry. Changes: - admission evidence core — canonical witness/explanation/proof-ref records, predecessor hashes, redaction, deterministic rendering, and tamper verification. - apps/coh/src/{evidence.rs,evidence_timeline.rs} — caller-to-intent-to-facts-to-policy-to-decision-to-grant-to-outcome reconstruction using existing evidence packs/timelines. - docs/FORMAL_VERIFICATION.md + docs/TEST_PLAN.md + docs/BENCHMARKS.md — evidence classes, proof wording, reconstruction, redaction, and performance/non-claim lanes. Commands: - cargo test -p coh --test admission_evidence - scripts/ci/admission_conformance_run.sh --only evidence --state-dir out/admission/m28a-evidence Checks: - Witness reconstruction, tamper detection, proof-reference mismatch, non-minimal explanation-core handling, redaction, and deterministic evidence output pass; no ordinary decision is mislabeled as a formal proof. Deliverables: - Admission evidence integrated with the existing audit/replay/evidence graph. Title/ID: m28a-reference-admission-actions Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / bounded reference actions Goal: Prove GPU lease admission and one allowlisted `systemd.restart` remediation action end to end. Inputs: all prior m28a tasks, 27b `gpu.lease.grant` and `systemd.restart` provider-action records, GPU/Worker/inventory/quota/lease fixtures, host-ticket-agent, provider receipts. Changes: - reference policy records and fixtures — exact GPU lease and systemd restart required facts, scopes, quotas, generations, reservations/rechecks, and deterministic denial cases. - host-ticket-agent/provider integration — admitted existing actions only, with exact decision/grant ids and provider receipt correlation; no direct executor bypass or arbitrary shell. - evidence acceptance lane — mock/fixture plus host-safe live or dry-run evidence where appropriate, keeping provider and target evidence classes separate. Commands: - cargo test -p host-ticket-agent --test admission_actions - scripts/ci/provider_conformance_run.sh --provider gpu.lease.grant,systemd.restart --admission --state-dir out/provider-conformance/m28a-actions - scripts/ci/admission_conformance_run.sh --only reference-actions --state-dir out/admission/m28a-actions Checks: - Both actions preserve exact state-generation binding, provider receipt correlation, deterministic denial/stale-state behavior, and existing executor paths; no direct provider or Worker bypass exists. Deliverables: - Two bounded end-to-end reference flows proving resource and remediation admission. Title/ID: m28a-admission-security-and-performance Milestone: Milestone 28a — Machine-Checked Intent Admission + Decision-Bound Authority / security and performance acceptance Goal: Add targeted abuse-resistance, correspondence, performance, package, and release gates for machine-checked admission. Inputs: all m28a tasks, canonical negative corpus, scripts/ci/admission_{conformance_run,perf_probe}.sh, docs/TEST_PLAN.md, docs/BENCHMARKS.md, package/evidence manifests. Changes: - admission security corpus — injection, forged authority, untrusted policy selection, arbitrary expression, oversized/overflow/contradictory/reordered facts, replay, widening, proof substitution, timeout/crash, host/target disagreement, and secret leakage. - scripts/ci/admission_perf_probe.sh — separate fact, evaluation, reservation/recheck, grant, evidence, solver/verifier, and target-evaluator timing/size metrics. - docs/TEST_PLAN.md + docs/BENCHMARKS.md + package/release checks — acceptance gates, exact evidence paths, thresholds, proof-class separation, and host/Pi non-claims. Commands: - scripts/ci/admission_conformance_run.sh --state-dir out/admission/m28a - scripts/ci/admission_perf_probe.sh --state-dir out/bench/m28a-admission - scripts/ci/test_plan_run.sh --state-dir out/test-plan/m28a-admission - scripts/check-generated.sh Checks: - Security corpus fails closed, generated host/target decisions correspond, performance stages are separately bounded, packages contain exact generated contracts/checkers, and no host result is promoted to Pi or formal-proof evidence. Deliverables: - Accepted, bounded, abuse-resistant admission primitive ready for 27d-28b and 30b consumers. ``` **Outcome** After Milestone 28a: - Untrusted AI and non-AI requests can be converted into typed intents and checked against versioned policy plus authoritative current state. - Only `proved` decisions can create state-bound grants, and those grants are no broader or longer-lived than the exact admitted intent. - Tickets, leases, provider actions, Queen/root mutation, receipts, audit, replay, and evidence remain the canonical execution and evidence paths. - Decision witnesses make admission reproducible without pretending every result is a formal proof. - Later milestones can adopt one admission primitive without inventing AI-specific guardrails, protocol-specific policy evaluators, or parallel authority registries. ## Milestone 28b — Production Worker Ticket/Lease Binding + Driver Inventory Projection + Structured Fault Lifecycle [Milestones](#Milestones) **Delivery posture:** Release B production-assurance gate. It is mandatory only for profiles claiming one-to-one decision/ticket/lease binding to live seL4 Worker bundles, complete driver-inventory projection, structured quarantine, or fresh-ticket restart. It does not block the accurately labelled Release A host-only/operator-directed workflow. **Why now (production authority binding):** Milestone 26e already creates, contains, faults, completely tears down, and recreates the full minimum task bundle for every executable Heartbeat/GPU/LoRA Worker. Milestone 27a makes host/gateway writes attributable, idempotent, fenced, durable, and audit-first. Milestone 26e also establishes the baseline linked-driver containment contract, and Milestone 29 may add an independently accepted `driver-storage` bundle under that same contract. The remaining VM-side production concern is to bind the 28a-admitted action to the proven Worker bundles through production ticket/lease ledgers, project every selected accepted driver authority inventory through manifest runtime-instance ledgers, and add quarantine policy plus bounded evidence. Drivers never receive or own tickets. This milestone closes that ledger/projection gap; it does not retroactively supply security properties needed by a live 26e Worker/baseline driver or a selected Milestone 29 storage runtime. **Prerequisites** - Milestone **26e**, including `m26e-driver-runtime-mcs-port-and-cyw43-coexistence`, `m26e-worker-supervisor-child-isolation`, `m26e-host-worker-integration`, `m26e-worker-target-evidence-promotion`, and `m26e-root-tcb-target-proof`, completed for Heartbeat/GPU/LoRA with complete instance bundles, live badged telemetry IPC, durable completion, full teardown, fresh supervisor-generation recreation, host integration, and exact QEMU/Pi evidence; linked drivers have complete MCS authority and containment inventories. The inactive historical `m26c-cap-backed-worker-endpoints` proposal and current model-only profiles do not satisfy this prerequisite. - Milestone 26e task `m26e-mcs-smp-target-acceptance` completed; all cap bundles extend the accepted SMP+MCS task topology and may not introduce a second scheduler architecture. - For a persistence-enabled profile, Milestone **29** completed with accepted `driver-storage` generation-keyed authority inventory, basic fault/timeout containment, complete teardown, and fresh-generation readmission evidence. A disabled persistence profile has no storage-runtime ledger row; a configured or merely packaged runtime cannot satisfy this prerequisite. - Milestone **26d** seL4 baseline refresh completed for the selected profiles, so CSpace/VSpace/syscall assumptions match the accepted seL4 generated artifacts. - Milestone **27a** completed, including audit/replay defaults and generated gates that distinguish host authority records from VM cap-backed tickets. - Milestone **27b** completed for the provider/integration dependency graph, external-executor classifications, exact package manifests, and stable use-case rows that will consume production Worker-bundle bindings. A PEFT/AI row additionally requires the applicable Milestone **27d** live pipeline evidence; a row claiming semantic context or compatible inference additionally requires the applicable accepted Milestone **27c** and **27e** evidence. - Milestone **28a** completed for any production Worker ticket/lease action, including the accepted admission id, decision witness hash, intent/policy hashes, state epoch, Worker/resource generation facts, and state-bound grant. **Production authority gate:** Accepted owner-milestone evidence is sufficient to claim the matching live Worker/driver cap bundles and basic containment (26e for Workers/baseline drivers and 29 for a selected storage runtime). Milestone 28b is additionally mandatory only when a production profile claims one-to-one Worker ticket/lease-to-bundle ledger binding, complete driver-inventory ledger projection, structured quarantine/evidence, or fresh-ticket Worker restart. Read-only, host-ticket-only, gateway, and accepted owner-milestone task/driver projections may proceed without 28b when they avoid those stronger production-ledger claims. When 28b is selected, it extends the existing `host-integration-dependency/v1` and use-case records with `m28b_production_bundle` evidence; it does not create a separate lifecycle catalog or promote provider/external-executor support by itself. **Goal** Bind production Worker tickets/leases one-to-one to accepted live seL4 bundles, bind each admitted action to the exact decision and state against which it was approved, project each already-complete driver bundle through manifest runtime-instance, scheduler, supervisor, and cap-generation ledgers without inventing driver tickets; and convert already-contained Worker/driver faults into structured terminal/quarantine evidence with fresh-ticket Worker restart and fresh driver runtime-generation recovery policy. Publish those bindings into the shared integration/use-case evidence graph so host tools can distinguish a 26e executable Worker from a 28b production-bound bundle without inferring either from a ticket, provider receipt, or UI state. **Non-Goals (Explicit)** - No change to REST delegated identity, host-ticket action semantics, MCP/A2A protocol surfaces, or AI run control. - No change to semantic object/Context Capsule or inference contracts, and no inference receipt, capsule ref, provider receipt, or semantic object implies a VM cap-backed Worker binding. - No new VM protocol, console grammar, Secure9P verb, or root-owned physical-driver path. - No claim that host tickets, REST delegated tickets, provider tickets, or PEFT receipts are seL4 cap-backed unless a generated VM projection explicitly maps them to live caps. - No driver ticket or lease material. Host/provider tickets may authorize a root-projected driver action, but a driver runtime receives only its generated manifest identity, runtime generation, resource descriptors, and MCS/IPC caps. - No second Worker constructor, CSpace/VSpace loader, scheduler architecture, basic fault endpoint, or revocation path. 28b reuses the accepted 26e supervisor bundle and teardown implementation. - No CYW43/SDIO timing, retry, state-machine, restart, packaging, ownership, or evidence-classification change. Driver authority may be ledger-bound only as already generated and accepted. **Deliverables** - Generated production binding records map each active Worker ticket/lease, role, slot, lease epoch, supervisor generation, scheduler generation, and fault identity to exactly one accepted 26e instance bundle. Each admitted Worker action additionally correlates `admission_id`, `decision_witness_hash`, `intent_hash`, `policy_hash`, `state_epoch`, `worker_generation`, `ticket_or_lease_id`, and `cap_bundle_generation`. WorkerBus remains model-only and has no production VM bundle. - Generated driver records map manifest runtime identity plus runtime, scheduler, supervisor, and cap-bundle generations to the already accepted endpoint, notification, fault/timeout, SC/Reply, IRQ, shared-ring, data-frame, MMIO, DMA, and shared-buffer authority applicable to each linked runtime. They contain no ticket/lease credential, and SchedControl remains root-only. - Root-task reuses the sole 26e constructor/teardown and retained origin caps; it never creates a parallel Worker CSpace/VSpace path or hands out catch-all root, namespace, frame, device, or scheduling authority. - Production fault handling records bounded evidence, invokes the complete 26e Worker teardown or accepted driver containment path, marks the exact Worker ticket/lease or driver manifest-runtime ledger entry terminal or quarantined, and rejects late IPC, timeout events, ring turns, telemetry, and receipts from the old ledger generation. - Worker restart is allowed only through a new ticket, lease epoch, supervisor generation, and cap-bundle binding. Driver recovery uses a fresh admitted manifest runtime/cap generation and the accepted containment/reconstruction path, never a ticket. Neither may silently reuse a stale TCB, cap, Reply relationship, SC, DMA mapping, shared frame, or ring. - Milestone 28a proves admission against policy and state. This milestone binds that decision to the actual live Worker bundle, ticket/lease, capability generation, fault lifecycle, and quarantine state. A 28a decision alone is not production Worker authority proof, and any changed Worker or resource generation invalidates it. - Emit `worker-bundle-binding` integration evidence for Heartbeat/GPU/LoRA with target/image/manifest hashes, ticket/lease identity, Worker slot, lease epoch, supervisor/scheduler/cap generations, terminal/quarantine state, and the corresponding 26e component/integration evidence refs. Provider/executor results remain separate referenced records. - Re-evaluate only the use-case rows that explicitly require `m28b_production_bundle`. A live 28b binding cannot promote a row whose semantic/capsule, inference, CUDA, PEFT, FUSE, Kubernetes, federation, package, identity, recovery, or other host dependency is missing or non-live. **Commands** - `cargo test -p root-task --tests cap_bundle` - `cargo test -p root-task --tests fault` - `cargo test -p root-task --test fault_recovery_timing` - `cargo test -p pi4-driver-abi` - `cargo test -p pi4-driver-runtime` - `cargo test -p worker-heart` - `cargo test -p worker-gpu` - `cargo test -p worker-lora` - `cargo test -p coh --test evidence` - `cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json` - `scripts/check-generated.sh` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m28b-qemu-cap-bundles` - `scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m28b-pi4-cap-bundles` **Checks (DoD)** - Production Worker ticket/lease profiles fail generation if any executable Worker metadata scope lacks the corresponding one-to-one accepted live-bundle binding. Complete driver-inventory profiles fail if any admitted manifest runtime lacks its generation-keyed accepted inventory; no driver ticket is generated or delivered. - Any admitted Worker action fails before invocation when its `admission_id`, decision-witness, intent/policy hash, state epoch, Worker generation, ticket/lease id, or cap-bundle generation is missing, mismatched, expired, or stale. - Production profiles that expose AI, MCP/A2A, provider, or driver-runtime projections may cite matching accepted owner-milestone live authority, but fail if they claim 28b Worker ledger binding, complete driver-inventory projection, or structured quarantine without the corresponding 28b evidence. - Host tools, REST/FUSE/Python/UI/MCP/A2A projections, release manifests, and use-case rows consume the same generated 28b bundle-binding record and cannot synthesize production Worker state from tickets, semantic objects, Context Capsules, inference receipts, model entries, registry publication, or provider receipts. - Revoked Worker tickets lose their bound endpoint, notification, scheduling-context, timeout/fault cap, frame, and shared authority. The root-fault-owned Reply lane is not Worker-ticket authority; any association for the faulting generation is resolved separately before reuse. Quarantined driver runtime generations lose endpoint, notification, SC/Reply, timeout/fault, ring, frame, IRQ, MMIO, DMA, and shared-buffer authority; stale invocations, timeout events, and ring turns fail deterministically. - Recovery reconciles Worker ticket/lease ledgers and ticket-free driver manifest-runtime ledgers with the accepted owner-milestone object state so no active Worker ticket exists without exactly one live Worker bundle, no admitted driver ledger entry lacks its exact live bundle, and neither kind of bundle remains after its ledger entry becomes terminal. - Fault badges deterministically identify the Worker role/instance/logical lease epoch/cap-bundle generation or the driver role/manifest-runtime instance/ runtime generation/cap-bundle generation, without treating a driver as a ticket subject. - Fault handling revokes old caps, rejects stale shared-ring turns and telemetry, and requires fresh Worker ticket/lease binding or fresh admitted driver runtime generation before restart/recovery. - No root-fault or driver-command Reply association, and no donated scheduling context, is stranded or reused across a lease epoch, quarantine, revoke, or restart; SchedControl is never delegated. - Fault evidence is bounded, redaction-safe where needed, included in evidence packs, and does not alter console grammar or Secure9P framing. - Within a profile claiming 28b production-ledger authority, an executable Worker has no metadata-only or 26c endpoint-only fallback. A valid 26e-only executable profile remains a distinct supported tier when it makes no 28b ticket/lease-ledger or quarantine claim. The only non-executable state is explicitly model/session-only; it cannot claim live VM caps, faults, or Worker receipts. - Fault/revoke timing evidence stays bounded for representative worker and driver fault cases; material regressions are classified as cap-revocation, evidence-export, restart-policy, or driver-runtime recovery overhead before production profiles depend on structured fault recovery. **Compiler touchpoints** - `coh-rtc` emits production ticket/lease bindings to accepted 26e Worker bundle templates and separate ticket-free manifest-runtime bindings to complete generated driver inventories including SC/Reply/timeout/MMIO/DMA ownership, scheduler/supervisor/runtime generations, revoke/recovery evidence, production enablement gates, terminal/quarantine policy, and bounded fault evidence paths. SchedControl is never emitted to a child bundle. - `coh-rtc` extends those Worker bindings with the accepted 28a admission and decision-witness correlation fields while keeping provider admission, Worker ticket/lease identity, and live seL4 cap authority as distinct records. - `coh-rtc` emits explicit profile-state distinctions for read-only projection, host-ticket-only actuation, model/session-only roles, 26e isolated-task and linked-driver authority, conditional accepted Milestone 29 storage-runtime authority, 28b production Worker ticket/lease binding, complete driver-inventory projection, and structured quarantine. No active profile consumes the inactive 26c endpoint-only proposal as a compatibility floor or treats a driver as a ticket subject. - `coh-rtc` extends the 27b integration/use-case graph with generated 28b Worker-bundle binding and quarantine evidence requirements; it never changes provider/external-executor observed mode or use-case maturity without all other dependency rows passing. - Generated snippets refresh `docs/WORKER_TICKETS.md`, `docs/SECURITY.md`, `docs/HARDWARE_BRINGUP.md`, `docs/INTERFACES.md`, and `docs/TEST_PLAN.md`. **Task Breakdown** ``` Title/ID: m28b-production-worker-ticket-driver-inventory Milestone: Milestone 28b — Production Worker Ticket/Lease Binding + Driver Inventory Projection + Structured Fault Lifecycle / production live-bundle ledger binding Goal: Bind each production Worker ticket/lease to exactly one accepted 26e live bundle and project each selected accepted driver bundle through a ticket-free manifest-runtime ledger without reconstructing either task path or retaining metadata-only compatibility authority. Inputs: accepted 26e Worker and linked-driver bundle/inventory/integration evidence records, conditional accepted Milestone 29 storage-runtime bundle/inventory evidence, accepted 28a decision/grant/witness records, 27b host-integration and use-case registries, apps/root-task/src/lifecycle.rs, apps/root-task/src/hal/**, apps/root-task/src/generated/**, apps/root-task/src/ninedoor.rs, tools/coh-rtc/src/**, scripts/ci/use_case_gate.sh, docs/WORKER_TICKETS.md, docs/SECURITY.md, docs/HARDWARE_BRINGUP.md, docs/TEST_PLAN.md Changes: - tools/coh-rtc/src/** — bind production Worker tickets/leases to the exact accepted 28a admission id, decision-witness hash, intent/policy hashes, state epoch, Worker generation, ticket/lease id, cap-bundle generation, and complete accepted 26e endpoint, lifecycle/completion notification, active SC, standard/timeout fault, frame, image, supervisor-generation, and revoke inventory. Separately project each selected accepted driver endpoint/notification/SC/Reply/fault/ring/frame/IRQ/MMIO/DMA/shared-buffer inventory, including a selected Milestone 29 storage runtime, by owner milestone, manifest runtime identity, and generation; generate no driver ticket/lease field and keep SchedControl root-only. - apps/root-task/src/lifecycle.rs + apps/root-task/src/hal/** — reuse the sole 26e Worker constructor and accepted driver admission/containment contract, origin caps, and complete teardown for baseline and Milestone 29 storage runtimes; attach Worker live-bundle identity to the production ticket ledger and driver live-bundle identity to the manifest-runtime ledger without creating a second CSpace/VSpace, runtime descriptor, or scheduler path. - apps/root-task/src/ninedoor.rs + apps/root-task/src/event/** — reconcile Worker ticket ledgers and driver manifest-runtime ledgers with accepted live bundle state, refuse metadata-only production authority, and ensure host/provider tickets authorize only root-projected driver actions rather than entering a driver descriptor. - tools/coh-rtc/src/codegen/** + scripts/ci/use_case_gate.sh — emit and consume 28b `worker-bundle-binding` integration evidence and promote only use-case rows whose remaining host/provider/executor/package dependencies also pass. - docs/WORKER_TICKETS.md + docs/SECURITY.md + docs/HARDWARE_BRINGUP.md + docs/TEST_PLAN.md — document separate Worker-ticket and ticket-free driver-ledger semantics, production profile gates, revoke/recovery behavior, and negative tests. `pi4-driver-abi`, `pi4-driver-runtime`, and Worker source are regression inputs only and are not changed by this task. Commands: - cargo test -p root-task --tests cap_bundle - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - cargo test -p worker-heart - cargo test -p worker-gpu - cargo test -p worker-lora - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh - scripts/ci/use_case_gate.sh --promote-milestone 28b --matrix configs/generated/use_case_evidence.json --state-dir out/use-case-gate/m28g Checks: - Production Worker ticket profiles fail if any executable Worker lacks a one-to-one accepted live-bundle binding; driver-inventory profiles fail if any admitted manifest runtime lacks its generation-keyed complete accepted inventory; any generated/delivered driver ticket field fails validation. - A decision whose Worker/resource, ticket/lease, state, or cap-bundle generation changed is rejected; 28a admission evidence alone cannot satisfy live-bundle or quarantine proof. - Revoked Worker tickets lose their exact bound authority; quarantined driver runtime generations lose their exact endpoint/notification/SC/Reply/fault/ring/frame/IRQ/MMIO/DMA/shared authority; stale invocations, timeout events, and ring turns fail deterministically. - Recovery reconciles both ledger kinds with existing object state so no active Worker ticket or admitted driver generation lacks exactly one live bundle and no terminal entry retains one. - Host projections consume the exact binding record, and no use case is promoted by a Worker binding when any independent host integration row is missing, fixture, mock, dry-run, disabled, unknown, or otherwise below its required mode. Deliverables: - Production-grade Worker cap-backed ticket authority plus a complete ticket-free driver inventory projection bound to each runtime's accepted owner-milestone seL4 bundle. Title/ID: m28b-structured-fault-lifecycle Milestone: Milestone 28b — Production Worker Ticket/Lease Binding + Driver Inventory Projection + Structured Fault Lifecycle / structured quarantine and fresh-generation restart Goal: Project already-contained Worker and driver seL4 faults into Worker ticket/lease quarantine or ticket-free driver runtime quarantine, bounded evidence, fresh-ticket Worker restart, and fresh-generation driver recovery without duplicating 26e containment. Inputs: accepted 26e Worker teardown and baseline-driver containment interfaces/evidence, conditional accepted Milestone 29 storage-runtime containment evidence, apps/root-task/src/lifecycle.rs, apps/root-task/src/event/**, apps/root-task/src/hal/**, apps/root-task/src/generated/**, apps/coh/src/evidence.rs, tools/coh-rtc/src/**, docs/SECURITY.md, docs/INTERFACES.md, docs/TEST_PLAN.md Changes: - tools/coh-rtc/src/** — extend accepted 26e Worker fault/timeout identity with production ticket, logical lease epoch, scheduler/supervisor/cap-bundle generation, and extend driver identity separately with manifest runtime instance/runtime generation/scheduler/supervisor/cap-bundle generation; generate terminal/quarantine policy and bounded evidence paths without a driver ticket field. - apps/root-task/src/lifecycle.rs + apps/root-task/src/event/** — consume existing worker/driver fault and timeout IPC, record bounded production evidence, invoke the existing complete Worker teardown or accepted driver containment, resolve fault/driver Reply ownership, and transition the exact Worker-ticket or driver-runtime ledger entry to terminal/quarantined state. - apps/root-task/src/hal/** — invoke the accepted driver containment cut-off for IRQ, shared-ring, MMIO, DMA/shared-buffer, fault, and old-generation authority, then admit recovery only through a fresh manifest runtime generation. Do not edit the driver ABI/runtime or CYW43 behavior. - apps/root-task/tests/fault_recovery_timing.rs — bounded timing checks for revoke, evidence export, stale-turn refusal, and fresh restart admission under representative worker/driver faults. - apps/coh/src/evidence.rs + docs/SECURITY.md + docs/INTERFACES.md + docs/TEST_PLAN.md — include bounded fault lifecycle records in evidence exports and document restart/quarantine semantics. Commands: - cargo test -p root-task --tests fault - cargo test -p root-task --test fault_recovery_timing - cargo test -p pi4-driver-runtime - cargo test -p worker-heart - cargo test -p worker-gpu - cargo test -p worker-lora - cargo test -p coh --test evidence - cargo run -p coh-rtc -- configs/root_task.toml --out apps/root-task/src/generated --manifest configs/generated/root_task_resolved.json - scripts/check-generated.sh Checks: - Fault badges deterministically identify either the faulting Worker role/instance/logical lease epoch/cap-bundle generation or driver role/manifest-runtime instance/runtime generation/cap-bundle generation. - Fault/timeout handling completes the applicable existing containment, rejects stale Reply/donation, timeout, shared-ring, telemetry, and receipt events, and requires a fresh Worker ticket/lease/supervisor-generation/ bundle binding or fresh admitted driver runtime generation before recovery. - Fault evidence is bounded, redaction-safe where needed, included in evidence packs, and does not alter console grammar or Secure9P framing. - Fault/revoke timing remains bounded and is reported as VM authority recovery evidence, not Pi/QEMU network throughput proof. Deliverables: - Production fault lifecycle evidence that lets seL4 reviewers audit Worker ticket quarantine and ticket-free driver runtime quarantine/recovery separately. Title/ID: m28b-python-production-bundle-parity Milestone: Milestone 28b — Production Worker Ticket/Lease Binding + Driver Inventory Projection + Structured Fault Lifecycle / Python production projection parity Goal: Make the Python SDK consume generated Worker-bundle binding and Worker/driver quarantine evidence without synthesizing production authority or treating drivers as ticket subjects. Inputs: `m27b-authoritative-receipt-and-evidence-core`, `m28b-production-worker-ticket-driver-inventory`, `m28b-structured-fault-lifecycle`, generated 28b integration/use-case records and canonical evidence fixtures, tools/cohesix-py/cohesix/{generated.py,worker.py,orchestration.py,receipts.py,evidence.py}, tools/cohesix-py/tests/**, docs/PYTHON_SUPPORT.md. Changes: - tools/cohesix-py/cohesix/{worker.py,orchestration.py,evidence.py} — consume coh-rtc-generated Worker binding, ticket/lease epoch, scheduler/supervisor/cap generation, terminal/quarantine, recovery, and evidence-reference fields while preserving the separate ticket-free driver manifest-runtime identity and the 26e-only versus 28b-production profile distinction; do not hand-edit `generated.py`. - tools/cohesix-py/cohesix/receipts.py + focused fixtures — reuse the authoritative 27b receipt/evidence validators and conformance vectors to validate