What is proven

Evidence inventory for Spec 1. Claims are limited to what the test suite, published artifacts, and recorded boot observations establish.

Status: bootstrap logic tested; x86_64 QEMU self-init PASS (degraded=0) on kernel+initrd and hybrid ISO/GRUB serial; fleet bare-QEMU PASS-degraded; metal and non-x86_64 unverified. Unit tests pass under unittest discover with bash on PATH. Recorded boot observations under QEMU 10.2.2 (x86_64 serial) are listed below. None of them cover metal or non-x86_64.

Covered by tests

area	coverage
Arch resolution	nine targets via synthetic `uname -m` and generated table
Hash fail-closed	artifact and state mismatch halt with expected vs actual digests
Phase DAG / `on_failure`	halt stops later phases; degrade and continue documented
Restart + quarantine	backoff ceiling; attempt ceiling → quarantine + degrade
Export determinism	byte-identical render; order-independent input
Cycle / dangling refs	rejected at export and again in shell path
Verifier agreement	Python and shell accept/reject the same bodies
Acquire / offline	local HTTP server; partial fetch deleted; offline refuses network
Steady state	supervise ticks, health interval/threshold, escalation queue
Longrun start	immediate exit fails phase; mid-flight is restart/health
Floor `numctl`	identity, join states, capability, run-op dispatch edge; status named-halt
Join falsifiability	`disabled` / `joined` / `failed` distinguishable; no traffic without coordinator
Resource envelopes	`R` records; `ram_mb`/`timeout_s` applied; `cpu_pct` refused
Signal floor	`TERM`/`INT` handlers exit with named halt codes
Arch table drift	regenerated table byte-equals committed file
Distro profiles	`self-init` / `fleet` / `privacy-workstation` export
Algoblocker receipts	`py -m numos.receipt` + `numctl receipt-export`; same `C` hash; never POST

Recorded boot observations

Self-init profile — PASS (complete)

field	value
Verdict	PASS (`degraded=0`)
Profile	`self-init` (graph-resolved distro: mounts, identity, hold)
Arch	x86_64
Emulator	QEMU 10.2.2 (`qemu-system-x86_64`, q35, 512 MiB)
Path	kernel + initrd (not CDROM/firmware/bootloader chain)
Artifact source	Cloudflare Sandbox builder → R2 → local download
Floor	`numos-floor` (graph URL+sha256; not busybox product layout)
Kernel	Debian `linux-image-6.1.0-50-amd64` (third-party)
Key serial lines	`numos: boot complete degraded=0`; `numos: steady state entered`
Observation	`docs/observations/2026-08-09-self-init-kernel-initrd.md`

Self-init profile — hybrid ISO / GRUB serial — PASS (complete)

field	value
Verdict	PASS (`degraded=0`)
Profile	`self-init`
Arch	x86_64
Emulator	QEMU 10.2.2 (`qemu-system-x86_64`, q35, 512 MiB)
Path	ISO / CDROM: SeaBIOS → El Torito → GRUB 2.06 → kernel → initramfs → `/init`
Artifact	`build-out/artifacts/numericalos-self-init.iso` (remaster of CF hybrid base + self-init initrd; MSYS `xorriso` in-place map)
ISO sha256	`d93d0da251558e6a19f83ddb7ca1bff89f7d2adb2b980ed60716f7fea2319044`
Key serial lines	`numos: boot complete degraded=0`; `numos: steady state entered`
Log	`build-out/artifacts/boot-self-init-iso.log`
Observation	`docs/observations/2026-08-09-self-init-iso-cdrom.md`

Fleet profile on bare QEMU — PASS-degraded

field	value
Verdict	PASS-degraded (`degraded=1`)
Profile	`fleet` (net / clock / join + op catalogue)
Arch / emulator / path	same as above (x86_64, QEMU 10.2.2, kernel+initrd)
Key serial lines	`numos: boot complete degraded=1`; `numos: steady state entered`
Degrades	`net`, `clock` (warn), `join`, health `join-alive` — seeded units need eth0/ntpd/coordinator; not a packer failure

Per numericalos-verify-boot, degrade-policy failures after a successful phase walk are a scoped pass for the fleet profile. Self-init is the offline/QEMU-complete graph. Metal and other arches remain open gates.

Open gates

claim	required environment
boot on non-x86_64	matching `qemu-system-*` + floor provider or metal
fresh CF Sandbox ISO rebuild	Worker health OK; `POST /build` still intermittent (Sandbox 500 / edge 1101)
true PID-1 signal quality	same (plus Zig static path for Spec 3)
static `numinit` publish	Zig cross builds; manifest `F numinit-$arch`
metal behavior	physical hardware

Build skills produce artifacts and may not claim boot. numericalos-verify-boot is the sole claim path, scoped to one artifact and architecture.

Build substrates

path	skill	notes
Local Linux	`numericalos-build-iso` / initramfs	needs `cpio`/`xorriso`/kernel
Cloudflare (no WSL)	`numericalos-build-iso-cf`	Sandbox + R2; Workers alone cannot `mkisofs`
OCI	`numericalos-build-oci`	shared host kernel — not a boot
Distro export	`py -m numos.export_state --profile self-init\|fleet`	writes `numos.state` + `distro.floor.json`

Scaffold: deploy/cloudflare-iso-builder/. R2 downloads require wrangler r2 object get … --remote.

Topology boundary (local)

Node-side join is implemented as a falsifiable local contract:

state	meaning
`disabled`	`NUMOS_COORDINATOR` unset — no outbound request; capability still on disk
`joined`	coordinator accepted the capability document
`failed`	unreachable or rejecting coordinator — never recorded as joined

Still absent: coordinator protocol body, phase-required start of all ops as daemons, and a local op interpreter. run-op is a dispatch edge only (requires declared unit + NUMOS_OP_RUNTIME).

Residuals

Metal and non-x86_64 boot unobserved — x86_64 QEMU only (kernel+initrd and hybrid ISO serial).
CF POST /build — authenticated smoke PASS 2026-08-10 (initrd + ISO; QEMU degraded=0). Builder uses readFileStream for artifact egress (base64 fallback). Smoke script: scripts/cf-build-smoke.ps1. Residual: infrastructure can still flake; request-path source still base64 JSON.
Git remote — this working clone has no git remote; provenance is local commits + Pages deploy only until a remote URL is configured.
Fleet bare-QEMU degrades — by design of net/clock/join units without virtio-net/ntpd/coordinator.
PID-1 signals incomplete — TERM/INT named-halt only; no full SIGCHLD discipline.
Ops-registry unit drift — content hash detects change; reconcile policy is Spec 2.
Op units are a dispatch catalogue — oneshot/never, not phase-started daemons.
No control socket — no external query of a running numinit.
No published static numinit — manifest lists shell floor only.
Floor provider pins — only x86_64 (and i686 URL) published; other arches need operator floor.
CF ISO large-object ferry — sandbox→Worker→R2 base64-mediates; prefer presigned PUT later.
CF builder availability — health endpoint may be up while POST /build returns edge 1101; treat as infrastructure residual, not a NumericalOS boot residual.

Praxis / CTL provenance

Observation records and cycle notes live under docs/observations/ (including the self-init kernel+initrd PASS and the CTL self-realization note). MegaPraxis/MetaMethodology alignment: audit → classify → bridge → apply → verify → converge; only numericalos-verify-boot upgrades boot claims.

Documentation policy

Fail-closed runtime and fail-closed claims use the same rule: named residuals, no silent upgrade of status. Understating a limitation is treated as the same class of defect as overstating a capability. A QEMU pass does not become “NumericalOS boots” without arch, profile, emulator, and path scope.