Host baseline recorder: read-only probe and receipts for the 24.04 and 26.04 hosts (guard unit A PR-0) - #710

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ll anchor), privacy gate on every exception, login-shell run command, both 26.04 artifacts (Opus p2s)

GPT-6.1 Sol repair round pr0-baseline-r1 (answers the Claude Opus batch-7 read) through the packaged SDK worker; the
coordinator commits.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tch, archived r1 source, recounts, self-reported hash, dpkg status, observation class)

- Login check: host_baseline_probe.py matches the login only as a whole token or path
  component in observation outputs and stderr. Fixed labels and tool identities are excluded.
  Logins such as ubuntu, codex or user no longer force exit 3; a real disclosure still exits 3
  silently.
- The exact r1 probe source is archived as evidence/artifacts/host-baseline-20261004/
  host-baseline-probe-r1.txt, and the NativeStack receipt binds that copy, so the live
  entrypoint can change without rewriting historical evidence. The two 26.04 receipts keep their
  r0 archive bindings.
- The decision record's counts were recounted by script from the committed artifacts.
  NativeStack: 64 observations (52 exit 0, 11 exit 1, one exit 127). Each 26.04 capture: 56
  observations (50 exit 0, six exit 1). A test now checks them.
- The probe labels its canonical-source hash as self-reported and unverified. The guide
  hashes the exact bytes with sha256sum on the coordinator side before piping them. Historical
  receipts keep the executed-input hash as unknown.
- Package rows record dpkg's db:Status-Status. The guide no longer treats the dpkg-query exit
  code as an installation predicate, and the historical rows are marked status-unrecorded with
  their captured values unchanged.
- The historical coreutils upgrade receipt uses the policy's independent-observation class
  instead of local_integration.

Every fix has a regression test that was red before it (12 tests now pass). No host was re-captured.
Built by GPT-6.1 Sol through the packaged SDK worker (round pr0-baseline-t1); committed by the
coordinator.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…xemptions, profile-path patterns, dated amendments)

- Each tool's name is exempt everywhere in its own version banner, and the os-release ID is
  exempt in distribution vendor tags. Logins such as claude or ubuntu no longer collide with
  the committed Claude banners or an Ubuntu gdb banner, and identity paths still fail closed.
- The probe's whole-document check carries scripts/validate.py's personal-home and
  Windows-user path patterns unchanged, and rejects attached -u<login> forms. A WSL profile path
  such as /mnt/c/Users/<login>.HOST/... now fails at the probe. The guide records which
  compound <login>-x and <login>.x tokens are accepted by design.
- Each of the four receipts gains a dated amendment entry (2026-10-05T05:02:52Z, from date -u)
  that references t1 (7ec3f2a) and t2, lists the changed fields and keeps the prior values of
  the two fields rewritten in place. Captured artifact values are unchanged.
- The guide names the 26.04 command as the coordinator's command for the two r0 captures
  (repair round r1).

Every fix has a regression test that was red before it.

Built by GPT-6.1 Sol through the packaged SDK worker (round pr0-baseline-t2); committed by the
coordinator.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…on, and compound forms are refused again (privacy gate)

- Explicit identity forms (USER=, LOGNAME=, --user=, -u <login>, <login>@, ~<login>,
  uid=N(<login>), <login>:x:) and standalone-login values are now checked on the
  unstripped value, before any exemption. Tool-name exemptions apply only between the stated
  delimiters, and the vendor-tag exemption covers only the first parenthesized group. This
  closes t2's fail-open for a login equal to a tool name or the os-release ID.
- Login matching uses ASCII alphanumeric boundaries again. Numeric suffixes (alice123) and
  attached user/group option clusters are refused. The fixed sudoers marker path is exempted
  as a whole path instead of weakening the match.
- 42 new regression cases were all red before the fix. A replay over the three committed
  artifacts with logins claude, codex, ubuntu, user and alice passes 15/15, so the real
  captures show no false positive. The guide and the decision record follow the code.

The coordinator re-ran tests.test_host_baseline_probe: OK.

Built by GPT-6.1 Sol through the packaged SDK worker (round pr0-baseline-t3); committed by the
coordinator.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…d home normalization

- Version-label exemptions now cover only the leading product-label segment, and vendor groups must follow it immediately on the same line. Later tool-name occurrences are still checked for account syntax, including in merged stderr. Regression tests add 128 account-annotation cases and the vendor/stderr cases. They failed against the t3 code and pass now.
- Home normalization rewrites only values equal to the current home, or values that start with its complete path component followed by a slash. Prefix-sharing sibling paths and embedded references keep their path and fail closed. 16 regression cases cover output, stderr and commands.

Built by GPT-6.1 Sol through the packaged SDK worker (round pr0-baseline-t4); committed by the coordinator. The builder ran these, each exit 0:
- tests.test_host_baseline_probe (24 tests);
- a local dry run, with zero login, home-prefix or actual-home matches;
- validate, evidence_manifest --check and git diff --check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…egistry plus the owned rows)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…egistry plus the owned rows)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…fore the final hot-file commit

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… (hot-file protocol: every hot-file edit in the last commit)

Co-Authored-By: Claude Opus 5.5 <[email protected]>