the shared binding/fault records and refuse missing, forged, duplicate, stale-generation, wrong-target, wrong-role, driver-ticket-bearing, client-authored, or incompletely correlated inputs; keep provider/executor receipts separate and add no parallel Python validator or receipt format. - tools/cohesix-py/tests/{test_worker_compatibility.py,test_orchestration.py,test_evidence_receipts.py} — cover live, revoked, quarantined, stale-generation, missing-binding, fresh-generation recovery, 26e-only, and WorkerBus model-only cases using the canonical Rust/generated vectors. - docs/PYTHON_SUPPORT.md — document read/projection behavior and explicitly deny any Python-created production-bundle, quarantine, restart, or driver-ticket authority. Commands: - python3 -m pytest -q tools/cohesix-py/tests/test_worker_compatibility.py tools/cohesix-py/tests/test_orchestration.py tools/cohesix-py/tests/test_evidence_receipts.py - scripts/check-generated.sh Checks: A ticket, lease, provider receipt, model publication, local file, or client-created JSON cannot become a 28b production-bundle claim; stale generations and incomplete correlations fail closed; no driver ticket is accepted or emitted; 26e-only profiles remain distinct; fresh recovery requires the generated new identity; WorkerBus remains model-only. Deliverables: Python projects the same generated production-binding and quarantine truth as other host tools without creating a parallel lifecycle or authority model. ``` ## Milestone 28c — MCP/A2A Gateway Projection: Read-Only First, Ticketed Writes Later [Milestones](#Milestones) **Delivery posture:** Release B accepts MCP phase 1 plus only the ticketed MCP tools required by the accepted walkthroughs. A2A is a demand-gated extension, not part of the Release B definition of done. It may be activated only by a named cross-agent delegation case with an owner, protocol version, security posture, interoperability target, and evidence plan. Read-only MCP may ship before mutating MCP; neither implies A2A conformance. **Why now (ecosystem boundary):** Milestone 27a gives `hive-gateway` caller-attributed, fenced, audit-first write authority. Milestone 27b provides the generated provider/action and integration-surface graph, read visibility classes, identity mappings, external-executor conformance, package manifests, and use-case evidence rows that gateway protocol projections must consume. Milestone 27c provides immutable semantic objects and Context Capsules. Milestone 28a provides the typed-intent, authoritative-fact, decision, and state-bound-grant contract for every mutating protocol projection. Milestone 27d defines the host-side AI/provider model and complete PEFT lifecycle for delegated runs, optional NeMo providers, GPU leases, and evidence receipts, and Milestone 27e provides the OpenAI-compatible inference boundary and provider-neutral inference receipts. That is the right point to add a Model Context Protocol (MCP) server: external agent hosts need standard MCP tools, resources, and prompts, but Cohesix must not create a second authority plane, inference protocol, semantic store, policy evaluator, or VM grammar to satisfy them. MCP support belongs inside or immediately beside `hive-gateway` because the gateway is already the host-only multiplexer over existing Cohesix file semantics. This milestone makes MCP a client-facing projection over the same `LS`, `CAT`, `TAIL`, and `ECHO` paths, plus read-only adapters over accepted 27c semantic/capsule artifacts and 27e inference receipts, and the existing `/host/tickets/spec` actuation lane. It is not a new runtime, not an in-VM endpoint, and not an excuse to expose model providers, `systemctl`, `docker`, `kubectl`, CUDA, PEFT, or NeMo APIs directly to an agent. A2A belongs in the same gateway milestone only as a companion agent-delegation facade. MCP answers "what tools/resources can this agent host use?"; A2A answers "what task can one external agent delegate to Cohesix and how is progress/artifact state observed?" Cohesix should support that distinction because 27c, 27d, and 27e already define durable semantic/capsule, run/checkpoint, and inference-receipt records, but A2A must project those records rather than introduce an opaque agent bus. **As-built alignment note:** There is no MCP server or A2A facade in `hive-gateway` today. Current gateway behavior is REST/OpenAPI over `LS`/`CAT`/`ECHO`, and the host ecosystem already has bounded providers for CUDA/NVIDIA discovery, GPU leases, PEFT, systemd, Docker, and K8s through Cohesix host tools and `/host/tickets/*`. The accepted 27e inference endpoint remains a separate host service; 28c discovers and references it but does not proxy, reimplement, or redefine its compatible wire contract. `coh mount --rest-url` already mounts through `hive-gateway` and is the primary FUSE path for the live Cohesix namespace; Milestone 28c must not rebuild that through MCP or A2A. Milestone 28c adds MCP-compatible and A2A-compatible surfaces only after those existing flows are the implementation substrate. Older prose must not claim MCP or A2A support until the gateway exposes lifecycle/discovery/execution/authorization/conformance evidence for the relevant protocol. **Sequencing note:** Milestone 28c is staged inside one milestone. Phase 1 is read-only MCP transport/resource/prompt discovery and conformance over existing bounded namespace reads, accepted 27c semantic/capsule artifacts, and accepted 27e inference receipts, with every resource classified by the Milestone 27b visibility model. Phase 2 may add mutating MCP tools and A2A task facades only after the 27a delegated authority floor, 27b provider/integration graph, 27c artifact model, 28a admission primitive, 27d run/checkpoint/evidence model, and 27e inference admission/receipt contract are proven. A projected mutating tool/skill is omitted or reports typed unavailable when its provider action lacks an accepted 28a policy or any required provider, surface, external executor, Worker tier, package, semantic artifact, or inference profile row is not accepted. No mutating MCP/A2A path can be accepted solely because read-only protocol conformance passes, and protocol conformance cannot promote the underlying use case. A path may cite matching 26e evidence for live Worker/driver authority; if it additionally claims production Worker ticket/lease binding, complete driver-inventory projection, or structured quarantine/restart, it must cite the corresponding Milestone 28b evidence. Host-ticket-only and read-only projections must not claim either class by implication. Phase 2 is itself split: selected mutating MCP tools may enter Release B after their exact 28a actions pass; A2A remains outside the release gate until the demand gate above is explicitly satisfied. **Prerequisites** - Milestone **28a** completed for every mutating tool/skill, including the generated typed-intent mapping, accepted policy, authoritative fact sources, decision receipt, state-bound grant, and stale-state refusal. Read-only protocol conformance does not require a mutating admission decision. - Milestones **27a**, **27b**, **27c**, **27d**, and **27e** completed for the exact delegated-authority, registry, artifact, run/action, and inference surfaces projected by the selected profile. **Goal** Expose Cohesix to MCP clients through standard MCP server primitives and to A2A peers through task/artifact protocol primitives while preserving Cohesix's existing grammar and authority model: 1. MCP resources provide bounded read-only context from existing Cohesix paths, accepted semantic objects/Context Capsules, inference receipts, and evidence artifacts. 2. MCP tools either read existing files or submit existing host tickets; mutating tools never call host executors directly. 3. MCP prompts encode safe semantic/context and inference audits plus operational playbooks for CUDA/GPU, PEFT, NeMo, K8s, systemd, and Docker workflows without becoming authority. 4. All writes inherit Milestone 27a delegated ticket, idempotency, writer-epoch, audit/replay, and request-auth rules. 5. The shared `cohsh-core` console grammar, NineDoor semantics, and generated manifest bounds remain byte-stable. 6. `coh mount --rest-url` remains the canonical gateway-backed namespace mount; any MCP-backed mount mode is a read-only MCP resource/catalog view for MCP-admitted context, not a replacement write path. 7. A2A Agent Cards, messages, tasks, artifacts, and streaming updates are projections of accepted 27c semantic/capsule records, 27d run/checkpoint/evidence records, 27e inference receipts, and existing host-ticket receipts, not a separate scheduler or agent memory. 8. Read-only MCP/A2A conformance is an ecosystem compatibility claim, not a write-authority claim. Mutating protocol evidence must name delegated-ticket, provider-action, idempotency, writer-epoch, audit/replay, matching 26e live-task evidence where VM execution is claimed, and 28b production-ledger/quarantine evidence only where those stronger claims are made. 9. Tool/resource/prompt and Agent Card/skill availability derives from the accepted 27b integration and use-case rows; MCP/A2A never upgrades a mock, dry-run, integration-pattern, or not-enabled workflow into production support. 10. Every mutating flow is `MCP tool call or A2A task -> generated typed intent -> 28a admission -> existing host-ticket or control action`; neither MCP nor A2A contains an independent policy evaluator. **Non-Goals (Explicit)** - No in-VM MCP endpoint, MCP listener, MCP filesystem root, or MCP-specific root-task parser. - No new console verbs, no new 9P verbs, no ACK/ERR/END grammar changes, and no hidden RPC behind MCP tool names. - No direct execution of `systemctl`, `docker`, `kubectl`, CUDA/NVML, PEFT, or NeMo provider APIs from the MCP server. Side effects go through delegated REST and/or `/host/tickets/spec`. - No OpenAI-compatible endpoint, inference proxy, provider call, or model-output tool execution inside MCP/A2A. Inference submissions map to accepted 27d `infer.run` admission and the 27e gateway; model-produced tool calls remain inert data until separately validated and authorized. - No duplicate semantic graph, vector index, capsule planner, prompt archive, or inference receipt schema in `hive-gateway`; 28c consumes accepted 27c and 27e libraries and immutable refs. - No MCP tool that bypasses role-scoped tickets, policy approval, writer-epoch fencing, host-ticket allowlists, or evidence exports. - No MCP/A2A-local policy evaluator, fact-authority classifier, grant minter, or admission cache transferable across intents. Protocol metadata and model text remain untrusted intent inputs. - No model-controlled prompt or MCP client metadata is trusted as authorization. Tool descriptions, prompts, and annotations are documentation only. - No CUDA/NVML, PEFT, NeMo, Kubernetes, systemd, or Docker code enters the VM TCB. - No implicit translation from arbitrary FUSE writes into MCP `tools/call`. Write-capable Cohesix mounts continue to use existing console/REST `ECHO` semantics and the existing append-only control files. - No in-VM A2A endpoint, no A2A-specific root-task queue, no A2A peer mesh, no opaque inter-agent mailbox, and no direct A2A-to-provider execution path. - No A2A push notification callback is accepted without SSRF-safe URL validation, explicit allowlist policy, per-task auth material, bounded retry policy, and audit evidence. **Deliverables** ### 1) MCP protocol endpoint and lifecycle in `hive-gateway` **Purpose:** Let standard MCP hosts connect to Cohesix without client-specific shims while keeping the gateway's loopback/auth defaults. Implementation requirements: - Add an MCP server mode to `apps/hive-gateway` with: - stdio transport for local MCP hosts that launch the gateway as a subprocess, - Streamable HTTP endpoint for remote-capable MCP clients, sharing the gateway's loopback-only default and non-loopback risk override, - protocol revision, JSON Schema dialect, authorization mode, and capability negotiation pinned in `docs/HOST_API.md` and generated gateway metadata, - HTTP `MCP-Protocol-Version` handling, optional `Mcp-Session-Id` lifecycle, explicit session termination behavior, and deterministic unsupported-version errors, - `tools`, `resources`, and `prompts` capabilities with paginated discovery where needed, - optional list-change notifications only when the implementation has deterministic change detection. - Remote MCP transport must validate `Origin`, require gateway request auth, and require delegated tickets for mutating tools. A production non-loopback profile must implement the authorization contract of the pinned MCP revision or explicitly document and test a narrower compatibility mode; a preconfigured loopback bearer token alone is not generic remote MCP authorization conformance. - Stdio mode must read credentials only from environment/config, never from prompts or tool arguments. - MCP stdout/stdin must carry only valid MCP JSON-RPC messages; logs go to stderr or the existing gateway log path. - Streamable HTTP mode must support the accepted request/response content types, bounded SSE streams when enabled, explicit cancellation handling, and no broadcast of one client's server messages to another client. - The gateway must expose enough server metadata for common MCP clients and inspectors to identify the server, protocol revision, tool names, resource URI scheme, and auth requirements. As-built leverage: - Reuse `hive-gateway` broker queues, request-auth checks, loopback binding policy, OpenAPI bounds, and existing `cohsh` REST transport code. --- ### 2) Resource catalog over existing Cohesix paths and accepted host artifacts **Purpose:** Give MCP clients context without giving them a new authority or storage model. Implementation requirements: - Define namespace-backed `cohesix://namespace/*` resource URIs that map one-to-one to existing bounded reads: - `/proc/boot`, `/proc/root/*`, `/proc/9p/*`, `/proc/lease/*`, `/proc/schedule/*`, `/proc/spool/*`, `/proc/attest/*` - `/gpu/*`, `/gpu/models/*`, `/gpu/telemetry/schema.json` - `/host/tickets/status`, `/host/tickets/deadletter`, and provider status under `/host/systemd/*`, `/host/docker/*`, and `/host/k8s/*` - evidence-pack and timeline summaries when Milestone 27/27a/27c/27d/27e evidence is available - NeMo capability, guardrail, evaluator, and provider receipt summaries only when the 27d optional provider family is enabled. - Define host-artifact resource families only when their owner milestones are accepted: - `cohesix://semantic/snapshot//object//` and bounded edge/query summaries backed by the 27c read-only semantic core, - `cohesix://context/capsule/` and its manifest/render receipt backed by the 27c capsule verifier/renderer, - `cohesix://inference/receipt/` and bounded status/timeline views backed by the 27e receipt verifier and evidence projection. - Namespace-backed resource reads must use only `LS`, `CAT`, or `TAIL` through the existing gateway/session machinery and must enforce manifest-derived path, line, byte, and walk-depth bounds. Host-artifact resources must use only the accepted read-only 27c/27e libraries over immutable ids and must not acquire repository paths, provider credentials, run admission, or write authority. - Resource templates may expose common path families, but template expansion must reject `..`, absolute host filesystem paths, overlong components, and undeclared provider roots. - Resource contents must be redacted with the same rules as evidence packs: no raw tickets, auth tokens, provider credentials, or secret refs. - Resource metadata must expose source milestone, schema version, artifact hash, visibility class, provenance/receipt ref, and freshness without claiming host-artifact data is a kernel-visible 9P object. As-built leverage: - Reuse `coh evidence pack`, `coh evidence timeline`, generated Cohesix path defaults, the existing `/host` provider status surfaces, and the accepted `cohesix-semantic-core` and `cohesix-inference-core` read/verify APIs. --- ### 3) Tool catalog for real Cohesix operations **Purpose:** Support useful MCP automation while preserving the Cohesix write path. Implementation requirements: - Read-only tools: - `cohesix.fs.ls`, `cohesix.fs.cat`, `cohesix.fs.tail` - `cohesix.semantic.inspect` and `cohesix.semantic.query` over an admitted 27c snapshot id, - `cohesix.context.inspect`, `cohesix.context.render`, and `cohesix.context.verify` over an admitted immutable capsule id, - `cohesix.inference.status` and `cohesix.inference.receipt` over admitted 27e ids, - `cohesix.cuda.inventory` for bounded host CUDA/NVIDIA capability and GPU inventory summaries - `cohesix.evidence.timeline` for bounded evidence/timeline summaries. - Mutating or side-effect-capable tools must produce existing Cohesix writes only: - `cohesix.host_ticket.submit` appends the generated action-selected `host-ticket/v1` or `host-ticket/v2` record to `/host/tickets/spec`. `receipt_mode=none` uses v1; a receipt-bearing GPU/PEFT action uses v2 and must carry the exact admitted Worker binding fields required by 26e. A caller cannot choose a weaker schema than the provider/action registry requires. - `cohesix.gpu.lease_grant`, `cohesix.gpu.lease_renew`, and `cohesix.gpu.lease_release` map to existing GPU lease actions. - `cohesix.peft.export`, `cohesix.peft.import`, `cohesix.peft.activate`, and `cohesix.peft.rollback` map to existing PEFT ticket/action flows and 27d transaction receipts. - `cohesix.inference.submit` maps a fixed, generated request schema and optional accepted Context Capsule ref through 28a admission to the existing 27d `infer.run` host-ticket action and 27e inference gateway. It never calls a provider directly or executes model-produced tool calls. - `cohesix.nemo.probe`, `cohesix.nemo.infer`, `cohesix.nemo.guardrails`, and `cohesix.nemo.evaluate` map to 27d optional provider actions or deterministically return unavailable when NeMo is not enabled. - `cohesix.k8s.cordon`, `cohesix.k8s.drain`, and `cohesix.k8s.lease_sync` map to existing K8s host-ticket actions. - `cohesix.systemd.status_check`, `cohesix.systemd.start`, `cohesix.systemd.stop`, and `cohesix.systemd.restart` map to existing systemd host-ticket actions. - `cohesix.docker.status_check`, `cohesix.docker.stop`, and `cohesix.docker.restart` map to existing Docker host-ticket actions. - MCP tool schemas and A2A skill schemas must derive from the shared manifest/provider action and integration-surface registry. Provider action names, target selectors, dry-run flags, idempotency keys, receipt fields, Worker tier, external-executor requirement, and availability state must not be hand-maintained separately for the two protocols. - Every mutating schema additionally derives its exact 28a intent schema, required facts, policy id, grant ceiling, freshness/recheck mode, and decision receipt. The gateway maps the call/task into that typed intent, consumes the accepted `admission_id`, then submits only the existing host-ticket or control action. - Discovery omits or marks typed unavailable any operation whose 27b/27c/28a/27d/27e dependency row or admission policy is not accepted in the selected profile. A client cannot select `live` mode to override missing semantic, capsule, provider, executor, inference, or receipt evidence. - Every tool schema must be generated or checked against manifest/provider policy: - bounded string lengths, - explicit enum values for actions and providers, - no free-form shell command field, - id/idempotency-key/writer-epoch requirements for mutating calls, - target path validation using existing Cohesix path rules. - Tool results must return structured MCP output plus a text fallback containing the Cohesix receipt id, ticket id, action, target, state path, and evidence refs. They must not expose raw tickets or provider credentials. As-built leverage: - Reuse `host-ticket-agent` executors, `coh peft`, `host-cuda`, generated policy defaults, delegated REST identity, writer-epoch fencing, and evidence/timeline redaction. --- ### 4) Prompt templates for safe operator workflows **Purpose:** Provide MCP-native workflows without making prompts authoritative. Implementation requirements: - Add prompt templates that assemble existing tools/resources for common Cohesix tasks: - semantic impact review from an immutable snapshot and Context Capsule, - inference receipt and context-selection audit without raw prompt retention, - CUDA capacity triage before a GPU lease, - PEFT export/import/promotion/rollback review, - NeMo provider readiness and guardrail/evaluator receipt review, - K8s cordon/drain with lease and evidence checks, - systemd service recovery with Docker workload status, - Docker remediation with post-action evidence collection. - Prompts must require explicit user approval for side-effecting tools and must name the exact host-ticket action that would be submitted. - Prompt text must not embed secrets, tickets, endpoint auth, or unbounded host paths. - Prompt outputs are guidance only; only existing Cohesix tickets, receipts, and evidence determine state. As-built leverage: - Reuse Milestone 27 operator utilities, 27a audit/replay/fencing, 27c semantic/capsule artifacts, 27d run envelopes/checkpoints, 27e inference receipts, and existing host-ticket provider receipts. --- ### 5) A2A Agent Card and task facade over existing runs **Purpose:** Let external A2A peers delegate bounded Cohesix operational tasks and observe status/artifacts without making A2A a coordination plane. Implementation requirements: - Add an A2A-compatible HTTP facade in `hive-gateway` behind existing gateway request auth, loopback default, non-loopback exposure override, rate limits, and broker backpressure. - Record the accepted A2A protocol revision, Agent Card `protocolVersion`, endpoint paths, supported binding, media type, extension policy, unsupported-version errors, and streaming/push support in `docs/HOST_API.md` and generated gateway metadata. - Pin one accepted binding/revision mapping in generated policy. JSON-RPC, HTTP+JSON, and gRPC method or endpoint names must not be mixed across protocol revisions, and fixtures must be regenerated when that mapping changes. - Publish an Agent Card from `/.well-known/agent-card.json` when A2A is enabled; alternate generated paths may exist only as additional configured aliases. The card must advertise only enabled Cohesix skills, authentication requirements, endpoint interfaces, and safe capability summaries; it must not expose raw tickets, secrets, host paths, or executor internals. - Provide the authenticated extended Agent Card endpoint only when policy enables it, and ensure the extended card obeys stricter access checks than the public discovery card. - A2A skills map to the same real-world operational families as MCP tools: semantic/capsule inspection, inference submission/status/receipt, CUDA/GPU inventory and leases, PEFT export/import/activate/rollback, optional NeMo probe/infer/guardrail/evaluator actions, K8s cordon/drain/lease sync, systemd status/start/stop/restart, Docker status/stop/restart, and evidence/timeline inspection. - A2A `SendMessage` and `SendStreamingMessage` operations (or the exact generated equivalents for the pinned binding/revision) create or resume 27d run/task envelopes only after fixed skill/action/input schema validation. Semantic inputs are immutable 27c snapshot/capsule refs; inference actions map through 28a admission to the existing 27d action and 27e gateway. Free-form natural language is never translated directly into host or provider execution. - A2A `GetTask`, `ListTasks`, `CancelTask`, `SubscribeToTask`, push-notification configuration, and streaming update operations (or their generated binding equivalents) are projections of existing semantic/capsule refs, run/checkpoint/evidence records, 27e inference receipts, host-ticket receipt state, and gateway audit state. Cancellation may append a validated Cohesix cancel/control request when one exists; it must not kill provider executors directly. - A2A artifacts are bounded, redacted references to immutable semantic objects, Context Capsules, inference receipts, evidence packs, timelines, checkpoint summaries, provider receipts, and MCP/Cohesix resource refs. Large files, raw prompts/outputs, secrets, raw ticket material, and provider credentials are never embedded in artifacts. - A2A push notification configs are disabled by default. If enabled, they require SSRF-safe URL validation, generated allowlists, per-task auth material, bounded retry/backoff, signed or authenticated delivery where configured, and audit evidence for every callback attempt. As-built leverage: - Reuse Milestone 27c semantic/capsule artifacts, 27d run envelopes, checkpoints and provider receipts, 27e inference receipts, `host-ticket-agent` state, gateway request auth, and delegated REST identity. --- ### 6) Security, audit, and confused-deputy controls **Purpose:** Keep model-controlled MCP and A2A calls inside Cohesix's existing capability discipline. Implementation requirements: - Mutating MCP tools require: - gateway request auth, - delegated capability ticket with matching path/action scope, - id/idempotency_key, - writer_epoch when the target profile enables fencing, - policy approval where the underlying Cohesix path already requires it. - A2A task-creating or task-mutating calls require the same gateway request auth, delegated scope, id/idempotency key, writer epoch, and policy approval as the underlying Cohesix ticket/control action. - Gateway audit lines must record protocol (`mcp` or `a2a`), method, tool/resource/prompt/skill/task name, semantic snapshot/Context Capsule/render/inference receipt refs when present, delegated ticket hash, Cohesix path/action, idempotency key, writer epoch, upstream ACK/ERR, task state, and evidence refs. - MCP clients cannot supply arbitrary upstream paths for provider-specific mutating tools; provider tools must expand from checked target fields into manifest-allowlisted Cohesix paths/actions. - A2A clients cannot supply arbitrary provider targets, host paths, or executor commands through message text or metadata; A2A skill inputs must expand only into manifest-allowlisted Cohesix paths/actions. - Tool listing, prompt listing, Agent Cards, and A2A skills are not authorization. Calls fail closed if the current request lacks the required delegated scope. - Remote MCP and A2A transports inherit loopback default, non-loopback exposure warning, origin validation, request-auth, rate limits, broker backpressure, and bounded response sizes. - MCP and A2A conformance tests must include prompt-injection and confused-deputy negative cases: a resource, prompt, Agent Card, or peer message that asks the model to bypass tickets must not change server-side authorization. - Inference results containing apparent MCP/A2A calls, host-ticket lines, paths, or credentials remain untrusted content and cannot initiate a second action without fresh schema validation, delegated scope, policy approval, and a new attributable audit record. As-built leverage: - Reuse REST delegated identity from 27a, host-ticket WAL/replay, evidence redaction, policy rules, and gateway queue/backpressure controls. --- ### 7) Ecosystem conformance and client configuration **Purpose:** Make Cohesix usable from standard MCP hosts and A2A peers without custom client forks. Implementation requirements: - Add checked examples for: - local stdio MCP server config, - remote Streamable HTTP MCP endpoint config, - read-only namespace, semantic object, Context Capsule, and inference receipt browsing, - an inference submission that carries an immutable capsule ref and returns a 27e receipt ref without executing returned tool calls, - delegated mutating tool calls with explicit ticket/auth configuration, - A2A Agent Card discovery, - A2A task submission, streaming status, artifact retrieval, and cancellation against mock/dry-run providers. - Add checked protocol fixtures/schemas for MCP JSON-RPC messages, A2A HTTP+JSON requests, gateway REST/OpenAPI compatibility, and generated provider action schemas so future client regressions are reviewable as data. - Validate with at least one MCP inspector/client conformance path and archive the transcript/output under the milestone evidence directory. - Validate with at least one A2A-compatible client/conformance path and archive the transcript/output under the milestone evidence directory. - Add a gateway protocol performance probe covering namespace and host-artifact MCP resource reads, MCP tool calls that submit host tickets, A2A task creation/status streaming, and backpressure/refusal paths. Record semantic object/capsule/inference receipt adapter overhead separately from namespace and protocol overhead. Compare authority-bearing paths against REST read/write behavior from the accepted 27a gateway authority baseline; do not treat this as Pi hardware throughput proof unless the gateway probe exposes an upstream runtime regression. - Document how MCP clients should treat Cohesix resources, tools, prompts, approval prompts, and errors. - Document how A2A peers should treat Cohesix Agent Cards, skills, task status, artifacts, push notification limits, and errors. - Expose deterministic error mapping from Cohesix `ERR` lines and REST gateway errors into MCP errors without losing the original Cohesix reason. - Expose deterministic error mapping from Cohesix `ERR` lines, host-ticket refusals, and REST gateway errors into A2A task/error states without losing the original Cohesix reason. As-built leverage: - Reuse `docs/HOST_API.md`, `docs/API_GUIDELINES.md`, `docs/HOST_TOOLS.md`, `resources/openapi/hive-gateway.yaml`, and existing gateway