Explicit candidate selection: host proof, 2026-10-02

Task 5b.5 controller preparation was performed in /home/jadams/tmp/k230-mainline-root-path, branch audit/mainline-root-path, from f950dafdc1df5271d23030983152d38987d7b257. Owned paths are tools/mainline-drm-initrd-shell-trial.py, tests/test_mainline_drm_initrd_shell_trial.py, and this note. No board, serial port, staging operation, reboot, or build slot was used.

The controller accepts --bundle and --normal-report. Existing invocations retain the historical gf3 bundle and after.json defaults. The selected bundle’s system symlink determines the candidate system; the manifest and the sole init= argument must select that exact system. Identities are passed through the preparation and trial functions without changing the global defaults. The minimal and optional survey command protocols are unchanged; no label or clock mode was added.

Before importing serial or opening a board lock/session, preparation requires:

• Direct, existing, read-only /nix/store bundle and system directories, an explicit system symlink, and an executable system init.
• The exact five manifest load artifacts, positive integer sizes, valid hashes and CRCs, and nonoverlapping load intervals within the board’s 1 GiB RAM. Each of the four bundle payloads must be a read-only regular file whose actual size, SHA-256 and CRC32 match its manifest record. The stage-one wrapper’s identity remains anchored to the protected normal baseline.
• Nonempty, read-only regular registration, store-paths and SHA256SUMS metadata.
• A structured normal report matching the protected p1 system/profile, kernel, all eight committed boot-file sizes and hashes, three active services and a valid boot ID. Boot-file records retain the original {bytes, sha256} shape; a later report containing only flat digests is not accepted as a substitute.

Existing protected normal preflight/postflight and U-Boot size/CRC checks remain in place. The printed U-Boot bootargs must be one complete matching assignment; an echoed substring or duplicate assignment cannot satisfy that check.

Host commands and results

The following checks passed on 2026-10-02 (UTC observation 2026-10-02T15:58:18Z), in the worktree above:

python3 -m unittest discover -s tests -p test_mainline_drm_initrd_shell_trial.py
python3 -m py_compile tools/mainline-drm-initrd-shell-trial.py tests/test_mainline_drm_initrd_shell_trial.py
openspec validate the-board-runs-a-mainline-kernel --strict
git diff --check
python3 tools/mainline-drm-initrd-shell-trial.py --help

The suite passed all 36 tests, retaining the previous 21 protocol tests. The 15 additional tests exercise changed candidate selection, CLI defaults and explicit arguments, manifest/system mismatch, missing artifacts and metadata, unsafe store selections, invalid sizes/hashes/CRCs, actual sparse-file overlap, malformed bootargs, and normal-report identity failures. Negative trial tests assert that neither the private serial session nor os.open is reached. Positive candidate preparation uses a separate read-only test store without serial access or changes to the historical BUNDLE/SYSTEM constants.

Pure preparation also succeeded against the actual historical immutable bundle and committed manifest using the committed structured normal baseline:

python3 - <<'PY'
import importlib.util
from pathlib import Path
p = Path('tools/mainline-drm-initrd-shell-trial.py')
s = importlib.util.spec_from_file_location('initrd_trial', p)
m = importlib.util.module_from_spec(s)
s.loader.exec_module(m)
v = m.prepare_trial(
    Path('docs/evidence/mainline-display/physical-2026-10-01/manifest.json'),
    m.BUNDLE, m.NORMAL_BASELINE,
)
assert v['system'] == m.SYSTEM
assert v['normal']['candidate_system'] == m.SYSTEM
print('PASS: exact historical immutable bundle, manifest, init, metadata, ranges and protected normal identities')
for name, _, address, _ in m.LOADS:
    size = v['manifest']['files'][name]['bytes']
    print(name, hex(int(address, 16)), hex(int(address, 16) + size), size)
PY

The bundle was /nix/store/gf3aqks2dg0z3ksz33ysfprnlbk83vw3-k230-mainline-drm-trial-boot-files; its resolved system was /nix/store/k9f4r2i9k9qj58z8z4l2kssy9rpwxxm1-nixos-system-nixos-26.11.20260919.20b1ddd. Verified sizes yielded these half-open load intervals:

Remaining physical gate

UNVERIFIED: this preparation does not demonstrate serial reception, corrected proc setup, reboot recovery, root mounting, root login, or behavior of a newly built restart candidate. Task 5b.5 and the optional restart physical gate remain open. Using the committed normal report in the pure host check proves schema and pinned identities; it does not assert the board’s current boot identity.

After the operator has reserved the board, reviewed a matching new immutable bundle/manifest, and prepared a fresh structured protected normal report, the existing bounded minimal protocol can be selected with this template (not run):

python3 tools/mainline-drm-initrd-shell-trial.py \
  --bundle /nix/store/EXACT_NEW_BUNDLE \
  --manifest /path/to/MATCHING_MANIFEST.json \
  --normal-report /path/to/STRUCTURED_PROTECTED_NORMAL.json \
  --mode minimal

The placeholder paths must be replaced with reviewed actual artifacts. Existing reception retry limits, stage timeouts, stop-on-missing-marker behavior, private log handling, and protected normal recovery checks remain applicable. A failed marker is not root-cause evidence and does not authorize further probe input. Review, merge and push remain with the coordinator; no physical claim is added.