Own private binary-format dispatch before native caller lockdown

research/h25-private-binary-dispatch/INVENTORY.json

@@ -0,0 +1,114 @@
+{
+  "schema": "private-binary-dispatch-package-inventory-v1",
+  "files": {
+    "EXACT-NATIVE-CHANGE.diff": {
+      "bytes": 22597,
+      "sha256": "c8fb382905796457e085c9416a4bb462532e353c8adc0d5fdea9c2b93befea75"
+    },
+    "PROVENANCE.json": {
+      "bytes": 4089,
+      "sha256": "a6139d71a6390dc5bba7cf078edac86a126b373ef10bd26c148a3038f35fb8af"
+    },
+    "README.md": {
+      "bytes": 7761,
+      "sha256": "ae2c815e9aeac19553e0cb42be35c6a232264df766c511fb1d66acb942641c90"
+    },
+    "controls/AUTHORING-STATUS.md": {
+      "bytes": 1545,
+      "sha256": "30e2d873de077fc890efe3d8dd407f0fbafb069f450478f2b35662a0d4f3b9a2"
+    },
+    "controls/dispatch_control.c.txt": {
+      "bytes": 5160,
+      "sha256": "c87edf3865eb631c9b7c289fd163572f4a67dbcc286b079d55f92fa5cddc3364"
+    },
+    "evidence/BINARY-PIN.json": {
+      "bytes": 270,
+      "sha256": "584daec6d2853deda5460d95bc41b513f8d7140ba2011106ad0dfe6568940792"
+    },
+    "evidence/FINAL-RESULT.json": {
+      "bytes": 2711,
+      "sha256": "8e9ab1892788dd5ecf5808bc0a024c9cf04188dd1c05d05b41cde7b5900340b9"
+    },
+    "evidence/LEDGER-001.json": {
+      "bytes": 561,
+      "sha256": "dcf67ced06c8223ee3c45237a9872ef72db246bf2c8a24183935e13d3ed8988e"
+    },
+    "evidence/PARENT-ADMISSION.json": {
+      "bytes": 1523,
+      "sha256": "1d822ab0bb7fbbca3ce42bdf3a47cd0e5ef8315321308d381477bc8643041e64"
+    },
+    "evidence/PREDECESSOR-WARNING-STATEMENTS.json": {
+      "bytes": 444,
+      "sha256": "6b45081a359a41dd39b95e61601c8abed0a5701f2cef05751847bbebf78a244d"
+    },
+    "evidence/compile/RESULT.json": {
+      "bytes": 762,
+      "sha256": "c74304533416bbc0ad160e04b35c65b7a5f229c1172035115a6ede9b8e6a8105"
+    },
+    "evidence/compile/START.json": {
+      "bytes": 658,
+      "sha256": "50f34f7d3e44f3c20d449c9c29f848a9255a95cf33f7dcf879a67a93edbb1522"
+    },
+    "evidence/compile/stderr.raw": {
+      "bytes": 3252,
+      "sha256": "e7a2833e67848b3d895447c4923b6ff96f22a96ca0a94b49a13f84d3aae1b0c0"
+    },
+    "evidence/compile/stdout.raw": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "evidence/mock-control/RESULT.json": {
+      "bytes": 777,
+      "sha256": "ddc2d7a33fbe8e444999c8e23e1aa003c9b0e07ad614a0ee2bbe75f26ac4764c"
+    },
+    "evidence/mock-control/START.json": {
+      "bytes": 331,
+      "sha256": "66e460447882f62a05c7459f4f1ee222b4ed557ba910bdca2b3133d8d304e62c"
+    },
+    "evidence/mock-control/stderr.raw": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "evidence/mock-control/stdout.raw": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "evidence/run_mock_guard.py.txt": {
+      "bytes": 4818,
+      "sha256": "84dd4ee39e68d38bb030b4b40330bd63b2dc52e6bd6e9de18c622885ba643f0e"
+    },
+    "review/CONSEQUENCE-REVIEW-v1.md": {
+      "bytes": 17345,
+      "sha256": "804abed4b9e5223cba5bb0d1991315f0bc0d892f62c1a71e7b92a0e07fb8a583"
+    },
+    "review/MOCK-CONTROL-ADMISSION-v1.md": {
+      "bytes": 2926,
+      "sha256": "2c6badd3e55164463dfa25a90c5ac1fa1f661aad06d709aed54191deb7cf1426"
+    },
+    "review/MOCK-RESULT-ACCEPTANCE-v1.md": {
+      "bytes": 3261,
+      "sha256": "bb49c9cbb99c8c37666959d05534ba78ff9e76e63d8e0f7db369d991361f8d14"
+    },
+    "review/NATIVE-PREREQUISITE-REVIEW-v1.md": {
+      "bytes": 4016,
+      "sha256": "b337c15e8073efbd8e9d552e10fe3b405fa4f84085238eec3b576347aa1361ea"
+    },
+    "source/VIEW-ENTRY-CONTRACT-v1.md": {
+      "bytes": 27645,
+      "sha256": "39c17afc3f0a9981e659c69cc0513be71fb95630f67c5419520e7abc423f1185"
+    },
+    "source/native-profile.json": {
+      "bytes": 3095,
+      "sha256": "d34bf38d322ad3a4331b13aac415ad181c2bb328314d2e8d4e71b6fb975387ef"
+    },
+    "source/science_view_entry.c.txt": {
+      "bytes": 45415,
+      "sha256": "60af72915efea62f46ea376e2ba7ed0c616f99b09ca1beec0f4b0d8173609410"
+    },
+    "verify_integrity.py": {
+      "bytes": 984,
+      "sha256": "08a6b3615ae19f61dd2ea58172d22b539cc2ef79ffa25e3635b71d6505e0fdf5"
+    }
+  },
+  "scope": "Exact inert source snapshots, independent reviews, actual mocked control evidence and passive byte checker only"
+}