status counters. --- ### 8) `coh mount` interoperability: REST primary, MCP context view optional **Purpose:** Keep `coh mount --rest-url` as the direct gateway-backed namespace mount, while adding a useful MCP-facing filesystem view only where MCP resource discovery brings additional value. Implementation requirements: - Preserve the existing `coh mount --rest-url` behavior as the canonical FUSE view over Cohesix namespaces through `hive-gateway`; it remains the path for normal file-shaped reads and append-only writes. - Add an optional MCP resource mount mode only if the MCP server exposes a resource/tool/prompt catalog that a local filesystem consumer cannot get from the existing mount without speaking MCP: - `coh mount --mcp-url --read-only --at ` mounts MCP-admitted context, not the full Cohesix namespace. - The mounted tree exposes bounded MCP resources, resource templates, tool schemas, prompt templates, and evidence/resource links as files. - Resource file reads call MCP `resources/list`, `resources/templates/list`, and `resources/read`; tool and prompt catalog files are generated from `tools/list`, `prompts/list`, and `prompts/get`. - The tree must make the backing type explicit for every resource/tool entry: namespace path/action for `LS`/`CAT`/`TAIL`/`ECHO` or `/host/tickets/spec`, or immutable artifact id/schema/hash and owner milestone for 27c semantic/capsule and 27e inference receipt resources. - The MCP mount is read-only by default and in the milestone acceptance path. Writes, renames, chmod, symlink creation, and host filesystem path escapes fail deterministically with no MCP `tools/call`. - If a later task proposes write-capable MCP mount nodes, it must be a separate breaking-risk review and may append only the generated action-selected `host-ticket/v1` or `host-ticket/v2` record with delegated ticket, idempotency key, writer epoch, policy approval, and local operator confirmation. Receipt-bearing actions require v2; a mount write cannot request, downgrade, or synthesize the schema/receipt mode. It must never map arbitrary file writes to arbitrary MCP tools. - A2A does not get a FUSE mode in this milestone. A2A task status and artifact links may appear as read-only MCP/evidence files, but task creation remains an A2A HTTP operation or an existing Cohesix ticket/control write. - `coh doctor` and mount validation should report whether the REST mount, MCP resource mount, both, or neither are available, and should distinguish FUSE availability from MCP protocol availability. - `coh doctor` must also distinguish namespace-resource readiness from semantic store/capsule verifier and inference receipt-verifier readiness; one missing optional artifact family does not make unrelated resources appear healthy or unavailable. - MCP resource mount caches must be bounded, TTL-governed, and invalidated on MCP list-change notifications when enabled; stale cache reads must be marked as stale rather than silently presented as live state. As-built leverage: - Reuse `coh mount` FUSE validators, REST mount exclusivity, `CohAccess` read helpers, gateway MCP resource catalog, and evidence redaction rules. --- ### 9) Operator walkthrough and docs-as-built alignment **Purpose:** Keep operator-facing guidance accurate as MCP, A2A, gateway REST, and mount modes become adjacent surfaces. Implementation requirements: - Audit and update `docs/OPERATOR_WALKTHROUGH.md` so the happy path, prerequisites, command ordering, failure handling, and expected evidence match the as-built gateway/MCP/A2A/mount behavior. - Audit and update related canonical docs in the same milestone work: - `docs/HOST_API.md` for REST, MCP, and A2A endpoint/auth behavior, - `docs/HOST_TOOLS.md` for `coh mount --rest-url`, optional `coh mount --mcp-url`, `hive-gateway`, semantic/capsule and inference receipt resources, A2A Agent Card/task facade, host-ticket-agent, GPU bridge, and sidecar workflows, - `docs/API_GUIDELINES.md` for transport choice and MCP-vs-A2A-vs-REST-vs-filesystem guidance, - `docs/USERLAND_AND_CLI.md` for operator-visible commands and grammar-stability wording, - `docs/INTERFACES.md` for path/action mappings and refusal semantics, - `docs/ARCHITECTURE.md` for host-only MCP/A2A projections and the VM/host boundary, - `docs/SECURITY.md` for delegated ticket, prompt-injection, confused-deputy, redaction, and non-loopback exposure guidance, - `docs/TEST_PLAN.md` for the MCP, A2A, and mount evidence matrix. - The audit must start from as-built code and generated truth: - `apps/hive-gateway/src/**`, - `apps/coh/src/mount.rs`, - `apps/coh/src/doctor.rs`, - `apps/host-ticket-agent/src/executors/**`, - `docs/snippets/*`, - generated manifests and `coh-rtc` outputs. - Documentation must distinguish: - direct TCP `cohsh` proof, - REST/gateway proof, - gateway-backed `coh mount --rest-url`, - optional read-only MCP resource mount, - read-only 27c semantic/capsule and 27e inference receipt projections versus namespace-backed resources, - the separate 27e OpenAI-compatible endpoint versus MCP inference submission/status/receipt tools, - MCP tools/prompts that submit Cohesix tickets rather than executing host commands directly, - A2A Agent Card discovery, task submission, streaming status, artifact retrieval, and refusal behavior. - Generated snippets and derived docs must be refreshed through `coh-rtc` or their owning generator; hand-editing generated blocks is invalid. As-built leverage: - Reuse 26c docs-as-built audit discipline, existing host-tool docs, generated snippets, and the 28c MCP/A2A conformance evidence. **Commands** - `cargo test -p hive-gateway` - `cargo test -p hive-gateway --test mcp_protocol` - `cargo test -p hive-gateway --test mcp_resources` - `cargo test -p hive-gateway --test mcp_tools` - `cargo test -p hive-gateway --test mcp_prompts` - `cargo test -p hive-gateway --test mcp_security` - `cargo test -p hive-gateway --test gateway_action_registry` - `cargo test -p hive-gateway --test a2a_protocol` - `cargo test -p hive-gateway --test a2a_tasks` - `cargo test -p hive-gateway --test a2a_security` - `cargo test -p coh --test mount_mcp` - `cargo test -p host-ticket-agent` - `cargo test -p coh --test evidence_pack` - `cargo test -p coh --test evidence_timeline` - `cargo test -p coh-rtc` - `scripts/ci/gateway_perf_probe.sh --scenario mcp-a2a-protocols --state-dir out/bench/m28c-gateway-protocols` - `git diff --check -- docs/BUILD_PLAN.md docs/OPERATOR_WALKTHROUGH.md docs/HOST_API.md docs/HOST_TOOLS.md docs/API_GUIDELINES.md docs/USERLAND_AND_CLI.md docs/INTERFACES.md docs/ARCHITECTURE.md docs/SECURITY.md docs/TEST_PLAN.md` - `scripts/check-generated.sh` - `scripts/cohsh/run_regression_batch.sh` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m28c-qemu-gateway-agents` **Checks (Definition of Done)** - MCP lifecycle, `MCP-Protocol-Version`, optional `Mcp-Session-Id`, cancellation, `tools/list`, `tools/call`, `resources/list`, `resources/templates/list`, `resources/read`, `prompts/list`, and `prompts/get` pass against the accepted protocol revision recorded in the docs. - A2A Agent Card discovery, Agent Card `protocolVersion`, optional authenticated extended Agent Card, and the generated `SendMessage`, streaming, task query/list/cancel/subscribe, push-notification, artifact, and update mappings pass against the accepted protocol revision and binding recorded in the docs. - `crates/cohsh-core/fixtures/grammar.sha256` and generated `docs/snippets/cohsh_grammar.md` remain unchanged unless a separately approved breaking grammar milestone changes them. - Every namespace-backed MCP read maps to existing `LS`, `CAT`, or `TAIL`. Every semantic/capsule or inference-receipt read maps to the accepted read-only 27c or 27e core over an immutable id. Every MCP write maps to existing `ECHO` into a documented Cohesix control file or `/host/tickets/spec`; no host-artifact adapter mints authority. - Every A2A task maps to accepted 27c semantic/capsule refs where context is used, an existing 27d run/checkpoint/evidence record, a 27e inference receipt where inference is used, and, when mutating, an existing Cohesix host-ticket/control action. No A2A message text or metadata becomes authorization. - Read-only MCP acceptance passes before mutating MCP tools or A2A task creation are enabled in the milestone evidence path. - Read-only MCP acceptance is not sufficient evidence for mutating tools, A2A task creation, inference/provider action execution, or VM Worker/driver authority. Each mutating acceptance artifact must name its 27a/27b/27c/27d/27e authority, context, admission, and receipt inputs, matching 26e live-task evidence where applicable, and 28b evidence only for production Worker ledger binding, complete driver-inventory projection, or structured quarantine/restart claims. - Read-only MCP and A2A artifact/resource acceptance includes negative tests for public, ticket-scoped, and admin-only read visibility; ticket/provider/evidence/audit reads for the wrong delegated identity fail before payload construction. - MCP tool schemas and A2A skill schemas are generated from the same provider/integration graph and reference the same accepted semantic/capsule and inference schemas; parity tests fail if semantic/context, inference, CUDA/GPU, PEFT, NeMo, K8s, systemd, Docker, FUSE/read projection, federation, evidence, Worker tier, external-executor requirement, or availability state drifts between protocols. - MCP/A2A discovery and execution respect the selected use-case row. Missing live dependencies yield omission or typed unavailable/refused results, and protocol success never changes the row's maturity classification. - No MCP tool directly invokes host executors, shell commands, CUDA/NVML calls, PEFT filesystem mutation, NeMo endpoints, `systemctl`, `docker`, or `kubectl` outside the existing Cohesix adapters. - No A2A skill directly invokes host executors, shell commands, CUDA/NVML calls, PEFT filesystem mutation, NeMo endpoints, `systemctl`, `docker`, or `kubectl` outside the existing Cohesix adapters. - No MCP tool or A2A skill calls an inference provider directly, reimplements the OpenAI-compatible surface, or executes model-produced tool calls; an inference submission is admitted through 27d and observed through a verified 27e receipt. - Semantic/capsule inspection, inference submission/receipt, CUDA/GPU, PEFT, NeMo, K8s, systemd, and Docker scenarios have deterministic mock tests and at least one live-safe dry-run/conformance transcript appropriate to their claim class. - Mutating tools and A2A task actions fail without delegated scope and leave no side effects; duplicate mutating calls with the same id/idempotency key do not duplicate side effects. - Remote MCP and A2A endpoints validate `Origin`, enforce auth, respect loopback defaults, and return bounded protocol errors under gateway backpressure. - Evidence packs and timelines can reconstruct the MCP call or A2A task, semantic snapshot/capsule/render refs, delegated ticket hash, inference admission/receipt ref, underlying Cohesix path/action, provider receipt, and final state without raw prompt/output or secret leakage. - Standard MCP clients can discover resources/tools/prompts and call read-only tools without Cohesix-specific patches. - Standard A2A clients can discover the Agent Card, submit a dry-run task, observe status/artifacts, and handle refusals without Cohesix-specific patches. - Existing `coh mount --rest-url` semantics remain unchanged, including REST mount exclusivity and append-only write behavior. - `coh mount --mcp-url` exposes only MCP-admitted resources/tool schemas/prompt templates/evidence links, is read-only in the acceptance path, and never invokes MCP tools during filesystem metadata or write operations. - There is no A2A FUSE mode; A2A task/artifact state appears through gateway protocol responses and read-only evidence/resource projections only. - MCP-mounted resource contents match the corresponding MCP `resources/read` output and, for Cohesix namespace-backed resources, the corresponding REST/console read within documented bounds. - MCP-mounted semantic/capsule and inference receipt resources verify against the same immutable hashes and schemas as the direct 27c/27e host tools; their presence never claims those artifacts exist in the VM namespace. - A2A artifacts and push notification attempts are bounded, redacted, policy-gated, and reconstructable from audit/evidence without raw secret leakage. - Gateway protocol performance evidence shows MCP resource/tool and A2A task/artifact paths stay bounded relative to the 27a gateway authority baseline; any full Pi/QEMU benchmark is triggered only by evidence of upstream runtime-path regression. - `docs/OPERATOR_WALKTHROUGH.md` and related canonical docs describe the as-built transport, mount, MCP, A2A, host-ticket, provider, and evidence behavior without claiming implemented support before code/tests/generated outputs exist. **Compiler touchpoints** - `coh-rtc` emits `gateway.mcp.*` policy: - enabled transports (`stdio`, `streamable_http`), - accepted MCP protocol revision, - JSON Schema dialect and authorization mode for the accepted revision, - HTTP protocol-version header policy, optional session-id policy, cancellation policy, and SSE enablement/bounds, - endpoint path, - resource URI roots and path allowlists, - tool allowlists and provider action mappings, - prompt template ids, - MCP resource-mount enablement, read-only requirement, cache TTL, and synthetic tree bounds, - per-tool max input/output bytes, - delegated-ticket and writer-epoch requirements, - redaction and evidence-export flags. - Generated MCP policy references, without redefining: - accepted 27c semantic snapshot/object/view/edge, Context Capsule, render, visibility, and immutable-id schemas, - accepted 27e inference request/admission/receipt ids, read visibility, and status/submit action mappings. - Manifest validation rejects semantic/capsule resources whose schemas, visibility classes, store profiles, or immutable-id bounds do not match accepted 27c outputs, and rejects inference resources/tools whose admission, receipt, provider, or content-retention contract does not match accepted 27d/27e outputs. - Manifest validation rejects MCP enablement when Milestone 27a delegated write identity or required audit/replay/fencing prerequisites are disabled for mutating tools. - Manifest validation rejects NeMo MCP tools unless the 27d optional NeMo provider family and parity checks are enabled. - `coh-rtc` emits protocol-neutral `gateway.provider_actions.*` and `gateway.integration_surfaces.*` projections derived from the Milestone 27b graph for every operation exposed through MCP tools or A2A skills, with referenced owner schemas from 27c and 27e where semantic/capsule or inference operations are present. They include action ids, target schema refs, dry-run support, idempotency requirements, writer-epoch requirements, receipt schema refs, Worker/executor/package dependencies, observed availability, use-case refs, and evidence-export behavior. They are generated compatibility metadata, not a second registry, semantic store, inference protocol, or authority source. - Manifest validation rejects any MCP tool or A2A skill whose provider action mapping is absent from the shared registry or whose schema diverges between the two protocol projections. - `coh-rtc` emits `gateway.a2a.*` policy: - enabled endpoint/binding, - accepted A2A protocol revision, - binding-specific operation and endpoint mappings for that revision, - Agent Card `protocolVersion` and extension policy, - Agent Card path, provider metadata, skill ids, and interface declarations, - task, artifact, stream, and push-notification bounds, - skill allowlists and provider action mappings, - per-skill max input/output bytes, - delegated-ticket, idempotency, and writer-epoch requirements, - redaction, evidence-export, and callback allowlist flags. - Manifest validation rejects A2A enablement when required Milestone 27a/27c/27d/27e delegated authority, immutable context, durable run/task state, inference admission/receipt, audit/replay, evidence export, or fencing prerequisites are disabled for the selected task-creating or task-mutating skills. - Manifest validation rejects NeMo A2A skills unless the 27d optional NeMo provider family and parity checks are enabled. - Generated docs refresh: - `docs/HOST_API.md` - `docs/API_GUIDELINES.md` - `docs/HOST_TOOLS.md` - `docs/INTERFACES.md` - `docs/ARCHITECTURE.md` - `docs/SECURITY.md` - `docs/TEST_PLAN.md` - `docs/USERLAND_AND_CLI.md` - Human-authored as-built docs refreshed in: - `docs/OPERATOR_WALKTHROUGH.md` **Task Breakdown** ``` Title/ID: m28c-mcp-policy-ir Goal: Admit MCP gateway policy in compiler IR without changing Cohesix console or NineDoor grammar. Inputs: tools/coh-rtc, configs/root_task.toml, accepted 27c semantic/capsule schemas, accepted 27e inference receipt/action schemas, docs/HOST_API.md, docs/SECURITY.md. Changes: - tools/coh-rtc/src/ir.rs — `gateway.mcp.*` schema for revision, JSON Schema dialect, authorization mode, transports, endpoint, namespace and host-artifact resource roots, tool allowlists, prompt ids, owner-schema refs, bounds, and prerequisite gates. - tools/coh-rtc/src/validate.rs — reject mutating MCP tools without delegated identity, audit/replay, and provider action prerequisites, and reject non-loopback production profiles whose authorization mode does not satisfy the pinned revision. - tools/coh-rtc/src/codegen/* — generated gateway MCP defaults and docs snippets. Commands: cargo test -p coh-rtc && scripts/check-generated.sh Checks: MCP revision/schema/auth policy is compiler-owned, profile-gated, conformance claims match the selected mode, and `cohsh-core` grammar specs remain untouched. Deliverables: Generated MCP gateway policy and validation gates. Title/ID: m28c-a2a-policy-ir Goal: Admit A2A gateway policy in compiler IR without changing Cohesix console or NineDoor grammar. Inputs: tools/coh-rtc, configs/root_task.toml, accepted 27c semantic/capsule schemas, accepted 27d/27e run/inference schemas, docs/HOST_API.md, docs/SECURITY.md, docs/TEST_PLAN.md. Changes: - tools/coh-rtc/src/ir.rs — `gateway.a2a.*` schema for endpoint/binding, accepted revision, binding-specific operation mappings, Agent Card path, skill ids, task/artifact/stream/push bounds, callback allowlists, and prerequisite gates. - tools/coh-rtc/src/validate.rs — reject mixed-revision or mixed-binding operation names and reject A2A task-creating or task-mutating skills without their generated 28a intent/policy/fact/grant mapping, required 27a delegated authority, 27c immutable context, 27d durable run/task state, 27e inference admission/receipt, audit/replay, evidence export, and provider action prerequisites. - tools/coh-rtc/src/codegen/* — generated A2A gateway defaults, Agent Card metadata, and docs snippets. Commands: cargo test -p coh-rtc && scripts/check-generated.sh Checks: A2A revision/binding mappings are compiler-owned and internally consistent, profile gates hold, and `cohsh-core` grammar specs and NineDoor semantics remain untouched. Deliverables: Generated A2A gateway policy, Agent Card metadata, and validation gates. Title/ID: m28c-provider-action-registry-projection Milestone: Milestone 28c — MCP/A2A Gateway Projection: Read-Only First, Ticketed Writes Later / m28c-provider-action-registry-projection Goal: Consume the Milestone 27b provider/integration and use-case graph plus 27c/27e owner schemas so MCP tools and A2A skills cannot define independent schemas or availability claims. Inputs: tools/coh-rtc, apps/hive-gateway, apps/host-ticket-agent, crates/host-cuda, accepted 27c semantic/capsule outputs, accepted 27e inference outputs, configs/generated/host_integration_dependency.json, configs/generated/use_case_evidence.json, docs/INTERFACES.md, docs/HOST_API.md. Changes: - tools/coh-rtc/src/validate.rs — reject MCP/A2A projections that reference undeclared 27b actions/surfaces, duplicate 27c/27e owner schemas, or drift from target, semantic/capsule/inference receipt, read-visibility, Worker, executor, package, use-case, or observed-mode records. - apps/hive-gateway/src/actions/registry.rs — generated 27b provider/integration view consumed by MCP tools, A2A skills, evidence mapping, availability reporting, and security checks. - apps/hive-gateway/tests/gateway_action_registry.rs — parity fixtures proving MCP and A2A expose the same allowed actions, bounds, dependency availability, receipt refs, and refusal semantics where the same provider operation exists. Commands: cargo test -p coh-rtc && cargo test -p hive-gateway --test gateway_action_registry && scripts/check-generated.sh Checks: Provider/integration metadata is generated once by 27b, owner schemas remain owned by 27c/27e, projections stay protocol-neutral, missing dependencies are omitted or typed unavailable, and drift between MCP tools, A2A skills, host-ticket lines, context/receipt refs, read visibility, use-case maturity, and evidence receipts is rejected. Deliverables: Gateway protocol projection and parity tests for semantic/context, inference, CUDA/GPU, PEFT, NeMo, K8s, systemd, Docker, federation, FUSE/read surfaces, and evidence operations without a second registry. Title/ID: m28c-gateway-mcp-transport Goal: Implement MCP lifecycle and stdio/Streamable HTTP transport in `hive-gateway`. Inputs: apps/hive-gateway/src/main.rs, gateway auth/broker code, docs/HOST_API.md. Changes: - apps/hive-gateway/src/mcp/protocol.rs — MCP JSON-RPC lifecycle, capability negotiation, pagination, and error mapping. - apps/hive-gateway/src/mcp/transport.rs — stdio and Streamable HTTP endpoint handling with stdout/stderr separation and Origin validation. - apps/hive-gateway/src/main.rs — CLI/env flags for MCP enablement and endpoint selection. Commands: cargo test -p hive-gateway --test mcp_protocol Checks: Standard lifecycle and discovery requests work over both transports; invalid JSON-RPC, bad Origin, missing auth, and oversize messages fail deterministically. Deliverables: MCP-capable gateway process with safe defaults. Title/ID: m28c-mcp-resource-catalog Goal: Expose Cohesix namespace state and accepted semantic/capsule/inference artifacts as MCP resources backed only by bounded read-only projections. Inputs: apps/hive-gateway, apps/coh/src/evidence.rs, crates/cohesix-semantic-core, crates/cohesix-inference-core, generated path and visibility defaults, accepted 27c/27e fixtures. Changes: - apps/hive-gateway/src/mcp/resources.rs — typed `cohesix://namespace`, `cohesix://semantic`, `cohesix://context`, and `cohesix://inference/receipt` catalogs, templates, id/path validation, namespace dispatch through existing `LS`/`CAT`/`TAIL`, and host-artifact dispatch through accepted read-only owner libraries. - apps/hive-gateway/tests/mcp_resources.rs — resource list/read fixtures for `/proc`, `/gpu`, `/host`, semantic objects, capsules, inference receipts, visibility refusal, tamper refusal, and evidence summaries. Commands: cargo test -p hive-gateway --test mcp_resources Checks: Resource reads enforce manifest bounds, reject undeclared paths or ids, redact secrets/content, match REST/console output for namespace fixtures, and verify exact 27c/27e hashes/schemas for host artifacts without claiming a VM path. Deliverables: MCP resource catalog that faithfully projects Cohesix namespace state and accepted immutable host artifacts. Title/ID: m28c-mcp-prompts Goal: Add MCP prompt templates for safe operational workflows over existing Cohesix tools/resources. Inputs: apps/hive-gateway/src/mcp, docs/HOST_TOOLS.md, docs/SECURITY.md. Changes: - apps/hive-gateway/src/mcp/prompts.rs — prompt templates for semantic impact review, inference receipt audit, CUDA triage, PEFT promotion, NeMo readiness, K8s drain, systemd recovery, and Docker remediation. - docs/HOST_TOOLS.md — operator guidance for MCP prompt use, approval expectations, and non-authority status. Commands: cargo test -p hive-gateway --test mcp_prompts Checks: Prompts contain no secrets, name exact Cohesix tools/actions, and require user approval before side-effecting tool calls. Deliverables: MCP prompt catalog that improves operator ergonomics without becoming control state. Title/ID: m28c-readonly-mcp-acceptance-gate Goal: Prove read-only MCP transport, resources, prompts, and conformance before enabling mutating tools or A2A task creation. Inputs: apps/hive-gateway, generated MCP policy, docs/HOST_API.md, docs/TEST_PLAN.md. Changes: - apps/hive-gateway/tests/mcp_readonly_acceptance.rs — lifecycle, namespace and host-artifact resources, templates, prompts, visibility, hash/schema verification, redaction, auth, Origin, and oversize negative fixtures with mutating tools disabled. - docs/TEST_PLAN.md — record read-only MCP acceptance as the first 28c evidence gate. Commands: cargo test -p hive-gateway --test mcp_readonly_acceptance && scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m28c-qemu-mcp-readonly Checks: Standard MCP clients can discover and read admitted context, but mutating tools are unavailable or deterministically refused until provider action registry and delegated-authority gates pass. Deliverables: Archived read-only MCP conformance evidence that later mutating MCP/A2A work must cite. Title/ID: m28c-mcp-tool-catalog Goal: Expose real Cohesix operations as MCP tools without direct host execution. Inputs: apps/hive-gateway, apps/host-ticket-agent, apps/coh, crates/cohesix-semantic-core, crates/cohesix-inference-core, crates/host-cuda, accepted 27c/27d/27e schemas, docs/INTERFACES.md. Changes: - apps/hive-gateway/src/mcp/tools.rs — schema-defined tools for file reads, semantic/capsule inspect/query/render/verify, inference submit/status/receipt, CUDA/GPU inventory, host-ticket submission, GPU leases, PEFT, NeMo, K8s, systemd, Docker, and evidence summaries; each mutating call is first converted into its generated 28a typed intent. - apps/hive-gateway/src/mcp/tickets.rs — 28a admission-reference validator and host-ticket builder with id/idempotency/writer-epoch validation, provider action mapping, and generated v1/v2 selection from the required receipt mode; it contains no policy evaluator and cannot mint a grant. - apps/hive-gateway/tests/mcp_tools.rs — success and refusal fixtures for read-only, delegated mutating, duplicate, and unauthorized calls. Commands: cargo test -p hive-gateway --test mcp_tools && cargo test -p host-ticket-agent Checks: Mutating tools require an accepted non-stale 28a decision, then append only validated Cohesix ticket/control lines and cannot downgrade a receipt-bearing v2 action to v1 or synthesize Worker binding fields; inference submission uses 28a admission, the 27d host-ticket action, and 27e receipts; provider executors and model-produced tool calls are never invoked directly by the MCP server; read-only MCP acceptance and provider action registry parity evidence already exists; missing admission policy makes the mutating tool typed unavailable. Deliverables: Tool catalog covering semantic/context, inference, CUDA/GPU, PEFT, NeMo, K8s, systemd, and Docker under existing Cohesix authority. Title/ID: m28c-a2a-agent-facade Goal: Implement A2A Agent Card discovery and task/message/artifact projection over existing Cohesix semantic/capsule, run, inference receipt, and ticket state. Inputs: apps/hive-gateway, apps/host-ticket-agent, apps/coh/src/evidence.rs, accepted 27c/27d/27e owner schemas, generated provider action registry, docs/HOST_API.md, docs/API_GUIDELINES.md, accepted A2A protocol revision. Changes: - apps/hive-gateway/src/a2a/agent_card.rs — generated Agent Card publication with enabled skills, auth requirements, supported interfaces, and no secret/internal executor data. - apps/hive-gateway/src/a2a/tasks.rs — generated `SendMessage`, streaming, task query/list/cancel/subscribe, push-notification, status, idempotency, and refusal mappings for the pinned A2A binding/revision, backed by 27c immutable context refs, 27d run/checkpoint/evidence records, and 27e inference receipts. - apps/hive-gateway/src/a2a/artifacts.rs — bounded redacted artifact references for semantic objects, Context Capsules, inference receipts, evidence packs, timelines, checkpoints, provider receipts, and Cohesix resource refs. - apps/hive-gateway/src/a2a/push.rs — disabled-by-default push notification config with allowlist, SSRF validation, per-task auth material, bounded retry, and audit evidence. - apps/hive-gateway/tests/a2a_protocol.rs + apps/hive-gateway/tests/a2a_tasks.rs — Agent Card, message, stream, task, artifact, cancel, push-refusal, duplicate, and unauthorized fixtures. Commands: cargo test -p hive-gateway --test a2a_protocol && cargo test -p hive-gateway --test a2a_tasks Checks: A2A clients can discover Cohesix skills, submit dry-run tasks, observe semantic/capsule/inference refs and status/artifacts, and receive deterministic refusals; no A2A path bypasses Cohesix tickets, context/run records, 27e admission/receipts, gateway auth, or provider allowlists; provider action registry parity and read-only MCP acceptance evidence already exists. Deliverables: A2A-compatible gateway facade for bounded Cohesix delegation and observation. Title/ID: m28c-coh-mount-mcp-resource-view Goal: Add an optional read-only `coh mount --mcp-url` mode for MCP-admitted resources, schemas, prompts, and evidence links without replacing the existing REST-backed Cohesix namespace mount. Inputs: apps/coh/src/mount.rs, apps/coh/src/doctor.rs, apps/hive-gateway/src/mcp/resources.rs, apps/hive-gateway/src/mcp/tools.rs, crates/cohesix-semantic-core, crates/cohesix-inference-core, docs/HOST_TOOLS.md, docs/API_GUIDELINES.md. Changes: - apps/coh/src/mount.rs — read-only MCP