[auser]

Superseded by draft #5326, rebased onto current main without rewriting this branch. This PR remains open until the replacement diff and CI are reviewable; do not merge either draft.

---

Scope and review boundary

Stacked on draft #5263. This remains a draft staging slice, not a release candidate that can be launched in production.

• Preserve v1 authoring/reader and all published pack meanings. Define the one-file v3 ordered graph/entrypoint request, strict schema-3 application and schema-4 runtime/tool readers, exact manifest-pin acquisition and authenticated policy snapshots. The v3 graph is not yet wired into mvmctl run --compose.
• Bind a selected local schema-3 kernel/tar to distinct schema-9 same-host Dev proof; keep production canonical Linux proof separate. Stage signed v3 component bytes against either a separately signed compatible base or an unsigned local-development base, with architecture/ABI/libc/kernel/capability and path-conflict checks. The separate base-compatibility/v1 verifier retains exact signature evidence and can recheck current image revocations; no production descriptor is published.
• Reuse the existing host-signed composition bundle/cache and verified ext4/verity extraction; command-only choices do not reassemble unchanged filesystem inputs. Cache hits must recheck retained input trust and policy.
• Add compile-time-gated, PR-only guest-runtime and synthetic-default-base verifiers. The latter verifies an exact PR workflow Sigstore identity before using the existing local Dev custody path; no PR signer or host key is promoted to publisher authority. A new PR job signs a deliberately nonbootable test base solely to test this verifier. A real CLI boot fixture and witness are still absent.
• Fix the formerly failing feat(pack): draft local composition with signed input admission #5263 missing-bundle test context, refactor oversized bundle/hostd/CLI modules, and include the sealed local composition tar in the local image-set producer.

Checks run locally (macOS, not Linux boot evidence)

python3 -m unittest discover -s tests (151 passed) and python3 scripts/validate-packs.py (11 manifests) passed in mvm-packs. just release-check in mvm-images passed 200 tests (one macOS filename skip) and five BDD scenarios. In mvm, focused v3 contract (7), v3 materializer (19 plus one ignored), local-base graph/refusal (1), component reader (7), policy-profile (136), bundle reader (97), host admission (99), and rootfs streaming (13) tests passed. Focused CLI synthetic-base/runtime PR-number test, feature-matrix cargo check, scoped cargo clippy -D warnings, formatting, workflow paths, file-size and two-surface gates passed. The PR-only real Sigstore fixture job has not yet completed at this head. check-all and check-stubs exceeded the local terminal limit and are not green.

cargo run --locked -p xtask -- check-rust-footprint fails: 1,259,422 physical / 988,159 SLOC versus the existing 1,250,600 / 980,000 limit (all new files staged and counted). No ratchet increase has been made; the single authorized measured, bounded change is deferred until the complete scope is settled.

Acceptance still missing

• No actual mvmctl run --compose cold/repeat guest-value, verified cache-hit/admission, or measured assembly/boot/transfer/retained-disk witness. Direct-QEMU guest reads are additional filesystem evidence only.
• The v3 graph still needs CLI dispatch, signed evidence/lock/cache binding, effective command and policy/host grants in the plan, and fresh revocation rechecks immediately before launch. The synthetic PR base job uses nonbootable bytes and proves only signature/input refusal.
• No independently verified protected-pipeline-signed self-contained production .mvmpkg export. Current local bundles remain same-host Dev. Signed image-set v0.2.4 lacks the composition tar; a compatible published CLI/full-runtime and production signed base-compatibility descriptor are unavailable. images.lock remains untouched.
• No GCP KVM host or tracked-checkout transfer has been authorized for this exact run. Nix and actual CLI microVM boots require the project Linux builder-VM boundary; host checks above do not substitute.

Keep this and its parent draft. Do not merge, publish image sets/packs, or sign a production release until the one-command guest-output/admission/cache-hit gates and release prerequisites pass.

[auser]

Superseded by #5326; unfinished selected-base/v3 graph and witnesses remain tracked in #5415 (handoff: #5415 (comment)). Closing this draft without merging or deleting its branch; no production or release claim.