amadan

carlos / platform Public

census-ruling-claim-step6-artifacts-fix1: record the controller's ruling

platform-1e accepted fix round 1's census as proposed on 2026-10-18: the
root-read overlay plan14-root-reads-claim-step6-artifacts-fix1.tsv (2 changed,
3 new, 1 removed) and the 9B8 entry putAttempts.Put as nonrecord. The seal
stands. The overlay's rows now carry
rev3=census-ruling-claim-step6-artifacts-fix1; its header, the loader comment,
the 9B8 inventory comment and the proposal's "Fix round 1" status say ruled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude acde0d26efacd15c30109aad8294af9d8c682a61 parent 6640de7
4 files changed, +14 −13
  • docs/superpowers/notes/census-proposal-claim-step6-artifacts.md +2 −2
  • internal/provision/claim_step6_artifacts_census_test.go +3 −3
  • internal/provision/plan14_root_reads_test.go +3 −2
  • internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv +6 −6

CI passed — run details

CI log 
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	322.360s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.852s
ok  	github.com/carlosframework/platform/cmd/moveprobe	93.439s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.712s
ok  	github.com/carlosframework/platform/internal/activator	250.944s
ok  	github.com/carlosframework/platform/internal/agentsock	0.020s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.023s
ok  	github.com/carlosframework/platform/internal/appconfig	2.542s
ok  	github.com/carlosframework/platform/internal/apperr	0.081s
ok  	github.com/carlosframework/platform/internal/applog	0.175s
ok  	github.com/carlosframework/platform/internal/awsinv	0.007s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	0.786s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.712s
ok  	github.com/carlosframework/platform/internal/changelog	0.334s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.589s
ok  	github.com/carlosframework/platform/internal/clamd	0.057s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	407.528s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.728s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.010s
ok  	github.com/carlosframework/platform/internal/dbverify	0.007s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.006s
ok  	github.com/carlosframework/platform/internal/domains	2.437s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	45.236s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.010s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.162s
ok  	github.com/carlosframework/platform/internal/gate	1.656s
ok  	github.com/carlosframework/platform/internal/genselect	0.015s
ok  	github.com/carlosframework/platform/internal/geo	0.020s
ok  	github.com/carlosframework/platform/internal/geoip	0.034s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.185s
ok  	github.com/carlosframework/platform/internal/host	181.005s
ok  	github.com/carlosframework/platform/internal/hostactors	6.202s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.015s
ok  	github.com/carlosframework/platform/internal/hostbox	2.800s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.567s
ok  	github.com/carlosframework/platform/internal/hostenv	0.015s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.015s
ok  	github.com/carlosframework/platform/internal/hostexec	5.097s
ok  	github.com/carlosframework/platform/internal/hostfence	0.033s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.500s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.014s
ok  	github.com/carlosframework/platform/internal/hostguard	1.032s
ok  	github.com/carlosframework/platform/internal/hostops	1.622s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.014s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.014s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.464s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.147s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.019s
ok  	github.com/carlosframework/platform/internal/infraview	0.015s
ok  	github.com/carlosframework/platform/internal/instancectl	5.247s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.773s
ok  	github.com/carlosframework/platform/internal/instancefs	0.019s
ok  	github.com/carlosframework/platform/internal/instancekey	0.016s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.020s
ok  	github.com/carlosframework/platform/internal/layout	1.563s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.017s
ok  	github.com/carlosframework/platform/internal/lease	9.859s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.006s
ok  	github.com/carlosframework/platform/internal/ledger	0.015s
ok  	github.com/carlosframework/platform/internal/mail	0.173s
ok  	github.com/carlosframework/platform/internal/maintenance	0.077s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.506s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.082s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.255s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.775s
ok  	github.com/carlosframework/platform/internal/objstore	0.192s
ok  	github.com/carlosframework/platform/internal/ops	0.175s