resource/catalog FUSE adapter with bounded readdir/read, no write-to-tool translation, no symlink/rename/chmod support, and explicit stale-cache markers. - apps/coh/src/main.rs — `coh mount --mcp-url --read-only --at ` flags that are mutually exclusive with write-capable REST/console mount modes. - apps/coh/src/doctor.rs — report REST mount availability separately from MCP resource-mount protocol/FUSE availability and report namespace, semantic/capsule, and inference-receipt resource readiness independently. - apps/coh/tests/mount_mcp.rs — fixtures for resource reads, tool schema files, prompt template files, cache invalidation, write denial, and parity with MCP `resources/read`. - docs/HOST_TOOLS.md + docs/API_GUIDELINES.md — document when to use REST mount versus MCP resource mount and why MCP mount is read-only by default. Commands: cargo test -p coh --test mount_mcp && cargo test -p hive-gateway --test mcp_resources Checks: Existing `coh mount --rest-url` behavior is unchanged; MCP mount reads only MCP-admitted context, refuses all filesystem mutations by default, never calls MCP tools from FUSE operations, and traces every mounted file back to a Cohesix path/action or verified 27c/27e artifact/catalog entry. Deliverables: Agent- and filesystem-friendly MCP context mount that adds discovery/schema/prompt value without adding a new Cohesix write path. Title/ID: m28c-operator-docs-as-built-audit Goal: Audit and update the Operator Walkthrough plus related canonical docs so gateway, MCP, A2A, mount, provider, and evidence guidance matches the as-built implementation. Inputs: docs/OPERATOR_WALKTHROUGH.md, docs/HOST_API.md, docs/HOST_TOOLS.md, docs/API_GUIDELINES.md, docs/USERLAND_AND_CLI.md, docs/INTERFACES.md, docs/ARCHITECTURE.md, docs/SECURITY.md, docs/TEST_PLAN.md, resources/openapi/hive-gateway.yaml, apps/hive-gateway/src/**, apps/coh/src/mount.rs, apps/coh/src/doctor.rs, apps/host-ticket-agent/src/executors/**, docs/snippets/**. Changes: - docs/OPERATOR_WALKTHROUGH.md — operator sequence for direct TCP, REST/gateway, the separate OpenAI-compatible inference endpoint, `coh mount --rest-url`, semantic/capsule/inference MCP resources/tools/prompts, A2A Agent Card/task flow, optional read-only MCP resource mount, evidence capture, and deterministic failure handling. - docs/HOST_API.md + docs/API_GUIDELINES.md — MCP and A2A endpoint/auth/error semantics and transport-choice guidance aligned with the REST gateway contract. - docs/HOST_TOOLS.md + docs/USERLAND_AND_CLI.md — command references and prerequisites for `hive-gateway`, `coh mount`, MCP resource mount, A2A task facade, host-ticket-agent, GPU bridge, sidecar bridge, and grammar-stability constraints. - docs/INTERFACES.md + docs/ARCHITECTURE.md + docs/SECURITY.md + docs/TEST_PLAN.md — as-built path/action/task/artifact mappings, VM/host boundary, delegated ticket/security posture, and evidence matrix. - resources/openapi/hive-gateway.yaml — keep REST/OpenAPI routes aligned with any gateway endpoint additions and document that MCP/A2A are adjacent protocol surfaces, not REST authority replacements. Commands: git diff --check -- docs/OPERATOR_WALKTHROUGH.md docs/HOST_API.md docs/HOST_TOOLS.md docs/API_GUIDELINES.md docs/USERLAND_AND_CLI.md docs/INTERFACES.md docs/ARCHITECTURE.md docs/SECURITY.md docs/TEST_PLAN.md && scripts/check-generated.sh Checks: Documentation distinguishes direct TCP proof, REST gateway proof, 27e inference proof, gateway-backed FUSE mount, optional read-only MCP resource mount, namespace versus host-artifact resources, MCP ticket-submission tools, and A2A task/artifact/status behavior; no doc claims MCP, A2A, semantic, inference, mount, provider, or host-ticket behavior that lacks code/tests/generated evidence. Deliverables: Operator-facing documentation that is coherent with as-built 28c behavior and usable for live, mock, and dry-run workflows. Title/ID: m28c-gateway-protocol-performance Goal: Prove MCP/A2A gateway protocol projections remain bounded relative to the 27a gateway authority baseline. Inputs: apps/hive-gateway, scripts/ci/gateway_perf_probe.sh, docs/BENCHMARKS.md, docs/TEST_PLAN.md, accepted 27a gateway authority artifacts. Changes: - scripts/ci/gateway_perf_probe.sh — add namespace, semantic/capsule, and inference-receipt MCP resource reads, MCP ticket-submitting tool call, A2A task create/status stream, artifact read, and backpressure/refusal scenarios. - docs/BENCHMARKS.md + docs/TEST_PLAN.md — record protocol-projection performance as gateway evidence, separate from Pi/QEMU runtime throughput proof. Commands: - scripts/ci/gateway_perf_probe.sh --scenario mcp-a2a-protocols --state-dir out/bench/m28c-gateway-protocols Checks: - MCP/A2A protocol paths stay bounded relative to the 27a gateway authority baseline, with 27c/27e host-artifact adapter cost separated from protocol cost and queue depth, refusal counts, auth checks, and evidence/audit emission cost recorded. - A full REST/Pi/QEMU benchmark is triggered only if gateway protocol evidence shows an upstream runtime-path regression. Deliverables: - Gateway protocol performance ledger for MCP/A2A clients and downstream AI namespace work. Title/ID: m28c-gateway-agent-security-conformance Goal: Prove MCP/A2A ecosystem compatibility and preserve Cohesix security boundaries. Inputs: apps/hive-gateway, docs/SECURITY.md, docs/TEST_PLAN.md, accepted MCP protocol revision, accepted A2A protocol revision. Changes: - apps/hive-gateway/tests/mcp_security.rs — confused-deputy, prompt-injection, semantic/capsule/inference visibility and tamper, returned tool-call inertness, auth, Origin, backpressure, duplicate, and redaction negative tests. - apps/hive-gateway/tests/a2a_security.rs — Agent Card disclosure, message injection, semantic/capsule/inference ref substitution, returned tool-call inertness, task idempotency, artifact redaction, push callback, cancellation, auth, Origin, and backpressure negative tests. - docs/TEST_PLAN.md — MCP/A2A conformance and security evidence stage. - docs/HOST_API.md + docs/API_GUIDELINES.md — MCP/A2A endpoint, transport, auth, error, and client configuration guidance. Commands: cargo test -p hive-gateway --test mcp_security && cargo test -p hive-gateway --test a2a_security && scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m28c-qemu-gateway-agents Checks: Standard MCP clients and A2A peers can discover and call allowed read-only/dry-run flows; unauthorized, prompt-injected, tampered-artifact, provider-direct, model-returned, forged callback, duplicate, or overbroad calls cannot bypass delegated tickets, 28a inference admission, the 27d host-ticket action, or Cohesix policy. Deliverables: Archived MCP/A2A conformance and security evidence. ``` **Outcome** After Milestone 28c: - Cohesix can be used from standard MCP-capable agent hosts and A2A-capable peer agents through `hive-gateway`. - MCP clients see useful resources, tools, and prompts for immutable semantic objects, Context Capsules, inference receipts, CUDA/GPU, PEFT, NeMo, K8s, systemd, and Docker operations. - A2A peers can discover Cohesix skills, submit bounded dry-run or delegated tasks, observe task status, and retrieve redacted semantic/capsule/inference, CUDA/GPU, PEFT, NeMo, K8s, systemd, Docker, and evidence artifacts. - All side effects still flow through Cohesix tickets, files, policy, audit, and evidence. - Every mutating MCP/A2A projection first produces its generated typed intent and consumes an accepted 28a admission; neither protocol owns policy evaluation or grant issuance. - Inference continues to use the separate accepted 27e compatibility boundary; MCP/A2A adds ecosystem projection, not another provider path or inference protocol. - The VM grammar, Secure9P semantics, and generated manifest authority remain unchanged. ## Milestone 29 — Bounded VM-Local Persistence: Spool Stores + Settings [Milestones](#Milestones) **Status:** Conditional Release C edge-depth track. Milestone 26e is complete. M29 is not a Release A or Release B prerequisite. It may be activated for a selected profile only when an accepted user or resilience requirement shows that host-side durable run/evidence storage is insufficient. Any selected Pi persistence phase still waits for the exact QEMU/Pi SMP+MCS topology, current-image CYW43 coexistence record, and same-harness Pi performance/ repeatability baseline produced by `m26e-mcs-smp-target-acceptance`. **Why now (resilience):** Edge deployments need bounded store/forward and a small set of runtime-owned settings that survive reboot and link outage. The implementation must add that resilience without turning Cohesix into a filesystem project or destabilizing the accepted Pi 4 Wi-Fi path. **Investment boundary:** M29 completion is profile-qualified. A QEMU or non-persistent Release A profile does not wait for the Pi EMMC2 lane and cannot claim VM-local restart persistence. A selected Pi persistence profile requires the full EMMC2, raw-region, CYW43 coexistence, containment, reboot, and media evidence below. Models, datasets, checkpoints, semantic objects, inference caches, and PEFT artifacts remain host-side on configurable NVMe-backed paths; M29 must not become their storage service. **Current as-built and platform truth:** Cohesix has host-side sidecar buffering, telemetry snapshots, and U-Boot-owned `cohesix.env`, but no VM-local persistent spool/settings store, persistence manifest IR, storage runtime, block backend, or persistent NineDoor providers. The selected Pi manifest currently declares seven physical runtimes and gives the CYW43-linked `sdio-host` runtime the SDHCI controller at `0xfe300000`, the Wi-Fi power/DMA resources, GIC IRQ 158, and DMA IRQ 116. The boot microSD card is a different device on BCM2711 EMMC2 at `0xfe340000`. The pinned Pi DTB and captured Linux topology also show that `mmc0` EMMC2 and `mmc1` CYW43 SDIO multiplex the same physical GIC IRQ 158. Existing `coh-rtc` validation rejects duplicate physical IRQ owners. The canonical QEMU launcher currently attaches virtio networking but no block device. Both the pinned QEMU 10.1.0 lane and the current host diagnostic QEMU advertise `sdhci-pci` plus `sd-card`, but that is a PCI SDHCI model, not BCM2711 EMMC2. It does not represent Pi pin/card wiring, the shared IRQ-158 topology, the Pi DMA/cache path, or CYW43 coexistence. ### Objective and closure boundary M29 is complete for a selected persistence-enabled Pi profile only when the same bounded persistence semantics: 1. work deterministically on QEMU through `virtio-blk`; 2. work on the Pi 4 boot microSD through the EMMC2 controller and a manifest-bounded raw region; 3. coexist on real Pi hardware with the accepted CYW43/SDIO path without a semantic regression; 4. introduce no material CYW43 performance regression outside the accepted same-harness repeatability envelope; and 5. preserve compiler/HAL-enforced storage/CYW43 authority, containment, and restart separation. The target implementations need not be superficially symmetric. Root owns the bounded spool/settings semantics. QEMU may use the smallest direct virtual block HAL path. Pi physical I/O must use a separate isolated `driver-storage` runtime and the accepted 26e driver-supervisor contract. ### Non-negotiable scope and authority - No POSIX VFS, general filesystem, C-FFI filesystem, generic storage framework, generic SDIO framework, scheduler redesign, or new testing framework. - Persistence is distinct from the in-memory host-side `sidecars.*.adapters[].spool` and `/bus//spool` contract. - `/proc` remains read-only. Mutating spool/settings operations use documented role-scoped NineDoor control roots; M29 does not change console framing, Secure9P bounds, or TCP grammar. - QEMU uses a deterministic per-run raw image behind `virtio-blk`. QEMU proves the virtual block contract and persistence integration only; it proves no Pi EMMC2, physical-media, DMA/cache, shared-IRQ, or Wi-Fi behavior. - Pi persistence uses only a manifest-declared raw partition/range outside the FAT boot assets and `cohesix.env`. Routine reflashing continues to replace only the exact existing FAT child. Creating or changing the two-partition boot-plus-raw topology remains an explicit `--initialize-disk` operation after whole-device size and identity checks; it is never an automatic fallback. - The Pi storage runtime owns only EMMC2 MMIO at `0xfe340000`, its private block queue/buffers, generated endpoint/notification/SC/Reply/fault caps, and any later explicitly admitted storage-only DMA frames. It receives no CYW43/SDIO bus link, Wi-Fi shared aperture, Wi-Fi power-sequence page, BCM2835 SDIO DMA channel/page, IRQ 116, or IRQ 158 capability. - Existing generated uniqueness, range, badge, CSpace, temporal-admission, descriptor-seal, and containment checks must prove the storage endpoint, notifications, queues/buffers, mappings, SC/Reply, fault records, restart generation, and any DMA frames are disjoint from CYW43/SDIO. Storage may use the common driver-supervisor mechanism, but a storage fault or recovery can revoke/restart only its own generation and EMMC2 controller; it cannot quarantine, reset, wake, or otherwise act on the CYW43/SDIO pair. - Because EMMC2 and CYW43 SDIO share physical IRQ 158, initial Pi storage uses bounded PIO/status-driven service turns with EMMC2 interrupt signalling disabled. Each turn has a generated operation bound and virtual-counter deadline; no background poller or unbounded wait is allowed. Retain this simpler path if it satisfies M29. Add controller-local DMA only if early Pi evidence shows it is necessary, and then only with disjoint generated buffers and the existing bounded-no-IOMMU truth. If reliable storage would require sharing IRQ 158, changing its accepted owner, or touching the CYW43/SDIO runtime, M29 stops for an explicit authority redesign and full CYW43 requalification. - Storage uses the accepted 26e constructor, MCS admission, driver supervisor, generation, containment, teardown, and fresh readmission mechanisms. Its CPU, service priority, core, budget/period, operation size, and recovery work are derived from the smallest admitted bounds that pass the early target canaries; this plan does not preselect a core or invent a new scheduler. - Every issue, completion, flush, scan, retry, recovery, and fault path is bounded. Storage pressure or recovery cannot monopolize root-control, `driver-storage`, the driver supervisor, or the CYW43/SDIO hot path. ### Protected CYW43/SDIO baseline The exact accepted pre-M29 CYW43/SDIO implementation and evidence contract are frozen inputs. Ordinary M29 work must not refactor, generalize, deduplicate, clean up, or otherwise modify: - CYW43 or SDIO runtime code and images; - the CYW43-SDIO ABI, shared aperture, notifications, CARD_INT/DPC path, IRQ ownership, or completion rings; - Wi-Fi scheduling, deadlines, retry ceilings, restart/recovery order, error classification, or operator proof semantics; or - the accepted Wi-Fi harness, counters, and repeatability classification, except for the smallest evidence consumer needed to correlate an unchanged counter with an M29 run. Generated source/configuration review must show whether these surfaces are byte-identical. Adding `driver-storage` may change the aggregate driver-archive hash, but the embedded CYW43 and SDIO component bytes and hashes must remain identical to the frozen inputs. A demonstrated need to touch one moves the change out of the ordinary storage lane and requires an explicit task revision, causal Pi evidence, and complete CYW43 requalification. Storage adapts to the accepted Wi-Fi boundary. ### QEMU SDHCI decision `sdhci-pci` plus `sd-card` is not a mandatory M29 lane. In the current architecture it would require a new QEMU PCI storage attachment/admission path and exercise a different controller integration while leaving the decisive Pi EMMC2/shared-IRQ/CYW43 risks untouched. That work is not justified merely to claim SD parity. A bounded non-acceptance experiment may be run after the virtio raw-block canary. Promote it to a supplemental QEMU acceptance lane only if the Pi work has already produced a controller-independent SD/MMC command/block core and the remaining QEMU adapter is a thin, low-risk reuse with no new generic PCI or storage framework. Otherwise record the experiment or rationale and stop. A macOS `/dev/rdiskN` backend is likewise optional manual diagnostics only, after exact removable-media verification and unmount; it is never CI, canonical QEMU, or acceptance evidence and its absence cannot block M29. ### Persistent semantics - **Telemetry spool:** fixed-size append-only ring; versioned bounded records `magic | version | kind | seq | ts | len | crc | payload`; incomplete or invalid tails are ignored; deterministic scan budget; explicit refuse-when- full or overwrite-only-acked policy. - **Settings:** two fixed A/B pages with generation and checksum; write and validate the inactive page before its generation becomes current; strict byte/UTF-8/key/value bounds. - **Identity:** store metadata binds to the selected manifest fingerprint without adding a trust root. - **Namespace:** `/proc/spool/{status,read}` is read-only; `/queen/spool/{append,ack}` is Queen-controlled; settings use the smallest role-scoped control/read surface agreed in `ARCHITECTURE.md` and `INTERFACES.md`. Worker telemetry continues through its existing path. - **Policy separation:** settings cannot contain or override U-Boot-owned network mode/interface/static-IP/Wi-Fi credentials in `cohesix.env`, or manifest-authored boot policy mirrored through `/chosen/cohesix,*`. ### Target-first evidence ladder 1. Freeze the exact accepted pre-M29 CYW43 artifact/evidence baseline and add only cheap deterministic tests for persistence encoding, bounds, A/B commit selection, block ABI/layout, and manifest rejection. 2. Boot the smallest raw read/write/flush/reopen canary on QEMU `virtio-blk`; do not build the spool/settings stack first. 3. Add the smallest EMMC2 PIO/no-signal `driver-storage` path and prove one raw-region write/flush/reboot/read on Pi 4 as soon as it is buildable. 4. On that same early Pi candidate, prove existing CYW43 association, DHCP, raw TCP, bounded storage activity, no shared-IRQ assertion, and no Wi-Fi or SDIO reset/restart before adding higher persistence semantics. 5. Add spool semantics, repeat the cheap QEMU and Pi roundtrip/coexistence gates, then add settings semantics and repeat them. Add a regression after a target defect only when the cause is an independently testable deterministic contract. 6. After the feature set converges, run the complete exact-artifact QEMU and Pi acceptance, storage fault/recovery, Wi-Fi repeatability, and same-harness performance comparisons. Intermediate canaries remain non-claiming. Do not require exhaustive unit, fuzz, crash, or broad workspace testing before the first QEMU and Pi canaries. Deterministic tests cover semantic commit cuts, malformed input, and observed target defects; they do not simulate Pi IRQ, DMA/cache, scheduling, or media truth. ### Commands - `cargo test -p coh-rtc persistence` - `cargo test -p root-task --test persistence` - `cargo test -p pi4-driver-abi block` - `cargo test -p pi4-driver-runtime storage` - `scripts/ci/test_plan_converge.sh --target qemu --focus ninedoor --operation-script scripts/cohsh/spool_roundtrip.coh` - `scripts/ci/test_plan_converge.sh --target pi4 --focus pi4-driver --operation-script scripts/cohsh/spool_roundtrip.coh --pi4-target-evidence --pi4-readback-image --pi4-identity-metadata --pi4-serial-log --pi4-host ` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m29-qemu` - `scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m29-pi4` - the exact accepted CYW43 repeatability and performance commands named by the frozen pre-M29 baseline; do not substitute a new M29-only harness ### Checks (DoD) - QEMU proves deterministic raw-block, spool, settings, reboot/reopen, invalid- tail, and selected fault/recovery behavior through `virtio-blk` on the exact named image and initial disk bytes. It makes no Pi claim. - Pi proves the manifest-declared raw region through the isolated EMMC2 runtime, with no root-owned storage MMIO and no storage cap or link for IRQ 158, IRQ 116, `0xfe300000`, the Wi-Fi power/DMA pages, or CYW43 shared state. - Generated admission and the observed runtime inventory agree for MMIO, endpoints, notifications, SC/Reply, faults, queues/buffers, DMA if present, generation, containment anchors, and restart domain. Existing duplicate-IRQ and resource-ownership evidence is reused rather than restated by a second M29 proof system. - Storage completion, flush, scan, fault, teardown, and recovery remain within declared service/deadline bounds. Fault injection leaves no stale caps, mappings, ring work, Reply/SC association, DMA/shared buffer, or old runtime generation; fresh service requires fresh generated readmission. - Spool append/read/ack and settings A/B semantics are deterministic and bounded; offline store/forward and reboot recovery work on both targets; malformed and partial state fails closed. - `/proc` stays read-only; U-Boot policy, FAT boot assets, sidecar spool semantics, console/TCP behavior, and the absence of a general filesystem are preserved. - On fresh exact-image Pi runs, persistence-disabled/pre-M29, M29-enabled-idle, M29-under-load, and one meaningful storage fault/recovery case retain comparable environmental and harness conditions. Every counted M29 Wi-Fi boot reaches association, host EAPOL, DHCP, raw TCP, authenticated `cohsh`, and the accepted focused workloads with no semantic error, CYW43/SDIO reset or restart caused by storage, hidden timeout/retry success, authority leak, unresolved storage/driver fault, or operator-liveness regression. - Compare exact pre-M29 baseline -> M29 idle and M29 idle -> representative storage load using the existing accepted workload and counters. No arbitrary percentage allowance is introduced. A material delta outside the established same-harness repeatability envelope is investigated and blocks closure until explained and resolved or explicitly requalified. ### Compiler touchpoints - `coh-rtc` emits persistence limits, settings bounds, backend and raw-region selection, the Pi storage-runtime descriptor, temporal admission, and the existing generation-keyed driver authority inventory. - Pi validation admits `pi4-emmc2-raw` only with EMMC2 `0xfe340000`, a bounded raw region, an isolated MCS runtime, no physical IRQ row, no CYW43 bus link, and disjoint runtime/shared/DMA resources. The existing duplicate-physical- IRQ validator continues to reject any attempt to grant IRQ 158 twice. - Validation rejects CYW43, `sdio-host`, USB/local-seat, FAT, `cohesix.env`, root-owned physical MMIO, or an undeclared region as a storage backend. Persistence IR and generated clients remain distinct from sidecar spool IR. ### Task Breakdown ``` Title/ID: m29-contract-baseline-admission Milestone: Milestone 29 — Bounded VM-Local Persistence: Spool Stores + Settings / pre-M29 freeze and generated persistence admission Goal: Freeze the exact accepted CYW43 comparator and admit only the minimum target-specific persistence resources and semantics. Inputs: accepted `m26e-mcs-smp-target-acceptance` QEMU/Pi records and benchmark artifacts, configs/root_task.toml, configs/root_task_pi4_uboot_aarch64.toml, tools/coh-rtc/src/**, apps/root-task/src/hal/**, tools/cohesix-py/**, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/BENCHMARKS.md. Changes: - docs/BENCHMARKS.md + M29 evidence record — reference, without copying or reclassifying, the exact accepted pre-M29 CYW43 image, manifest, driver archive, repeatability set, workload, counters, and environmental notes used for final comparison. - tools/coh-rtc/src/** + configs/root_task*.toml — add bounded `persistence.*` semantics/backend/region fields and the Pi `driver-storage` image/task record; QEMU selects `virtio-blk`, Pi selects `pi4-emmc2-raw`; generated paths remain distinct from host sidecar spool paths. - compiler/HAL validation — Pi storage is exactly EMMC2 `0xfe340000`, has no physical IRQ row or CYW43 bus link, and cannot name or receive IRQ 158, IRQ 116, `sdio-host`, `cyw43455`, Wi-Fi MMIO/power/DMA/shared resources, USB/local-seat, FAT, `cohesix.env`, or root-owned physical MMIO. Reuse the existing duplicate-IRQ, image/hot-path uniqueness, temporal admission, cap-layout, descriptor-seal, generation, and containment invariants. - compatibility review — record required generated/document changes for `cohsh`, `coh`, `.coh` fixtures, `hive-gateway`, `tools/cohesix-py`, release packaging, and performance scripts; do not add an independent client-side persistence authority. Commands: - cargo test -p coh-rtc persistence - scripts/check-generated.sh Checks: - The comparator names immutable accepted M26e evidence, not historical M26b data or a newly selected favorable sample. - Invalid/overlapping resources, a second IRQ-158 owner, non-MCS Pi storage, sidecar-spool aliasing, and forbidden settings keys fail generation. - No CYW43/SDIO source, ABI, manifest resources, scheduling semantics, restart logic, harness, or evidence classification changes. Deliverables: - Minimal generated persistence contract, exact pre-M29 comparison input, and compatibility-review record. Title/ID: m29-qemu-virtio-raw-canary Milestone: Milestone 29 — Bounded VM-Local Persistence: Spool Stores + Settings / first target integration Goal: Prove the bounded raw-block contract on QEMU before implementing spool/settings or Pi controller detail. Inputs: `m29-contract-baseline-admission`, apps/root-task/src/hal/**, apps/root-task/src/drivers/virtio/**, scripts/qemu-run.sh, scripts/lib/qemu_launch_artifacts.py, canonical QEMU profiles. Changes: - apps/root-task/src/hal/block.rs + apps/root-task/src/storage/layout.rs — the smallest role-selected bounded read/write/flush/reopen contract and raw-region bounds used by both target semantics. - apps/root-task/src/drivers/virtio/** — `virtio-blk` backend for QEMU only; no Pi or physical-driver claim. - QEMU launch/evidence tooling — create a deterministic initial raw disk image, copy it to one mutable per-run image, attach it to the canonical `virt` launch, and bind initial/final image identity and geometry without making a mutated disk invalidate immutable kernel/root launch evidence. - optional diagnostic only — try `sdhci-pci` + `sd-card` only under the promotion rule above; do not create a PCI/storage framework or block this task on the result. Commands: - cargo test -p root-task --test block_contract - python3 -m pytest -q tests/test_qemu_launcher_profile.py tests/test_qemu_launch_artifacts.py - scripts/ci/test_plan_converge.sh --target qemu --focus root-mcs --operation-script scripts/cohsh/storage_raw_roundtrip.coh Checks: - One exact QEMU boot writes, flushes, reopens after reboot, and reads the expected bounded raw blocks with stable typed errors for bounds and injected I/O failure. - No spool/settings implementation, Pi emulation claim, broad regression suite, or mandatory SDHCI lane precedes this canary. Deliverables: - Non-claiming QEMU raw-block canary and an explicit retained/rejected QEMU-SDHCI decision. Title/ID: m29-pi4-emmc2-raw-canary Milestone: Milestone 29 — Bounded VM-Local Persistence: Spool Stores + Settings / early physical storage and Wi-Fi coexistence Goal: Prove the smallest isolated EMMC2 raw-block path on Pi 4 and immediately test it beside accepted CYW43. Inputs: `m29-qemu-virtio-raw-canary`, accepted 26e Pi driver constructor/supervisor, configs/root_task_pi4_uboot_aarch64.toml, pinned Pi DTB and Linux topology capture, crates/pi4-driver-abi/**, apps/pi4-driver-runtime/**, apps/root-task/src/hal/**, scripts/pi4-image-build.sh, docs/HARDWARE_BRINGUP.md. Changes: - scripts/pi4-image-build.sh — extend only explicit `--initialize-disk` to create and verify the manifest-sized FAT boot plus unformatted raw persistence topology after exact whole-device identity/size checks; add a non-destructive planner test; leave routine exact-FAT-child reflashing, policy preservation, stage-only behavior, and U-Boot `mmc 0:1` loading unchanged. - crates/pi4-driver-abi/** + apps/pi4-driver-runtime/** + HAL — add fixed pointer-free block request/completion records and isolated `driver-storage` service over EMMC2 `0xfe340000`; begin with bounded PIO/status completion, EMMC2 signal-enable clear, no physical IRQ cap, explicit device deadlines, and the accepted 26e MCS/supervisor/Reply/fault/generation lifecycle. - selected Pi manifest/generated output — declare only storage-private ring/shared buffers and the derived temporal/resource budget; retain the existing three-entry physical IRQ topology and the complete existing CYW43-SDIO link unchanged. - bounded fallback decision — retain PIO if it meets the canary. Consider controller-local DMA only after same-image evidence demonstrates a need; never borrow the accepted SDIO DMA page/channel, IRQ 116, or buffers. Commands: - bash -n scripts/pi4-image-build.sh - python3 -m pytest -q tests/test_pi4_image_build.py - cargo test -p pi4-driver-abi block - cargo test -p pi4-driver-runtime storage - scripts/cohesix-build-run.sh --clean --no-run --cargo-target aarch64-unknown-none - scripts/pi4-image-build.sh --manifest configs/root_task_pi4_uboot_aarch64.toml --clean - scripts/ci/test_plan_converge.sh --target pi4 --focus pi4-driver --operation-script scripts/cohsh/storage_raw_roundtrip.coh --pi4-target-evidence --pi4-readback-image --pi4-identity-metadata --pi4-serial-log --pi4-host Checks: - A fresh exact Pi image performs one raw-region write/flush/reboot/read through `driver-storage` with no root EMMC2 mapping, out-of-region access, unbounded wait, or stale