[rdpollard]

The merged Mint archival helper needs verified source delivery and independent lifetime/report supervision before any separately authorized host operation. Prepare fixed local delivery, report and process ports around the frozen helper bytes; no native execution is included.

Verify two owner-only bounded immutable source snapshots against hashes from helper commit 887ebc9. A separately verified controller must be loaded before these ports are invoked; no runtime self-approval, downloader or mutable-path helper import. Persist a bounded exclusive source-bound report before starting exactly one child. Arm only after retaining its pidfd; configure Linux parent-death behavior before the barrier; collect bounded validated JSON/EOF/zero-exit evidence. Supervise a 35-second wall-clock window with two-second TERM/KILL grace periods through pidfd-only signaling, no retries or generic command path.

Keep durable report records explicitly pending final closeout, with separate worker and supervisor outcomes. Missing acknowledgement, unconfirmed child termination or uncertain persistence/closure cannot Pass. Stop without report repair/retry and retain native journal/control/evidence state for read-only reconciliation. Userspace deadlines are not guarantees against uninterruptible kernel calls or scheduler failure.

Review fixes: reject nondefault SIGCHLD before pipes/fork; require consistent armed/pidfd/reaped evidence for worker Pass; preserve worker Pass if supervisor cleanup fails; sanitize unknown Stop payloads; identify frozen helper provenance as helperSourceSha rather than controller provenance. Update the independent controller digest in the delivery procedure.

QA: 194 mocked/static checks passed (29 delivery/supervisor cases), focused actionlint and whitespace passed. Full branch remains exact infrastructure-only scope; mixed application/key controls still require normal application CI. Automatic policy CI adds only the mocked suite and exact paths. Original helpers, launcher, manual workflows and production code are unchanged.

Keep this PR unmerged and #73 draft/unmerged. No host execution, activation changes, runner registration/start, workflow dispatch, downloads, guests, application builds, packages or releases. Final verified caller/delivery packet and native lifetime/durability assumptions remain review/validation gates before separately authorized execution. Publication is not execution approval; sole-maintainer self-approval stays allowed.

[rdpollard]

Final merge-readiness assessment at 2a72039: no additional implementation defects found; no code changes required in this pass. Re-ran all 194 mocked/static checks, focused actionlint and whitespace checks: passed. Verified controller SHA-256 e9c1ca0e9b9ad0fa2dbaffdf9e554a07731be8224a7105a334d041f69eb9aafb matches the delivery reference. Helpers/private launcher/manual workflow bytes are unchanged, full branch stays exact infrastructure-only scope, mixed application/key controls remain enabled.

Current GitHub CI: policy/scope/workflow-checks passed; native fixtures and application checks/native/update-trust/release skipped. GitHub reports MERGEABLE/CLEAN. Ready to merge as isolated preparation tooling subject to GitHub requirements on the eventual merge. Neither #82 nor #73 merged; #73 remains draft.

Remaining execution gates, separate from merge readiness:

1. Review the final trusted caller/copy-paste delivery packet, including pre-load controller hash verification, frozen helper hashes and capture of the bounded post-closeout return. Do not interpret durable pending-closeout records as final Pass.
2. Bind that packet to final reviewed controller source, obtain fresh owner attestations that activation is disabled, no runner is registered and no job is queued/active, and authorize only the single fixed local archival/setup operation. No activation, runner registration/start, dispatch or media operation is implied.
3. Perform its authorized preflight against the actual host/session IDs and fresh control/report/archive/journal absence; preserve both evidence sessions. Stop on mismatches rather than replacing state, changing mechanisms or silently adopting new identities.
4. Native parent-death/pidfd/barrier/timeouts, filesystem atomicity/fsync/crash durability and post-failure reconciliation remain validation targets of that future bounded run. They are not proven by mocks, and are not extra product decisions needed to merge. Unsupported behavior, unconfirmed child termination, missing acknowledgement or uncertain journal/report/closeout must stop without retries or a successor action.

No host execution, activation/settings changes, runner operations, dispatch, downloads, guests, application builds, packages or releases. Sole-maintainer self-approval remains allowed. Merge readiness is not execution authorization or authentication/whole-host-cleanup proof.

[rdpollard]

Merged reviewed head 2a72039 through normal GitHub squash merge with exact-head guard, no admin bypass, as 95812c6. Pre-merge policy/scope/workflow-checks passed and native fixture/application jobs were skipped.

Post-merge main: run 39141476451 scope passed; native, update-trust, checks and release all skipped. Run 39141476477 policy passed after a GitHub-hosted ubuntu-24.04 scheduling delay. No manual workflow dispatch or native/application build occurred.

#73 remains open and draft. Activation settings/spare host untouched; no runner operations, downloads, guests, packages or releases. This merge is preparation only. Final trusted caller/delivery packet, independent controller/helper hash verification, fresh control attestations and explicit local archival/setup authorization remain gates before any host execution; native behavior remains unvalidated. Sole-maintainer self-approval stays allowed.