GitHub

ADR-0054: Candidate-Specific Standalone ELF Correspondence

Status: accepted for the exact candidate-specific standalone ELF and untimed direct-process correspondence boundary; measurement, performance claim, and global policy-1.5 selection remain closed

Date: 2026-08-02

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0039, ADR-0041, ADR-0051, ADR-0052, ADR-0053

Extends: ADR-0053 by packaging its exact selected target pair into direct ELF64 images and checking the fixed corpus through fresh standalone processes

Preserves: encoder policy 1.4 as the sole globally selected policy; ordinary R1-S8 authority and artifact types; Gate B timing, claim, and selection boundaries; every accepted policy-1.4 identity

Context

ADR-0053 proves that the exact ADR-0051 policy-1.5 BranchMix candidate and the exact policy-1.4 Bounds fallback reproduce ADR-0052 correspondence records in fresh worker processes. It does not prove that those selected bytes remain correct after composition with NAUX’s libc-free startup and direct ELF64 writer, nor that the resulting image behaves correctly when launched by the operating system as the process image.

The ordinary R1-S8 standalone authority cannot be widened to accept this candidate. It is deliberately rooted in SourceBoundX64TargetArtifact and ordinary policy-1.4 process evidence. Converting the candidate into that type, making the artifact builder generic over raw bytes, or importing the existing timed Gate B process evidence would erase the separation established by ADR-0051 through ADR-0053.

The startup lowering and ELF grammar are policy-independent after an admitted profile, ABI, entry offset, and target placement have been derived. Their reviewed raw encoders and independent byte verifiers may therefore be reused behind a new concrete candidate authority. Reuse of these mechanical layers does not permit reuse of ordinary policy-1.4 provenance.

Decision drivers

  • Standalone authority requires opaque, already verified ADR-0052 correctness and ADR-0053 process witnesses; raw evidence and detached hashes are not accepted.
  • BranchMix is exactly the frozen policy-1.5 candidate. Bounds is exactly the canonical source-bound policy-1.4 fallback.
  • Candidate reconstruction must match the frozen capsule, correctness, and process roots before any startup or ELF bytes are emitted.
  • No caller supplies code, target artifacts, ABI fields, entry offsets, selection, startup bytes, ELF fields, or identity claims.
  • The ordinary X64StandaloneSeedAuthority, artifact verifier, and process evidence remain unchanged and cannot consume the candidate authority.
  • Typed startup planning, raw startup encoding/verification, and the direct ELF64 writer/parser are reused only through concrete candidate-bound wrappers.
  • Every one of the canonical 51 cases runs as a fresh direct process. A BranchMix failure is terminal and never retries through policy 1.4.
  • Evidence binds each direct observation to the exact corresponding ADR-0052 Machine-IR observation and ADR-0053 process receipt.
  • Deadlines and lifecycle durations may be observed internally for containment, but elapsed time never enters candidate evidence and no timing accessor is exposed.
  • The implementation is NAUX-owned and adds no dependency.

Considered options

1. Convert the candidate to ordinary source-bound policy 1.4

This would make a prospective encoder result indistinguishable from the globally selected encoder and invalidate the ordinary verifier boundary. Rejected.

2. Generalize the ordinary standalone builder over caller target bytes

This would turn the ELF builder into executable authority for arbitrary code. Rejected.

3. Duplicate the startup and ELF encoders

This avoids a shared seam but creates two machine-code and ELF grammars that can drift. The admitted profile/ABI/placement mechanics are identical, so a concrete authority-bound wrapper around the reviewed implementation is both smaller and easier to audit. Rejected.

4. Reuse ordinary timed R1-S8c evidence

That evidence carries policy-1.4 provenance and elapsed values intended for a later measurement boundary. It cannot describe this candidate pair without lying about both provenance and timing authority. Rejected.

5. Create separate candidate authority, artifact, and untimed process evidence

This retains type-level separation while sharing only verified mechanical startup/ELF/process containment primitives. Accepted.

Decision

1. Candidate standalone authority

A new opaque authority is created only from:

  1. an opaque verified ADR-0052 correctness witness;
  2. an opaque verified ADR-0053 process witness structurally rebound to that same correctness witness; and
  3. one closed BranchMix or Bounds profile selector.

