GitHub

ADR-0053: Process-Isolated Policy-1.5 Candidate Correspondence

Status: accepted for the exact finite fresh-child correspondence boundary; standalone, ELF, timing, claim, and global policy-1.5 authority remain closed

Date: 2026-08-02

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0038, ADR-0050, ADR-0051, ADR-0052

Extends: ADR-0052 by moving its exact finite correctness identity across a bounded fresh-child boundary

Preserves: encoder policy 1.4 as the sole globally selected policy; ordinary source-bound native execution; standalone, ELF, measurement, performance claim, and P1 authority; every accepted policy-1.4 identity

Context

ADR-0052 proves in-process Machine-IR/native parity for the exact policy-1.5 BranchMix candidate and the exact policy-1.4 Bounds fallback. A native fault, signal, runaway execution, malformed output, or inherited pipe in that gate is still inside the compiler process. The immediate next boundary must carry the same 51-case result through fresh child processes without turning the candidate into a general executable artifact.

The existing R1-S7b-c worker and IPC protocol cannot be reused as if nothing changed. They accept and seal only SourceBoundX64TargetArtifact under encoder policy 1.4. Making a policy-1.5 candidate masquerade as that type would invalidate the source-replay boundary established by ADR-0037 and ADR-0038.

Repeating the complete 2.526-billion-work Gate B profile in every child is also not a viable reconstruction protocol. The parent must first possess a freshly verified ADR-0052 correctness witness. A child therefore reconstructs the exact already-admitted executable bytes from the canonical BranchMix source chain and the deterministic prospective raw encoder, then checks the complete frozen candidate identity vector. This is reconstruction of one accepted candidate, not a new profile proof or encoder-selection decision.

Decision drivers

  • Every canonical case runs in a fresh process group with bounded stdout, stderr, diagnostics, timeout, termination, reap, and pipe-reader cleanup.
  • The child receives only one canonical case ordinal. It receives no code, target artifact, capsule, profile, hash override, input, selection, or execution policy from the caller.
  • BranchMix bytes are regenerated from canonical source and the owned raw encoder, then checked against the complete accepted ADR-0051 vector before execution.
  • Bounds always uses the independently rebuilt source-bound policy-1.4 artifact. A failed BranchMix candidate never retries through policy 1.4.
  • Canonical MXCSR is established inside the child and restored there.
  • IPC is fixed-width, domain-separated, bounded, canonically encoded, and sealed independently of Rust layout, text, or enum discriminants.
  • The parent admits a child result only when it matches the exact ordinal, workload, selection, input, capsule, per-record hash, and aggregate correctness hash already verified under ADR-0052.
  • The worker path remains an explicit caller-provided trust anchor, as in R1-S7b-c. This ADR provides protocol and execution correspondence, not binary or launch-environment attestation.
  • No candidate bytes or process witness can enter standalone, ELF, timing, measurement, claim, or ordinary source-bound APIs.
  • The implementation is NAUX-owned and adds no dependency.

Considered options

1. Reuse the ordinary policy-1.4 worker record

This would require either lying about source binding or weakening the ordinary execution-record verifier. Rejected.

2. Send the candidate capsule or executable bytes from parent to child

The child would only execute a caller-provided payload and could not establish independent reconstruction. Rejected.

3. Regenerate the complete weighted profile in every child

This preserves the strongest upstream replay but multiplies billions of work by 46 and makes the finite process gate operationally unusable. Rejected.

4. Reconstruct the accepted candidate from source plus frozen identities

The child rebuilds the policy-1.4 source package, reruns the deterministic raw encoder, requires a complete prospective shadow, seals a policy-1.5 artifact, and checks its baseline, plan, code, semantic, prospective, profile-root, and capsule identities against the accepted ADR-0050/0051 vector. The parent has already freshly verified that vector through ADR-0052. Accepted.

5. Transport the complete correctness record over IPC

This duplicates a large semantic codec. The parent already owns the exact verified ADR-0052 record preimage. Transporting its collision-resistant record hash together with all routing identities is sufficient to bind the child to that exact record; a reviewed worker must construct the hash only after real execution. Rejected in favor of the smaller commitment protocol.

