[Clear1nsight]

Change and mathematical scope

Preserve the closed Linux 7/AppArmor channel and original-contract source audit as a self-contained registered static replay in research/h25-c05-linux7-channel-audit. The source review did not accept a deployable channel mechanism and stopped before any installer. Full compiler-input closure and full bootstrap-control campaign remain false.

The package retains 25 selected kernel source/license/tag bodies at exact Ubuntu commit 88cb661f6b53f472167d39a72241b5396e34ab2a, associated with tag Ubuntu-hwe-7.0-7.0.0-42.42_24.04.1 and source version 7.0.0-42.42~24.04.1. It retains all 54 selected AppArmor files / 843856 bytes, plus the exact full 26432-byte LGPL-2.1 COPYING.LGPL required by the retained libapparmor header, source controls, patch series, licenses, acquisition/limit failures, independent source reviews v1/v2, the 21-channel original-contract review and the late parser-qualification supplement. Kernel/package/tag association is distinct from complete signatures, source history and running-binary correspondence. AppArmor base source plus Debian/Ubuntu patch inputs remain unapplied; applied composition and the actual selected policy ABI remain UNQUALIFIED.

The finite source findings are:

• AppArmor's actual registered initializer contains getattr/file_receive but omits the reviewed inode_readlink, inode_permission and System V IPC families. Replay checks the initializer boundary and registration call. This is neither global string absence nor a universal impossibility result. Actual GCC use of a gap is not shown.
• Source transition/descriptor/rawlog facts leave original-preservation obligations: inherited FD revalidation/null replacement, unconfined object delegation, pdeath_signal and rlimit effects, ordinary nonappend rawlog opens, and unchanged direct Popen context. No actual log clobber or failed legitimate launch is demonstrated.
• BPF hook availability supplies no concrete complete policy, program/maps, attachment, authority or lifetime proof.
• Provider source has 216 runtime literal rows = 215 headers + /proc/self/exe, plus one separately checked adjacent profile, producing the 217-file preflight. Variant source explicitly requires six C/header role occurrences across two roles; it has no automatic all-215 child-membership loop. Provider custody does not establish compiler exclusion, a 215-row reduction, complete closure or fitting selection.

All original Python snapshots are inert .txt files and are parsed only as DATA. No archived C/Python source, historical test, original helper/provider/Root/caller/native TCB/compiler, namespace/Popen/scientific execution or policy installation runs.

Task and overlap

Original source investigation: PR #6321. Frozen H25 benchmark: PR #6029. Immediate predecessors: PR #6374, PR #6373.

Exact publication base: 7c49fe3, tree e6898c8ba7a27b71587c32ba3f639259ceeeed91. TASK.json pins the portable-replay provenance card and declares changed scope for this explicit closed-source-evidence export; no random new task was drawn.

Nearest related deliveries:

• PR6370, e144f3b
• PR6371, 8e772ea
• PR6373, b91c5c7
• PR6374, b02bfe3

These are related source/component packages; the added value here is the exact Linux 7/channel/215-header audit, its independent reviews and a cold-available static replay. Their supplied hosted PASS checkpoint observations are distinct from new exact-head publication checks and add zero original scientific credit. This bounded overlap list is not a novelty proof. No predecessor package is copied merely for provenance. All replay source bytes are local to this package; old local paths in raw evidence are historical origins, not execution dependencies.

Validation

Observed local checks on the frozen export, Python 3.12 standard library:

• Metadata: python3 -B scripts/research_package.py --package research/h25-c05-linux7-channel-audit --check-only — PASS_PACKAGE_METADATA_AND_PINS.
• Registered replay: python3 -B scripts/research_package.py --package research/h25-c05-linux7-channel-audit — normal and explicit -O commands pass, PASS_REGISTERED_RESEARCH_PACKAGE, outcome partial.
• Package-only cold read-only copy: python3 -I -B verify.py and python3 -I -O -B verify.py — PASS_STATIC_SOURCE_AUDIT_ONLY in both profiles.