Construction regenerates the canonical source packages, reconstructs and fully checks the frozen ADR-0051 capsule, verifies all profile-specific source, Machine-IR, target, ABI, entry, lane, case-count, selection, and per-case record/receipt bindings, and requires the accepted correctness and process roots. The authority owns no timer, measurement baseline, performance ratio, claim, or global selection token.

For BranchMix its target is the candidate artifact inside the reconstructed capsule. For Bounds its target is the unchanged source-bound policy-1.4 artifact. A single concrete authority method supplies the reviewed startup module with an internal binding snapshot; no detached snapshot is accepted by the public API.

2. Candidate-specific startup and artifact

The startup module adds one crate-private wrapper whose parameter is the new concrete candidate authority. It derives profile, entry offset, ABI, entry ABI, placement, and binding from that authority, then runs the existing typed planner, local verifier, authority equality check, raw encoder, and independent raw verifier.

The candidate artifact module defines types distinct from ordinary R1-S8 artifacts. Build and verification both regenerate the authority-bound startup, require exact candidate/fallback target bytes, use the reviewed ELF writer and independent parser/reconstructor, verify the exact startup slice, reject interpreter/dynamic-loader/symbol/system-linker and writable-executable structure, and seal a candidate-domain artifact identity. An emitted image is not execution authority; only its lifetime-bound verified view may be prepared as an executable.

Every artifact identity includes at least:

candidate standalone schema/policy
profile and exact selection
Gate A manifest
ADR-0051 capsule
ADR-0052 correctness root
ADR-0053 process root
source Core/SSA/Machine-IR identities
selected target semantic/plan/code/ABI identities
startup plan/code and I/O identities
ELF image identity and exact component lengths
outer artifact seal

3. Untimed direct-process correspondence

Aggregate emission requires both live profile authorities and both exact verified artifact views. It prepares two temporary executables whose bytes and mode are read back, then launches exactly one fresh contained process for each canonical case in ordinal order. The existing process-group, deadline, bounded-pipe, EOF, status, and cleanup machinery is reused.

The case workload determines the authority and artifact. There is no retry or fallback decision. The canonical input frame is regenerated internally. The decoded direct output is normalized and compared to the exact Machine-IR observation already sealed in the corresponding verified ADR-0052 record. The record also binds the exact corresponding ADR-0053 receipt, selected artifact, input frame, output frame, selection, and dependency-absence facts.

Elapsed duration, timestamps, process IDs, paths, addresses, ASLR, and diagnostic contents are excluded from deterministic evidence. The lifecycle still enforces a nonzero finite timeout and complete child/process-group reap.

4. Verification and failure policy

Independent verification regenerates the manifest, authorities, startup, target bytes, both ELF images, every canonical input, every expected ADR-0052/0053 binding, every normalized output, every record seal, and the ordered aggregate seal. It accepts no caller-provided selection table, identity override, fallback rule, or timing value.

Any authority, reconstruction, startup, ELF, file, process, protocol, correspondence, dependency, count, order, root, record, or aggregate mismatch returns no verified witness. BranchMix failure cannot produce a Bounds record or partial aggregate.

5. Explicitly excluded authority

Acceptance of this ADR does not authorize:

  • arbitrary or public policy-1.5 native/standalone execution;
  • caller-provided code, startup, ELF, ABI, input, or selection;
  • conversion to ordinary source-bound or R1-S8 authority/artifact types;
  • elapsed-time evidence, measurement, matched baseline, ratio, or claim;
  • global or per-program encoder-policy selection;
  • changing X64_TARGET_ENCODER_POLICY_VERSION from 1.4.0; or
  • binary, kernel, loader, filesystem, or launch-environment attestation.

Consequences

  • The exact candidate/fallback pair can cross the final packaging boundary without weakening ordinary policy-1.4 provenance.
  • Startup, ELF, and process-containment logic remain single reviewed implementations, while authority and evidence domains stay distinct.
  • A later measurement ADR may consume this direct-process correctness witness, but must independently define matched baselines, timing, stability, and claim admission.
  • Candidate identities remain frozen compatibility inputs; changing the candidate requires a new ADR and policy version.