generation. - The same early candidate reaches accepted CYW43 association, DHCP, raw TCP, and authenticated `cohsh` while storage is idle and during a bounded raw-block burst; EMMC2 does not signal shared IRQ 158 and no CYW43/SDIO reset, restart, timeout masking, or semantic error occurs. - Any failure that requires IRQ sharing or CYW43/SDIO edits stops this task; it is not patched as ordinary storage bring-up. Deliverables: - Earliest useful boot-bound Pi EMMC2 proof and a go/no-go decision before higher persistence semantics. Title/ID: m29-persistence-semantics-increments Milestone: Milestone 29 — Bounded VM-Local Persistence: Spool Stores + Settings / incremental stores and namespace Goal: Add demonstrated spool then settings semantics, repeating the cheapest meaningful QEMU and Pi gate after each increment. Inputs: `m29-pi4-emmc2-raw-canary`, apps/root-task/src/storage/**, apps/root-task/src/ninedoor.rs, apps/nine-door/**, scripts/cohsh/**, tools/cohesix-py/**, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/SECURITY.md, docs/SECURITY_NIST_800_53.md. Changes: - spool increment — implement bounded ring records, partial-tail rejection, deterministic scan/ack/full policy, manifest binding, `/proc/spool/{status,read}`, and `/queen/spool/{append,ack}`; then rerun focused QEMU and same-boot Pi roundtrip/CYW43 coexistence before settings work. - settings increment — implement bounded A/B generation/checksum selection for runtime-owned local settings, explicitly rejecting U-Boot network/Wi-Fi and manifest boot-policy keys; then repeat both target gates. - deterministic guards — cover semantic commit cuts, malformed/bounded decoders, a known block-image fixture, authorization, and disabled/missing profiles. Use a host `nine-door` mirror only where it is the smallest fixture adapter; root-target semantics remain authoritative. - compatibility and docs — add focused `.coh` roundtrips and generated Python availability/bounds, update security/data-at-rest/retention/erase posture and canonical interfaces, and keep sidecar spool names and behavior unchanged. Commands: - cargo test -p root-task --test persistence - cargo test -p nine-door --test persistence - cohsh --script scripts/cohsh/spool_roundtrip.coh - cohsh --script scripts/cohsh/settings_roundtrip.coh - python3 -m pytest -q tools/cohesix-py/tests/test_persistence.py - scripts/ci/test_plan_converge.sh --target qemu --focus ninedoor --operation-script scripts/cohsh/spool_roundtrip.coh - scripts/ci/test_plan_converge.sh --target pi4 --focus pi4-driver --operation-script scripts/cohsh/spool_roundtrip.coh --pi4-target-evidence --pi4-readback-image --pi4-identity-metadata --pi4-serial-log --pi4-host Checks: - Each store's deterministic contract passes before and after reboot on QEMU and Pi; target evidence, not a host model, establishes physical persistence. - Each material increment retains the early Pi CYW43 functional/coexistence gate without broad reruns or speculative hardware simulations. Deliverables: - Bounded target-authoritative spool/settings namespace plus the smallest useful host/client regression surfaces. Title/ID: m29-target-acceptance Milestone: Milestone 29 — Bounded VM-Local Persistence: Spool Stores + Settings / frozen-artifact QEMU and Pi acceptance Goal: Accept deterministic persistence on both targets and prove Pi storage authority, failure containment, and CYW43 functional/performance non-regression. Inputs: all preceding M29 tasks, exact accepted pre-M29 comparator, frozen QEMU/Pi images and manifests, initial/final disk identities, fresh Pi readback/serial/capture evidence, existing CYW43 repeatability and performance harness, docs/TEST_PLAN.md, docs/BENCHMARKS.md. Changes: - verification-only gate — make no runtime, manifest, generated-policy, harness, or image change; drift returns to the owning implementation task and invalidates affected evidence. - QEMU acceptance — run deterministic raw-block/spool/settings/reboot/crash-cut/fault cases through `virtio-blk` and the applicable staged Test Plan. Any supplemental SDHCI result remains separately typed and cannot strengthen the Pi claim. - Pi authority/fault acceptance — bind storage region, EMMC2 MMIO, absence of IRQ/DMA/CYW43 authority, generated/observed cap and runtime inventory, bounded MCS service, teardown, and fresh-generation recovery; exercise one meaningful storage failure/recovery while Wi-Fi stays live. - Pi CYW43 acceptance — using comparable environmental conditions and the established workload/counters, compare exact pre-M29 baseline -> exact M29 persistence-enabled idle, then M29 idle -> representative sustained storage load. Preserve every run, error, timeout, retry, reset/restart, loss, reconnect, latency, throughput, DPC/IRQ, deadline, queue, fault, and operator-liveness classification already emitted by the accepted harness. Add instrumentation only if an observed delta cannot be decided or diagnosed from existing evidence. Commands: - scripts/check-generated.sh - scripts/ci/check_test_plan.sh - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m29-qemu - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m29-pi4 - the exact frozen pre-M29 CYW43 repeatability and same-harness performance commands for baseline, M29 idle, and M29 storage-load runs Checks: - QEMU and fresh Pi independently pass their applicable persistence and staged acceptance; neither target's record substitutes for the other. - Wi-Fi is repeatably healthy with persistence enabled idle, under representative sustained storage, and through one storage fault/recovery; storage causes no CYW43/SDIO reset/restart, semantic/traffic error, authority leak, hidden timeout/retry success, or operator-liveness loss. - Baseline-to-idle and idle-to-load results remain inside the established repeatability envelope. Any material delta is investigated from same-boot evidence rather than waived with a new percentage allowance. - Complete storage fault containment and readmission are accepted in M29; later production-ledger projection cannot be used to defer basic safety. Deliverables: - Separate exact-artifact QEMU and Pi M29 acceptance records plus a reviewable CYW43 non-regression comparison bound to the accepted pre-M29 baseline. ``` ### Rabbit-hole review The following work is deliberately absent or conditional because it does not change the M29 accept/reject decision at proportionate cost: - mandatory QEMU `sdhci-pci` parity, a QEMU hardware-emulation project, and a canonical macOS raw-device dependency; - a generic filesystem, generic block/storage framework, generic SDIO layer, USB mass-storage profile, scheduler redesign, or CYW43 cleanup; - a fixed storage CPU/core/priority topology or controller DMA before the early Pi PIO canary establishes a need; - exhaustive byte-by-byte power-loss campaigns before target integration; tests cover the store's defined commit cuts and observed failure contracts; - a new percentage performance allowance, a broad new Wi-Fi metric suite, or full QEMU/Pi acceptance after every small edit; and - duplicate M29 resource proofs where the generated manifest, existing duplicate-IRQ validator, sealed runtime descriptor, and 26e supervisor evidence already establish the invariant. The questions intentionally left to early M29 experiments are whether bounded PIO with EMMC2 interrupt signalling disabled meets the needed persistence rate, whether controller-local DMA is therefore necessary, which existing storage fault injection gives the most decision-rich recovery case, and whether an already-factored SD/MMC core ever makes the optional QEMU SDHCI lane cheap enough to promote. None is a reason to design around Pi behavior before the first physical canary. ## Milestone 29a — Core-Local Service-Turn Scheduling (SMP Hot-Path Optimization) [Milestones](#Milestones) **Delivery posture:** Conditional Release C performance work. This milestone is activated only when accepted same-harness QEMU or Pi evidence shows a specific throughput, contention, locality, or tail-latency SLO miss and the smallest bounded fix within the existing 26e scheduler cannot close it. It is not a prerequisite for Milestones 27, 27a-27f, or a release that makes no core-local service-bucket claim. **Why now (core-local performance with proof):** Milestone 25 established the architectural rule for multicore Cohesix: use isolated seL4 tasks and manifest affinity, not bulky SMP libraries, shared thread pools, or hidden work stealing. Completed Milestone 26b supplies the accepted isolated runtime same-harness benchmark gate. Milestones 26c, 26d, 26e, 28, and 29 add the missing enforcement substrate around generated worker/driver scheduling evidence, seL4 baseline alignment, the accepted SMP+MCS temporal-authority model, persistence drains, proof witnesses, HAL authority checks, and verification gates. Milestone 29a is the right point to consume accepted SC/core placement and accepted 26b hot-path closure as compiler-owned core-local service scheduling without weakening authority, replay, or hardware-proof boundaries; it does not reopen scheduler selection. **As-built alignment note:** Cohesix already has manifest affinity, `smp activity`, manifest-declared isolated driver runtime active-slot rules, bounded service-turn language, and host-safe pressure evidence. Milestone 26b owns the first isolated runtime benchmark comparator, same-harness Pi/QEMU benchmark evidence, and immediate bounded driver hot-path fixes. Cohesix does **not** yet have compiler-owned core-local service buckets, generated per-core service-turn budgets, per-core telemetry/spool drain policy, IRQ-locality witnesses, or Pi/QEMU evidence proving that hot paths stay local to their assigned core under mixed load. Older prose must not claim core-local hot-path scheduling or multicore throughput closure until this milestone has passing evidence. **Non-negotiable constraints** - No POSIX threads, general SMP runtime, async executor, shared work-stealing queue, or bulky SMP library inside the VM. - No new in-VM protocols, console grammar, Secure9P verbs, namespace authority, or root-owned physical-driver hot paths. - Authoritative state remains serialized through the authority path; parallelism is only at bounded, manifest-declared service edges. - Physical hardware driver service remains restricted to manifest-declared isolated driver runtimes. Root-task may admit HAL resources, publish descriptors, and observe counters; it must not regain steady-state device ownership. - Backpressure is explicit and deterministic: saturated service buckets return bounded busy/overrun evidence, not unbounded queue growth. - Physical Pi 4 multicore throughput claims require fresh target evidence and must stay separate from shell transport, USB keyboard, Wi-Fi, HDMI, and flash proof lanes. ### Prerequisite - Before executable Worker service buckets may be enabled, Milestone 26e task `m26e-worker-supervisor-child-isolation`, `m26e-host-worker-integration`, and `m26e-worker-target-evidence-promotion` must be complete for the selected profile, including applied Worker scheduling, coalesced-notification, complete-teardown, host-receipt, and exact-target evidence. WorkerBus remains model-only and excluded. - Milestone 26e task `m26e-mcs-smp-target-acceptance` must be complete for both QEMU and Pi 4. Milestone 29a consumes that single SMP+MCS architecture and may not add a scheduler switch, classic compatibility profile, or fallback path. - Milestone **26e** completed for the selected service topology so NineDoor, console/network, Worker, and root-task bucket ownership is assigned to real as-built tasks rather than the superseded root-owned/model-only layout. - The Milestone **28 core** completed for the selected scheduling claims, including proof witnesses, HAL/driver-task authority checks, and verification-gate evidence. Milestone 29 persistence is required only when the measured hot path includes a selected persistent-spool drain. - Milestones **26a** and **26b**, plus Milestones **26c** and **26d**, completed or explicitly scoped where their artifacts are inputs to Pi 4 driver-runtime, isolated runtime benchmark evidence, affinity, seL4 baseline, and target-qualified proof. ### Goal Convert existing manifest affinity into **core-local, bounded service-turn execution** for workers, manifest-declared isolated driver runtimes, NineDoor/provider paths, telemetry drains, and persistent-spool drains while preserving Cohesix's file-shaped control plane, deterministic ordering, and tiny TCB. This milestone optimizes the runtime shape; it does not add user-visible capabilities. Its success criteria are lower contention, bounded hot-path latency, deterministic busy/yield evidence, and proof that multicore work stays inside generated authority and scheduling contracts. ### Deliverables #### A) Compiler-owned core-local service IR - Extend `coh-rtc` with profile-qualified scheduling fields for: - per-core service buckets, - per-role and per-driver service-turn budgets, - bounded burst size, - queue depth, - IRQ/locality hints, - backpressure policy, - telemetry/spool drain assignment. - Generated manifests identify which core owns each bucket, which roles/drivers feed it, and which counters prove bounded execution. - Validation rejects: - roles assigned to unavailable cores, - physical-driver hot paths without isolated runtime ownership, - unbounded queues or bursts, - a bucket core that differs from its owner's SchedControl/SC core, - cross-core donation for IRQ- or locality-bound work, - overlapping authority that would let a worker or driver bypass its cap bundle or HAL-declared resources. #### B) Core-local event pumps - Root-task, NineDoor/provider adapters, workers, and manifest-declared isolated driver runtimes drain only their assigned bucket unless an explicit manifest rule declares a bounded handoff. - Each service turn has fixed max work, max bytes, and max completions. - Authority decisions remain serialized; local buckets may prepare, parse, drain, publish counters, and return deterministic busy/yield status. - Every service bucket remains inside its admitted MCS budget and exposes scheduling-context binding, consumed-budget, timeout, Reply/donation, and overrun evidence. Per-turn max work/bytes/completions remain independent application bounds rather than being replaced by the SC budget. #### C) Core-local linked-driver hot-path integration - Build on the Milestone 26b bounded batching and counter evidence by binding GENET, CYW43, SDIO, USB, HDMI, serial, and PCIe service loops to generated service buckets. - Payload-bearing submits continue to use the staged active-slot path: range validation, staged-byte fingerprint, busy-on-conflict, and no overwrite of an in-flight turn. - Routine successful dataplane turns must not spam UART or corrupt foreground console output; hot counters are exposed through bounded observability instead. - IRQ notification, DMA/cache maintenance, service turn, and completion publication stay local to the assigned runtime core wherever the platform profile supports it. #### D) Sharded telemetry and spool drains - Per-core telemetry buffers keep producer hot paths local and publish deterministic summaries into the existing namespace. - Persistent-spool drain policy from Milestone 29 remains authoritative: no general filesystem, no `/proc` mutation, and append/ack semantics remain role-scoped. - Merge order is deterministic by generated bucket id, sequence, and timestamp fields; lost, dropped, or overwritten records carry explicit bounded evidence. #### E) Observability, evidence, and verification - `smp activity` extends from assignment-bucket diagnostics to service-bucket evidence: - per-core service turns, - budget exhaustions/yields, - busy returns, - max observed turn latency, - queue depth high-water marks, - driver/worker bucket membership, - IRQ/locality proof where available. - `/proc/schedule/*`, evidence packs, and generated proof witnesses include the same bounded service-bucket records. - Verification checks prove the generated bucket layout matches resolved manifests, generated Rust tables, HAL grants, driver-task resources, and cap-bundle authority where enabled. #### F) Pressure and target-qualified proof lanes - Host-safe pressure tests validate mixed Secure9P, worker telemetry, driver-task, and spool-drain load without claiming Pi hardware throughput. - QEMU SMP tests prove semantic stability and contention reduction against the generated schedule evidence. - Pi 4 tests prove hardware throughput only with fresh logs that also separate flash proof, shell transport, USB/local-seat, Wi-Fi/GENET, HDMI, and SMP service-bucket evidence. - Full same-harness benchmark closure is required in this milestone because the runtime scheduling model changes: QEMU and Pi 4 REST harness evidence must compare 29a results against the accepted 26d rolling baseline, and every claimed improvement or regression must cite service-bucket counters plus target-qualified proof. ### Commands - `cargo test -p coh-rtc` - `cargo test -p root-task --tests schedule` - `cargo test -p pi4-driver-abi` - `cargo test -p pi4-driver-runtime` - `scripts/check-generated.sh` - `scripts/ci/verification_gate.sh` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m29a-qemu-service-buckets` - `python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m29a-pi4-service-buckets` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m29a-qemu-smp` - `scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m29a-pi4-smp` ### Checks (DoD) - Generated manifests and proof witnesses identify every service bucket, owner core, role/driver membership, budget, burst limit, queue bound, and backpressure rule. - QEMU and Pi 4 profiles prove scheduling-context/core binding, donation/Reply ownership, timeout-fault routing, consumed-budget evidence, aggregate admission bounds, root/emergency/fault reserves, and absence of a classic scheduling fallback. - Manifest-declared isolated driver runtimes keep payload-bearing work on staged active-slot APIs, return busy on conflicting payloads, and never overwrite in-flight turns. - Service-bucket integration preserves the Milestone 26b batching and counter bounds while reducing multicore contention without changing ACK/ERR/END, Secure9P, console, worker namespace, or persistent-spool semantics. - `smp activity` and `/proc/schedule/*` report bounded service-bucket counters with `cpu_pct=unavailable` unless a real kernel-backed utilization source exists. - Host-safe pressure tests pass and remain classified as semantic/regression evidence, not Pi hardware throughput proof. - QEMU and Pi 4 target-qualified Test Plan runs pass with no undocumented output drift; Pi 4 throughput claims cite fresh target evidence and keep USB/Wi-Fi/HDMI/shell proof lanes separate. - Same-harness REST benchmark artifacts show whether service buckets improved, preserved, or regressed the 26d rolling baseline; any tuning remains bounded by generated service-bucket policy and cannot relax backpressure or proof-lane separation. ### Compiler touchpoints - `coh-rtc` emits service-bucket tables beside existing affinity, worker/driver scheduling, driver-image, persistence, and proof-witness outputs. - Manifest validation fails closed when service-bucket topology conflicts with authority, HAL resource grants, driver-runtime ownership, cap-bundle records, or persistence bounds. - Generated docs snippets summarize the service-bucket layout; hand-maintained docs may describe those snippets but must not become the scheduling source of truth. ### Task Breakdown ``` Title/ID: m29a-smp-service-ir Goal: Add compiler-owned core-local service bucket IR and validation. Inputs: tools/coh-rtc, configs/root_task*.toml, docs/ROLES_AND_SCHEDULING.md, docs/INTERFACES.md. Changes: - tools/coh-rtc/src/ir.rs — service-bucket schema for core, role/driver membership, budget, burst, queue, IRQ-locality, and backpressure fields. - tools/coh-rtc/src/validate.rs — reject unavailable cores, unbounded queues/bursts, physical-driver ownership drift, and authority conflicts. - tools/coh-rtc/src/codegen/* — emit generated Rust/docs/proof-witness service-bucket tables. Commands: cargo test -p coh-rtc && scripts/check-generated.sh Checks: Service-bucket manifests are generated from IR, invalid topology fails closed, and generated docs match resolved manifests. Deliverables: Compiler-owned service-bucket topology for QEMU and Pi 4 profiles. Title/ID: m29a-core-local-event-pumps Goal: Drain worker, provider, NineDoor, and root-task work through bounded core-local service turns. Inputs: apps/root-task/src/event, apps/root-task/src/ninedoor.rs, apps/worker-*, apps/root-task/src/generated. Changes: - apps/root-task/src/event/** — service-turn dispatcher keyed by generated bucket id. - apps/root-task/src/ninedoor.rs — bounded provider/session drains using generated bucket membership. - apps/worker-heart + apps/worker-gpu + apps/worker-lora — keep worker loops within generated service-turn budgets where enabled. Commands: cargo test -p root-task --tests schedule && cargo test -p worker-heart && cargo test -p worker-gpu && cargo test -p worker-lora Checks: Each loop respects max work, bytes, completions, and deterministic busy/yield behavior; authority decisions remain serialized. Deliverables: Core-local event-pump execution without a VM thread pool or work-stealing runtime. Title/ID: m29a-linked-driver-hotpath-batching Goal: Bind Milestone 26b manifest-declared isolated driver runtime batching and counters to generated core-local service buckets while preserving staged active-slot semantics. Inputs: apps/pi4-driver-runtime, crates/pi4-driver-abi, apps/root-task/src/hal/driver_task.rs, docs/DRIVERS.md. Changes: - apps/pi4-driver-runtime/src/** — assign GENET, CYW43, SDIO, USB, HDMI, serial, and PCIe bursts/counters to generated service buckets. - crates/pi4-driver-abi/src/** — expose fixed-layout service-bucket membership, counter, and max-turn evidence. - apps/root-task/src/hal/driver_task.rs — preserve staged active-slot submit, busy-on-conflict, and completion publication invariants under batching. Commands: cargo test -p pi4-driver-abi && cargo test -p pi4-driver-runtime && cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib Checks: Service-bucket integration keeps batching bounded, does not add root-owned physical-driver paths, and cannot overwrite active payload-bearing turns. Deliverables: Core-local isolated runtime hot paths with contract-local backpressure. Title/ID: m29a-telemetry-spool-sharded-drain Goal: Keep telemetry and persistent-spool drains core-local while preserving existing namespace and persistence semantics. Inputs: apps/root-task/src/storage, apps/root-task/src/ninedoor.rs, docs/ARCHITECTURE.md, docs/INTERFACES.md. Changes: - apps/root-task/src/storage/spool.rs — generated bucket assignment for drain/flush work without changing append/ack semantics. - apps/root-task/src/ninedoor.rs — deterministic merge order for per-core telemetry summaries and spool status reads. - docs/ARCHITECTURE.md + docs/INTERFACES.md — document per-core drain evidence as observability, not new authority. Commands: cargo test -p root-task --test spool && cargo test -p nine-door --test spool Checks: Spool append/read/ack fixtures stay byte-stable; per-core telemetry merge order is deterministic and bounded. Deliverables: Core-local telemetry/spool drain path that does not become a general filesystem or new protocol. Title/ID: m29a-smp-observability-and-proof Milestone: Milestone 29a — Core-Local Service-Turn Scheduling (SMP Hot-Path Optimization) / Python schedule-evidence projection compatibility Goal: Expose service-bucket proof through `smp activity`, `/proc/schedule/*`, evidence packs, and verification witnesses. Inputs: apps/root-task/src/event/mod.rs, apps/root-task/src/ninedoor.rs, apps/coh/src/evidence.rs, tools/coh-rtc, tools/cohesix-py/cohesix/evidence.py, tools/cohesix-py/tests/test_evidence_receipts.py, docs/USERLAND_AND_CLI.md, docs/TEST_PLAN.md. Changes: - apps/root-task/src/event/mod.rs — extend `smp activity` with service-bucket counters, busy/yield counts, max-turn latency, and IRQ-locality proof rows. - apps/root-task/src/ninedoor.rs — bounded `/proc/schedule/*` service-bucket summaries. - apps/coh/src/evidence.rs — include service-bucket snapshots in evidence packs. - tools/cohesix-py/cohesix/evidence.py + tools/cohesix-py/tests/test_evidence_receipts.py — consume the generated additive service-bucket schedule fields and updated byte bounds without truncation, schema invention, inferred CPU utilization, or promotion to Worker, driver, QEMU, Pi, or hardware acceptance proof. - tools/coh-rtc/src/verify.rs — verify service-bucket witnesses against resolved manifests and generated Rust tables. Commands: cargo test -p root-task --tests schedule && cargo test -p coh --test evidence && python3 -m pytest -q tools/cohesix-py/tests/test_evidence_receipts.py -k service_bucket && scripts/ci/verification_gate.sh Checks: Observability is bounded, read-only, generated-manifest aligned, and keeps `cpu_pct=unavailable` unless real utilization evidence exists; Rust and Python evidence-pack projections agree on service-bucket fixtures and bounds. Deliverables: Auditable service-bucket proof surface with compatible Rust and Python evidence consumers for operators and verification gates. Title/ID: m29a-pressure-and-target-proof Goal: Add host-safe pressure coverage and target-qualified QEMU/Pi proof lanes for core-local service scheduling. Inputs: scripts/ci/test_plan_run.sh, docs/TEST_PLAN.md, docs/BENCHMARKS.md, scripts/pi4_trace_normalize.py. Changes: - scripts/ci/test_plan_run.sh — add m27b QEMU and Pi target stages for service-bucket evidence. - docs/TEST_PLAN.md — classify host pressure, QEMU semantic proof, and Pi hardware throughput proof separately. - docs/BENCHMARKS.md — document required fresh-evidence fields before making throughput claims. - scripts/pi4_trace_normalize.py — parse service-bucket counters only as SMP evidence, not USB/Wi-Fi/HDMI acceptance by itself. Commands: - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m29a-qemu-smp - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m29a-pi4-smp - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --log-dir out/bench --log-prefix m29a-qemu-service-buckets - python3 scripts/rest_perf_harness.py --mode perf --suite all --runs 5 --no-qemu --no-gateway --rest-url http://: --log-dir out/bench --log-prefix m29a-pi4-service-buckets Checks: Host pressure stays semantic-only; QEMU proves regression stability; Pi throughput claims require fresh target logs and separated acceptance lanes; same-harness REST artifacts compare service-bucket results to the 26d rolling baseline with service-bucket counters attached. Deliverables: Repeatable validation and benchmark lanes for core-local SMP optimization. ``` ## Milestone 29b — Operator-Lane Scheduler + Multi-Surface Responsiveness [Milestones](#Milestones) **Delivery posture:** Conditional Release C responsiveness work. Activate it only when the Release A walkthrough or an accepted pressure run shows a specific command, cancellation, emergency-status, or active-operator latency SLO miss that bounded queue/output fixes cannot close. Milestone 27 and the 27f showcase may expose existing pressure truth without waiting for this scheduler redesign. **Why now (operator concurrency without a larger TCB):** Milestone 29a turns manifest affinity into generated service buckets. That is necessary but not sufficient for field responsiveness: serial, USB local-seat, authenticated TCP console, HDMI feedback, diagnostics, network progress, telemetry drains, and persistence work still need an explicit operator-facing fairness contract. 