research/h25-private-binary-dispatch/PROVENANCE.json

@@ -0,0 +1,94 @@
+{
+  "schema": "private-binary-dispatch-provenance-v1",
+  "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a",
+  "original_PR": "https://github.com/CrocSwap/integer-mult-bounds/pull/6321",
+  "direct_predecessor": {
+    "PR": 6818,
+    "head": "1479ccf2ec0bc29b7bf741a2d613d79e1f9ec19e",
+    "path": "research/h25-original-refusal-repair/snapshots/implementation/native/science_view_entry.c.txt",
+    "sha256": "14aa284e4671bc454b58b37fa9f4884d8c72774cff42a34b05d87991df2a121c"
+  },
+  "coverage": {
+    "schema": "native-dispatch-upstream-coverage-v1",
+    "observed_utc": "2026-11-06 22:10:56 UTC",
+    "main": "7c49fe32c55de02c2c873655c804b16e4c3fef0a",
+    "predecessor": "outputs/caller-refusal-repair-20261106T2119Z/control/PR-COVERAGE-v1.json",
+    "decisions": [
+      {
+        "number": 6715,
+        "url": "https://github.com/CrocSwap/integer-mult-bounds/pull/6715",
+        "head": "dc34598c22e2ef43ae7e11fc1d8c14de3915cf89",
+        "state": "open",
+        "draft": true,
+        "decision": "reuse",
+        "reason": "Exact accepted complete scientific/native dependency source selection; no new image substitution."
+      },
+      {
+        "number": 6736,
+        "url": "https://github.com/CrocSwap/integer-mult-bounds/pull/6736",
+        "head": "0f2a86fa9ef0daf760b77c662a5b762e17848598",
+        "state": "open",
+        "draft": true,
+        "decision": "reuse",
+        "reason": "Original genuine parent ownership, fd/error/retention mechanics remain controlling; image/profile hashes do not prove new dispatch consequences."
+      },
+      {
+        "number": 6744,
+        "url": "https://github.com/CrocSwap/integer-mult-bounds/pull/6744",
+        "head": "1ac58a84b725bd6f17eec66727edc877c49c7e66",
+        "state": "open",
+        "draft": true,
+        "decision": "reuse",
+        "reason": "Original complete scientific subjects and original activity/caller criteria remain byte-exact."
+      },
+      {
+        "number": 6762,
+        "url": "https://github.com/CrocSwap/integer-mult-bounds/pull/6762",
+        "head": "3bcf99910a95248452e955d382c59bd23792a39b",
+        "state": "open",
+        "draft": true,
+        "decision": "review-only",
+        "reason": "Later CLOSE component remains separate from current native/source closure."
+      },
+      {
+        "number": 6780,
+        "url": "https://github.com/CrocSwap/integer-mult-bounds/pull/6780",
+        "head": "a7903f7ee16c85015f3f9a87fd6f3ae5c9053349",
+        "state": "open",
+        "draft": true,
+        "decision": "review-only",
+        "reason": "Original metadata enforcement finding remains a proof obligation; no Landlock-only fallback."
+      },
+      {
+        "number": 6818,
+        "url": "https://github.com/CrocSwap/integer-mult-bounds/pull/6818",
+        "head": "1479ccf2ec0bc29b7bf741a2d613d79e1f9ec19e",
+        "state": "open",
+        "draft": true,
+        "decision": "adapt",
+        "reason": "Exact published corrected runner/profile/source graph is predecessor; carry its accepted startup refusal controls unchanged."
+      }
+    ],
+    "queries": [
+      {
+        "query": "repo:CrocSwap/integer-mult-bounds is:pr \"binfmt_misc\"",
+        "total": 0,
+        "incomplete": false,
+        "ids": []
+      },
+      {
+        "query": "repo:CrocSwap/integer-mult-bounds is:pr \"FSCONFIG_CMD_CREATE\"",
+        "total": 0,
+        "incomplete": false,
+        "ids": []
+      }
+    ],
+    "new_code_reason": "No concrete equivalent repair was identified by the bounded exact-behavior title/body searches. Actual published entry lacks fs-context/dispatch ownership; adapt its existing source owners rather than another wrapper.",
+    "coverage_limit": "All-author/all-state bounded PR metadata searches and exact implicated heads; not global source absence. Exact original source and primary Linux function review remain required.",
+    "no_upstream_or_source_qualification_inferred_from_merge_or_CI": true
+  },
+  "new_native_execution": false,
+  "complete_original_caller_accepted": false,
+  "new_original_credit": 0,
+  "physical_costs": "OPEN_NOT_ZERO"
+}

