[raylei50653]

Closes #546 (on merge). Does not close #465. This submits the evidence and a recommended verdict for owner review.

Recommended verdict

ENGINEERING_COMPLETE — PUBLIC_DISTRIBUTION_DEFERRED. The record is docs/reference/native_runtime_closeout.md:

• definitions of the two statuses;
• an architecture / trust-boundary diagram marking mandatory [M] and optional [O] controls;
• an acceptance matrix linking each claim to its merged PR, formal evidence, limits and tests;
• the evidence-reuse rationale, the public-distribution blockers and the deferred work.

Public-distribution blockers (licence L-1..L-4, release key, publish decision) are tracked separately in #547.

Release policy (resolved config doc §21)

• Mandatory (unchanged): SHA-256 digest, exact MANIFEST file set / hash / size / mode, atomic staging with RENAME_NOREPLACE, fail-closed install, runtime identity.
• minisign is optional for local-only packages. install.sh already never read the signature. It is a runtime-identity input, so it stays byte-identical (afa5d06a…) and needs no republish.
• check_shipping_package.py tarball:
  • The report gains an authentication field: none unless a signature was requested and verified.
  • A .minisig without --pubkey now fails release_set with an explicit message. A signature is either verified or the check fails; it is never ignored.
  • With --pubkey, a bad signature fails as before.
• README.txt: a release is three files, a signed one four. It states what the digest/MANIFEST show (integrity) versus what the signature shows (publisher). An unsigned package must not be described as authenticated.
• MANIFEST reading is unchanged, and so is the stale header comment in install.sh. Both are recorded as limits (§21.5).

Evidence (no GPU; contract c7581100 committed before the run)

Run: results/546_closeout/full_c7581100/, verdict PASS on V1–V3, E1–E4 and U1–U5.

Positive checks:

• Tree: differs from PR-C4 r2 only in README.txt.
• Unsigned package: tarball 7/7 PASS, authentication: none. Clean-container install passes install-trace 5/5, static --manifest 13/13 and --verify.
• Signed (test key): 8/8 PASS, publisher_authenticated: true. Container verify exits 0.

Negative controls:

• U1 corrupt digest (unsigned): refused, nothing created.
• U2 .minisig without --pubkey: release_set FAIL.
• U3 tampered digest: signature FAIL.
• U4 wrong key: signature FAIL.
• U5 pre-existing target: exit 2, nothing changed.

Runtime bytes are unchanged, so the PR-C4 r2 7-seq EXACT and G2-2/G2-4 evidence is reused. GPU evaluation was not re-run.

Tests

• test_package_signature.py: unsigned release keeps all 7 integrity checks; changed digest still fails unsigned; signature without pubkey is not ignored; bad signature / wrong key is never authenticated; truth table of authentication().
• test_shipping_package.py: the installer never reads a signature, and its output claims no authentication.
• pre_push.sh: 5327 passed. The 2 test_h2_measurement_controller hygiene failures came from the uncommitted tree; both pass after commit (63/63).
• --mode attested exits 0. No runtime-identity input changed.

Not changed

Runtime, installer, launcher, auditor, third-party set, licence audit, distribution status (local-only), numerics, tracker, detector, CI.

🤖 Generated with Claude Code