29b adds that contract as generated lane policy over the 29a service buckets before Milestone 27 host tools begin presenting pressure and state to operators. **As-built alignment note:** Cohesix already has a cooperative event pump, serial/TCP/local-seat console paths, isolated driver runtimes, bounded service-turn language, `smp activity`, and pressure counters. It does **not** yet have compiler-owned operator lanes, lane starvation deadlines, lane-aware large-output resumability, or target-qualified proof that serial, USB keyboard, TCP responses, HDMI redraws, diagnostics, network control/data, telemetry, and persistent-spool drains remain responsive under mixed load. Older prose must not claim Linux-like parallel activity handling until this milestone has evidence. **Non-negotiable constraints** - No POSIX threads, in-VM async executor, shared work-stealing queue, or bulky runtime library. - No new in-VM protocol, unaudited RPC path, console grammar drift, Secure9P verb change, namespace authority change, or unbounded queue. - Authoritative command execution remains serialized through the existing authority path; 29b improves concurrent I/O progress, buffering, response flush, and resumable work around that serialized command boundary. - Physical hardware service remains restricted to manifest-declared isolated driver runtimes. Root-task may schedule bounded service turns and observe evidence; it must not regain steady-state device ownership. - Operator priority is conditional on authenticated TCP-console state, not one static ranking. With no authenticated TCP session, service serial input, then USB local-seat input, then HDMI feedback. With an authenticated TCP session, make TCP command/response progress primary while preserving bounded serial/local-seat, emergency-diagnostic, and fatal-status service. - Under load, active operator input and emergency/fatal status must not be hidden behind HDMI redraws, verbose diagnostics, large tails, telemetry spam, storage drains, or network proof traffic. - A "100x better" claim must be grounded in accepted 26d/29a baseline evidence: either worst-observed operator input stall improves by two orders of magnitude under the same pressure harness, or the milestone records a manifest-declared hard latency bound with hardware reasons why a ratio claim is invalid. ### Prerequisite - Milestone **29a** completed for the selected profile only when the accepted responsiveness defect requires its generated service buckets. A narrower 29b activation may operate over the accepted 26e MCS topology when its task record proves that no new service-bucket architecture is required. - Milestone **26e** SMP+MCS target acceptance remains the sole scheduler architecture consumed by lane policy; 29b may tune generated admitted values but may not introduce a classic or runtime-selectable scheduler mode. - Milestones **26c/26d**, conditional **29**, and the **28 core** completed or explicitly scoped only where their artifacts define the selected profile, persistence drains, formal witnesses, and rolling performance baseline. ### Goal Convert the 29a service-bucket substrate into an **operator-lane scheduler** that preserves Cohesix's single-authority command model while making serial, USB local-seat, authenticated TCP, HDMI, diagnostics, network, telemetry, and persistence work progress fairly and observably under mixed load. ### Deliverables #### A) Compiler-owned operator lane IR - Extend `coh-rtc` with generated lane records for: - `serial-input` - `usb-local-seat` - `tcp-console-rx` - `tcp-console-tx` - `network-control` - `network-data` - `hdmi-display` - `diagnostics` - `telemetry-spool` - Each lane declares priority class, starvation deadline, max work per turn, max bytes per turn, bounded queue depth, backpressure policy, degradation policy, owning task/SC/service bucket, admitted budget demand, and its generated behavior for TCP-authenticated versus no-TCP operator modes. Runtime session state selects only between statically admitted modes; it cannot inflate a budget, period, refill supply, MCP, or aggregate per-core demand, and clients cannot supply or raise lane priority. - Validation rejects unbounded lanes, authority overlap, physical-driver lane ownership drift, and any lane that can bypass generated service-bucket or HAL resource limits. #### B) Deterministic lane scheduler - Root-task drains generated lanes using bounded deterministic policy over the 29a service buckets and within the owning MCS scheduling contexts. - With no authenticated TCP session, serial input precedes USB local-seat input, which precedes HDMI feedback; all three stay above routine network data, verbose diagnostics, telemetry, and storage drains. - With an authenticated TCP session, TCP receive and response flush become the primary control-plane shell lanes for bounded `ACK`/`ERR`/`END` liveness, but cannot starve serial/local-seat input, emergency diagnostics, or fatal status. - Saturated lanes return explicit busy/yield/drop evidence rather than growing queues. #### C) Serialized authority with parallel I/O progress - The console command parser and authority decisions remain single-writer and deterministic. - Serial, local-seat, and TCP input arbitration records which surface supplied each command and how conflicting partial lines were handled. - Long commands, diagnostics, transcript flushes, large `tail` output, and HDMI redraws become resumable bounded work items so input polling and response flushing can interleave. #### D) Backpressure and degradation policy - HDMI redraws coalesce or drop superseded frames before physical input or TCP `ACK`/`END` liveness is affected. - Verbose telemetry, routine progress breadcrumbs, network mirroring, and large tails degrade before command liveness. - Storage/spool drains inherit Milestone 29 persistence semantics and must not preempt USB local-seat or serial input. - Serial and local-seat output includes rate-limited `idle`, `busy`, `high-load`, or `overload` summaries plus the strongest known blocker; these summaries are bounded lane work and cannot create a new output backlog. - Network proof traffic remains classified separately from production TCP or REST throughput; proof-mode overrides must be explicit and lane-visible. #### E) Observability and evidence - `smp activity` adds operator-lane rows: per-lane turns, ready/backlog state, max observed latency, starvation yields, busy returns, drops, coalesces, and suppression counts. - `/proc/pressure/*` exposes the same bounded read-only lane-pressure summary. - Evidence packs include lane snapshots so Milestone 27 tools can explain pressure without reconstructing scheduler internals. - `scripts/pi4_trace_normalize.py` treats lane proof as responsiveness evidence only; it must not convert lane counters into USB, Wi-Fi, HDMI, TCP, or flash acceptance by itself. #### F) Target-qualified pressure proof - Host-safe tests simulate mixed serial, USB, TCP, HDMI, diagnostics, network, telemetry, and persistence pressure without making Pi throughput claims. - QEMU proves transcript stability, bounded lane latency, and no ACK/ERR/END drift. - Pi 4 proof, when claimed, requires fresh logs that keep serial responsiveness, USB local-seat, TCP/`cohsh`, Wi-Fi/GENET, HDMI, persistence, and flash proof lanes separate. ### Commands - `cargo test -p coh-rtc` - `cargo test -p root-task --tests schedule` - `cargo test -p root-task --test operator_lanes` - `cargo test -p pi4-driver-abi` - `cargo test -p pi4-driver-runtime` - `scripts/check-generated.sh` - `scripts/ci/verification_gate.sh` - `scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m29b-qemu-lanes` - `scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m29b-pi4-lanes` - `python3 scripts/rest_perf_harness.py --mode perf --suite console-pressure --runs 5 --log-dir out/bench --log-prefix m29b-qemu-lanes` ### Checks (DoD) - Generated manifests and docs identify every operator lane, priority, deadline, max work, queue bound, degradation policy, owning SC/core, and admitted demand. - Both authenticated-TCP and no-TCP static modes preserve generated per-core admission plus independent root/emergency/fault reserves; mode changes cannot mint or enlarge CPU-time authority. - Serial and USB local-seat input have bounded key/line-to-echo and line-to-dispatch latency under mixed TCP/HDMI/network/diagnostic/storage pressure. - Authenticated TCP console responses preserve bounded `ACK`/`ERR`/`END` liveness without starving physical input or fatal/emergency status. - No-TCP and authenticated-TCP pressure fixtures prove the generated priority transition: serial -> USB local-seat -> HDMI feedback without TCP, and TCP as the primary shell with bounded physical/emergency progress when authenticated. - Serial and local-seat load summaries are rate-limited, bounded, and report only `idle`, `busy`, `high-load`, or `overload` plus the strongest blocker. - Long diagnostics, large tails, HDMI redraws, telemetry drains, and persistence drains are resumable and cannot monopolize an event-pump turn. - Console grammar, Secure9P semantics, worker namespace paths, persistence append/ack behavior, and driver-runtime authority remain byte-stable unless a separately versioned breaking-change process is followed. - QEMU and Pi 4 target-qualified Test Plan runs pass with no undocumented output drift; Pi 4 claims cite fresh target logs and separated proof lanes. - Any 100x responsiveness claim cites the accepted 26d/29a baseline, the exact pressure harness, and the lane counters that prove the improvement. ### Compiler touchpoints - `coh-rtc` emits operator-lane tables beside service-bucket, affinity, persistence, proof-witness, and cap-bundle outputs. - Manifest validation fails closed when lane policy conflicts with generated authority, HAL grants, driver-runtime ownership, Secure9P bounds, or persistence drain semantics. - Generated docs snippets summarize lane policy; hand-maintained docs may explain those snippets but must not become the scheduling source of truth. ### Task Breakdown ``` Title/ID: m29b-operator-lane-ir Goal: Add generated operator-lane policy and validation. Inputs: tools/coh-rtc, configs/root_task*.toml, docs/ROLES_AND_SCHEDULING.md, docs/USERLAND_AND_CLI.md. Changes: - tools/coh-rtc/src/ir.rs — lane schema for TCP-authenticated/no-TCP priority modes, owning task/SC/core, admitted demand, deadline, work/byte bounds, queue depth, and degradation policy. - tools/coh-rtc/src/validate.rs — reject unbounded lanes, admission overflow, authority overlap, physical-driver ownership drift, incompatible service-bucket references, and session modes that enlarge CPU-time authority. - tools/coh-rtc/src/codegen/* — emit Rust/docs/proof-witness lane tables. Commands: cargo test -p coh-rtc && scripts/check-generated.sh Checks: Lane policy and authenticated-session mode transitions are compiler-owned, generated docs match resolved manifests, both modes fit the accepted SMP+MCS admission totals and reserves, clients cannot raise priority or budget, and invalid topology fails closed. Deliverables: Generated operator-lane contract for QEMU and Pi 4 profiles. Title/ID: m29b-event-pump-qos Goal: Schedule serial, USB local-seat, TCP, HDMI, diagnostics, network, telemetry, and spool work through bounded lanes. Inputs: apps/root-task/src/event/**, apps/root-task/src/local_seat.rs, apps/root-task/src/net/**, apps/root-task/src/storage/**. Changes: - apps/root-task/src/event/** — deterministic lane scheduler over generated service buckets. - apps/root-task/src/local_seat.rs — lane-aware keyboard drain, echo, and HDMI coalescing policy. - apps/root-task/src/net/** — lane-aware TCP response flush and network-control/data polling. - apps/root-task/src/storage/** — persistence drain scheduling that cannot preempt physical input. Commands: cargo test -p root-task --tests schedule && cargo test -p root-task --test operator_lanes Checks: No-TCP and authenticated-TCP priority modes match the charter, physical input and TCP response liveness stay bounded, and saturated lanes report busy/yield/drop evidence. Deliverables: Bounded operator-lane scheduler without a thread pool or new protocol. Title/ID: m29b-resumable-output-and-diagnostics Goal: Prevent diagnostics, large tails, HDMI redraws, and transcript flushes from monopolizing turns. Inputs: apps/root-task/src/event/mod.rs, apps/root-task/src/ninedoor.rs, docs/USERLAND_AND_CLI.md, tests/fixtures/transcripts/. Changes: - apps/root-task/src/event/mod.rs — resumable diagnostic and output jobs with stable ACK/ERR/END behavior. - apps/root-task/src/ninedoor.rs — bounded tail/log/read output chunks with lane-visible continuation. - tests/fixtures/transcripts/ — pressure transcripts proving byte-stable command results. Commands: cargo test -p root-task --test operator_lanes && cargo test -p nine-door Checks: Existing command output remains byte-stable where semantics do not change; large outputs yield between bounded chunks. Deliverables: Long-running console-visible work that remains responsive under input pressure. Title/ID: m29b-pressure-observability Goal: Expose lane pressure through `smp activity`, `/proc/pressure/*`, evidence packs, and trace normalization. Inputs: apps/root-task/src/event/mod.rs, apps/root-task/src/ninedoor.rs, apps/coh/src/evidence.rs, scripts/pi4_trace_normalize.py. Changes: - apps/root-task/src/event/mod.rs — operator-lane rows in `smp activity`. - apps/root-task/src/ninedoor.rs — bounded read-only `/proc/pressure/*` summaries. - apps/coh/src/evidence.rs — lane snapshots in evidence packs. - scripts/pi4_trace_normalize.py — parse lane proof without treating it as device acceptance. Commands: cargo test -p root-task --tests schedule && cargo test -p coh --test evidence && pytest tests/test_pi4_trace_normalize.py Checks: Pressure evidence is bounded, read-only, manifest-aligned, and separated from USB/Wi-Fi/HDMI/TCP acceptance gates. Deliverables: Operator-visible pressure proof ready for Milestone 27 tooling. Title/ID: m29b-pressure-and-target-proof Goal: Add host-safe, QEMU, and Pi 4 pressure gates for multi-surface responsiveness. Inputs: scripts/ci/test_plan_run.sh, scripts/rest_perf_harness.py, docs/TEST_PLAN.md, docs/BENCHMARKS.md. Changes: - scripts/ci/test_plan_run.sh — m27c QEMU and Pi target stages. - scripts/rest_perf_harness.py — console-pressure suite or equivalent bounded pressure harness. - docs/TEST_PLAN.md + docs/BENCHMARKS.md — classify lane responsiveness, throughput, and target proof separately. Commands: - scripts/ci/test_plan_run.sh --target qemu --state-dir out/test-plan/m29b-qemu-lanes - scripts/ci/test_plan_run.sh --target pi4 --state-dir out/test-plan/m29b-pi4-lanes - python3 scripts/rest_perf_harness.py --mode perf --suite console-pressure --runs 5 --log-dir out/bench --log-prefix m29b-qemu-lanes Checks: QEMU proves semantic stability, timeout/overrun behavior, and latency bounds; Pi 4 claims require fresh target logs, preserved MCS admission/reserve evidence, and separated serial, USB, TCP, Wi-Fi/GENET, HDMI, persistence, and flash proof lanes. Deliverables: Repeatable validation for Cohesix multi-surface responsiveness. ``` ## Milestone 30 — Edge Local Status (Pi 4 Host Tool) [Milestones](#Milestones) **Delivery posture:** Conditional Release C field tool. Its shared read-only snapshot, trace, status, and attestation internals belong to Milestone 27 and 27f regardless of whether a standalone `coh-status` binary is activated. The binary ships only when a field workflow needs a smaller tool than `coh` or SwarmUI; it cannot block Releases A or B. **Why now (compiler):** Field techs need offline status on edge devices using the same 9P grammar. Tool must respect Pi 4 boot profile semantics and attestation outputs. **As-built alignment note:** `apps/coh-status` currently exists as a library crate with trace replay support and a convergence transcript fixture. It is not yet a standalone read-only field CLI, and its current convergence fixture still exercises `/queen/ctl` writes. Milestone 30 promotes that crate into the read-only tool described below and replaces generic convergence coverage with status-specific read-only fixtures. **Prerequisite** - Milestone **27** completed for the shared read-only inspect/attest/evidence-pack internals that `coh-status` reuses. Milestone 30 must not fork a second status parser, attestation verifier, trace reader, or snapshot schema when the Milestone 27 host-tool core already owns that behavior. **Goal** Promote `coh-status` into a **small read-only CLI** for local field inspection of boot/attest data using the existing TCP console transport and offline artifacts, without adding any in-VM 9P/TCP listener and without introducing a second UI stack. **Non-Goals** - Repo-wide SPDX/NOTICE header sweeps (track separately; not required for the status tool). - A separate Tauri/UI variant; SwarmUI already occupies the UI role. - Generic shell verbs (`echo`, `spawn`, arbitrary writes) or any write-capable façade over `/queen/ctl`. **Deliverables** - `coh-status` binary with: - default read-only status summary - `attest` subcommand for manifest/evidence verification - offline replay/snapshot mode for field diagnostics - Shared read-only status/snapshot core reused by `coh inspect`, `coh attest`, SwarmUI, and `coh-status`. - Shared offline snapshot/CBOR parsing code extracted from existing SwarmUI logic so grammar stays aligned. - Status-specific fixtures proving read-only behavior; no `/queen/ctl` writes in the canonical `coh-status` test flows. - Bounded command-latency fixture for offline and live-read status paths. This is field-tool latency evidence, not a full runtime or hardware throughput benchmark. **Commands** - `cargo build -p coh-status` - `cargo run -p coh-status -- --help` - `cargo run -p coh-status -- offline --trace tests/fixtures/traces/trace_v0.trace` - `cargo run -p coh-status -- attest --help` - `cargo test -p coh-status --test latency` **Checks (DoD)** - Works offline; wrong/expired ticket → deterministic `ERR reason=Permission` surfaced to user. - Shared snapshot/CBOR parsing identical to SwarmUI for overlapping flows. - Abuse case: attempt to write via `coh-status` returns deterministic denial and does not mutate state. - UI/CLI/console equivalence MUST be preserved: ACK/ERR/END sequences must remain byte-stable relative to the 7c baseline. - `coh-status` latency evidence stays bounded on representative offline traces and live-read fixtures; regressions are classified as snapshot parsing, attestation verification, transport, or artifact-size overhead before 30a/30b field surfaces reuse the status core. **Compiler touchpoints** - `coh-rtc` emits localhost binding guidance and attestation paths for Pi 4 boot profile into `docs/HARDWARE_BRINGUP.md` and `docs/USERLAND_AND_CLI.md`. **Task Breakdown** ``` Title/ID: m30-status-tool Goal: Build a real read-only `coh-status` CLI on top of shared inspect/attest internals. Inputs: apps/coh-status/, shared host-tool status core, Pi 4 boot profile manifest outputs, attestation nodes. Changes: - apps/coh-status/src/main.rs — status CLI entrypoint with read-only subcommands only. - apps/coh-status/src/lib.rs — preserve trace replay helpers while exposing only read-only status/attestation operations to the CLI. - apps/coh-status/tests/offline.rs — simulate offline read and expired ticket. - apps/coh-status/tests/transcript.rs — remove the current generic `/queen/ctl` convergence flow from the canonical status transcript. Commands: - cargo build -p coh-status - cargo run -p coh-status -- --help Checks: - Expired ticket returns ERR; offline cache used when transport unavailable. Deliverables: - Tool usage documented in docs/HARDWARE_BRINGUP.md and docs/USERLAND_AND_CLI.md. Title/ID: m30-shared-snapshot-core Goal: Extract shared read-only snapshot/CBOR parsing for SwarmUI and `coh-status`. Inputs: apps/swarmui snapshot/cache code, apps/coh-status, shared host-tool internals. Changes: - shared status/snapshot module — read-only offline artifact decoding. - apps/coh-status/src/lib.rs — consume shared snapshot/trace helpers. Commands: - cargo test -p coh-status --test offline - cargo test -p swarmui --test trace Checks: - Shared offline parsing stays byte-stable across SwarmUI and `coh-status`. Deliverables: - Shared read-only snapshot core with no duplicate parsers. Title/ID: m30-attest-verify Goal: Verify nonce-bound TPM2 Quote or DICE evidence with the same trust policy as the shared host-tool stack; never treat a manifest hash as attestation. Inputs: accepted m26-device-identity-attestation-closure evidence, `/proc/attest/{capabilities,status,challenge,evidence}`, trust anchors/reference measurements/revocation policy, shared attestation helpers, cached offline evidence. Changes: - apps/coh-status/src/attest.rs — generate/consume a bounded challenge and verify evidence type, signature/certificate or DICE chain, nonce freshness, device identity, selected target/manifest/component measurements, policy/profile, clock/reset/restart state where present, and revocation/expiry against configured trust material. - shared attestation verifier reused by `coh inspect` / `coh attest` where applicable; measurement-only and unavailable modes remain explicit and cannot satisfy an authenticated-device gate. - offline mode — verify a previously captured evidence/challenge/reference bundle without implying current freshness; label it historical with capture identity/time. Commands: - cargo test -p coh-status --test attest Checks: - Forged signatures/chains, replayed or wrong nonces, wrong device/manifest/measurement/profile, expired/revoked trust, unsupported evidence, and measurement-only input are rejected identically by `coh-status`, `coh inspect`, and `coh attest`; valid TPM2/DICE evidence is identity- and freshness-bound, and offline results are never presented as live. Deliverables: - Verified live and clearly labelled offline attestation workflows documented; regression outputs stored. Title/ID: m30-readonly-regressions Goal: Replace generic convergence fixtures with `coh-status`-specific read-only flows. Inputs: apps/coh-status/tests/, tests/fixtures/transcripts/, docs/TEST_PLAN.md. Changes: - apps/coh-status/tests/transcript.rs — read-only status transcript only. - apps/coh-status/tests/latency.rs — bounded offline/live-read status latency fixtures over representative artifacts. - tests/fixtures/transcripts/ — `coh-status` fixtures with no `/queen/ctl` writes. Commands: - cargo test -p coh-status --test transcript - cargo test -p coh-status --test latency Checks: - Canonical `coh-status` flows read `/proc/boot`, `/proc/attest/*`, and selected telemetry without mutating state. - Offline/live-read status latency stays bounded and is reported as field-tool evidence, not REST/Pi throughput proof. Deliverables: - Field-tech read-only transcript fixtures and explicit docs. ``` ## Milestone 30a — Pi 4 Root-Shell Hardware Status (`hw-status`) [Milestones](#Milestones) **Delivery posture:** Deferred behind a concrete Pi field-support case. It is not activated merely because firmware property calls are available, and it cannot block the AI, assurance, MCP, or community-showcase releases. **Why now (field diagnostics):** Milestone 30 gives field techs a host-side read-only status tool, but Pi 4 bring-up still needs a serial-local command when TCP, host tooling, or storage artifacts are unavailable. `hw-status` is a Pi 4 U-Boot profile diagnostic for quick board/firmware inspection from `cohesix>` without changing device state or promoting root-task back into steady-state hardware ownership. **As-built alignment note:** There is no `hw-status` command today. Current Pi 4 hardware facts are split across boot logs, framebuffer hints, driver-task progress lines, timer summaries, and isolated runtime diagnostics. Milestone 30a adds one bounded, read-only root-shell view; older prose must not claim a Pi 4 hardware-status command or firmware property snapshot until this milestone has implementation and transcript evidence. **Prerequisite** - Milestone **26a/26b** owner-state and isolated runtime proof restored for the selected Pi 4 profile. - Milestone **27** completed for shared read-only snapshot/evidence conventions. - Milestone **30** completed or explicitly scoped so `hw-status` field names can be reused by `coh-status` rather than creating a second status vocabulary. **Goal** Add a Pi 4-build-only `hw-status` command on the root shell that prints bounded, stable, read-only board status: - firmware-reported power-state flags, - selected clock rates, - selected voltage domains, - SoC temperature and throttle/undervoltage flags when exposed, - framebuffer geometry plus ARM/GPU memory split, - bounded firmware-managed device notification counters or last-notification summaries. **Non-Goals** - No firmware writes, power-state changes, clock changes, voltage changes, turbo/overclock controls, reboot policy changes, or recovery actions. - No root-owned HDMI, USB, Wi-Fi, GENET, SDIO, PCIe, or GPU driver path; isolated runtimes remain the hardware owners for steady service. - No new in-VM TCP listener, 9P provider requirement, host RPC, or `cohsh-core` grammar expansion beyond the documented root-console command. - No direct physical-address probing or mailbox/MMIO access outside HAL-admitted Pi 4 resources. **Deliverables** - `hw-status` root-shell command available only for the Pi 4 U-Boot profile. Other profiles must omit it or return deterministic `ERR reason=unsupported` per generated grammar/docs. - HAL-mediated Pi 4 firmware-property/status helper with an explicit allowlist of read-only property tags, bounded buffers, timeout evidence, and failure rows. - Stable serial transcript format using sectioned rows such as `hw power`, `hw clock`, `hw voltage`, `hw thermal`, `hw memory`, `hw framebuffer`, and `hw firmware-notify`. - Optional read-only status mirror for `coh-status` only if it reuses the same field names and does not add authority or a second parser. - Documentation and regression fixtures proving the command is passive, Pi 4-profile gated, and does not count as isolated runtime hardware acceptance. - Bounded serial-local command-latency evidence for `hw-status` so passive diagnostics stay quick without reopening runtime throughput gates. **Commands** - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hw_status -- --test-threads=1` - `cargo test -p cohsh-core` - `SEL4_BUILD_DIR=$REPO/seL4/build_UBOOT cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4` - `scripts/check-generated.sh` - `scripts/ci/test_plan_run.sh --state-dir out/test-plan/m30a-hw-status` - `cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hw_status_latency -- --test-threads=1` **Checks (DoD)** - `help` and `docs/USERLAND_AND_CLI.md` list `hw-status` only for the Pi 4 root-console surface; TCP/`cohsh` shared grammar does not accidentally accept undocumented raw hardware commands. - Mocked firmware-property tests cover success, unsupported tag, timeout, malformed response, and partial data without panics or unbounded waits. - Live Pi 4 acceptance, when claimed, includes a fresh serial transcript showing `hw-status` returning bounded rows while USB/local-seat, Wi-Fi/GENET, HDMI, and shell proof lanes remain separate. - No `hw-status` path writes firmware state, changes clocks/voltage/power domains, clears notifications, or touches isolated runtime device state. - Generated docs, fixtures, and trace-normalizer expectations remain aligned; command output drift is intentional only with matching docs/tests. - `hw-status` latency evidence stays bounded in mocked tests and, when live Pi evidence is claimed, is reported as serial-local passive diagnostic timing rather than hardware runtime throughput proof. **Compiler touchpoints** - `coh-rtc` owns the profile gate and generated command/help snippets for `hw-status`. - Manifest validation rejects enabling `hw-status` outside Pi 4 hardware profiles or without the HAL firmware-property resource declared. **Task Breakdown** ``` Title/ID: m30a-hw-status-ir Goal: Add the Pi 4-only generated command gate and status field vocabulary. Inputs: tools/coh-rtc, configs/root_task_pi4_uboot_aarch64.toml, docs/USERLAND_AND_CLI.md. Changes: - tools/coh-rtc/src/** — profile-gated `hw-status` command/help generation and field-name constants. - configs/root_task_pi4_uboot_aarch64.toml — declare read-only Pi 4 firmware-status capability for the root diagnostics surface. - docs/snippets/* + docs/USERLAND_AND_CLI.md — generated and hand-maintained command reference updates. Commands: cargo test -p coh-rtc && scripts/check-generated.sh Checks: Non-Pi profiles reject the command gate; generated help/docs match resolved Pi 4 manifest truth. Deliverables: Compiler-owned `hw-status` profile gate and stable field vocabulary. Title/ID: m30a-hw-status-hal Goal: Implement bounded read-only Pi 4 firmware-property status queries behind HAL. Inputs: apps/root-task/src/hal/**, apps/root-task/src/arch/aarch64/**, seL4/build_UBOOT generated headers. Changes: - apps/root-task/src/hal/** — Pi 4 firmware-property read helper with tag allowlist, bounded mailbox buffers, timeout/fault evidence, and no write/control tags. - apps/root-task/src/arch/aarch64/** — reuse existing cache/MMIO primitives only through HAL-approved mappings. Commands: cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hw_status -- --test-threads=1 Checks: Success, timeout, malformed response, unsupported tag, and partial-data fixtures return typed status rows without panics or unbounded waits. Deliverables: HAL-owned passive Pi 4 hardware-status snapshot provider. Title/ID: m30a-hw-status-shell Goal: Add the `hw-status` root-shell command and stable serial transcript. Inputs: apps/root-task/src/console, apps/root-task/src/event/mod.rs, docs/USERLAND_AND_CLI.md. Changes: - apps/root-task/src/console/** + apps/root-task/src/event/mod.rs — parse and dispatch `hw-status` only on the Pi 4 root-console diagnostics surface. - apps/root-task/src/event/mod.rs — emit bounded `hw ...` rows for power, clocks, voltage, thermal, framebuffer/GPU memory, and firmware notifications. - docs/USERLAND_AND_CLI.md — document serial/local-only behavior and unsupported-profile result. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hw_status -- --test-threads=1 - SEL4_BUILD_DIR=$REPO/seL4/build_UBOOT cargo check -p root-task --target aarch64-unknown-none --no-default-features --features release-pi4 Checks: Output is stable, bounded, read-only, and does not change ACK/ERR/END semantics for existing commands. Deliverables: Pi 4 serial `cohesix> hw-status` command. Title/ID: m30a-hw-status-regressions Goal: Add fixtures and Pi 4 evidence parsing for passive hardware-status diagnostics. Inputs: docs/TEST_PLAN.md, scripts/pi4_trace_normalize.py, tests/fixtures/transcripts/. Changes: - docs/TEST_PLAN.md — classify `hw-status` as passive Pi 4 diagnostics, not hardware acceptance for USB/Wi-Fi/GENET/HDMI. - scripts/pi4_trace_normalize.py — parse optional `HW_STATUS_*` fields from captured transcripts without making them gate blockers. - apps/root-task/tests/hw_status_latency.rs — mocked bounded timing checks for HAL firmware-property status rows and unsupported-profile refusal. - tests/fixtures/transcripts/ — add serial-local `hw-status` success and unsupported-profile fixtures. Commands: - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hw_status -- --test-threads=1 - cargo test -p root-task --no-default-features --features driver-tests-pi4 --lib hw_status_latency -- --test-threads=1 - pytest tests/test_pi4_trace_normalize.py Checks: Transcript, latency, and normalizer coverage prove passive behavior, bounded command timing, stable field extraction, and no regression in existing Pi 4 gates. Deliverables: Repeatable host and Pi 4 validation for `hw-status`. ``` ## Milestone 30b — AI-Native Namespace Surfaces (Control-Plane Only) [Milestones](#Milestones) **Delivery posture:** Deferred behind adoption evidence. Implementation begins only when accepted CLI, Python, OpenAI-compatible, and MCP workflows reveal a specific lifecycle operation that is materially safer or simpler as a bounded NineDoor projection. Namespace symmetry alone is not sufficient authority. **Why now (positioning):** Cohesix already exposes bounded, file-shaped control surfaces for workers, GPU state, updates, models, and observability. Before this deferred milestone may activate, the selected 27b provider/use-case rows, 27c Context Capsule core, 28a consequential-action admission, 27d AI/PEFT workflow, 27e compatible inference boundary, and 28c MCP projection must prove that a namespace solves a remaining adoption problem. A2A is not a prerequisite. Only then may bounded control refs and evidence from proven AI fleet state become legible through the same namespace discipline without moving the semantic graph or inference data plane into the VM, creating a second executor, or exposing a path whose external dependencies are missing. **Goal** Add a manifest-defined, role-scoped AI control namespace that lets operators and automation inspect and drive AI lifecycle state through existing Secure9P semantics. This milestone is limited to **control-plane surfaces only**: no in-VM application runtime, no general UI stack, no mutable POSIX-like filesystem, and no new transport or RPC model. **As-built alignment note:** There is no `ecosystem.ai.*` manifest IR and no `/jobs`, `/datasets`, `/experiments`, `/infer`, `/metrics`, or `/proc/admission/*` AI/admission namespace provider in the host or VM NineDoor implementations as of the 26c planning audit. Milestone 30b adds those projections only after 27a, 27b, 27c, 28a, 27d, 27e, and 28c prove delegated authority, provider action/read-visibility conformance, semantic/capsule identity, machine-checked admission, host-ticket AI actions, checkpoints/evidence semantics, inference receipts, and MCP/A2A gateway projection without grammar drift. ### Prerequisites - Milestone **27a** completed (delegated REST identity, idempotent queen intents, writer-epoch fencing, audit/replay baseline). - The exact Milestone **27b** provider/integration rows completed for the namespace use case; unselected catalogue breadth is not a prerequisite. - The Milestone **27c core** completed for immutable snapshot/artifact refs, Context Capsules, render receipts, visibility/provenance, host tools, and selected conformance evidence; the full semantic graph is not a prerequisite. - Milestone **28a** completed (typed intent, authoritative fact snapshot, policy decision, state-bound grant, witness, audit/replay, and reference action evidence). - Milestone **27d** completed (host-side AI run envelopes, checkpoint/evidence model, complete PEFT pipeline transaction, use-case promotion, and `/host/tickets/spec` AI actuation semantics). - Milestone **27e** completed (compatible host inference admission, provider-neutral receipts, cache/stream evidence, content policy, host tools, and provider/client conformance). - Milestone **28c MCP phase 1** and any exact ticketed MCP actions used by the namespace case completed over existing Cohesix grammar. A2A is not required. - Production profiles may claim matching accepted 26e Worker/driver live authority for AI namespace projections. Claims of one-to-one Worker ticket/lease binding, complete driver-inventory ledger projection, or structured quarantine/restart additionally require Milestone **28b** evidence. Read-model-only or host-ticket-only profiles may remain gated by 27a/27b/27c/27d/27e/28c without either live-task or 28b production-ledger claims. **Non-Goals** - No app runtime, package manager, bundle loader, or process model beyond the existing Queen/worker control model. - No in-VM GUI, mutable `/ui` runtime surface, or second operator protocol. - No generic `/net` service API, sockets-by-file, or hidden request/response RPC behind file names. - No mutable general-purpose `/store`; existing CAS, models, telemetry, and spool semantics remain authoritative and distinct. - No in-VM semantic graph, object pack, rebuildable index, extractor, capsule planner/renderer, vector store, raw source tree, prompt archive, model output archive, tokenizer, or provider client. The namespace exposes bounded immutable refs/status/receipts, not the host semantic or inference data plane. - No OpenAI-compatible API over NineDoor and no claim that `/infer/*` replaces or proxies the accepted 27e host endpoint. - No new 9P verbs, no console grammar changes, and no deviation from `ERR = no side effects`. - No second host-execution plane parallel to `/host/tickets/spec`; VM-visible AI paths do not bypass delegated host-ticket authority or Milestone 27a fencing/idempotency rules. - No create, unlink, rename, chmod, symlink, dynamic prompt/blob tree, arbitrary path component, or general directory mutation semantics. AI namespace writes target fixed generated control files only. - No opaque inter-agent mailbox or prompt-transcript tree exposed as a first-class namespace primitive. **Deliverables** - AI namespace roots are the VM-visible control-plane projection of the host-side semantics proven in 27c, 27d, and 27e. - Every enabled root/control file names the stable 27b `use_case_id`, required provider/integration rows, minimum Worker tier, and accepted host receipt schema. Generation fails or the path is deterministically absent when required dependencies are unavailable; a namespace projection never promotes their observed mode. - Any AI path whose write can cause host-side side effects MUST resolve to documented host-ticket actions and inherit delegated identity, idempotency, writer epoch, and audit/replay guarantees. - Read-only AI paths (`/metrics/*` and read views of `/jobs/*`, `/datasets/*`, `/experiments/*`, and `/infer/*`) do not become a second source of truth for semantic provenance, context admission, inference facts, or execution authority. - Add only bounded read-only admission projections using the established namespace families: - `/proc/admission/status` for current bounded gate/version/state summaries, - `/proc/admission/recent` for a bounded redacted recent-decision view, - `/policy/admission/version` for the generated policy/schema/checker identity, and - existing `/audit/decisions` for append-only decision evidence. These are projections of accepted 28a records, not a new AI-specific write, policy mutation, grant, ticket, or replay path. - Manifest-gated AI control roots under the Secure9P namespace, with paths aligned to current authority rules: - `/jobs/*` for bounded job submission, queue state, completion records, checkpoint refs, and handoff lineage views - `/datasets/*` for dataset metadata, lineage pointers, and policy-visible readiness state - `/experiments/*` for append-only run metadata, semantic snapshot refs, Context Capsule/render/retrieval-manifest refs, selection summaries, and result summaries - `/infer/*` for bounded inference request/admission/receipt control surfaces where explicitly enabled, including capsule refs, prefix-group read views, provider-fact classification, and output digests but no raw prompt/output content - `/metrics/*` for read-only fleet, semantic-paging, context-render, inference, cache, and model metrics summaries with fact source and owner receipt refs - Queen-only control files remain append-only; worker and observer views remain role-filtered and read-only where appropriate. - Host tools (`cohsh`, `coh`, REST projection, SwarmUI read models where relevant) discover and render the new paths without introducing new verbs. `cohsh` uses only existing `LS`/`CAT`/`TAIL`/`ECHO`; full semantic traversal and compatible inference remain on the accepted host CLI/SDK/gateway surfaces. - FUSE, Python, MCP/A2A, and UI views remain projections of the same admitted paths and 27b visibility classes; each is independently conformance-tested and cannot synthesize jobs, Workers, models, or successful PEFT/GPU execution from client state. - Canonical schemas for all new paths documented in `docs/INTERFACES.md` and emitted from `coh-rtc`. - Namespace state remains a projection of 27c immutable snapshot/capsule/render refs, 28a admission decisions/grants, 27d run envelopes/checkpoints/retrieval manifests, and 27e inference receipts; it does not introduce an independent semantic store, inference protocol, scheduler, or executor. - Namespace-scale microbenchmark evidence for representative job/run/checkpoint counts proves `ls`, `cat`, `tail`, and fixed-control-file writes remain bounded. This is a namespace/provider microbenchmark, not a full Pi hardware throughput gate, unless high-churn AI namespace paths change the root-task hot runtime path. **Commands** - `cargo test -p coh-rtc` - `cargo test -p nine-door` - `cargo test -p root-task` - `cargo test -p cohsh` - `cargo test -p coh --test ai_namespace` - `python3 -m pytest -q tools/cohesix-py/tests/test_ai_namespace.py` - `cohsh --script scripts/cohsh/ai_namespace_roundtrip.coh` - `cohsh --script scripts/cohsh/ai_namespace_scale.coh` **Checks (DoD)** - All new AI namespace paths are manifest-gated, bounded, and role-scoped. - Write-capable AI paths are fixed generated control files with declared target grammar; no dynamic file creation, unlink, rename, chmod, symlink, arbitrary path expansion, prompt/blob tree, or hidden request/response RPC is accepted. - Writes remain append-only and auditable; reads stay within declared `msize` and path bounds. - Existing ACK/ERR/END grammar, Secure9P transport behavior, and host-tool semantics remain byte-stable unless intentionally versioned in the same change. - Missing AI paths are treated as gate state, not client bugs. - Enabled AI paths have accepted semantic/capsule, inference, provider/integration, package, external-executor, Worker-tier, and use-case records for the selected profile; missing dependencies yield generated absence or typed not-enabled status before mutation. - Read views expose verified 27c snapshot/object-summary/capsule/render refs, 27d task/handoff/checkpoint/prefix evidence, and 27e admission/provider/cache/stream/output-digest receipt refs without becoming a second source of authority. - Admission read views expose only redacted, bounded, generated 28a status, recent-decision, policy-version, and audit refs; they cannot accept an intent, select policy, issue a grant, or trigger execution. - `/infer/*` writes map through accepted 28a admission to the existing 27d host-ticket action and 27e gateway contract; no provider call occurs from NineDoor, and no raw prompt/output or model-produced tool call is stored or executed by the namespace provider. - No new in-VM listener, runtime, or hidden RPC behavior is introduced. - AI namespace scale evidence shows bounded path walk/list/read/write behavior at representative job/run counts; material regressions are classified as namespace-provider overhead, host-tool projection overhead, or runtime hot-path regression before downstream profiles depend on the new roots. **Compiler touchpoints** - `coh-rtc` admits `ecosystem.ai.*` IR fields for path gating, quotas, and per-surface limits. - `coh-rtc` emits bounded read-only `/proc/admission/status`, `/proc/admission/recent`, `/policy/admission/version`, and existing `/audit/decisions` projection metadata from the accepted 28a schemas and visibility/redaction policy; no admission write field or AI-specific authority path is generated. - Each `ecosystem.ai.*` entry references stable 27b integration/use-case ids, accepted 27c semantic/capsule schema refs, accepted 27d run/action refs, accepted 28a admission plus 27e receipt refs, and generated Worker/executor prerequisites; validation rejects independent schemas, availability, facts, or maturity declarations. - `coh-rtc` rejects AI namespace definitions that require dynamic path creation, unconstrained components, directory mutation, prompt/blob-tree storage, or side effects outside generated host-ticket-backed receipt mappings. - Generated snippets refresh `docs/INTERFACES.md`, `docs/ARCHITECTURE.md`, and `docs/USERLAND_AND_CLI.md` so host tools consume authoritative bounds and namespace roots. - Validation and generated docs make the authority mapping explicit: AI namespace writes that trigger external execution are projections over the 28a decision, 27d host-ticket action, and 27e receipt model, not an independent inference endpoint or executor. - Validation rejects configurations that overload existing `/updates`, `/models`, telemetry, or spool semantics. **Task Breakdown** ``` Title/ID: m30b-ai-ir Milestone: Milestone 30b — AI-Native Namespace Surfaces (Control-Plane Only) / generated Python AI namespace contract Goal: Admit AI namespace surfaces in compiler IR without changing Cohesix transport or runtime boundaries. Inputs: accepted 27c semantic/capsule schemas, accepted 28a admission schemas, accepted 27d run/action schemas, accepted 27e inference receipt schemas, tools/coh-rtc, tools/cohesix-py/cohesix/generated.py, docs/ARCHITECTURE.md, docs/INTERFACES.md, docs/USERLAND_AND_CLI.md. Changes: - tools/coh-rtc/src/ir.rs — `ecosystem.ai.*` schema, gating, semantic/capsule/run/inference owner-ref mappings, receipt-projection mapping, content-retention policy, bounded read-only admission projection mappings, and bounds validation. - tools/coh-rtc/src/codegen/{docs,rust,cohsh,cohesix_py}.rs — generated AI namespace snippets and Rust, cohsh, and Python client defaults. Commands: - cargo test -p coh-rtc - scripts/check-generated.sh Checks: - AI namespace admission is compiler-defined, rejects overlap with existing semantic/CAS/model/spool and inference endpoint surfaces, and preserves the 27c artifact, 28a decision/grant, 27d host-ticket action, and 27e receipt mappings for side-effecting flows and read-model projections. - Generated Python roots, fixed control files, gates, and bounds match the selected resolved manifest and cannot be hand-maintained independently. Deliverables: - Authoritative manifest + docs snippets for AI namespace roots. Title/ID: m30b-ninedoor-ai-providers Goal: Add bounded NineDoor providers for AI control-plane paths. Inputs: apps/nine-door, apps/root-task/src/ninedoor.rs, generated manifest outputs. Changes: - apps/nine-door/src/host/namespace.rs — host-mode AI namespace providers for tests. - apps/root-task/src/ninedoor.rs — in-VM AI namespace provider wiring and policy enforcement plus bounded read-only `/proc/admission/status`, `/proc/admission/recent`, `/policy/admission/version`, and existing `/audit/decisions` projections over accepted 28a records. Commands: - cargo test -p nine-door - cargo test -p root-task Checks: - Paths enforce append-only/read-only semantics, role filters, deterministic refusals, fixed generated control files, and documented handoff to host-ticket-backed actuation where side effects are involved; semantic/capsule/checkpoint/handoff/prefix/inference read views remain bounded verified-ref projections only. - Dynamic create/unlink/rename/chmod/symlink/path-component expansion and prompt/blob-tree storage are refused before any state mutation. - Admission projections refuse every write and cannot evaluate policy, issue a grant, append an intent, or create an alternate audit/replay path. - NineDoor never parses a repository, plans/renders a capsule, speaks a provider API, retains raw prompt/output content, or executes a model-produced tool call. Deliverables: - AI control-plane namespace available in host and VM implementations with matching semantics. Title/ID: m30b-host-tool-discovery Milestone: Milestone 30b — AI-Native Namespace Surfaces (Control-Plane Only) / Python and host-tool discovery compatibility Goal: Extend host-tool discovery and read models for AI namespace paths without adding verbs. Inputs: apps/cohsh, apps/coh, apps/swarmui, tools/cohesix-py/cohesix/{generated.py,backends.py,orchestration.py}, tools/cohesix-py/tests/, coh-rtc-generated enabled/disabled AI namespace profile fixtures and client defaults. Changes: - apps/cohsh — existing list/cat/tail/echo flows for `/jobs`, `/datasets`, `/experiments`, `/infer`, `/metrics`, including immutable semantic/capsule/render, checkpoint/handoff/prefix-status, and inference receipt refs; no new verb. - apps/coh — host-side helpers correlate namespace refs with the existing 27c semantic and 27e inference commands without treating the VM read model as owner truth. - apps/swarmui — optional read-only views backed by existing `/proc` and AI namespace tails, correlated through the accepted 27f semantic/inference inspector when available. - tools/cohesix-py/cohesix/{backends.py,orchestration.py} + tools/cohesix-py/tests/test_ai_namespace.py — consume the coh-rtc-generated enabled/disabled profile fixtures to discover and access only generated `/jobs`, `/datasets`, `/experiments`, `/infer`, and `/metrics` roots and fixed control files through existing bounded backend operations; prove MockBackend as explicit non-proof `host-model` plus filesystem, TCP, and REST missing/disabled/denied/enabled behavior; preserve the 27c owner refs, 28a admission refs, 27d host-ticket actions, and 27e receipt mappings without hand-editing `generated.py`. Commands: - cargo test -p cohsh - python3 -m pytest -q tools/cohesix-py/tests/test_ai_namespace.py Checks: - Host tools discover AI paths using existing grammar and deterministic error handling, with read models aligned to accepted 27c/27d/27e artifacts and receipts rather than inferred hidden state. - Python matches coh/cohsh fixtures, cannot create dynamic paths or translate arbitrary data into host execution, and cannot bypass generated dependency, visibility, receipt, or fixed-control-file gates. Deliverables: - Operator-facing Rust, UI, and Python tooling parity for AI namespace surfaces. Title/ID: m30b-ai-regressions Goal: Add deterministic regression coverage for AI namespace semantics. Inputs: scripts/cohsh/, tests/fixtures/, docs/TEST_PLAN.md. Changes: - scripts/cohsh/ai_namespace_roundtrip.coh — canonical AI namespace script using existing verbs only, including semantic snapshot/capsule/render refs and inference admission/receipt refs without raw prompt/output content. - scripts/cohsh/ai_namespace_scale.coh — representative namespace-scale listing, read, tail, and fixed-control-file write probe for high-churn job/run roots. - tests/fixtures/transcripts/ — stable transcript fixtures for gated/missing/enabled AI paths, owner-ref mismatch, wrong visibility, unavailable capsule/inference dependencies, and raw-content refusal. Commands: - cohsh --script scripts/cohsh/ai_namespace_roundtrip.coh - cohsh --script scripts/cohsh/ai_namespace_scale.coh Checks: - Missing paths, denied writes, successful reads/writes, semantic/capsule and inference receipt refs, and representative high-churn namespace listings all preserve existing grammar, owner identity, refusal semantics, content policy, and bounded runtime behavior. Deliverables: - Canonical AI namespace regression pack and test-plan coverage. ``` ## Milestone 31 — AWS AMI (UEFI → Cohesix, ENA, Diskless 9door) [Milestones](#Milestones) **Status:** Parked. Milestone 31 is not authorized implementation work and is not part of a committed release. Only the bounded A0 platform-feasibility task may be activated, and only by an explicit task after a funded user requirement, current AWS support confirmation for the intended Arm custom-OS path, selected instance family, maintainer budget, and stop/go criteria are recorded. Failure or ambiguity at that gate stops all ENA, TLS/HTTP, IMDS, 9door mount, AMI, and performance work. **Why not now (platform risk and opportunity cost):** Cohesix can deliver its AI authority/evidence value through Linux-hosted tools on cloud systems while the seL4 control plane runs on accepted QEMU/Pi targets. Direct EC2 boot would combine a new seL4 platform port, UEFI/ACPI handoff, PCIe, ENA, network bootstrap, optional TLS/HTTP/IMDS, AMI registration, fault recovery, and a new performance lane. That effort does not improve the reference Jetson journey or the reusable Pi/seL4 community contribution enough to justify the remaining maintainer time without external demand and funding. If later activated, the intended result is still a first-class EC2 target without Linux, agents, or filesystems: direct UEFI boot and native Nitro networking. ENA is mandatory on AWS, and the guest-stateless AMI would be sourced from an immutable snapshot containing the ESP image, kernel, rootserver, and manifest. The contingent design below is retained so a future feasibility decision starts from explicit boundaries rather than rediscovery; its presence does not authorize implementation. On EC2, an EBS-backed AMI launches with a persistent root EBS volume created from the AMI snapshot. "Diskless" therefore means that Cohesix admits no runtime block-storage service, never mounts or writes the boot volume after firmware/loader handoff, and reconstructs runtime state from signed boot/fabric inputs; it does **not** mean EC2 presents physically read-only or absent boot media. **Goal** Boot Cohesix on AWS EC2 (Arm64) via **UEFI -> elfloader.efi -> seL4 -> root-task**, then bring up ENA networking through a manifest-declared isolated AWS network runtime admitted by root-task and mount the Cohesix 9door namespace over the network with **no local filesystem**, **no Linux**, and **no virtio**. Milestone 31 first reconciles the **generic UEFI ESP/QEMU baseline** currently described by the repo with the newer Pi 4 U-Boot path, then adds the **AWS-specific delta**: AWS profile admission, ENA, outbound bootstrap, optional IMDSv2, and AMI registration. **As-built alignment note:** The repo currently has UEFI profile/configuration material, a UEFI shim crate, and `scripts/uefi/*` helpers, but it does not have AWS profile admission, `scripts/aws/*`, isolated ENA runtime descriptors/images, outbound 9door mount code, or approved root-task TLS/HTTP/IMDS support. Milestone 31 must start with boot-chain and TCB reconciliation before runtime code depends on UEFI, TLS/HTTP, IMDS, or AWS-specific assumptions. **Prerequisites** - Milestone **26d** completed for the accepted seL4 16 provenance and timer/syscall baseline. Milestone 31 must still create and validate a separate AWS-selected seL4 build; Pi 4 or QEMU artifacts are not AWS boot proof. - Milestone **28** completed before production AWS assurance claims so generated witnesses, HAL authority checks, and claim-class separation cover the AWS profile. - Milestone **29a** completed before D2 peak-performance work so ENA queue affinity and service-bucket evidence consume the generated core-local scheduling substrate rather than inventing a parallel scheduler. - Milestone **28b** completed before any production profile claims complete ENA runtime-inventory ledger projection or structured quarantine/recovery. Milestone 28b supplies the generic ticket-free driver-ledger and quarantine machinery, not evidence for a future ENA runtime. Milestone 31 must emit new ENA-specific bundle, ledger, fault, teardown, and fresh-generation recovery evidence under that contract. A pre-28b EC2 boot/first-link probe is permitted only as explicitly non-production feasibility evidence. **Non-negotiable constraints** - The first executable gate is EC2 Arm64 platform feasibility, not ENA implementation. Re-check the selected instance family's current custom-OS support posture, then prove AMI registration, UEFI entry, serial/console evidence, selected seL4 platform support, and the hardware-description handoff used for memory, GIC/timer, PCIe configuration, and interrupts (ACPI, DT, or a documented conversion). If that gate fails, stop before ENA, TLS/HTTP, IMDS, or fabric-mount code. - Milestone 31 may not assume the UEFI/ESP baseline is authoritative until the first AWS task reconciles it against the current Pi 4 U-Boot pivot, `scripts/uefi/esp-build.sh`, `docs/BOOT_REFERENCE.md`, `docs/HARDWARE_BRINGUP.md`, and the charter rule for UEFI tooling. If the baseline is stale, AWS work starts by refreshing or reintroducing it under this milestone with docs and tests. - AWS boot work must produce a boot-resource map before ENA, TLS/HTTP, IMDS, or outbound fabric code depends on the profile. The map records AMI snapshot/root-volume geometry, ESP contents, kernel/root-task/rootserver artifacts, manifest hash, signed bootstrap manifest, trust anchors, seL4 handoff and ACPI/DT assumptions, attestation evidence, firmware-managed persistent state, and explicit non-claims. - The AWS diskless profile disables Milestone 29 VM-local persistence and rejects the EC2 root EBS device, ESP, or any other local block device as a spool/settings backend. The immutable AMI snapshot is build provenance; the launched root EBS volume is persistent platform boot media that Cohesix treats as read-only and outside runtime authority. - In-VM TLS, HTTP, and IMDSv2 are a deliberate TCB expansion, not a routine AWS delta. They are disabled by default until `docs/ARCHITECTURE.md`, `docs/NETWORK_CONFIG.md`, `docs/SECURITY.md`, `docs/SECURITY_NIST_800_53.md`, and `docs/AWS_AMI.md` explicitly approve the bounded client-only threat model and generated manifest gates. - AWS VM profiles require dependency-closure evidence before runtime code lands: no `std`, libc, POSIX filesystem/process API, DNS resolver, web framework, unapproved TLS/HTTP stack, or host-only ecosystem dependency may enter the root-task or isolated runtime closure. - No listener is introduced in the VM. AWS networking is outbound-only after seL4, and any Secure9P fabric mount must preserve existing frame bounds, role-scoped authority, and deterministic error behavior. - AWS ecosystem coexistence remains host/fabric-side unless explicitly admitted by the TCB gate. Cloud-side adapters, observability, deployment automation, and policy workflows must reuse `/host/tickets/*`, provider registry evidence, and host/fabric termination where the security review rejects in-VM TLS/HTTP. - If the security review rejects in-VM TLS/HTTP, the milestone must use a signed bootstrap manifest and a host/fabric-side termination design instead of importing a web/TLS stack into the root-task closure. - ENA is PCIe/MMIO/DMA-backed physical hardware. Steady ENA admin queue, IO queue, interrupt/poll, RX/TX descriptor, and DMA/cache service must live in a manifest-declared isolated AWS network runtime over the fixed driver-task ABI after HAL admission. Root-task remains the HAL/resource admitter, descriptor publisher, bounded service-turn client, network stack owner, and diagnostics publisher; it must not contain a root-owned steady ENA driver. - AWS ENA records must extend the existing fixed driver-task ABI without forking a second incompatible contract. A platform-neutral ABI extraction is allowed only with byte-layout/version compatibility tests for existing Pi 4 descriptors, generated migration, and no change to accepted Pi evidence by implication. - Production ENA profiles must extend the accepted 28b ticket-free manifest-runtime ledger and structured quarantine contract with ENA-specific generation-keyed endpoint, notification, SC/Reply, fault/timeout, queue/ring, PCIe/BAR, IRQ/MSI-X, DMA, and shared-buffer inventory. Prior Pi/storage runtime records prove schema/logic compatibility, not ENA authority or recovery. - The initial single TX/RX queue polling path is bootstrap evidence only. Peak-performance AWS claims require a later generated multi-queue, MSI-X or equivalent notification, queue-affinity, and core-local service-bucket evidence phase. **Deliverables** #### A0) Boot-chain / TCB reconciliation and boot-resource map - Reconcile the current UEFI/ESP builder, Pi 4 U-Boot pivot, selected EC2 instance family, seL4 platform/handoff assumptions, and AWS profile requirements before runtime AWS code lands. - Prove a bounded EC2 Arm64 feasibility chain before ENA work: register an EBS-backed UEFI AMI, reach a deterministic UEFI/serial marker, identify the selected seL4 platform gap or reach root-task, and capture the ACPI/DT, memory, GIC/timer, PCIe, interrupt, and console inputs the port must consume. - Produce a boot-resource map covering AMI snapshot/root-volume geometry, ESP layout, elfloader, kernel, root task/rootserver, optional initrd, resolved manifest hash, signed fabric bootstrap manifest, root trust anchors, selected attestation inputs, hardware-description handoff, firmware-managed persistent state, and explicit non-claims. - Record whether root-task TLS/HTTP/IMDS is accepted, rejected, or deferred. If deferred or rejected, AWS bootstrap must use signed manifest inputs and host/fabric-side termination rather than importing those stacks into the VM closure. #### A) AWS compiler + profile admission - Dedicated AWS Arm64 profile and manifest vocabulary for: - `ena` as a network backend - ENA queue bounds - bootstrap retry limits - signed fabric bootstrap manifest requirements - optional IMDSv2 allowlist and bounded response sizes - explicit diskless state that disables `persistence.