docs/observations/2026-08-10-ctl-cycle3-provenance-verify-harness.md

back to source

# CTL cycle 3 — provenance + verify harness (2026-08-10)

MegaPraxis / MetaMethodology / SwarmInvocation · M/G/S/MGS · ASEC.  
Builder ≠ Verifier. Commit is provenance, not boot victory.

## η sequence

### 1. η_audit

| Surface | State |
|---|---|
| Self-init k+initrd | PASS (prior) |
| Self-init ISO serial | PASS (prior) |
| Dual-claim STATUS | Live + tests |
| CF `/build` | Health OK; token **unset** in agent env |
| Git tree | Dirty praxis source (pre-commit this cycle) |

### 2. η_classify

| Residual | Class | Cycle 3 |
|---|---|---|
| Uncommitted source | decidable | **Commit** (source only) |
| No re-verify script | decidable | **`scripts/qemu-verify.{sh,ps1}`** |
| CF auth smoke | semi | **Blocked** — no session token |
| Metal / multi-arch | Tarski | Named |

### 3. η_bridge

| Bridge | Application |
|---|---|
| verify-boot skill → local script | `qemu-verify.sh` for MSYS agents |
| Junction no-space path | Documented via `C:\numos-art` when present |
| Fail-closed CF | Skip smoke without inventing `BUILD_TOKEN` |

### 4. η_apply

- Added `scripts/qemu-verify.sh` and `scripts/qemu-verify.ps1`
- Dry-run both modes against existing self-init artifacts
- Git commit of intentional source (see repo log)

### 5. η_verify (this cycle)

| Check | Result |
|---|---|
| `unittest` principles + distro | 22 OK |
| `qemu-verify.sh kernel-initrd` | **PASS** `degraded=0` |
| `qemu-verify.sh iso` | **PASS** `degraded=0` |
| CF authenticated POST | **skipped** (token unset) |

Re-verify logs (local, not committed):

- `build-out/artifacts/verify-kinitrd-*.log`
- `build-out/artifacts/verify-iso-*.log`

### 6. η_converge

Residual-stable when:

1. Source committed under dual-claim honesty  
2. Re-verify path scripted and green on known artifacts  
3. CF pack residual remains **named**, not confused with boot  

## SwarmInvocation

| Role | Work |
|---|---|
| Prober | gitignore, token names, health |
| Builder | scripts + commit |
| Verifier | unittest + qemu-verify dry-run |
| Reporter | this file |

## Next residual

1. Session with `NUMOS_BUILD_TOKEN` / `BUILD_TOKEN` → CF pack smoke by `stage`  
2. Push only on explicit request  
3. Tarski hold: metal, non-x86_64