Validation required before acceptance

  1. Authority construction accepts only opaque verified ADR-0052 and ADR-0053 witnesses and rejects every root, selection, count, ordinal, input, target, ABI, entry, lane, record, and receipt mismatch.
  2. BranchMix standalone bytes are exactly the frozen policy-1.5 candidate; Bounds bytes are exactly the ordinary source-bound policy-1.4 fallback.
  3. Neither candidate authority nor artifact can satisfy an ordinary source-bound, standalone, measurement, or claim API.
  4. Startup typed plans and raw bytes independently replay for both profiles, with candidate-domain binding identities.
  5. ELF verification reconstructs the exact image and rejects header, segment, placement, padding, startup, target, trailing, interpreter, dynamic, writable-executable, and dependency mutations.
  6. All 51 canonical direct processes pass: 46 policy-1.5 BranchMix and five policy-1.4 Bounds fallback cases.
  7. Every direct output equals the corresponding ADR-0052 Machine-IR observation and binds the exact ADR-0053 receipt.
  8. Timeout, abort, signal, abnormal exit, malformed/truncated/trailing output, diagnostics overflow, inherited pipe, and cleanup failure fail closed.
  9. Candidate failure never retries through policy 1.4, changes selection, or emits partial evidence.
  10. Evidence carries no elapsed time, timing API, measurement identity, baseline, performance ratio, or claim.
  11. Single-byte and structural mutations of artifact and process evidence, including self-resealed fields and record order, fail verification.
  12. Static audits find no candidate authority consumer in ordinary standalone, measurement, claim, or global encoder-selection paths; global encoder policy remains exactly 1.4.0.
  13. Focused tests, complete debug/release workspace suites, strict refinement, governance, Clippy with warnings denied, format, and diff gates pass.
  14. An explicit release-mode regenerative gate freshly verifies ADR-0052 and ADR-0053, builds and independently verifies both candidate-specific ELF images, runs all 51 direct processes, and independently verifies the aggregate before this ADR becomes accepted.

All fourteen validation items are accepted. The frozen ADR-0054 vector is:

ordered direct ELF processes      51
policy-1.5 BranchMix executions   46
policy-1.4 Bounds fallbacks         5
candidate capsule hash    12fce4c6336b3c34a34ad05961b4fb75ae45427ca7b75b7bace98efdab886d24
ADR-0052 correctness hash 35018ad7571de6e946f70dd5db237e8a52024447bcce013d65228aaba5e361ba
ADR-0053 process hash     887274dd8e5e5f089cba60ee513e61580cb1d6cfe13a7c94ff936aa48d5b5365
Branch artifact hash     2cdcad6a08fd8c9f31a2157c134baa2d74e1eb99c3d62441c917d38393bad81d
Bounds artifact hash     195ae4ba36183d6fb88e904cd6a6b031605da68396402d36fe06f907a7bbb44c
direct-process hash      f009ce3805fe8e077b22c7fe57feb4574accb272478b524eb3228514e8e35d5d

The explicit release-mode regenerative gate rebuilt ADR-0051, emitted and independently replayed ADR-0052, launched and replayed all 51 ADR-0053 worker processes, constructed and independently verified both candidate-specific ELF64 images, rejected header/startup/target/trailing/truncation mutations, launched all 51 fresh direct ELF processes, and independently verified the ordered aggregate in 464.18 seconds. A faster source-reconstruction gate also ran all 51 direct processes and rejected self-resealed input, upstream-record, output-frame, record-order, and aggregate-root mutations.

Complete debug and release workspace suites pass. In each mode the core unit set reports 360 passed and three explicitly ignored regenerative profile tests; the ignored ADR-0054 gate was run separately as described above. The ordinary policy-1.4 isolated corpus remains unchanged and passed in 327.07 seconds debug and 137.78 seconds release. Strict refinement passes 8/8, governance passes 22/22, Clippy passes with warnings denied, format and diff checks pass, and the only toolchain notice remains the pre-existing nom 1.2.4 future-incompatibility debt.

Static audits find the candidate authority only in its authority, startup, artifact, process, and export modules. Ordinary standalone authority/artifact/ process, measurement, claim, and global-selection modules do not import it. The candidate record/evidence types contain no elapsed value, timing sample, measurement identity, ratio, baseline claim, or claim token. Global encoder policy remains exactly 1.4.0.