*` and rejects local block backends #### B) EFI System Partition integration for AWS - Reuse the existing deterministic ESP builder as the canonical packager and produce an AWS-consumable EBS root image whose firmware-visible ESP contains: - `EFI/BOOT/BOOTAA64.EFI` (elfloader EFI) - `kernel.elf` - `rootserver` (root task ELF) - optional `initrd.cpio` - `manifest.json` and `manifest.sha256` - embedded, signed fabric bootstrap manifest (≥2 endpoints, root trust anchors) #### C) ENA isolated network runtime (adminq + single TX/RX queue bootstrap) - ENA PCIe discovery, BAR admission, adminq, completion path, and single TX/RX queue pair run in a manifest-declared isolated AWS network runtime using HAL-declared PCIe/MMIO/DMA/shared-buffer resources. - ENA command/completion records consume the single fixed driver-task ABI contract; any platform-neutral extraction preserves existing Pi 4 ABI layout/version behavior through explicit compatibility fixtures. - Root-task owns only generated descriptor publication, bounded ENA service turns, net-stack integration, and diagnostics. - Minimal polling dataplane with single TX/RX queue pair is accepted only as first-link/bootstrap evidence, not as peak AWS throughput closure. - Before production promotion, the ENA runtime must publish an owner-milestone, generation-keyed 28b-compatible inventory and pass injected admin/data queue, timeout, interrupt, DMA, and process-fault containment, quarantine, complete teardown, stale-turn refusal, and fresh-generation recovery tests on the selected EC2 profile. #### D) Outbound bootstrap core after seL4 - Reuse the Milestone 26b `no_std` DHCP core over the root-task net stack fed by isolated ENA runtime RX/TX service turns - Add bounded **outbound** TCP connection management - Add bounded TLS client support only after the AWS security/TCB expansion gate accepts it for the selected profile - Add a minimal outbound Secure9P/9door mount client - Diskless bootstrap path **after seL4**: HAL-admitted isolated ENA runtime -> DHCP (26b core) -> outbound TCP -> approved security/session layer -> 9door mount #### D2) AWS ENA performance closure (post-bootstrap) - Add generated queue-count, queue-affinity, notification/MSI-X or poll-budget policy, burst, and backpressure bounds after first-link smoke passes. - Map ENA queues into core-local service buckets from Milestone 29a without changing Secure9P, console, or namespace semantics. - Keep root-task as the serialized authority/net-stack client; isolated runtime owns queue service and DMA/cache maintenance. - Produce archived EC2 performance evidence for first-link single-queue bootstrap and later multi-queue/notification-backed ENA closure. Benchmark evidence must include instance type, ENA feature set, generated queue policy, service-bucket mapping, request suite, error-budget policy, and hostile-fabric/refusal context. Single-queue polling results are bootstrap/link evidence only and cannot be promoted to peak-performance claims. #### E) Optional IMDSv2 bootstrap - Optional IMDSv2 bootstrap (instance identity + config) is deferred until the bounded HTTP client threat model is approved; the default AWS path uses manifest-authored or signed-bootstrap inputs without IMDS. - No listeners; no background refresh loop #### F) AMI registration tooling - AWS scripts for ESP image registration and smoke tests for Arm64 (`uefi` / `uefi-preferred`) - Documentation in `docs/AWS_AMI.md` covering boot path, failure modes, and recovery - Dependency-closure and hostile-fabric evidence for every AWS-enabled VM profile before production claims. **Commands** - `cmake --build "$SEL4_BUILD_DIR" --target rootserver_image` - `scripts/uefi/esp-build.sh --manifest configs/generated/root_task_resolved.json --sel4-build-dir "$SEL4_BUILD_DIR"` - `scripts/aws/platform-feasibility.sh --state-dir out/aws/m31-platform-feasibility` - `scripts/aws/build-esp.sh` - `scripts/aws/register-ami.sh` - `scripts/aws/launch-smoke.sh` - `scripts/aws/ena-bench.sh --mode bootstrap --state-dir out/bench/m31-ena-bootstrap` - `scripts/aws/ena-bench.sh --mode peak --state-dir out/bench/m31-ena-peak` - `cargo test -p root-task --test ena_fault_recovery` - `cargo tree -p root-task --target aarch64-unknown-none --no-default-features` - `cargo deny check bans` **Checks (DoD)** - EC2 instance boots directly into Cohesix with no intermediate OS. - EC2 Arm64 feasibility evidence identifies the supported instance family, AMI registration path, UEFI/serial result, selected seL4 platform status, and authoritative ACPI/DT hardware-description path before ENA runtime work is accepted. - Boot-chain reconciliation and the boot-resource map are complete before AWS runtime code cites UEFI, TLS/HTTP, IMDS, ENA, or outbound fabric assumptions. - AWS dependency-closure gate proves the VM profile remains `no_std` and excludes libc, POSIX filesystem/process APIs, DNS resolver, web framework, and unapproved TLS/HTTP dependencies. - ENA link comes up deterministically; DHCP lease acquired within bounded time. - ENA hardware service must use a manifest-declared isolated ENA runtime; root-task direct ENA MMIO/DMA paths fail profile validation outside explicitly named QEMU/host compatibility tests. - ENA runtime records use the fixed shared driver-task ABI, and any platform-neutral extraction proves existing Pi 4 descriptor layout/version compatibility. - A production ENA profile has new target-specific 28b-compatible manifest-runtime ledger and structured fault/quarantine evidence; no Pi 4, storage-runtime, schema-only, or bootstrap-link record can substitute for the exact ENA generation and EC2 target. - ENA fault recovery revokes BAR/MMIO, IRQ/MSI-X, DMA/shared-buffer, queue/ring, endpoint, notification, SC/Reply, and timeout/fault authority, rejects stale completions and service turns, and requires fresh generated admission before network service resumes. - 9door namespace mounts successfully and control plane is reachable. - Single-queue polling evidence is classified as bootstrap/link proof. Peak AWS performance claims require the D2 multi-queue/core-local evidence lane. - ENA benchmark artifacts are archived for bootstrap and, where peak-performance claims are made, multi-queue or notification-backed service-bucket runs. EC2 results are compared against the latest accepted rolling benchmark baseline only for capacity/context; AWS target evidence is its own lane and must not overwrite Pi/QEMU proof. - IMDSv2 metadata fetch is absent by default or optional and bounded after approval; if unavailable or denied, boot continues safely with explicit diagnostics and no unbounded retries. - If TLS/HTTP is approved, proof shows it remains client-only and non-persistent: no listener, no background refresh loop, bounded trust-anchor/cert storage from signed manifest inputs, bounded handshake/input parsing, and deterministic boot behavior when fabric, TLS, or IMDS is unavailable. - Cohesix never mounts or writes the root EBS volume after boot handoff, the AWS profile exposes no Milestone 29 persistence backend, and reboot/stop-start restores runtime state only from signed inputs. Any firmware-managed UEFI-variable persistence is inventoried separately and cannot be described as Cohesix control-plane persistence. - Failure cases (no fabric, hostile fabric, forged remote manifest, auth failure, ticket widening attempt, Secure9P-bound relaxation attempt, replay, malformed frame, link down) fail terminally or refuse boundedly with explicit console diagnostics, no local policy mutation, no widened authority, and no partial trust state. - AWS security docs record the accepted posture for any root-task TLS/HTTP code, or explicitly state that TLS/HTTP termination remains outside the VM. **Compiler touchpoints** - `coh-rtc` emits: - AWS profile / backend admission for `ena` - boot-resource map schema, AMI/root-volume geometry, artifact hashes, hardware-description handoff, signed-bootstrap manifest references, trust-anchor references, selected attestation inputs, firmware-state inventory, and generated non-claim summaries for AWS profiles. - isolated ENA runtime descriptors, ENA queue bounds, bootstrap retry limits, and later multi-queue/core-local performance gates. - ENA-specific extensions to the accepted 28b ticket-free driver manifest-runtime ledger, structured quarantine policy, bounded fault evidence, and fresh-generation recovery gates. - explicit diskless-profile validation that disables `persistence.*` and rejects the root EBS/ESP or other local block devices as runtime persistence backends. - the single fixed driver-task ABI version and any generated AWS extension records, with compatibility evidence for existing Pi 4 descriptors. - Fabric bootstrap manifest schema and signature requirements. - dependency-closure allow/deny lists for AWS VM profile crates. - IMDSv2 allowlist, max response bytes, and retry bounds (optional gate). - Regeneration guard verifies EFI binary hash against recorded compiler output. **Task Breakdown** ``` Title/ID: m31-uefi-and-tcb-reconciliation Goal: Reconcile AWS platform, boot, and security assumptions with the current Cohesix UEFI baseline and tiny-TCB networking posture before runtime work starts. Inputs: scripts/uefi/esp-build.sh, docs/BOOT_REFERENCE.md, docs/HARDWARE_BRINGUP.md, docs/NETWORK_CONFIG.md, docs/SECURITY.md, docs/SECURITY_NIST_800_53.md, docs/AWS_AMI.md, AGENTS.md. Changes: - docs/AWS_AMI.md — state the selected EC2 Arm64/custom-OS support posture, accepted AWS boot chain, whether the UEFI/ESP builder is current, the boot-resource map fields, EBS root-volume truth, hardware-description handoff, and what evidence proves them. - docs/NETWORK_CONFIG.md + docs/SECURITY.md + docs/SECURITY_NIST_800_53.md — record whether root-task TLS/HTTP/IMDS is accepted, rejected, or deferred for AWS. - docs/BUILD_PLAN.md — keep Milestone 31 subtasks synchronized with the accepted TCB posture. Commands: - scripts/uefi/esp-build.sh --help - scripts/ci/check_test_plan.sh Checks: - AWS work has an explicit platform-support decision, boot-chain baseline, boot-resource map, hardware-description path, and security-approved plan for TLS/HTTP/IMDS before ENA bootstrap code depends on those assumptions. Deliverables: - EC2 platform/UEFI and AWS TCB reconciliation note, including a boot-resource map, that blocks unsupported platform assumptions and accidental import of web/TLS stacks into the VM. Title/ID: m31-uefi-esp Goal: Validate or refresh the deterministic ESP builder and selected seL4 UEFI build before EC2 feasibility work. Inputs: upstream elfloader EFI build, selected `SEL4_BUILD_DIR`, `scripts/uefi/esp-build.sh`, manifest outputs, accepted m30 UEFI/TCB reconciliation. Changes: - scripts/uefi/esp-build.sh — remain the canonical ESP builder for Cohesix only if `m31-uefi-and-tcb-reconciliation` accepts it as current; otherwise refresh or replace it under the same documented contract. - scripts/aws/build-esp.sh — thin AWS wrapper producing an AMI-ready EBS root/ESP image from the canonical builder output. Commands: - cmake --build "$SEL4_BUILD_DIR" --target rootserver_image - scripts/uefi/esp-build.sh --manifest configs/generated/root_task_resolved.json --sel4-build-dir "$SEL4_BUILD_DIR" Checks: - The selected build directory supplies the UEFI elfloader, kernel, and embedded rootserver truth; the ESP reaches the deterministic UEFI/root-task marker required by the platform-feasibility probe. Deliverables: - Documented ESP layout and build recipe for the selected Arm64 UEFI profile. Title/ID: m31-ec2-arm64-platform-feasibility Goal: Prove the selected EC2 Arm64 family can launch a custom Cohesix UEFI/seL4 payload and expose the platform inputs required before ENA implementation. Inputs: accepted m30 UEFI/TCB reconciliation, selected `SEL4_BUILD_DIR`, scripts/uefi/esp-build.sh, AWS account/region/instance-family test profile, docs/AWS_AMI.md. Changes: - scripts/aws/platform-feasibility.sh — register a disposable EBS-backed Arm64 UEFI probe image, launch the selected instance family, capture console/serial and lifecycle evidence, and clean up bounded test resources. - docs/audit/M30_EC2_PLATFORM_FEASIBILITY.md — record AMI registration, UEFI marker, seL4/root-task reachability or exact platform blocker, ACPI/DT handoff, GIC/timer, memory, PCIe/interrupt, console, root-volume, and unsupported-feature evidence. - docs/AWS_AMI.md — classify the selected family as supported for further implementation, experimental with a named blocker, or unsupported. Commands: - scripts/aws/platform-feasibility.sh --state-dir out/aws/m31-platform-feasibility Checks: - AMI registration and UEFI entry are proven on the named instance family, and the selected seL4 platform either reaches root-task or has a bounded, explicit porting task before ENA work. - The evidence identifies the authoritative ACPI/DT and PCIe/interrupt discovery path; QEMU `virt` addresses or Pi DT assumptions are not reused implicitly. Deliverables: - Go/no-go EC2 Arm64 platform evidence that gates every later AWS runtime task. Title/ID: m31-aws-profile Goal: Admit AWS/ENA/IMDS bootstrap in compiler IR and profile selection before runtime implementation. Inputs: tools/coh-rtc, configs/, docs/AWS_AMI.md. Changes: - tools/coh-rtc/src/ir.rs — AWS profile, selected hardware-description path, `ena` backend, isolated ENA runtime descriptor schema, bounded bootstrap schema, explicit diskless/no-persistence state, and later performance-gate fields. - tools/coh-rtc/src/codegen/{docs,rust}.rs — generated AWS/profile snippets and dependency allow/deny policy summaries. Commands: - cargo test -p coh-rtc Checks: - Runtime code can consume authoritative AWS/ENA/IMDS limits from generated outputs, and physical AWS profiles cannot enable root-owned ENA MMIO/DMA paths. - AWS profiles cannot enable TLS/HTTP/IMDS/fabric support without matching TCB posture and dependency-closure gates. - AWS diskless profiles reject `persistence.*`, the root EBS/ESP, and all local block backends as runtime spool/settings storage. Deliverables: - Compiler-defined AWS admission with docs snippets updated. Title/ID: m31-vm-dependency-closure Goal: Prove AWS VM profiles do not import unapproved host, POSIX, web, or TLS/HTTP dependencies into root-task or isolated runtimes. Inputs: Cargo.toml workspace metadata, apps/root-task, apps/aws-driver-runtime, tools/coh-rtc, deny configuration, docs/AWS_AMI.md. Changes: - tools/coh-rtc/src/validate.rs — generated AWS dependency allow/deny policy for selected VM profiles. - scripts/ci/aws_dependency_closure.sh — target-qualified `cargo tree`/deny check for root-task and isolated AWS runtime closure. - docs/AWS_AMI.md + docs/SECURITY.md — accepted dependency posture and approved exceptions, if any. Commands: - scripts/ci/aws_dependency_closure.sh - cargo tree -p root-task --target aarch64-unknown-none --no-default-features - cargo deny check bans Checks: - `std`, libc, POSIX filesystem/process APIs, DNS resolver crates, web frameworks, host-only ecosystem crates, and unapproved TLS/HTTP dependencies are absent from AWS VM artifacts. Deliverables: - Reproducible AWS VM dependency-closure evidence before runtime code can cite TLS/HTTP/IMDS or outbound fabric support. Title/ID: m31-shared-driver-task-abi Goal: Extend one fixed driver-task ABI for AWS without cloning or silently changing the accepted Pi 4 contract. Inputs: crates/pi4-driver-abi, apps/pi4-driver-runtime, apps/root-task/src/hal/driver_task.rs, tools/coh-rtc, accepted Pi 4 ABI fixtures and proof evidence. Changes: - crates/driver-task-abi/src/** — extract only platform-neutral versioned headers, resource descriptors, command/completion framing, and proof fields needed by both Pi 4 and AWS runtimes. - crates/pi4-driver-abi/src/** — consume or re-export the shared records while preserving existing Pi 4 wire layout, version behavior, and profile-generated descriptors. - tools/coh-rtc/src/** — emit one ABI version/family plus platform-specific extension records; reject conflicting Pi/AWS layouts. - tests/fixtures/driver_task_abi/** — byte-layout, version, bounds, and old-Pi-fixture compatibility tests. Commands: - cargo test -p driver-task-abi - cargo test -p pi4-driver-abi - cargo test -p pi4-driver-runtime - scripts/check-generated.sh Checks: - Existing Pi 4 descriptors and accepted fixtures remain byte-compatible, AWS extensions are versioned and bounded, and no second incompatible ring/service-turn contract is introduced. Deliverables: - One compiler-declared fixed driver-task ABI family ready for isolated ENA records. Title/ID: m31-ena-runtime-adminq Goal: Implement ENA PCIe discovery and admin queue in a manifest-declared isolated AWS network runtime. Inputs: accepted m30 platform-feasibility evidence, apps/root-task HAL admission, m30 shared driver-task ABI, apps/aws-driver-runtime, docs/AWS_AMI.md. Changes: - apps/root-task/src/hal/aws_ena.rs — HAL admission for ENA PCIe BARs, IRQ/notification policy, DMA/shared-buffer descriptors, and runtime image selection. - crates/driver-task-abi/src/** — fixed-layout ENA init/adminq command records and completion evidence, preserving compatibility with the Pi 4 driver-task ABI shape. - apps/aws-driver-runtime/src/** — isolated ENA runtime adminq and completion queue service. - apps/root-task/src/net/ena.rs — root-side ENA ring-client/net-stack wiring only. Commands: - cargo test -p root-task --test ena_adminq - cargo test -p driver-task-abi - cargo test -p aws-driver-runtime Checks: - Feature negotiation succeeds with minimal feature set. - ENA BAR/MMIO/DMA access occurs only in the isolated runtime after HAL admission; root-task remains a bounded client. - ENA records use the generated shared ABI version and cannot alter existing Pi descriptor layout or evidence classification. Deliverables: - AdminQ protocol notes in docs/AWS_AMI.md. Title/ID: m31-ena-runtime-io-bootstrap Goal: Bring up minimal isolated runtime ENA dataplane for first-link bootstrap. Inputs: manifest-declared isolated AWS network runtime, root-task net stack abstractions, generated ENA descriptors. Changes: - apps/aws-driver-runtime/src/** — single TX/RX SQ + CQ and polling dataplane service turns. - crates/driver-task-abi/src/** — fixed-layout RX/TX descriptor service records, queue bounds, and completion counters. - apps/root-task/src/net/mod.rs — integrate isolated ENA runtime RX/TX service into the root-task net stack. Commands: - cargo test -p root-task --test ena_ioq - cargo test -p driver-task-abi - cargo test -p aws-driver-runtime Checks: - TX reclaim and RX refill invariants hold under sustained traffic, root-owned ENA dataplane paths are absent from physical AWS profiles, and single-queue polling evidence is labeled bootstrap-only. Deliverables: - Deterministic dataplane invariants documented. Title/ID: m31-ena-production-ledger-and-recovery Milestone: Milestone 31 — AWS AMI (UEFI → Cohesix, ENA, Diskless 9door) / ENA production ledger and structured recovery Goal: Bind the new ENA runtime to the accepted ticket-free production driver ledger and prove target-specific quarantine, teardown, and fresh-generation recovery. Inputs: accepted Milestone 28b driver-ledger/quarantine schemas and implementation, m30 ENA admin/data queue runtime, selected AWS profile and EC2 target evidence, apps/root-task/src/hal/**, apps/root-task/src/event/**, apps/aws-driver-runtime, tools/coh-rtc, docs/AWS_AMI.md, docs/TEST_PLAN.md. Changes: - tools/coh-rtc/src/** — emit ENA owner-milestone and manifest-runtime identity plus generation-keyed endpoint, notification, SC/Reply, fault/timeout, queue/ring, PCIe/BAR, IRQ/MSI-X, DMA, shared-buffer, quarantine, and recovery records under the accepted 28b ticket-free driver schema. - apps/root-task/src/hal/aws_ena.rs + apps/root-task/src/event/** — attach each admitted ENA bundle to the manifest-runtime ledger, invoke the accepted containment/teardown path on construction, admin/data queue, timeout, interrupt, DMA, and process faults, and reject all old-generation completions or service turns. - apps/aws-driver-runtime/src/** — preserve the fixed driver-task ABI while exposing only the bounded generation/fault evidence needed by root-owned ledger validation; no driver ticket, SchedControl, or recovery authority enters the runtime. - apps/root-task/tests/ena_fault_recovery.rs + EC2 fault-injection lane — cover faults at every admitted resource and queue phase, complete BAR/MMIO/IRQ/DMA/ring/cap teardown, quarantine evidence, stale-generation refusal, and fresh generated readmission. - configs/test_plan_actions.toml + scripts/ci/test_plan_run.sh — add the bounded AWS ENA ledger/recovery stage and target selector with explicit account, region, instance-family, cleanup, and archived-evidence requirements. - docs/AWS_AMI.md + docs/SECURITY.md + docs/TEST_PLAN.md — distinguish generic 28b machinery, ENA-specific target evidence, bootstrap-only link proof, and production recovery claims. Commands: - cargo test -p root-task --test ena_fault_recovery - cargo test -p aws-driver-runtime - cargo test -p coh-rtc - scripts/check-generated.sh - scripts/ci/test_plan_run.sh --target aws --state-dir out/test-plan/m31-ena-ledger-recovery Checks: - A production AWS profile cannot enable ENA without exactly one live generation-keyed manifest-runtime ledger entry and matching EC2 evidence for every admitted ENA bundle. - Quarantine removes all ENA endpoint/notification/SC/Reply/fault/timeout/queue/ring/BAR/MMIO/IRQ/MSI-X/DMA/shared authority, stale work fails deterministically, and recovery requires a fresh generated runtime generation. - Existing Pi 4 and Milestone 29 storage-runtime records prove only shared schema/logic compatibility and cannot satisfy ENA target authority, fault, or recovery evidence. Deliverables: - ENA-specific production ledger and structured recovery evidence over the accepted 28b machinery. Title/ID: m31-ena-performance-closure Goal: Add peak-performance AWS ENA evidence after first-link bootstrap without changing the authority model. Inputs: accepted m30 ENA production-ledger/recovery evidence, generated ENA queue policy, Milestone 29a service-bucket outputs, manifest-declared isolated AWS network runtime, docs/BENCHMARKS.md, docs/AWS_AMI.md. Changes: - tools/coh-rtc/src/ir.rs — generated ENA queue-count, queue-affinity, notification/MSI-X or poll-budget, burst, and backpressure limits. - apps/aws-driver-runtime/src/** — bounded multi-queue service turns and queue-local counters where the platform profile admits them. - apps/root-task/src/net/ena.rs — deterministic merge/backpressure handling for isolated runtime queue completions. - scripts/aws/ena-bench.sh — archived EC2 benchmark runner for bootstrap and peak ENA lanes, including target metadata, queue policy, service-bucket evidence, and error-budget summary. - docs/BENCHMARKS.md + docs/AWS_AMI.md — classify bootstrap link proof separately from peak-throughput proof. Commands: - cargo test -p coh-rtc - cargo test -p root-task --test ena_ioq - cargo test -p aws-driver-runtime - scripts/aws/ena-bench.sh --mode bootstrap --state-dir out/bench/m31-ena-bootstrap - scripts/aws/ena-bench.sh --mode peak --state-dir out/bench/m31-ena-peak Checks: - Multi-queue or notification-backed claims cite generated bounds and archived EC2 evidence; single-queue polling cannot be described as peak performance. - Benchmark artifacts preserve target metadata, generated queue policy, service-bucket counters, error-budget results, and hostile-fabric/refusal context; AWS performance is recorded as a target-specific lane, not substituted for Pi/QEMU evidence. Deliverables: - AWS ENA performance lane aligned to Cohesix service-bucket proof rather than root-owned driver shortcuts. Title/ID: m31-outbound-bootstrap-core Goal: Add bounded outbound TCP/session primitives and only the approved security primitive required before fabric mount. Inputs: apps/root-task net stack, approved TLS or fabric-termination helpers, docs/AWS_AMI.md. Changes: - apps/root-task/src/net/dhcp.rs — adapt/reuse Milestone 26b DHCP core for ENA link and AWS-specific bounds. - apps/root-task/src/net/tcp.rs — outbound TCP session support for long-lived sessions. - apps/root-task/src/net/tls.rs — fabric-auth TLS handshake only if `m31-uefi-and-tcb-reconciliation` approves root-task TLS; otherwise this task wires the approved host/fabric-side termination alternative. - apps/root-task/src/net/bootstrap.rs — deterministic sequencing and retries. Commands: - cargo test -p root-task --test net_bootstrap Checks: - Network reaches "fabric-ready" state within defined bounds. - If TLS/HTTP is approved, it is client-only, non-persistent, bounded, and deterministic when fabric/TLS/IMDS is unavailable; no listener or background refresh loop is introduced. Deliverables: - Bootstrap timing guarantees recorded. Title/ID: m31-imdsv2-bootstrap Goal: If approved by the AWS TCB gate, read bounded instance metadata (IMDSv2) and feed boot policy inputs. Inputs: apps/root-task net stack, docs/AWS_AMI.md. Changes: - apps/root-task/src/net/http.rs — minimal HTTP request/response parsing (bounded, no chunked), only if the AWS TCB gate approves root-task HTTP. - apps/root-task/src/net/imdsv2.rs — token fetch + allowlisted metadata queries, disabled by default and profile-gated. - apps/root-task/src/boot/policy.rs — consume optional IMDS fields (instance-id, region, az, tags if enabled). Commands: - cargo test -p root-task --test imdsv2 Checks: - IMDSv2 is optional: absence, timeout, or denial does not block boot and emits deterministic diagnostics. Deliverables: - IMDSv2 bootstrap flow documented with explicit bounds and allowlist. Title/ID: m31-fabric-mount Goal: Mount 9door namespace and enter steady state (post-seL4). Inputs: root-task net stack, Secure9P client, docs/AWS_AMI.md. Changes: - apps/root-task/src/net/door9p_client.rs — minimal 9P client for fabric mounts. - apps/root-task/src/net/bootstrap.rs — signed manifest verification. - apps/root-task/src/net/mount.rs — mount orchestration and error handling. Commands: - cargo test -p root-task --test fabric_mount Checks: - Namespace mount preserves Secure9P frame/path/fid/ticket bounds and read/write semantics. - Hostile fabric, forged manifest, auth failure, ticket widening, Secure9P-bound relaxation, replay, and malformed-frame cases are terminal or bounded refusals that leave no local policy mutation, widened authority, or partial trust state. Deliverables: - Fabric bootstrap flow documented. Title/ID: m31-ami-pipeline Goal: Produce and validate AWS AMI. Inputs: scripts/aws/, docs/AWS_AMI.md. Changes: - scripts/aws/build-esp.sh — ESP image creation. - scripts/aws/register-ami.sh — snapshot + AMI registration. - scripts/aws/launch-smoke.sh — EC2 smoke test. Commands: - scripts/aws/register-ami.sh Checks: - AMI launches on supported Nitro instance family and passes smoke test. Deliverables: - Reproducible AMI build pipeline. ``` --- ## Docs-as-Built Alignment (applies to Milestone 8 onward) To prevent drift: 1. **Docs → IR → Code** - Any new behaviour MUST land as IR fields with validation and codegen. - Build fails if IR references disabled gates, violates Secure9P bounds, or forces `std` where the runtime is `no_std`. 2. **Autogenerated Snippets** - `coh-rtc` refreshes embedded snippets in `SECURE9P.md`, `INTERFACES.md`, and `ARCHITECTURE.md` (CBOR schema, `/proc` tree, concurrency knobs, hardware tables) during release prep. 3. **As-Built Guard** - Script compares generated file hashes, manifest fingerprints, and doc excerpts against committed versions. Drift fails CI and blocks release notes. - Rule: **Documentation must describe the system “as built”** (post-codegen), not only “as intended”. 4. **Red Lines** - Enforced in the compiler and restated here: 9P2000.L, `msize ≤ 8192`, walk depth ≤ 8, no `..`, no fid reuse after clunk, no in-VM TCP listeners except the authenticated root-task console, CPIO < 4 MiB, no POSIX façade, maintain `no_std` for VM artefacts. 5. **Regression Pack (post–Milestone 7c)** - From Milestone 8 onward, `docs/TEST_PLAN.md` and the declarative test catalog determine development convergence and applicable acceptance closure. Non-claiming convergence may precede the shared regression pack, but never satisfies or replaces final staged acceptance. - Note: `.coh` scripts live in `scripts/cohsh/` and follow `docs/USERLAND_AND_CLI.md`. - The regression pack includes at minimum: - `tests/integration/qemu_tcp_console.rs` (Milestone 7 TCP console flow). - `scripts/cohsh/boot_v0.coh` (baseline help/attach/log/quit script from the manifest compiler). - `tests/cli/tracefs_script.sh` (TraceFS JSONL flows). - `scripts/cohsh/9p_batch.coh` (Secure9P batching). - `scripts/cohsh/telemetry_ring.coh` (telemetry rings & cursor resumption). - `scripts/cohsh/observe_watch.coh` (observability `/proc` grammar). - `scripts/cohsh/cas_roundtrip.coh` (CAS update round-trip). - CI for each Milestone ≥ 8 must: - Run the applicable canonical regression pack and fail on unexplained output drift (including ACK/ERR/END lines, `/proc` grammars, and telemetry formats). - Only permit intentional behaviour changes when the relevant CLI scripts, doc snippets, and manifest fields are updated **in the same change**. - Canonical protocol/as-built fixtures remain authoritative unless their governing contract intentionally changes. Tests may be added, simplified, consolidated, replaced, or removed under `AGENTS.md` Test Discipline; test count is not a compatibility guarantee. 6. **Cross-Milestone Stability Rules** - Changes to console ACK/ERR/END grammar, NineDoor error codes, or `/proc` node formats MUST be treated as breaking changes and require: - (a) matching updates to all CLI fixtures under `scripts/cohsh/*`, - (b) regeneration of manifest-derived snippets, - (c) explicit doc updates in `INTERFACES.md`, and - (d) a version bump of the manifest schema. - Milestones ≥ 9 MUST NOT introduce new 9P verbs or extend grammars unless routed through the manifest compiler and validated by IR red lines. - Networking cadence and event-pump tick pacing MUST NOT shift across milestones unless the change is documented in `SECURITY.md` with updated bounds.