Exact configured objects and matching full host artifacts

Evidence class: completed matching host artifacts and exact selected-header RISC-V object compilation. No board/UART/camera action, worker execution, receipt, physical counters, root/touch or recovery was tested here. Physical 5h.5–6, positive controller preparation and task 5b.5 remain UNVERIFIED.

The coordinator’s full matching bundle/dev invocation used frozen revision 75cc49df12972235be411e6eca739935ce75614d and returned 0, from 2026-10-04T03:00:57.305156+00:00 to 2026-10-04T03:33:55.986861+00:00. Its exact public-safe command, times and returned paths are in proof.json. That full build was not duplicated.

The narrow object invocation used worktree /home/jadams/tmp/k230-mainline-uart-progress-post-sample, branch mainline-uart-progress-post-sample, source revision e3edc5e6e71219216c78cddae6cf14166c82144d. Only after the actual successful receipt and installed dev availability did we acquire the shared lock. Offline dry run selected only the exact-object derivation. Narrow receipt records return 0, 2026-10-04T03:35:05.945773+00:00–03:35:18.333116+00:00. The lock was released.

flock -n /tmp/k230-nix-build.lock nix build \
  .#kernelMainlineUartProgressPostSampleExactObjects --offline --no-link \
  --print-out-paths --max-jobs 1 --cores 2
python3 docs/evidence/mainline-uart-progress-post-sample/exact-full-host/verify.py \
  /nix/store/jaxswy1k0vj56460sxc80mh4za57nrga-k230-mainline-uart-progress-exact-objects \
  ~/tmp/k230-mainline-uart-post-sample-board/full-build-result.private.json \
  docs/evidence/mainline-uart-progress-post-sample/exact-full-host

The read-only verifier passed. Owned changes are this evidence and only task 5h.2–3 entries; source, protocol, recipes, defaults, controllers and protected card files were not changed. The first verifier attempt incorrectly assumed kernel.dev’s source was a symlink to the complete selected source. It is the installed build skeleton directory. The corrected check compares its Makefile with the selected source, while the exact recipe compiles the actual three selected C files against that installed dev’s config/generated headers. The selected complete source is independently pinned by the object output, source derivation layering and worker digest; no artifact was altered.

Kernel/dev share derivation 0ldhm7ay…; bundle matches zgkkp2km…. Actual worker SHA-256 is aee68aaec5c5c0e2b23919901eb99189265fd2b4787a0e50bc11159afd81ef9b. The realized source derivation layers exactly over immutable k5a5… Breadcrumbs source with only the new PostSample patch. Six cached getter/timer source/header/Kconfig dependencies are byte-identical to that parent, with per-file SHA-256 receipts retained.

All three objects are ELF64 little-endian RISC-V relocatables from GCC 15.3.0, W=1. Actual config/autoconf bytes match selected installed dev before/after compilation, without a CONFIG overlay; both also match the parent xl3cy… dev. Config SHA-256: 52e7470b108ad094dbdf88b94e3e8838564edbda9e7a015b4279012e6765c9f1; autoconf SHA-256: 99f44d781b246202edab1d5ef8c4836b15ae99c590999ff268541dfd673865d0. Effective config differences from parent are empty. Reporter/SBI/8250/DW/OF/ timer dependencies remain built-in, pages are 4KiB, VMAP_STACK=y and KUNIT is disabled. The compile log retains the pahole-version mismatch (kernel131/object environment0); no C warning was observed. Checksums passed.

The worker ELF inspection shows four ordinary .rodata arrays, section alignment64: worker-entry offset0 size31, third-post-sleep offset64 size35, first-post-sleep offset128 size35, after-n1-write offset192 size33 (sizes include NUL). Exact bytes match the four reviewed records, each <=64 and page-contained, with no stack/init-freed storage. Worker is .text; flags are .sbss; helpers are inlined into that ordinary worker. Only setup/late-init functions use .init.text. Original sample buffer remains ordinary .bss, size256/alignment256. Complete section/header tables and K230 symbol excerpts ground ordinary 8250 getter and timer getter/state lifetimes.

The existing inspector passed selected kernel Image and selected system initrd payload equality, uImage header/data CRCs and sizes, DT bootargs, all checksums, nonempty registration and all 629 closure paths including selected system/kernel. Selected init is executable. Image contains each of the four complete records and all three reporter setup keys uniquely. Original numeric reporter strings remain linked. Artifact arguments exactly match inherited parameters plus sole selected init: original two trace tokens and sole ttyS0; no rdinit/async/reporter/Breadcrumbs/PostSample/retained-console comparison flags are baked in.

Complete decoded hardware DT matches parent mhq… after copying both immutable DTBs to temporary files, deleting only /chosen/bootargs with fdtput -d, and comparing sorted dtc -I dtb -O dts -s output. Canonical SHA-256: c36085249e61fc1ed6f8f586b1ccbf11f22a4e27428a3e7e23b046384268fc02. Original DTBs were not modified. The source identity receipt preserves all 95 old package and 11 exposed kernel source/config identities.

These actual host gates justify only 5h.2–3. Root owns review/integration/push, CI, positive controller preparation, manifest/staging and any explicit --mode minimal --same-image-shell-pid1 --uart-progress --uart-progress-breadcrumbs --uart-progress-post-sample physical comparison after its protected preflight. A visible after-n1 point proves the previous numeric call returned, not its full count or this call’s return; a later point proves later progress. Missing output remains unknown, and finite attempts provide no firmware wall-clock deadline. No physical RX, Bash delivery, usable root or automatic recovery follows from host proof.