6. Use one child for all 51 cases

A fault or timeout would make later cases ambiguous and share mutable process state across the corpus. Rejected.

Decision

1. Separate reconstruction capability

The target module owns an opaque process-reconstruction witness distinct from VerifiedX64TargetPolicy15CandidateCapsule. It may be created only by:

  1. independently verifying the canonical source-bound BranchMix baseline;
  2. replaying policy 1.4 raw encoding byte-for-byte;
  3. requiring the complete deterministic prospective shadow;
  4. sealing that shadow as encoder policy 1.5; and
  5. matching the accepted profile schema/policy/root, prospective realization, prospective code, candidate plan/code/semantic, and capsule hashes.

That witness has exactly one crate-private execution consumer owned by the ADR-0052 finite correctness module. It cannot satisfy the ordinary public runner, full profile verifier, standalone builder, or measurement APIs.

2. Child-side operation

A dedicated naux-policy15-candidate-worker accepts exactly one canonical decimal u32 ordinal. It rebuilds the manifest and relevant lighthouse packages. BranchMix uses the reconstructed candidate witness; Bounds uses the unchanged source-bound policy-1.4 fallback. The worker normalizes Machine IR and native observations and seals the same correctness record definition as ADR-0052.

The worker writes exactly one success frame followed by EOF. It never accepts stdin, executable bytes, a target identity, selection, input, timeout, MXCSR, or policy override.

3. Candidate IPC commitment

Each fixed-width frame seals at least:

candidate IPC schema and process policy
ADR-0052 correctness schema and policy
canonical Gate A manifest hash
accepted ADR-0052 aggregate correctness hash
accepted ADR-0051 candidate capsule hash
case ordinal, workload, selection, and canonical input hash
fresh child correctness-record hash
outer frame hash

The decoder checks the exact byte length before allocation, rejects unknown tags, validates every frozen identity and canonical case binding, verifies the outer seal, then byte-for-byte re-encodes the record. Trailing, truncated, double, malformed, oversized, wrong-case, wrong-selection, and self-resealed frames fail closed.

4. Parent admission and aggregate evidence

Public aggregate emission requires an opaque freshly verified ADR-0052 correctness witness. It launches exactly 51 fresh children in canonical order, with no retry. Every decoded frame must equal the corresponding verified ADR-0052 record identity and aggregate result identity.

One receipt seals the ordinal, input, workload, selection, capsule, correctness aggregate, correctness record, IPC frame, and receipt hashes. The aggregate seals the manifest, exact candidate/fallback counts, capsule, ADR-0052 result identity, all ordered receipt hashes, and its own result hash.

Public verification requires the same opaque ADR-0052 witness and independently reconstructs all receipt expectations. It does not trust self-resealed fields. Process IDs, addresses, ASLR, elapsed time, signals, stderr contents, and worker paths are preconditions or diagnostics and never enter deterministic evidence identity.

5. Containment and failure policy

The existing reviewed R1-S7b-c process-group lifecycle is shared rather than copied: null stdin, piped stdout/stderr, bounded readers, 30-second production timeout, signal/abnormal-exit distinction, process-group termination, bounded reap, descendant-pipe cleanup, diagnostic count/byte caps, and exact one-frame EOF semantics.

Any spawn, pipe, timeout, signal, exit, diagnostics, decode, identity, selection, correspondence, or aggregate failure returns no process evidence. There is no retry, fallback after candidate failure, partial admission, or selection-state mutation.

6. Explicitly excluded authority

Acceptance of this ADR does not authorize:

  • public or arbitrary policy-1.5 native execution;
  • caller-provided executable bytes or artifacts;
  • policy-1.5 standalone startup, ELF construction, or direct-process claims;
  • Gate B timing, performance ratios, or claim admission;
  • global or per-program policy-1.5 selection outside the exact 51-case gate;
  • changing X64_TARGET_ENCODER_POLICY_VERSION from 1.4.0; or
  • treating the worker path as binary or environment attestation.