ok  	github.com/carlosframework/platform/internal/park	0.218s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	38.248s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.009s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.589s
ok  	github.com/carlosframework/platform/internal/relay	7.233s
ok  	github.com/carlosframework/platform/internal/release	24.304s
ok  	github.com/carlosframework/platform/internal/rollout	3.887s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.059s
ok  	github.com/carlosframework/platform/internal/rootstate	0.029s
ok  	github.com/carlosframework/platform/internal/runs	0.579s
ok  	github.com/carlosframework/platform/internal/s3compat	0.006s
ok  	github.com/carlosframework/platform/internal/safefile	0.005s
ok  	github.com/carlosframework/platform/internal/schedule	2.532s
ok  	github.com/carlosframework/platform/internal/seeds	0.012s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	10.252s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.607s
ok  	github.com/carlosframework/platform/internal/status	0.064s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.279s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.005s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.006s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.581s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 49348770 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
  minio: downloaded, digest verified
  mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
  mc: downloaded, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/18 06:54:06 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DF8D37807454BD, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.023s
minio contract: PASS
diff --git a/docs/superpowers/notes/census-proposal-claim-step6-artifacts.md b/docs/superpowers/notes/census-proposal-claim-step6-artifacts.md
index 8113c88a6..0b536f682 100644
--- a/docs/superpowers/notes/census-proposal-claim-step6-artifacts.md
+++ b/docs/superpowers/notes/census-proposal-claim-step6-artifacts.md
@@ -60,9 +60,9 @@ No new bucket writer, so no 9B8 entry is added. The test passes unchanged. The o
- `TestRootActivationConsoleRuntimePayload` produces the identity through publish-identity over the production S3 store, the policy through the real binary's sign-policy and `--out`, and the console copies through the real binary's install-console. There is no hand-published identity and no hand-made console copy. guard-arm, guard-exec and the console then start under the guard drop-in as the service user, from the protected copy's bytes, and the floor publish-floor writes is the policy's.
- `TestRootActivationConsoleInstall` covers the installer as real root.
-## Fix round 1 (PROPOSED, `rev3=PROPOSED-claim-step6-artifacts-fix1`)
+## Fix round 1 (RULED, `rev3=census-ruling-claim-step6-artifacts-fix1`)
-Astra's review blocked the merge on four findings. The controller ruled F1, F3 and F4 FIX, and accepted F2 as a trial gap. The rows above stay as ruled. The changes are in a second overlay, `internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv`, loaded after the first, and they await a ruling.
+Astra's review blocked the merge on four findings. The controller ruled F1, F3 and F4 FIX, and accepted F2 as a trial gap. The rows above stay as ruled. The changes are in a second overlay, `internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv`, loaded after the first. RULED (platform-1e, 2026-10-18): accepted as proposed, the overlay's rows and the 9B8 entry alike; the seal stands.
- **F1, bounded ELF parsing.** `release.ArtifactBuild` runs `release.CheckELFBounds` (new, `internal/release/elfbounds.go`) before `buildinfo.Read`. The check reads only fixed-offset header fields and has no read site. It accepts only ELF64 little-endian EM_AARCH64, with at most 256 sections and 64 segments. Every table and range must lie inside the file, the tables must not overlap each other or the ELF header, sections with contents must not overlap, and no section may be SHF_COMPRESSED. An unstripped Go binary is refused, because its DWARF is compressed. Release and console builds are stripped (`-s -w`).
- **F2, recorded flag, not linked value: trial gap.** `ArtifactBuild` reads the recorded `-X` flag. Release binaries are stripped, so there is no symbol table to read the linked value from. The chain rests on the release key. Owed before production cohorts: trusted build attestation tied to the artefact digest.
diff --git a/internal/provision/claim_step6_artifacts_census_test.go b/internal/provision/claim_step6_artifacts_census_test.go
index 05f6dc95c..7fe7532e5 100644
--- a/internal/provision/claim_step6_artifacts_census_test.go
+++ b/internal/provision/claim_step6_artifacts_census_test.go
@@ -1,9 +1,9 @@
package provision
// plan14ClaimStep6ArtifactsWriteCensusInventory is the record-write
-// inventory with claims run's putAttempts.Put (fix round 1, F4), PROPOSED
-// for the controller's ruling
-// (docs/superpowers/notes/census-proposal-claim-step6-artifacts.md).
