evidence · 4.3 KiB

controller-host.md

Committed at docs/evidence/mainline-autonomous-bash-pid1/host/controller-host.md. This is what grounds the requirements that cite it.

Open raw source

Fixed autonomous Bash-PID1 controller preparation

This checkpoint implements group 5n.2 from base 703e91050375aa260a9b44472e605d390530d3e5 on branch mainline-autonomous-pid1-controller. It is host source/fixture evidence, with no UART, board operation or build. Actual artifact preparation and the native proof are separately required by 5n.3; the physical comparison remains UNVERIFIED.

The typed --autonomous-bash-pid1 flag requires --mode minimal --same-image-shell-pid1 and rejects competing diagnostics before preparation or UART. It generates one fresh 32-character lowercase hexadecimal nonce and only the reviewed 154-byte Bash body. For the selected p2 system, the raw arguments are 477 bytes and the single, single-quoted old-Hush setenv bootargs command is 503 bytes (504 including CR). Backslashes are doubled for the pinned old Hush parser. There is no generic script option. The prior literal transport and default modes remain unchanged.

Before UART, the controller qualifies the existing MemoryPrintk source, Image, actual same-derivation dev configuration and original archive. It then removes every reporter/trace/tick gate from the selected volatile policy. It inspects executable RISC-V ELF64 /bin/sh and /bin/sleep, their shared archived loader, and the defined Bash printf_builtin, test_builtin and exec_builtin exports. These are archive/ABI/export checks, not evidence that those programs executed on hardware.

The native gate pins receipt SHA256 1a718d596a9c31b65651738df4128687a77f3e00cb0c0922544959dca07f42b7 from source-agent commit 21974c021f2b7c697d622028661248d9c784060d. It checks every fixture/test hash, selected Linux source-file bytes, Hush capture facts, selected Linux recovered argv and independently reconstructed fixed vector before UART. Missing or changed native evidence fails closed. Native capture hooks do not prove the installed firmware command-handler ABI or runtime execution. The source agent owns these separate native files; this controller commit does not duplicate them.

Capture lasts at most 60 seconds, accepts only complete fresh nonce B/E records after the fresh exact received kernel arguments, Linux ttyS0 backend and /bin/sh milestone, and permits CRLF framing without repairing embedded CR, ANSI, echoes or interleaved lines. Missing, malformed, duplicate or reversed records retain unknown/incomplete facts. Begin, end and the primary prompt are independent observations: a record’s presence does not prove its own output call returned. The end record supports earlier begin-printf success and sleep return under the fixed script; a later primary prompt supports subsequent exec/startup. Neither is RX, root or touch acceptance.

The controller marks the autonomous boot attempt before writing bootm, including accepted-byte/unknown-flush failures. It saves unknown execution/recovery facts and sends zero candidate bytes after that attempt, including timeout, read-error and overflow paths. It never requests candidate reboot or exit. Only an independently ordered fresh SPL/vendor-kernel/login/normal prompt permits protected normal postflight input; exact normal identities, all eight hashes, three services, absent registration marker and a fresh boot must still pass. Otherwise NEW operator recovery is required. The historical report used for host preparation is not a fresh preflight or recovery proof.

Narrow proof (2026-10-05 UTC):

TMPDIR="$HOME/tmp" PYTHONDONTWRITEBYTECODE=1 python3 tests/test_mainline_autonomous_bash_pid1_controller.py

16 tests PASS in 0.144 seconds. Fixtures exercise fixed syntax/nonce/type/conflict rejection, native receipt/fixture/source/vector corruption and missing-proof pre-UART failure, real pump split/CRLF B/E capture, stale/echo/ANSI/embedded-CR/order/duplicate/truncation failures, independent normal return, read errors/byte bounds, archived ELF export validation, and all five load/CRC checks plus exact printenv/boot transport with zero post-boot writes. Their mocked hardware/archive data is fixture evidence only.

Affected existing proofs also passed: NoHz controller 13 tests; MemoryPrintk controller 23 tests; same-image shell PID1 14 tests; minimal controller 100 tests. Strict mainline validation and whitespace checks passed. No physical result is claimed; 5n.4 and ordinary root/touch task 5b.5 remain open.