The verifier authenticates byte inventory/origins, exact acquisition/member/source pins, the actual hook array, transition/FD/rawlog source anchors, provider literal partition/separate preflight and variant two-role/six-file guard. Five pure DATA controls address unknown predicate, dangling reference, changed source pin, an out-of-array hook token and a changed registered hook. Inputs/source snapshots remain unchanged. Normal/optimized/cold agreement is reproducibility of this same static checker, not independent theorem or supplier acceptance.

Independent publication review rejected the preliminary packet for omitting the full LGPL-2.1 text referenced by a retained header. This successor adds the exact libraries/libapparmor/COPYING.LGPL member from the already pinned AppArmor original archive and its bounded DATA-only acquisition receipt. The preliminary packet and rejection remain preserved; original source/test bytes and all claims are unchanged.

Full compressed AppArmor archives and the private full kernel config are omitted; selected exact bytes, archive/member receipts and selected config facts/hash/size are retained. The unreviewed partial decoder/fixtures are excluded. Preparation failures/corrections and all raw validation outputs are preserved outside the package in the local export receipt; they are not silently counted as successful original work.

The original source gate remains unaccepted; the parser supplement is late append-only bookkeeping. The earlier source rounds remain closed. The application goal remains paused, guarded attempt unapproved. 94.550533479/2400 policy seconds are not complete physical cost; all outside costs remain OPEN_NOT_ZERO. No fresh performance, kappa, complete original caller, original admission or scientific completion result is claimed. Hosted exact-head results are separate publication evidence.

Credit

Chris R/Clear1nsight; predecessors PR6321, PR6029, PR5864; unpaidmoon and Cursor/Grok assistance associated with PR6339; Douglas R. Colkitt and upstream research/replay maintainers. Substantial OpenAI Pro, Codex and GPT-6.1 Sol Max implementation, source review and publication preparation assistance is disclosed. Agent source review is not human or proof-kernel acceptance.

New checker/prose/metadata are Apache-2.0. Linux/AppArmor snapshots retain all original GPL/SPDX/copyright notices, complete selected license texts and source-specific exceptions; repository Apache-2.0 does not relicense them. See NOTICE.md, SOURCE-ORIGINS.json and retained license files.

Open next questions

TASK.json has structured questions, relevance, smallest first steps and blockers. First qualify the complete applied parser composition/actual ABI, or one exact original-compatible alternative mechanism. Then close the whole 21-channel F/P/A/E/K/witness selection with original parent/FD/rawlog/native preservation and actual 512-row/wire/byte/resource fit. Independently admit the instance and complete all physical/funding/privilege/execution gates before any constructor. Hook absence alone does not rule out other sufficiently justified routes. These remain open and are not completed by static replay.

[Clear1nsight]

Exact-head source-audit delivery verified.

All 178 added files /3,618,277 bytes at 2a26450dea25d7648b585befce5ed375857a8f90 match the independently reviewed manifest d415e1e71553cf123e27e01fd461da82400bddc4870d326f62c5f248c266ef02; tree 86f578e5889cfdcf3688963ce679857d45d2e6ed, sole parent 7c49fe32c55de02c2c873655c804b16e4c3fef0a, all mode 100644. Actual hosted run 41490678170 attempt 1 completed SUCCESS on this exact head: plan, registered static source replay, committed inputs unchanged. Local normal/-O, isolated cold normal/-O and committed-byte/history/mode checks passed; review scope and retained licensing repair are in the PR body.

Canonical technical handoff and next dependencies · coordination handoff · exact version-bound questions.

No original/native/compiler/namespace/scientific execution or policy installation; source-only replay is not original qualification. Current source/provider/enforcement/fit/ownership/admission/baseline and complete bootstrap-control campaign controls remain open. Outside preparation/Pro/review/reporting/publication/final costs remain OPEN_NOT_ZERO. Original authors/licenses and Pro/Codex/GPT-6.1 Sol Max assistance retained. Draft/open/unmerged; no source or head change made for this handoff.

Original H25 benchmark: PR #6029. Original source investigation: PR #6321.