+// inventory with claims run's putAttempts.Put (fix round 1, F4), ruled
+// nonrecord as census-ruling-claim-step6-artifacts-fix1 (platform-1e,
+// 2026-10-18; docs/superpowers/notes/census-proposal-claim-step6-artifacts.md).
//
// putAttempts wraps the store that claims run hands sign-policy and
// publish-identity, only to record that a write was attempted, so a failed
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go
index 5f6d138c6..cd6afeccb 100644
--- a/internal/provision/plan14_root_reads_test.go
+++ b/internal/provision/plan14_root_reads_test.go
@@ -845,8 +845,9 @@ func TestPlan14RootReadCensus(t *testing.T) {
}
// Census overlay claim-step6-artifacts-fix1 (fix round 1: F1 bounded ELF
// pre-check, F3 sums bound to the tag, F4 --out reserved before the
- // phase), loaded last. PROPOSED for the controller's ruling. It adds no
- // accepted-legacy row, so the seal stands.
+ // phase), loaded last, under census-ruling-claim-step6-artifacts-fix1
+ // (platform-1e, accepted as proposed). It adds no accepted-legacy row, so
+ // the seal stands.
if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv"), &inv, true); err != nil {
t.Fatal(err)
}
diff --git a/internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv b/internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv
index 1b499ec60..82424d188 100644
--- a/internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv
+++ b/internal/provision/testdata/plan14-root-reads-claim-step6-artifacts-fix1.tsv
@@ -1,12 +1,12 @@
-# Census overlay claim-step6-artifacts-fix1 (fix round 1 after Astra's review: controller rulings F1, F3 and F4; F2 accepted as a trial gap), loaded LAST, after claim-step6-artifacts. PROPOSED: every row marked rev3=PROPOSED-claim-step6-artifacts-fix1 waits for the controller's ruling; docs/superpowers/notes/census-proposal-claim-step6-artifacts.md, section "Fix round 1".
+# Census overlay claim-step6-artifacts-fix1 (fix round 1 after Astra's review: controller rulings F1, F3 and F4; F2 accepted as a trial gap), loaded LAST, after claim-step6-artifacts. RULED by platform-1e 2026-10-18 as census-ruling-claim-step6-artifacts-fix1: every row ACCEPTED as proposed (2 changed, 3 new, 1 removed), with the 9B8 entry putAttempts.Put as nonrecord; the seal stands; docs/superpowers/notes/census-proposal-claim-step6-artifacts.md, section "Fix round 1".
# F1 internal/release ArtifactBuild now runs release.CheckELFBounds (new, elfbounds.go: fixed-offset header reads only, no read site) before buildinfo.Read. F3 claimactivation sumsNameRelease (no read site) binds the signed sums to the tag through its two debs. F4 internal/host: claims run reserves --out before the phase runs (reserveActivationOutputAt), writes and reads it back through the held descriptor (activationOutput.finish), and removes it only while the entry is still its own file (activationOutput.ours); writeActivationOutputAt is gone (@remove: its checks moved into reserveActivationOutputAt and activationOutput.finish).