Consequences

  • A crash or runaway candidate case is contained to one fresh child process group, and no later case can inherit its native state.
  • The accepted ADR-0052 semantic identity gains a separate process identity without changing any earlier evidence domain.
  • Frozen identity constants become explicit compatibility inputs to the child reconstruction policy. Any accepted candidate change requires a new ADR and process-policy version.
  • Full Gate B replay remains mandatory once in the parent admission chain, while child reconstruction remains small and deterministic.
  • Standalone and performance work remain ordered future gates.

Validation required before acceptance

  1. The child receives only a canonical ordinal and independently reconstructs the exact selected target and input.
  2. All 51 cases run in fresh process groups: 46 policy-1.5 BranchMix and five exact policy-1.4 Bounds fallback cases.
  3. The reconstructed candidate matches every frozen ADR-0050/0051 target and capsule identity; policy 1.4 raw replay also matches its source package.
  4. Every child record hash matches the exact corresponding verified ADR-0052 record and aggregate correctness identity.
  5. Timeout, abort, signal, abnormal exit, missing/malformed/truncated/trailing/ double/oversized frame, unexpected diagnostics, wrong case, and descendant pipe retention all fail closed and are reaped.
  6. Wrong manifest, correctness root, capsule, ordinal, workload, selection, input, record, frame, receipt, order, count, and self-resealed aggregate mutations fail verification.
  7. Candidate failure never retries through the policy-1.4 fallback and emits no partial aggregate evidence.
  8. Static audits find no process-reconstruction or process-execution witness consumer in ordinary native, standalone, ELF, startup, measurement, or claim paths.
  9. Global encoder policy remains exactly 1.4.0; public ordinary source and native boundaries remain unchanged.
  10. Focused tests, complete debug/release workspace suites, strict refinement, governance, Clippy with warnings denied, format, and diff gates pass.
  11. An explicit release-mode regenerative gate verifies ADR-0052, emits all 51 process records, and independently verifies the aggregate before this ADR becomes accepted.

All eleven validation items are accepted. The frozen process vector is:

ordered fresh child processes     51
policy-1.5 BranchMix executions   46
policy-1.4 Bounds fallbacks         5
candidate capsule hash    12fce4c6336b3c34a34ad05961b4fb75ae45427ca7b75b7bace98efdab886d24
ADR-0052 correctness hash 35018ad7571de6e946f70dd5db237e8a52024447bcce013d65228aaba5e361ba
ADR-0053 process hash     887274dd8e5e5f089cba60ee513e61580cb1d6cfe13a7c94ff936aa48d5b5365

The release-mode regenerative gate emitted ADR-0051, emitted and independently replayed ADR-0052, launched all 51 dedicated workers, and independently verified the process aggregate in 462.58 seconds. Each child received only its canonical ordinal and rebuilt the source, selection, input, target, and code internally. The fixed-width frame transports the exact ADR-0052 record commitment and is capped at 512 bytes.

Focused tests cover both candidate/fallback routes, every single-byte frame mutation, truncation, trailing bytes, wrong ordinal, and self-resealed receipt, record, input, order, root, and aggregate mutations. The real worker failure matrix rejects abort, signal, abnormal exit, timeout, descendant-held pipes, missing/malformed/oversized/trailing/truncated/double frames, diagnostics at and beyond both caps, valid-frame-then-failure, and wrong-case output.

Complete debug and release workspace suites pass with 359 core tests and three explicit heavy tests ignored in ordinary runs. Strict refinement passes 8/8, performance governance passes 22/22, strict Clippy, format, diff, static consumer, and global-policy checks pass. The only toolchain notice remains the pre-existing future-incompatibility warning from nom 1.2.4.

Static audit finds the process-reconstruction capability only in the target, native, and finite candidate-correctness owner. Standalone, ELF, startup, measurement, baseline, and claim modules do not import it. Encoder policy remains exactly 1.4.0; this ADR creates no standalone artifact and records no timing observation.