[auser]

Scope

Draft main-based portable composition candidate. Published v1 packs and signed registries remain unchanged. Dev-only run --compose carries an invocation-private, one-use admission proof without installing or enrolling a bundle. machine create NAME --pack PACK.TOML (still hidden) records a data-only recipe, exact archive digest, and optional selected local base/PR runtime; machine start NAME re-verifies, re-admits, and dispatches the sealed guest entrypoint without ad-hoc argv. PR-only signatures and host signatures never become publisher authority.

Live evidence

• At 4d9e5d21ad, a PR-only signed x86_64 CLI/base/runtime returned COMPOSED_GUEST_VALUE=print('ready') from run --compose through Firecracker: 11.19 s cold, 8.52 s authenticated cache-hit repeat.

• At 4b95627ef9, the same-head signed CLI/base/runtime from Actions run 43284492364 returned that value through named machine create packed-fixed --pack, machine start, machine logs, stop and restart on x86_64 KVM/Firecracker. Create: 4.70 s; first start: 11.03 s; authenticated cache-hit restart: 8.77 s. The guest's write-only console descriptor is retained before UID 901 drops privilege; no device permission widening.

• On macOS arm64 HVF, a locally built native release-witness CLI with PR-signed aarch64 base/runtime produced COMPOSED_GUEST_VALUE=ready through named create, start and stop/restart. Create: 3.51 s; first start: 9.74 s; authenticated cache-hit restart: 9.77 s. This is not an attested CLI or an arm64 Linux/KVM witness.

• At 02a5f6ee3c, same-head PR-signed arm64 base/runtime from Actions run 43314770069 and a locally cross-built, hash-checked arm64 Linux CLI/host helpers ran a named machine on Raspberry Pi 4 Linux 6.18.50 with /dev/kvm API 12 and pinned Firecracker v1.17.0. Create: 20 s; first start: 53 s; stop/restart: 53 s. Both console logs contained COMPOSED_GUEST_VALUE=ready; the repeat Firecracker API log contained no network-interfaces request. The console output is not hash-chained, and the CLI is not a published or attested release. This closes the basic arm64 Linux/KVM guest-read gap only, not warm custody or speed acceptance.

• Focused guest/CLI tests, ordinary and gated compilation, formatting, Clippy, workflow lint, CLI/file-size/thin-CLI/footprint gates passed locally at their noted commits. PR-only base and guest runtime signing passed at 4b95627ef9; CI and the PR signing smoke passed at 02a5f6ee3c. Final docs-only head CI is pending. The footprint ratchet was raised with owner authorization and measures 977,263 total SLOC / 1,243,644 physical lines under 977,500 / 1,244,000. No image/runtime/pack/CLI release was published; images.lock is unchanged.

• At 9a589dd4bd, ADR-059 records the approved one-owner read-lease direction. A Linux-only page-budgeted sealed-memfd boot-file primitive passed two arm64 Pi tests, arm64 Clippy (-D warnings), and the opt-in APFS compilation check. It is not wired into TrustedSnapshotService claims, signed closure publication, or VMM lifetime custody; no warm claim is enabled. CI on this head is pending.

Blocking acceptance and landing

The current named path is cold and re-verifies/restages on each start. Neither Firecracker nor HVF meets cold <300 ms or warm <50 ms including admission; immutable optional warm custody/claim is not implemented. The arm64 Linux/KVM guest read is now witnessed, but safe warm lifecycle and both launch-speed targets are still missing. The proposed v3 graph CLI and protected-pipeline-signed production .mvmpkg are separate work, not claims of this Dev candidate. Keep the PR draft until immutable warm custody is evidenced and cold <300 ms / warm <50 ms launch including admission are measured; do not publish release assets from PR-only test proofs.

[auser]

Decision recorded in #5341 and the composition contract: one-command run --compose will use a distinct, single-use Dev-only transient proof. Explicit enrollment in #5301 remains required for installable/reusable local bundles; the current candidate still installs its archive, so it does not yet satisfy the transient boundary. No trust-store bypass or production authorization is implied.

Current validation since the PR body was drafted: the Linux workspace shard passed on the latest head, while the invariant gate remains red on the Rust footprint ceiling (no ratchet change). A PR-signed bootable base and PR guest-runtime quartet reached host Dev admission and Firecracker on the user-authorized KVM test box. The guest agent did not become reachable within 30 seconds; there is still no CLI guest-value/cold-repeat success. A first-use Firecracker download preserved the tar author UID and was refused; a separately SHA-256-checked, root-owned host Firecracker let the boot proceed to the agent-readiness failure. No publication or merge is authorized by these results.

[auser]

Preserving this Dev-only cold composition checkpoint while closing the draft PR; remaining immutable warm custody, independent protected signing and measured cold/warm gates stay open under #5415 (handoff: #5415 (comment)). No branch deletion, release or production approval.