research/h25-private-binary-dispatch/README.md

@@ -0,0 +1,41 @@
+# Private binary-format dispatch ownership
+
+The proposed native entry now creates an empty `binfmt_misc` instance in its fresh user namespace before building its filesystem view, dropping privileges or starting a descendant. This shadows inherited miscellaneous binary handlers, including handlers that retain an interpreter file opened before the new filesystem view existed.
+
+The entry reserves a descriptor slot before `fsopen`, records the actual descriptor immediately, calls `fsconfig(FSCONFIG_CMD_CREATE)`, and retires the context exactly once. A create error remains primary if close also fails. An uncertain close stops setup and is never retried. No visible registry mount is created. Existing descriptor, error and report caps remain unchanged. The final syscall allowlist continues to deny filesystem-context creation, mount changes, namespace creation, registration writes and descriptor import.
+
+This is a proposed source repair with independently reviewed source and eight passing mock-control groups. The actual entry source was compiled inside a harness whose main reaches only the new owner and its real descriptor/error machinery. Syscall and close boundaries were mocked. The production entry main, namespaces, handler operations and scientific caller were not executed. Complete caller acceptance and any measured optimization remain open.
+
+## Selected source premises
+
+The source profile selects the Linux v6.12 semantics and `CONFIG_BINFMT_MISC=y` with successful filesystem registration. This avoids module-request delegation during `fsopen`. It is a prospective selection, not an observation about the current host. The empty namespace instance is published during filesystem creation and survives disposal of its unattached superblock until user-namespace destruction. A create operation can have partially published state before a later security-hook error; such a failure terminates setup and cannot be called an original scientific refusal.
+
+Primary sources: [miscellaneous binary loading and instance creation](https://github.com/torvalds/linux/blob/v6.12/fs/binfmt_misc.c), [filesystem-context operations](https://github.com/torvalds/linux/blob/v6.12/fs/fsopen.c), [context release](https://github.com/torvalds/linux/blob/v6.12/fs/fs_context.c), [filesystem lookup and module request](https://github.com/torvalds/linux/blob/v6.12/fs/filesystems.c), and [namespace disposal](https://github.com/torvalds/linux/blob/v6.12/kernel/user_namespace.c).
+
+## Lineage and exact scope
+
+Original investigation: [PR #6321](https://github.com/CrocSwap/integer-mult-bounds/pull/6321). Original full caller and criteria: [PR #6744](https://github.com/CrocSwap/integer-mult-bounds/pull/6744) at `1ac58a84b725bd6f17eec66727edc877c49c7e66`. Direct predecessor: [PR #6818](https://github.com/CrocSwap/integer-mult-bounds/pull/6818) at `1479ccf2ec0bc29b7bf741a2d613d79e1f9ec19e`.
+
+The predecessor owns the corrected original optimized-refusal classification and connected caller sources. This package changes its existing native entry; it does not add another caller or replace original scientific bodies. The exact native delta is included. The original fixed helper and context coverage, resource limits, normal output oracle and optimized refusal oracle are preserved. The predecessor's accepted refusal controls were retained and were not rerun for this repair.
+
+Related work is reused at its exact recorded scope: [native selection #6715](https://github.com/CrocSwap/integer-mult-bounds/pull/6715), [parent ownership #6736](https://github.com/CrocSwap/integer-mult-bounds/pull/6736), [metadata consequence audit #6780](https://github.com/CrocSwap/integer-mult-bounds/pull/6780), and [later close component #6762](https://github.com/CrocSwap/integer-mult-bounds/pull/6762). The provenance record lists inspected commits and concrete reuse decisions. Bounded all-author, all-state PR title/body searches found no `binfmt_misc` or `FSCONFIG_CMD_CREATE` counterpart; this does not prove global code novelty.
+
+## Reproduction and evidence boundaries
+
+`source/science_view_entry.c.txt` is an inert exact source snapshot. The contract and profile describe its selected semantics. The original authoring-status file preserves the controls' initially unexecuted state. The later actual evidence records the sole admitted compile and mock run: both returned zero; the mock run had empty stdout and stderr. All eight fixed control groups passed. Compilation retained three pre-existing `-Wmisleading-indentation` warnings (3,252 bytes), not a warning-free result. The command used `-Wall -Wextra -Werror=implicit-function-declaration`. `review/` records independent source findings and their exact inputs. The guard, exact compiler/source identities, raw captures and results are retained under `evidence/`. The conservative policy charge was 24 seconds, including compile and mock-run allowances; full physical costs remain open. No replay registration is supplied for this unqualified production native source.
+
+After obtaining this package, run `python3 -B research/h25-private-binary-dispatch/verify_integrity.py` to check package membership and hashes only. This command neither imports the native caller nor executes its controls. Full caller dependencies remain in the exact predecessor package and its explicit external-input map; this contribution does not claim a self-contained cold science replay.
+
+## Open next questions
+
+1. **Required execution behavior.** Prove that removing inherited miscellaneous handlers preserves each original GNU-time, Python, compiler/helper, script and failed-exec observation. Exact executable bytes do not establish which handler would have run. The smallest next check is a finite source-selected dispatch map joined to the genuine parent association; it is blocked by the absent consequence owner.
+2. **Fault results.** Establish the affected original fault observations under the entry's existing `CORE(1,1)` profile, including GNU-time diagnostics and compiler-child wait status. A Python signal return code alone omits core-status consequences. This requires the actual consumer chain, not an assumed current host setting.
+3. **Creation and filesystem effects.** Join exact topology, permission and LSM creation/exec consequences to the same original caller. Subject hashes and metadata equality alone do not prove the new confinement preserves those consequences. Current kernel/images, actual association, numerical fit, funding and execution follow only after complete source acceptance.
+
+A helper or a delivered PR does not satisfy these complete-caller obligations. No performance claim, original full-data equality, supplier qualification or complete physical cost account is made. Preparation, consultation, agent review, reporting, publication and historical timing gaps remain `OPEN_NOT_ZERO`.
+
+## Credit
+
+Prepared for Clear1nsight with substantial OpenAI Codex and ChatGPT Pro assistance. Retains the predecessor native entry and its ownership, error and confinement machinery. Contributions are under the repository's Apache-2.0 license. Independent AI source review is distinct from human review, executed controls and runtime qualification.
+
+To reproduce just the mocked owner check, restore the two inert sources into a temporary directory with their original relative layout: `implementation/native/science_view_entry.c` and `controls/native-dispatch/dispatch_control.c`. Compile the control file using the recorded GCC command and then run that control executable under appropriate local limits. Its include must resolve to the exact supplied entry bytes. Do not run the production entry as this control. Current-host kernel behavior and complete caller qualification are outside this command.

