[raylei50653]

Summary

• [Architecture umbrella] Separate model artifacts from Saccade runtime and release lifecycle #549 S2-2 N03 Phase 2: the N03 operator library is loaded from a sealed memfd. The source is opened once with openat2, hashed, copied into a labeled memfd, sealed and read back, then dlopened from /proc/self/fd/<M> with a maps post-check, a process registry and poisoning. D-N03-5 is strict in both modes, and the loader auditor identifies each object by its kernel mapping (P-N03 rev 3c, reviewed in Draft docs(shipping): #549 S2-2 N03 TOCTOU threat model and P-N03 proposal (Phase 1) #583).
• P-N03 rev 3d (owner-accepted 2026-10-12, O-N03-1..3): the runtime no longer parses ELF. It accepts only the compiled singleton N03 pin (shipping/n03_operator_pin.json, aa84cccd…, 3,517,632 bytes) and refuses any other operator before the registry, the open or dlopen, even one whose attestation is self-consistent. The $ORIGIN/layout rule moved unchanged to the CPU-only saccade_n03_admission tool, which no runtime target links. Configure, install and the package checker compare digests against the pin. Design: docs/reference/model_bundle_s2_2_n03_offline_proposal_549.md.
• The runtime-identity coordinate is republished (implementation axis only, 303 → 312 files, fresh probe). The evidence is bound in docs/reference/model_bundle_s2_2_n03_phase2_549.md (+ .evidence.json).

Status (unchanged by this PR until merge and main CI): N03 MB-41 OPEN, S2-2 PARTIAL, aggregate hashed_before_load, V5 UNRESOLVED, installed package UNVERIFIED, distribution.status=local-only, owner_confirmation=null. Merge is not authorized.

Decision-layer change?

• Touched headline presets (mamba_whole_graph*.yaml)
• Touched schema / argparse defaults (scripts/eval/config/**)
• Touched pipeline inject (pipeline.py set_* / private det-set)
• Touched tracker cost / auction / relink / occ kernel
• Touched decision docs under docs/research/tracker-decision/

Behavior change?

• Yes. Shipping runtime behavior changes:

  • the operator load path is now a sealed memfd;
  • a plan naming any operator other than the pinned N03 is refused at Gate B (catchable DetectorLoadError, exit 2, Gate A identity kept);
  • legacy mode now also requires the pin's size;
  • lineage-only plans (cfea78…) are refused; that build no longer exists.

  Ladder on the frozen source 8b020ec0: the seven-sequence GPU replay (shipping trace/no-trace, measurement double-buffer and serial, 5,316 frames each), 7 negative controls, manifest mode, the launcher run and the failure states. Raw sections are EXACT, and MOT/trace hashes equal the feat(shipping): verify S2-2 model buffers and compatibility gates #582 replay. Formal verdicts are UNRESOLVED on this host (V5: driver 617.42 ≠ 616.92). Section equality is a local diagnostic, not qualified parity.

Adding, tightening, or retiring a check? (hook / pre_push.sh / pytest / CI)

Drift prevented:        a runtime that loads an operator other than the admitted N03, a pin that drifts from the tracked attestation, an install that pairs a binary with another operator, a shipping entrypoint built with a fixture pin
Blocked entry points:   CMake configure (n03_pin.cmake) and install (install_model_root.cmake); saccade_track POST_BUILD (check_n03_pin.cmake); ctest (operator_loader, n03_pin, n03_admission, attested-operator admission); pytest default collection (test_shipping_n03_operator_pin.py, the G2 and headline install fixtures, CLI and auditor suites)
Disposition:            fail-closed. A refusal here means another operator would ship or load.
When it fails:          update the pin only through a new admission record, review and rebuild (proposal §2); otherwise fix the build or install inputs. Only the source owner may change the pin.

Test plan

Final chain on the frozen source 8b020ec0 (results/549_s2_2_n03_phase2/verify_chain_r3d.sh, local-only):

• CPU loader test (the runtime's loader object, fixture pin): 47 checks, 30/30 repeated runs. Mutation: with the SHA pin check disabled, 3 controls fail.
• Admission test: 32 checks ($ORIGIN/${ORIGIN} under all five tags, layout controls, pin pairing). Production pin test: 2/2. Admission record for the real N03: admitted.
• Both saccade_track builds carry the pin digest and no admission strings.
• GPU native ctest: 8/8.
• CLI suites: 617 passed, 0 skipped (GPU lease). Includes the 37-case real-loader auditor suite.
• Seven-sequence GPU replay gpu_8b020ec0240d: memfd SHA-256 equals the pin, seals 0x2f, no operator path mapped. Reports show loaded_buffer ×3 with aggregate hashed_before_load.
• Coordinate: fresh --run-probe capture, append-only archive, attested check passes, independent review found nothing.
• scripts/pre_push.sh: all checks passed (pytest 5730 passed).
• Read-only Codex reviews:
  • rev 3c rounds 1–4;
  • rev 3d round 1: 1 major, 4 minor; round 2: 3 minor. All resolved except one minor that was accepted with a recorded reason: the end-to-end caller controls for manifest_head and configure (see the doc's review table).
• PR review at e4e93bde: P2 (package checker took an unreadable pin for an older commit) is fixed in c73ff7c1. The pin is now required once the commit's shipping CMake compiles it, with end-to-end manifest_head controls; a mutation restoring the fail-open read fails them. The change is outside the coordinate's axes, and pre-push passes. P3 (the install copies the attestation from its source after validating a snapshot) predates this PR and is tracked separately.
• main CI on the current head.

Known residuals:

• The package checkers' sources/strace readers do not understand the memfd load.
• The pinned shipping entrypoint (fbab8b79…) predates the pin. An installed package enforces the pin only after a package re-pin, which this PR does not authorize.
• The ADR 025 consumer docs still say CMake ≥ 3.18, while the shipping CMake now declares 3.19. The root build already used string(JSON) at configure.

🤖 Generated with Claude Code