# The seal stands: no accepted-legacy row. No box agent, update, recovery or edge path reaches any changed unit.
@coverage internal/claimactivation ee00b6e03fe3a0148a2b1e2835f21852f9a3498cec00f34bcbb3895b0519f45e
@coverage internal/host 8105036aeaefbe18f9236cf798d39cb90c8db6a910e86b6312ce1e2feeec0858
@coverage internal/release 158c6cc42d90632619f4c8c41b47238c3cbdc2170f58c3a8fb7c7a12d2032783
@remove internal/host/activation_artifacts_linux.go writeActivationOutputAt
-internal/release/program.go ArtifactBuild authority G,J4 rev3=PROPOSED-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host (publish-identity);basis=release.CheckELFBounds first: ELF64 little-endian EM_AARCH64, at most 256 sections and 64 segments, every table and range inside the file, no overlap, no SHF_COMPRESSED; then build info of bytes already hashed against a signed manifest; one plain -X version.Build flag or nothing; reads the recorded flag, not the linked value (F2 trial gap); no box path calls it file:Read@96 e89aeb9befc84a21f8f43d4c13e03f7246f00bf464813aa326083c9e6a3b1984
-internal/host/activation_command_linux.go runSystemClaims authority G,J4 rev3=PROPOSED-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0;basis=as census-ruling-claim-step6-artifacts; run reserves --out for sign-policy and publish-identity by exclusive create before the phase can write, and runs the phase on a store that records write attempts file:Read@1602 0d740c974987081d35a3ce3b8cc71d2584ad28f591d47b65c105766598421eef
-internal/host/activation_artifacts_linux.go reserveActivationOutputAt authority G,J4 rev3=PROPOSED-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=checked root-owned parent; refuses any existing entry without following it; exclusive 0600 create held open, owner checked, directory synced; dry-run only checks the path is free file:Fstat@659,file:Fstatat@236 0c47fca349ad833e49f479a448437a66377a18ee3f4952fee17946261abc2235
-internal/host/activation_artifacts_linux.go activationOutput.finish authority G,J4 rev3=PROPOSED-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=writes the phase's exact bytes through the held descriptor, syncs, reads them back through it, requires mode 0600, one link and the entry still its own file, syncs the directory file:Fstat@402,file:ReadAt@293 24d118853d45c9db4e8223db6f6dae810714415bdaf90c9442a7e50f96eebef9
-internal/host/activation_artifacts_linux.go activationOutput.ours authority G,J4 rev3=PROPOSED-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=compares the directory entry, not followed, with the held file's device and inode; abandon removes only a match file:Fstatat@69 a3056d2b0d2b2090c723aec8beb7633ed0a3418a078c9721e52e0c37730173da
+internal/release/program.go ArtifactBuild authority G,J4 rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host (publish-identity);basis=release.CheckELFBounds first: ELF64 little-endian EM_AARCH64, at most 256 sections and 64 segments, every table and range inside the file, no overlap, no SHF_COMPRESSED; then build info of bytes already hashed against a signed manifest; one plain -X version.Build flag or nothing; reads the recorded flag, not the linked value (F2 trial gap); no box path calls it file:Read@96 e89aeb9befc84a21f8f43d4c13e03f7246f00bf464813aa326083c9e6a3b1984
+internal/host/activation_command_linux.go runSystemClaims authority G,J4 rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0;basis=as census-ruling-claim-step6-artifacts; run reserves --out for sign-policy and publish-identity by exclusive create before the phase can write, and runs the phase on a store that records write attempts file:Read@1602 0d740c974987081d35a3ce3b8cc71d2584ad28f591d47b65c105766598421eef
+internal/host/activation_artifacts_linux.go reserveActivationOutputAt authority G,J4 rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=checked root-owned parent; refuses any existing entry without following it; exclusive 0600 create held open, owner checked, directory synced; dry-run only checks the path is free file:Fstat@659,file:Fstatat@236 0c47fca349ad833e49f479a448437a66377a18ee3f4952fee17946261abc2235
+internal/host/activation_artifacts_linux.go activationOutput.finish authority G,J4 rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=writes the phase's exact bytes through the held descriptor, syncs, reads them back through it, requires mode 0600, one link and the entry still its own file, syncs the directory file:Fstat@402,file:ReadAt@293 24d118853d45c9db4e8223db6f6dae810714415bdaf90c9442a7e50f96eebef9
+internal/host/activation_artifacts_linux.go activationOutput.ours authority G,J4 rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=compares the directory entry, not followed, with the held file's device and inode; abandon removes only a match file:Fstatat@69 a3056d2b0d2b2090c723aec8beb7633ed0a3418a078c9721e52e0c37730173da