research/h25-private-binary-dispatch/controls/AUTHORING-STATUS.md

@@ -0,0 +1,7 @@
+# Native dispatch source controls — unexecuted
+
+`dispatch_control.c` includes the actual entry source and redirects only `syscall` and `close` to fixed mocks. It exercises the real `create_private_binfmt_dispatch`, reservation/acquisition registry, once-close transitions and error custody. It does not reproduce the owner as a separate policy implementation.
+
+Cases cover successful one acquisition/create/close; prohibited second invocation; failed fsopen with no create/close; raw CREATE failure; publication followed by CREATE failure and an uncertain close; successful CREATE with failed close; ordering violations; and FD-capacity exhaustion before syscall. The close mock checks RETIRED before the call and actual create errno already captured before a secondary close error. A later close_all must not retry an uncertain descriptor. The partial-publication mock deliberately keeps publication present when the syscall fails, so the native success flag cannot be interpreted as proof of absence.
+
+These are authored controls only. **No control, compiler, native executable, namespace, mount, filesystem context, host registration or kernel probe has run.** Compilation or execution requires independent source GO followed by explicit parent guarded admission under the unchanged budget. A passing mocked control would establish only these source-state/error transitions; Linux callback/lifetime semantics, built-in registry association, finite original exec/CORE/LSM/topology compatibility and whole S10.03 remain separate obligations.